Privacy & terms
Privacy Policy
This policy explains what happens to your information when you use VaxFinder to find a pharmacy or send a request for help arranging a flu shot visit. We've tried to write it the way the service actually works.
- Effective date:
- October 4, 2026
- Last updated:
- October 4, 2026
The short version
- We collect only what we need to call you back and help arrange a visit: a first name, a phone number, age groups, one insurance answer, and your preferences.
- We don't ask for your date of birth, Social Security number, insurance ID, medical history, payment details, or street address.
- We share request details only with the pharmacy you chose, and only what's needed to arrange the visit.
- We don't sell your information or use it for advertising. There are no ad pixels on the request form.
- We delete names and contact details 180 days after your request closes. You can ask us to delete them sooner.
Who we are
VaxFinder is operated by Medical Supply Services LLC (“VaxFinder,” “we,” “us”), 723 W Jackson St, Cookeville, TN 38501. You can reach us about privacy at admin@vaxfinder.online.
VaxFinder is not a pharmacy, clinic, or government agency, and it isn't affiliated with any pharmacy chain. We help people in the U.S. find a nearby pharmacy and send a request for help arranging a seasonal flu shot visit. An operator follows up by phone; nothing is booked until the pharmacy confirms.
This policy covers the VaxFinder website and the requests you send through it. Once a pharmacy has your details, its own privacy practices apply to what it does with them.
What we collect and why
Most of this comes directly from you when you send a request. If you list other people in your household, you give us their information — please do so only with their permission.
| Information | Required? | Why we need it |
|---|---|---|
| Your first name (and last name, if you add it) | First name, yes | So the operator knows who to ask for when calling. |
| Phone number | Yes | To call you back about your request. Stored encrypted. |
| Email address | Only if you choose email as your contact method | To contact you by email. Stored encrypted. |
| For each person: age group (6 months – 2 years, 3 – 17, 18 – 64, or 65+) | Yes | Pharmacies have age rules, and older adults may be offered a different vaccine. |
| For each person: first name and relationship to you | No | So the operator and pharmacy can tell people apart. |
| One answer about insurance (yes, some, no, not sure, or prefer not to say) | Yes (“prefer not to say” is an option) | So the operator knows what to ask the pharmacy about cost. |
| The pharmacy you chose, preferred date and time of day, and an optional second choice | Yes (second choice optional) | To ask the pharmacy about a visit that suits you. |
| Callback window and preferred contact method | Yes | So we contact you when and how you prefer. |
| Your consent choices, with the version of the wording you saw | Processing consent, yes. Text and marketing consent are optional and offered only when those features are turned on. | To record what you agreed to. |
| A keyed, one-way hash of your IP address | Automatic | To limit spam and abuse. We don't store your raw IP address with your request. |
| Notes our operators record about contact attempts and the outcome | Automatic | To keep track of your request and show you its status. |
| Your reply-to email or phone and message, if you send a privacy request | Yes, for that request | To verify and answer your privacy request. Stored encrypted. |
| Anonymous usage counts (for example, “a search returned results”) | Automatic | To improve the service. Stored as daily totals with no user identifier and nothing you typed. |
| Visit activity (page path, ad campaign, device type and request steps) | Automatic | To monitor visits and requests as they happen. A random tab identifier groups activity temporarily; names, contact details and form answers are excluded. |
Location
To find pharmacies, you can type a ZIP code or city, which is looked up on our own server. If you type a street address, our server sends that address to the U.S. Census Bureau's public geocoding service to find its approximate coordinates; we use the result once to sort pharmacies by distance and don't store the address or the coordinates.
When you reach the pharmacy search, your browser may ask whether to share your location. If you allow it, the location is rounded to an approximate area (about half a mile) before it leaves your device, used once to sort the results, and not stored. If you decline, you can type an address, city, or ZIP code instead.
Our bot check
To keep out automated spam, your browser solves a small math puzzle in the background. Before you send the request, a VaxFinder window asks you to press Confirm. The check runs on our own server, doesn't use cookies, and doesn't show you an image puzzle.
What we don't collect
- Dates of birth or exact ages
- Social Security numbers
- Insurance member ID numbers or policy details
- Medical history, diagnoses, or health conditions
- Payment information — VaxFinder doesn't take payments
- Your home address as part of your request (an address typed into search is used only to find nearby pharmacies and isn't stored)
- Your precise location history
Please don't add these to free-text fields. The pharmacy may ask you for some of them when you get your shot; that is between you and the pharmacy.
How we use information
- To review your request, contact you about it, and help arrange the visit with the pharmacy you chose.
- To show you the status of your request when you enter your reference number and access code.
- To answer your questions and privacy requests.
- To prevent spam, fraud, and abuse, and to keep the service secure.
- To understand, in aggregate, how the service is used, so we can improve it.
- To comply with the law and enforce our Terms of Use.
We contact you only about your request. We don't send marketing messages. We don't currently send text messages.
No sale, no sharing for advertising
We don't sell your personal information, and we don't “share” it for cross-context behavioral advertising (targeted ads based on your activity across sites). We have not done so in the past 12 months.
We don't put advertising pixels, remarketing tags, or session-recording tools on the request form, the confirmation page, the status page, or the data-request page. We don't use your information to build advertising audiences.
How long we keep it
- Names and contact details (your name, phone, email, household first names, and operator notes) are deleted 180 days after your request closes — when it is completed or cancelled. If a request is never closed, they are deleted 180 days after you submitted it.
- After that, we keep only a de-identified record — such as the number of people, age groups, the pharmacy, and the dates — for aggregate reporting. It can't be used to contact you.
- Privacy requests are kept as long as needed to answer them and to show that we did, as the law requires.
- Security and audit logs don't contain your contact details. They record which staff member opened a request and when, and are kept as long as needed for security.
You can ask us to delete your information sooner through Your data choices.
Security
- Phone numbers, email addresses, and first names are encrypted in our database.
- The site uses HTTPS. Your request status can only be looked up with your reference number and a secret access code; we store only a scrambled (hashed) version of the code.
- Only staff who need to handle requests can see contact details. They sign in with a password and a second factor (multi-factor authentication), and every time someone views your contact details it's logged.
- We don't put your personal details in web addresses, logs, or analytics.
No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
Your choices and rights
Wherever you live, you can ask us to:
- Access the information we hold about you, and learn who we shared it with.
- Correct information that's wrong.
- Delete your information.
- Withdraw consent you gave — for example, to processing your request (which means we'll stop working on it), to texts, or to updates.
- Cancel your request at any time on the status page.
Use Your data choices or email admin@vaxfinder.online. To protect you, we verify requests before acting on them — for example, by asking for your request reference and access code, or by contacting you at the phone number or email in your request. You may use an authorized agent; we may ask for proof that they're acting for you.
We aim to respond within 45 days, as many state privacy laws require. If we need more time, we'll tell you why. If we decline a request, we'll explain why and how to appeal (see below).
California and other state privacy laws
If a state privacy law such as the California Consumer Privacy Act (as amended by the CPRA) applies to us, you have the rights it provides, including the right to know, delete, and correct, and the right to opt out of sale or sharing — though we don't sell or share. We use the information described above only for the purposes listed in this policy, which include sensitive information only as needed to provide the service you asked for. We won't discriminate against you for using any of these rights.
Appeals
If we decline your request, you can appeal by replying to our decision or writing to admin@vaxfinder.online with “Appeal” in the subject. We'll respond in writing within the time the law requires. If you're not satisfied, you can contact your state attorney general.
Children
VaxFinder is not directed to children under 13, and a person must be 18 or older to send a request. Parents and guardians may list their children as household members — for a child, we ask only for an age group and, optionally, a first name. We don't knowingly collect information directly from children. If you believe a child has sent us information, contact us and we'll delete it.
Consumer Health Data Notice
Some state laws — including the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), and Connecticut's data privacy law — protect “consumer health data.” Because the fact that someone wants a flu shot can say something about their health, we treat the information in your request as consumer health data, wherever you live.
What consumer health data we collect
- That you, or people in your household, are interested in getting a seasonal flu shot, and the pharmacy and times you chose
- The age group of each person
- Your answer about whether everyone has health insurance
- The status of the request, including whether a visit was confirmed and completed
Where it comes from
Directly from you, through the request form and conversations with our operator. The status of the visit may come from the pharmacy, when it confirms or declines a time.
Why we collect and use it
Only to provide the service you asked for: to review your request, contact you, arrange the visit with the pharmacy you chose, show you the status, keep the service secure, and meet legal obligations. We collect it only with your consent, which you give in the request form.
Who we share it with
The pharmacy you chose, as needed to arrange the visit, with your consent; service providers who process it for us under contract (hosting and, if used, email delivery); and authorities when the law requires it. We don't have affiliates that receive it.
We don't sell it
We don't sell consumer health data, use it for advertising, or set up geofences around health care locations.
Your rights
You can confirm whether we collect your consumer health data, access it, get a list of the third parties we've shared it with, withdraw your consent, and have it deleted. We'll also pass on a deletion request to the pharmacy and service providers that received your data, where the law requires it.
How to exercise them
Use Your data choices or email admin@vaxfinder.online. We'll verify your request and aim to respond within 45 days. If we decline, you can appeal as described in Your choices and rights. Washington residents who are not satisfied with our answer to an appeal can contact the Washington State Attorney General; information about the My Health My Data Act (opens in a new tab).
State-specific notes
VaxFinder currently accepts requests for pharmacies in: AL, AK, AZ, AR, CA, CO, CT, DE, DC, FL, GA, HI, ID, IL, IN, IA, KS, KY, LA, ME, MD, MA, MI, MN, MS, MO, MT, NE, NV, NH, NJ, NM, NY, NC, ND, OH, OK, OR, PA, RI, SC, SD, TN, TX, UT, VT, VA, WA, WV, WI, WY.
- California: see Your choices and rights. In the past 12 months we have collected the categories listed in What we collect — identifiers (name, phone, email), consumer health data, and limited internet activity (an IP hash and anonymous usage counts) — from the sources and for the purposes described there. We have not sold or shared any of it.
- Washington, Nevada, and Connecticut: see the Consumer Health Data Notice.
- Global Privacy Control: we treat a browser's Global Privacy Control signal as a request to opt out of sale and sharing. We don't sell or share in any case. If we ever enable optional measurement, we will treat the signal as a “no” to it as well.
HIPAA
VaxFinder is not a health care provider, health plan, or health care clearinghouse, and we don't handle patient records on behalf of a pharmacy. That means we are not a “covered entity” or “business associate” under HIPAA, the federal health privacy law, and HIPAA doesn't apply to the information you give us.
It still matters to us. The protections described in this policy — minimal collection, encryption, limited staff access with logging, no advertising use, and fixed deletion — apply to everything you send. When the pharmacy receives your details, the pharmacy's own privacy obligations, which may include HIPAA, apply to what it does with them.
Changes to this policy
If we change this policy, we'll update the “Last updated” date at the top. If a change affects how we use information you've already given us in a meaningful way, we'll ask for your consent where the law requires it, and we won't apply it to that information without consent.
Contact us
Medical Supply Services LLC
723 W Jackson St, Cookeville, TN 38501
Privacy email: admin@vaxfinder.online
For general support, see the contact page.