Trust & Security

This page is maintained by the NardRX team to answer common security and privacy questions about the NardRX pharmacy platform. It is editable project content — not an independent certification or third-party verification.

Shared responsibility. NardRX runs on the Lovable Cloud platform. Lovable provides the underlying hosting, database, and authentication services described below. NardRX is responsible for application logic, access rules, and the data its customers enter. Customers are responsible for managing their staff accounts, credentials, and how they use the app.

Access & authentication

Sign-in uses email and password through the platform's managed authentication service. Session tokens are issued per user.

All authenticated pages require an active session. Unauthenticated visitors are redirected to the sign-in screen before any application data is loaded.

Staff actions in the point-of-sale flow can be additionally gated by a per-user PIN that staff members set themselves.

Roles & organization scoping

Users belong to one or more pharmacy organizations. Application data — sales, inventory, accounts, patients, staff — is scoped to the organization the signed-in user belongs to.

Role-based access (owner, manager, staff) controls which actions a user can perform within their organization. Role checks are enforced in the database, not only in the user interface.

Data protection

Application data is stored in the platform's managed Postgres database with row-level security enabled. Policies restrict each query to rows the calling user is allowed to see based on their organization membership and role.

Privileged operations (such as posting accounting journal entries or transferring stock) are implemented as database functions with built-in access checks rather than ad-hoc client queries.

Data is transmitted over HTTPS between the browser, the application server, and the database.

Data collection & retention

NardRX collects only the information needed to run a pharmacy: staff accounts, product and inventory records, sales and receipts, patient records the pharmacy chooses to store, and accounting entries derived from those activities.

Each pharmacy organization controls its own records. Customers with administrative roles can update or remove records they own from within the app. For account-wide deletion or export requests, contact the address below.

Specific retention windows and regional compliance commitments (e.g. HIPAA, GDPR) are not asserted on this page; reach out for a written statement before relying on any such claim.

Platform & hosting

NardRX is hosted on Lovable, which runs the app on Cloudflare's global edge network and the managed Supabase backend. These providers handle low-level infrastructure such as TLS termination, network isolation, and database backups as part of their service.

References to platform capabilities here describe enabled features and are not a substitute for the providers' own certifications or audit reports.

Reporting a security issue

If you believe you have found a security vulnerability in NardRX, please contact the NardRX team directly with details and steps to reproduce. Do not include real patient or payment data in your report.

We will acknowledge reports as soon as we are able and work with you on a coordinated fix.

Last reviewed: 8/21/2026. This page reflects current app behavior and may be updated as the product evolves.