Privacy Policy

Who We Are

Iwan S. Nyotowidjojo, M.D., A Professional Corporation, doing business as Dr. Refills, is a telehealth physician practice licensed in the State of California. We provide asynchronous chronic medication refill services via drrefills.com.

Contact us: hello@drrefills.com

Information We Collect

Protected Health Information (PHI)

• Full name and date of birth
• Contact information (phone number and email address)
• Requested medication name, dose, and duration of use
• Pharmacy preference, location, and hours
• Health screening responses (safety questions, hospitalizations, other medications, urgency)
• Biological sex and gender identity (for clinical screening purposes)
• Insurance type (for pharmacy routing only)
• Prescription records transmitted through DoseSpot/Treat e-prescribing platform
• Payment records (processed by Stripe — no credit card numbers stored by Dr. Refills)
• Medication bottle photographs (optional, submitted by patient for dose verification)

SMS Communications

We use Twilio to send SMS notifications about your refill request status, payment links, and prescription updates. Your phone number is used solely for communications related to your refill request and is never shared with third parties for marketing purposes.

To opt out of SMS messages, reply STOP to any message from us. To get help, reply HELP. Standard message and data rates may apply.

How We Use Your Information

Treatment

We use your health information to review your refill request, verify your prescription history, make clinical decisions, and transmit your prescription to your pharmacy. This is the primary purpose of this service.

Business Associates

We share your information only with vendors who have signed Business Associate Agreements (BAAs) as required by HIPAA:

• Google Workspace — secure storage of patient encounter records (BAA executed)
• Anthropic — AI-assisted patient intake screening (BAA executed)
• DoseSpot/Treat — electronic prescription transmission (BAA executed)
• Stripe — payment processing; PHI limited to name and email only (BAA executed)
• Twilio — patient SMS notifications for refill status and payment links

De-Identified Data

We may use de-identified health information (consistent with HIPAA Safe Harbor, 45 CFR §164.514(b)) for quality improvement, analytics, and business development. Your identifiable health information will never be sold or used for marketing.

Required Disclosures

We are required by law to disclose your information to: you upon request, the U.S. Department of Health and Human Services for compliance investigations, and public health authorities or law enforcement as required by law.

Your Rights

• Right to Access — Request a copy of your health information. We respond within 30 days.
• Right to Amend — Request corrections to inaccurate information.
• Right to Restriction — Request limits on how we use or share your information.
• Right to a Paper Copy — Request a paper copy of this Notice at any time.

Submit all requests to hello@drrefills.com.

How We Protect Your Information

• All PHI stored in HIPAA-compliant Google Workspace under an executed BAA
• Data encrypted in transit (TLS 1.2+) and at rest
• Access limited to authorized personnel only (Iwan S. Nyotowidjojo, M.D.)
• Two-factor authentication required for all system access
• No PHI stored in Cloudflare logs (IP addresses hashed for rate limiting only)

Data Retention

Patient records are retained for a minimum of seven (7) years from the date of service, consistent with California Health & Safety Code §123111. Records for minor patients are retained until age 19, or seven years, whichever is longer.

How to File a Complaint

If you believe your privacy rights have been violated, contact us at hello@drrefills.com or file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr or 1-800-368-1019. You will not be penalized for filing a complaint.

Changes to This Notice

We reserve the right to change this Notice at any time. Changes will be posted at drrefills.com/privacy.html with an updated effective date.