Privacy Policy

How accounts work

RxRep is for business use only. There are no personal or consumer accounts.

• A company (the "organization") starts a free trial from our sign-up page with a work email address. We review each sign-up before it is approved.
• After that, the organization's administrators create and manage the accounts of their own staff. Individual employees cannot register themselves.
• Because the organization decides who has an account and what is recorded, the organization controls its data. We process it on the organization's behalf.

Who is responsible for your data

• Data an organization records in RxRep (its users, doctors and pharmacies, visits, locations, samples, sales and so on): the organization is the data controller and we are its processor. We use this data only to provide RxRep to that organization and follow its instructions. If you are an employee with a question or request about this data, please start with your organization's administrator.
• Our own sign-up, billing, support, security, website and service-improvement data: we are the controller.

Account and contact information

For people using RxRep through their organization:

• Name, work email address, phone number and employee code
• Job role, who you report to, and the areas and products assigned to you
• Time zone, and an optional profile photo
• Your password, which we keep only in scrambled (hashed) form, so nobody at RxRep can read it. If you turn on two-step sign-in, we also keep what is needed to check it.

When an organization signs up: the organization's name, country and time zone, the contact person's name, work email address and phone number, the plan chosen, and billing details.

Location

• Precise location (GPS). RxRep asks your device for your position when you record a doctor, pharmacy or other visit, when you mark attendance, and when you place a pin on a map. The coordinates are saved with that record, together with how far you were from the saved place. Managers use this to check visits, see attendance and view routes on a map.
• No continuous tracking. RxRep does not follow your location in the background. If you decline location permission you can still use RxRep, but some features that need it may be limited, or your visits may be flagged for your manager to review.
• Approximate location. If your device cannot provide a GPS position, RxRep may use an approximate position worked out from your IP address. Such records are marked as approximate.
• Routes. When RxRep shows road routes between visits, the coordinates of the stops (without names or other details) are sent to OpenRouteService to calculate the route.

Business records entered by the organization

• Details of doctors, pharmacies and other healthcare professionals: names, specialty, address, phone number and location, as provided by the organization
• Visit and call records with date, time, location and remarks; follow-ups and tasks
• Samples distributed, products, attendance, expense claims and receipts
• Sales, targets, incentives, invoices and distributor records

The details of healthcare professionals are professional contact information provided by the customer organization. RxRep is not designed to store patient information, and organizations must not enter patient health records.

Photos and files

• Photos you take with your camera or choose from your photo library or files, such as a visit photo, an attendance photo, a signature image or an expense receipt. They are stored with the record they belong to.
• RxRep asks for camera access only when you add a photo, and reads only the files you choose to attach.
• RxRep does not record audio or use your microphone.

Device, sign-in and usage information

• Active sessions. When you sign in, we record your IP address, browser or device type, approximate city and country (worked out from the IP address) and the time, so that you and your administrators can review your signed-in devices and sign them out.
• Audit log. Important actions, such as sign-ins, changes to users and permissions, and RxRep support signing in as a user to help them, are recorded with the time, IP address and device type.
• Push notifications. If you allow notifications, a push notification ID for your device (a OneSignal subscription ID) is linked to your account so we can deliver them.
• No analytics or advertising tools in the app. The signed-in RxRep web app and the Android and iOS apps do not use third-party analytics or advertising tools. (Our public website, rxrep.net, does: see "When You Visit Our Website" below.)
• Offline use. When there is no signal, visits, attendance and expense claims are saved on your device and sent when you are back online.
• Technical logs. Our servers keep logs and error reports to keep RxRep running and secure.

When You Visit Our Website

To understand how people find rxrep.net, our own site counts page views. For each page view we record:

• The page viewed and the date
• How the visit began: the website that linked to us and any campaign tags in the link (for example from an advert)
• Your approximate country, worked out from your IP address — we do not store the IP address with page views
• Whether you're on a mobile, tablet or desktop
• A random ID kept in your browser's local storage (not a cookie), so we can count visitors separately from page views; we store only a scrambled form of it

Your browser also remembers, for 90 days, how you first reached our site (the linking website, the page you landed on and any campaign tags). This stays in your browser and is sent to us only if you submit our contact form. With a contact form we also receive your IP address, your approximate city, region and country worked out from it, your device and browser, your time zone and your browser language. We use this to reply to you and to see which channels bring enquiries.

Our website also uses Google Analytics, Google Ads and Google Tag Manager, which set their own cookies — see our Cookie Policy.

You can stop this at any time: clear this site's data in your browser to remove the stored ID and first-visit details, and block cookies or scripts in your browser settings, or use Google's opt-out add-on for Google Analytics.

Payments

Subscriptions are processed by Paddle, our payment provider and merchant of record. Paddle collects your payment details. We receive confirmation of the payment, the plan, the amount and your country and tax details, but not your full card number. For customers who pay by bank transfer, we keep the invoices and payment records.

Messages to us

If you send a demo request or contact message, or write to support, we keep your name, company, email address, phone number, team size, your message and our replies.