Privacy Policy

TwinFyRx is a product of TwinDrift LLC (“TwinDrift”, “we”). This policy covers the website at twinfyrx.com, the TwinFyRx API at api.twinfyrx.com, and Drug Code Resolver by TwinFyRx, our plugin for ChatGPT and other assistants that connect over the Model Context Protocol (MCP).

The plugin needs no account and no sign-in. When an assistant calls one of its tools, we receive only the arguments of that call:

• a drug code — an NDC, an RxNorm concept ID (RXCUI) or a HCPCS code
• a drug, ingredient or brand name to search for
• optionally a date of service, used to pick the quarter a HCPCS payment limit applies to

We do not receive your conversation, your prompts, your name, your email address or your ChatGPT account details. The tools return public reference data about drug products; they never return information about a person.

For each call we keep one log line holding:

• the tool that was called
• the outcome (for example resolved, not found, invalid)
• how long it took
• a random request ID, which is also returned in the answer so you can quote it to support

The log line does not contain the code or name that was looked up. To stop a client calling in a loop, the calling IP address is counted in memory for one minute and then dropped; it is not written to our application logs. Our hosting and network providers keep their own standard request logs (time, path, status and IP address) as described under Who we share it with.

Requests reach us from the assistant provider’s servers. What OpenAI or another assistant provider collects about your use of their product is governed by their privacy policy, not this one.

• Forms. When you request access or download the sample dataset we ask for your name, company and work email, and use them to send what you asked for and to follow up about TwinFyRx.
• Visit data. The site loads HubSpot’s tracking script, which sets cookies and records pages viewed, referring site, browser and device type, and approximate location derived from IP address. If you later submit a form, HubSpot associates those visits with the contact details you gave.
• Interactive demos. The labs and sandbox send what you type (drug names and codes) to our API to produce results. The claims shown in the demos are synthetic.

API customers are identified by an API key. We keep the business contact details you give us when you sign up, and request logs (time, endpoint, status, IP address) used to operate, secure and support the service. Licensed data files are delivered under a separate agreement, which governs if it conflicts with this page.

TwinFyRx is not built to receive protected health information. Do not send patient names, member IDs, dates of birth, prescription numbers or any other information that identifies a person — through the plugin, the API, the demos or email. A drug code on its own does not identify anyone, and that is all the tools need. We are not acting as a HIPAA business associate for users of the plugin or the public API.

• to answer the request you or your assistant made
• to keep the service available: capacity planning, rate limiting, debugging and security
• to see which tools are used and where lookups fail, in aggregate, so we can improve coverage
• to reply to you and, if you gave us contact details, to tell you about TwinFyRx — you can opt out of those emails at any time

We do not sell personal information, we do not use it for advertising, and we do not use plugin or API requests to train machine-learning models.

Only the service providers that run TwinFyRx for us, each for the purpose shown:

• Railway — hosting for the website and the API
• Cloudflare — network security and delivery in front of the API
• MotherDuck — the database that holds the drug reference data (it holds no information about users)
• HubSpot — contact records, forms and website visit data
• Resend — delivery of the emails you request

We also disclose information when the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to information already collected.

• Plugin rate-limit counters: one minute, in memory only.
• Application and hosting logs: kept for our hosting providers' standard log retention period, then deleted. We do not copy them elsewhere.
• Contact details and correspondence: for as long as we have a relationship with you, or until you ask us to delete them.

You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or opt out of our emails. Write to [email protected] and we will act on it. Depending on where you live you may have further rights under local law, including the right to complain to a data protection authority; we honor those requests wherever you are. You can block the HubSpot cookies in your browser without losing any part of the site.

TwinFyRx is a business product and is not directed to children under 13.

If we change what we collect or how we use it, we will update this page and its effective date before the change takes effect.

TwinDrift LLC · [email protected]. See also our Terms of Service and Support page.