Privacy policy

My Central Care is the internal management system of GHST RX Inc., doing business as Central Care Pharmacy (Encino, California). It is used by the pharmacy’s owners, employees and representatives, each with a login the pharmacy creates. It is not offered to the public and has no self-service sign-up.

What the app handles

• Your account: your name, work email address, role and sign-in activity, created by an owner of the pharmacy.
• The pharmacy’s business records that you view or enter as part of your work: inventory counts and orders, vendors and prices, client facilities and the people who work there, sales leads, licences and contracts, bank and accounting information, approvals and the notes you log. These records belong to the pharmacy.
• Representatives’ payout details (bank, Zelle or mailing address), entered by the representative and stored encrypted; owners see the full details only to pay, and every look is logged.
• Your phone’s push-notification token, so approvals and questions addressed to you reach your phone. It is removed when you sign out.
• Technical logs (sign-ins, errors, the actions each person takes), kept as an audit trail of the business.

Dispensing records loaded from the pharmacy system identify patients only by a scrambled key; the app never shows patient names, and it is not a patient-facing service.

What the app does not do

• It does not sell or share personal information for advertising, and shows no advertising.
• It does not track you across other apps or websites.
• It uses the camera only when you choose to scan a document, and photos only when you choose to attach one.

Bank connections through Plaid

When an owner connects one of the pharmacy’s business bank accounts, the connection is made through Plaid Inc. The bank sign-in happens on Plaid’s own pages (or the bank’s), so the app never sees or stores a bank password. Plaid then provides the app with the connected accounts’ names, balances and transactions, which the app keeps as the pharmacy’s accounting records. The credential Plaid issues for the connection is stored encrypted (AES-256-GCM) and is used only to refresh those records. Plaid’s handling of the information it collects is described in the Plaid End User Privacy Policy. An owner can disconnect a bank at any time from Settings → Banks; the app then asks Plaid to revoke its access, and the stored credential is deleted.

Where information is kept

On servers in the United States operated for the pharmacy (hosting by Render), protected by encryption in transit (TLS 1.2 or better) and at rest. Push notifications are delivered through Expo’s notification service and Apple’s and Google’s notification systems, which receive the device token and the notification text only.

How long information is kept, and deletion

• Accounting records, including bank balances and transactions brought in through Plaid, are business records of the pharmacy. They are kept for as long as tax and bookkeeping rules require (generally seven years from the end of the tax year they belong to) and deleted after that.
• Bank connection credentials are deleted as soon as a bank is disconnected, and Plaid is asked to revoke the connection.
• Accounts of people who leave the pharmacy are deactivated at once, which ends their sessions and push notifications; their name stays on the records and audit entries they created, because those are part of the business’s books.
• Sign-in and audit logs are kept with the accounting records they relate to.
• A person can ask for their account information to be corrected or removed, and an owner can ask for Plaid-sourced records to be deleted where the law allows, by writing to the address below. Requests are answered within 30 days.

This retention practice is reviewed at least once a year and whenever the law or the app’s data handling changes.

Your choices

• Sign out ends the app’s access on that phone and removes its notification token.
• Notifications can be turned off in your phone’s settings at any time.
• Accounts are created and removed by the pharmacy’s owners. To correct or remove your account information, ask an owner or write to the address below.

Contact

GHST RX Inc. dba Central Care Pharmacy · nk@isourcebusiness.com

Changes to this policy are posted on this page with a new date.