Privacy Policy

We collect the information you yourself provide when you complete forms on the Site, enroll in a course, or contact us. This includes, as applicable: full name, email address, phone number, professional license number (when applicable), payment information (processed by our payment processor — see section 4), and any comments or inquiries you send us.

We also automatically collect certain technical information when you browse the Site: IP address, browser type and version, operating system, pages visited, date and duration of the visit, and the referrer (URL you came from). This information is collected through cookies and similar technologies.

We do not collect special categories of sensitive data (racial origin, political opinions, health, sexual orientation, etc.) unless you expressly provide them for an identified legitimate purpose.

We use your personal information for the following purposes: (a) processing your enrollment and charging the course fee; (b) communicating with you about your enrollment, cohort schedule, program changes, and related matters; (c) issuing completion certificates and assessment reports; (d) responding to your inquiries and support requests; (e) complying with applicable legal, tax, and regulatory obligations in Puerto Rico; (f) preventing fraud, abuse, or misuse of the Site; and (g) improving our services through aggregated and anonymized usage analysis.

We do not use your information for third-party advertising nor do we sell it to marketing entities.

We process your personal data only when there is a concrete operational or legal justification: (a) to perform the educational contract when you enroll in a course; (b) to comply with applicable legal, tax, and regulatory obligations in Puerto Rico, including requirements of the PR Department of Treasury and of the Puerto Rico Board of Pharmacy when applicable; (c) to operate and improve our services responsibly; and (d) with your express consent when we request it for specific purposes (for example, optional subscription to non-transactional communications).

SCCA does not transfer or sell your information to third parties for marketing or advertising purposes.

We share limited data with trusted third-party providers, each under contractual obligation to protect your information:

Stripe, Inc. — processes card payments. We do not store card numbers on our servers; Stripe receives them directly under PCI-DSS compliance. Policy: https://stripe.com/privacy

Resend — delivers transactional emails (enrollment confirmation, cohort reminders, operational communications). Policy: https://resend.com/legal/privacy-policy

Airtable — stores the enrollment registry, cohorts, and assessment results. Policy: https://www.airtable.com/company/privacy

Vercel, Inc. — hosts the Site and maintains technical access logs. Policy: https://vercel.com/legal/privacy-policy

Google Maps — campus map embed; when the page loads, your browser may send your IP to Google. Policy: https://policies.google.com/privacy

Some of these providers process data outside Puerto Rico (primarily in the continental United States). By using the Site, you accept this transfer.

We distinguish between two categories of technical data:

Browser cookies: the Site uses only cookies strictly necessary for its operation (language preference, session, and basic security). These do not require prior consent under applicable regulations and are not used for advertising or cross-site tracking.

Server logs: our infrastructure providers (Vercel) and our own backend record technical information about each HTTP request, including IP address, User-Agent, requested URL, response code, and timestamp. These logs are used exclusively for operational diagnostics, security, and fraud prevention.

If we incorporate aggregated analytics tools in the future (for example, Plausible Analytics), we will update this Policy and enable the consent mechanisms that may apply. You can configure your browser to reject cookies, although this may affect Site functionality.

SCCA does not currently respond to browser 'Do Not Track' signals because we do not perform the advertising or cross-site tracking those signals are intended to limit.

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, except where a legal or tax obligation requires longer periods. As a general reference:

Enrollment and payment data: up to seven (7) years, per PR Department of Treasury requirements for accounting records.

Inquiry emails without subsequent enrollment: up to two (2) years from last contact.

Issued assessment results and certificates: up to ten (10) years from certificate issuance, a reasonable period for later professional verification. After that period, records are anonymized or deleted unless the data subject requests otherwise.

Server logs and technical browsing data: up to twelve (12) months.

Once these periods expire, data is irreversibly deleted or anonymized, except for additional retention required by court order, regulatory requirement, or active litigation.

You have the following rights regarding your personal information: (a) access — request a copy of the data we hold about you; (b) rectification — correct inaccurate or incomplete information; (c) deletion — request erasure, except where law or active litigation requires retention; (d) limitation — ask us to restrict processing in specific circumstances; (e) portability — receive your data in a structured, readable format; (f) objection — object to processing based on operational interests.

To exercise any of these rights, write to us at scpcpr@gmail.com clearly identifying your request and your identity. We respond within a maximum of thirty (30) calendar days. We do not charge for these requests unless they are manifestly unfounded or excessively repetitive.

California residents: if you are a resident of the State of California, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what information we collect about you and the right to opt out of the sale of data. SCCA does not sell personal information within the meaning of the CCPA. To exercise CCPA rights, write to the same address.

Complaints: if you believe SCCA's processing of your data infringes applicable legislation, you may file a complaint with the Puerto Rico Department of Consumer Affairs (DACO).

We implement reasonable technical and organizational measures to protect your information: TLS encryption in transit, role-based access control to our systems, and selection of providers with recognized security standards (PCI-DSS for payment processing, SOC 2 Type II for infrastructure and storage). However, no system on the internet is 100 % secure; if you detect or suspect a security incident, report it immediately to scpcpr@gmail.com.

Incident notification (Puerto Rico Act 111-2005): in the event of a security breach that compromises personal information of Puerto Rico residents, we will notify those affected and the Department of Consumer Affairs (DACO) within the timeframes and in the manner established by Act No. 111 of September 7, 2005 ('Act for the Protection of Personal Information in Information Databases'), including the nature of the incident, the types of data involved, and the corrective measures adopted or recommended.

The Site and SCCA's educational programs are directed exclusively at persons eighteen (18) years of age or older. We do not accept enrollments from, nor intentionally collect personal information from, minors. If we discover we have received information from a minor, we will delete it without delay and cancel any associated enrollment. If you have reason to believe that a minor has provided personal data to us, contact us at scpcpr@gmail.com.

As noted in Section 4, some of our providers operate servers outside Puerto Rico, primarily in the continental United States. Each of these providers is subject to contractual security obligations and maintains industry certifications (PCI-DSS for payment processing, SOC 2 Type II for infrastructure). By using the Site you acknowledge and accept these transfers.

SCCA does not operate its own infrastructure outside Puerto Rico nor transfer data to jurisdictions other than those used by these providers. If in the future residents of the European Union or of jurisdictions with specific international transfer requirements access the Site, we will evaluate and implement the necessary contractual mechanisms (for example, Standard Contractual Clauses) before processing their data.

We may update this Privacy Policy when we add new services or operational changes. Any material change will be notified via a visible notice on the Site and, when applicable, by email to active enrollees. The "Last updated" date at the start of the document reflects the version in force.

For questions, requests, or complaints about this Privacy Policy or the treatment of your personal data:

Santa Cruz Compounding Academy, LLC Edificio Médico Santa Cruz, 73 Calle Santa Cruz, Suite 101 Bayamón, Puerto Rico 00960 Email: scpcpr@gmail.com Phone: 787-798-4646