Privacy policy

Who is responsible for your data

The data controller for this website is MLJ, SASU, a French simplified joint stock company registered under SIREN 934 769 837, publisher of the PillRoute brand. The publication director and privacy contact is Jimenez Julien. You can reach him at any time at jimenezjulien42@gmail.com. There is no separate privacy department: the same person who builds the product reads and answers privacy requests.

This policy covers the public marketing website at pillroute.com. Data that a pharmacy customer stores inside the PillRoute application, including patient records, is handled under a separate written agreement and a business associate agreement, and is not covered by the sections below.

What the request form collects

The only place this website collects personal information is the request form in the contact section of the home page. The visible fields you complete are:

• name, your full name, so we know who we are replying to.
• email, your work email address, which is where the reply is sent.
• company, the name of your pharmacy.
• role, your role at the counter, chosen from a short list such as owner or pharmacist in charge.
• request, what you would like from us, chosen from booking a demo, requesting early access or requesting a quote.
• size, how many stores you run and roughly how many maintenance patients you carry.
• message, your free text description of how refills currently reach your patients.
• consent, the checkbox confirming that you agree to us storing the message in order to reply.

Three hidden fields travel with the submission for routing purposes only: form-name, which identifies the form as pillroute-contact, subject, which labels the email we receive, and recipient, which is our own address. One further hidden field named bot-field exists purely as a spam trap and should always be left empty by a human visitor.

We ask for nothing else. Do not put patient names, prescription numbers, dates of birth or any protected health information into the message box. If you send that information by accident, tell us and we will delete the submission and confirm the deletion in writing.

Why we process it, and on what legal basis

We process these details for one purpose: to answer your request and, if it goes further, to prepare a proposal for your pharmacy. Under the EU General Data Protection Regulation the legal basis is your consent, given by ticking the consent box, together with our legitimate interest in responding to a business enquiry that you started. Under United States state privacy laws, the processing is limited to the purpose you submitted the form for.

We do not use form submissions for advertising, we do not enrich them with data bought from a broker, and we do not add you to a newsletter. If a conversation ends without a contract, the record simply expires.

Who processes and stores submissions

Form submissions are processed and stored by Netlify Forms, operated by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, which also hosts this website. Netlify receives the submission, stores it in the site account and forwards a copy by email to the address above. Netlify acts as our processor and is bound by its own data processing terms. Beyond Netlify and the standard email delivery involved in sending our reply, no other company receives what you send us.

How long we keep it

Submissions that do not lead to a customer relationship are deleted within twelve months of the last message exchanged. Submissions that lead to a signed agreement are kept for the life of that agreement and then for the retention period set out in the contract, because they form part of the commercial record. You may ask for earlier deletion at any point and we will act within thirty days unless we are legally required to keep a document.

Cookies and measurement

This website sets no advertising cookie, runs no third party analytics script and embeds no social network tracking pixel. There is no consent banner because there is nothing to consent to. Our host keeps standard server logs, including truncated network addresses, for security and abuse prevention, and those logs are not used to build a profile of you. Fonts are loaded from Google Fonts so that the pages render as designed, which means your browser requests the font files from that service.

Your rights in the United States

If you live in California, Colorado, Connecticut, Utah or Virginia, you have the right to know what personal information we hold about you, to obtain a copy of it, to correct it, to have it deleted, and to be free from discrimination for exercising those rights. Residents of California may also ask us to disclose the categories of personal information collected and any disclosure for a business purpose. We do not sell personal information and we do not share it for cross context behavioral advertising, so there is no opt out mechanism to operate. Send your request to jimenezjulien42@gmail.com and we will verify your identity using the email address that submitted the form.

Your rights in the European Union and the United Kingdom

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of earlier processing. You may also lodge a complaint with a supervisory authority, which in our case is the Commission Nationale de l'Informatique et des Libertes in France. We answer rights requests within one month.

International transfers

Our publisher is established in France and our host and form processor are established in the United States, so your submission crosses the Atlantic. Transfers rely on the standard contractual clauses adopted by the European Commission together with the supplementary measures described in our processor's terms. If you would rather not send data through a United States processor, write to us directly by email instead of using the form.

Children

PillRoute is business software sold to pharmacy operators, and this website is not directed at children. We do not knowingly collect information from anyone under sixteen. If you believe a child has submitted the form, write to us and the record will be deleted without delay.

Security

The site is served over HTTPS, submissions are encrypted in transit, and access to the form inbox is limited to the publication director and protected by two factor authentication. No system is perfect. If a breach affects your data we will tell you and the relevant authority within the deadlines the law sets, and we will describe what happened in plain language.

Changes to this policy

When this policy changes we update the date at the top of the page and describe the change in the paragraph below. This version replaces all earlier versions. The change made on March 2, 2026 was the addition of the field level list above and clearer wording on retention periods.