Procurement answers · written 2026-11-11
Data posture: what is true today, and what we do not claim
A security or AI-vendor review asks the same questions of every data vendor. Each is answered here with only what is true and checkable now, and every item we do not claim is marked as such. For a written answer to your own questionnaire, email us through the contact page.
The questions and the answers
- What data do you hold?true today
The library holds public records: FDA, CMS and NLM files and each assistance program’s own public page, stored as dated facts. It holds no patient records and no personal data about a customer’s users.
- Where does the data go when we use your tools?true today for the matcher; the local server is in development
The assistance matcher and the planned local server run on your machine over a frozen edition you hold. The income, household size, insurance and medicine a user enters are processed there and are not sent to us. The static files are fetched from our CDN; the request reveals which file you asked for.
- What do you log?partial: ask for the written answer
Pages and files are served through a content delivery network and a Worker that may keep aggregate request counts and records of automated crawler visits. We do not claim that no request is logged. Details of what is kept can be requested in writing.
- Retention and deletion?true today
Locally run tools keep nothing on our side. A licence enquiry submitted through the form on the licence page is stored so we can reply to it; ask us to delete yours and we will.
- Do you train or fine-tune models on our data?true today
No. Nothing a customer’s users enter reaches us when the tools run locally, and we do not train models on enquiry text.
- How is data provenance shown?true today
Every recorded fact carries its source address, retrieval date, source version, licence class and proof state. The provenance page lists sources used and refused; each answer lists the facts it rests on; editions carry a published hash root.
- Which sources are excluded, and why?true today
Sources whose terms bar redistribution, commercial use or derivative works are refused at the point a fact would be written. The provenance page names the refused sources and the reason.
- SOC 2, ISO 27001, penetration test?not claimed
None is held. We do not claim any.
- Subprocessors?true today
The website and static files are hosted on Cloudflare. Licence payments are handled by the payment processor shown at checkout. The planned local server uses no subprocessor.
- How are changes and errors communicated?true today
A corrections log on the provenance page records every change to a published or recorded figure, with its date. Edition roots and checksums are listed on the editions page. Errors can be reported through the contact page.
- Clinical use, indemnity, warranty?true today
OmniRx is a reference layer of dated public facts. It is not clinical decision support, gives no clinical warranty and refuses clinical questions. No indemnity is offered.
- Service levels?true today
The static files carry no uptime promise. A written availability commitment is part of the white-label licence terms.
- Breach notification?partial: not yet documented
There is no customer personal data in the library. If an incident affected a licensee, we would tell the licensee by email. A written process is not yet documented.
Why local-first
The facts we compile are public, so the sensitive part of any integration is the question a person asks: a medicine, an income, a household. The assistance matcher is published as a small module beside the data so it can run on your own machine, and the planned MCP server reads a frozen edition from local disk. Neither needs to send a question to us. See the static API, the editions and where every figure comes from.
Terms and licences are on the licence page. Not medical, legal or financial advice. This page is updated when a statement changes, and any change that corrects a published statement is recorded on the provenance page.