Planned Security & compliance
The compliance roadmap, gate by gate
No certifications are claimed. Below is every gate the pharmacy edition must pass before it touches a prescription, and the stage each one has reached.
1Plain words
What compliance means for a pharmacy POS
For a front store, it means card data stays on the processor and sales and tax records are correct. For the Rx counter, it means protecting patient health information under HIPAA, meeting board and DEA rules, and IIAS for FSA/HSA. Only the first is in place.
- Definition · PHI
- Protected health information: any health information that can identify a patient, such as a name on a prescription bag, a medication, or a pickup signature. HIPAA governs how pharmacies and their vendors handle it.
2Stage: Released
Front-store retail
Runs on the core POS today: catalogue, lots and expiry, checkout, loyalty, online store.
3Stage: Research
PMS integration
Which pharmacy systems first is decided by waitlist demand. Nothing is connected today.
4Stage: Research
HIPAA safeguards + BAA
Access control, audit logs, encryption, breach process and a Business Associate Agreement before any PHI.
5Stage: Research
Rx pickup & signature
Built on top of the PMS integration and the HIPAA safeguards, not before.
6Stage: Research
FSA/HSA via certified processors
IIAS through a processor that supports it, with SIGIS. US only.
7Stage: Released
Card data (PCI scope)
Cards run on the processor's terminal, so card data stays out of the POS. No PCI certification is claimed.
8This website
What this website collects
Only what you type into the waitlist or contact form (name, pharmacy, email, optional phone and city, your message), plus an optional analytics cookie if you allow it. We never ask for patient information.
9Sources
Sources we work from
Primary sources only, checked 2026-10-18.
10Questions
Security and compliance questions
Is the pharmacy edition HIPAA compliant?
Not plannedNo, and we do not claim it. The software does not handle protected health information today.
Full answerHide full answer
HIPAA compliance is not a badge a vendor can grant itself; it is how a covered entity and its business associates protect PHI. When the pharmacy edition is ready to handle PHI, we will publish the safeguards and offer a Business Associate Agreement.
Will you sign a BAA?
PlannedYes, when the pharmacy edition handles PHI and the safeguards are in place. A BAA signed before then would be meaningless.
Is it PCI compliant?
We do not process cards and do not claim PCI certification. Cards run on your processor's certified terminal, so card data never enters the POS.
Full answerHide full answer
Your PCI obligations as a merchant are set by your processor; keeping card data on their terminal keeps your scope small.
Is it IIAS certified?
PlannedNo. FSA/HSA support is planned through processors that support IIAS; certification is done with them and SIGIS, and we will not claim it before it exists.
Where is merchant data hosted?
Works todayOn the owner's hosted platform. Merchants use it in the browser; product, stock and sales data live there.
Full answerHide full answer
The backup schedule, data location and retention terms will be published here before the pharmacy edition launches. We are not publishing numbers we have not yet committed to.
Can I export my data?
Works todayYes. Products, customers, sales and reports can be exported, so you are never locked in.
What about state boards, DEA and controlled-substance logs?
PlannedThose belong to the Rx counter and stay in your pharmacy system. Any future signature or log feature will be reviewed against them first.
What about UAE and Pakistan rules?
PlannedEach market gets its own review: DHA, DoH and MOHAP in the UAE; DRAP and provincial rules in Pakistan.
How will I know when a gate is passed?
This page, the status box on every page and an email to the waitlist all change on the same day.