Skip to content

Privacy policy

Tabulora is a counting and record-keeping tool for pharmacy staff. This page explains what it records, why, where that goes, and how to have it removed.

Last updated October 30, 2026

Who this covers

This policy covers the Tabulora iPad app, the pharmacy dashboard at dashboard.tabulora.com, and this website. Tabulora is operated by Waveflow LLC (“we”). Our customer is the pharmacy: a pharmacy account is created by redeeming an invite code, and that one account is used by every iPad and by the dashboard. The people who use it day to day are the pharmacy’s staff.

What we collect

The pharmacy account

  • The account’s email address and password. Passwords are handled by Google Firebase Authentication and are never stored by us in readable form.
  • An internal account identifier, attached to each saved count so the records can be scoped to the right pharmacy.
  • The pharmacy’s name and its settings from the dashboard.
  • If the pharmacy has more than one location, the name and time zone of each branch. Each branch keeps its own counts, prescriptions and settings. The login and the staff list are shared by every branch, so anyone signed in to the account can switch between them and see each one’s records.

Staff

  • The names of staff the owner enters on the dashboard, for the staff PIN lock, and a one-way hash of each person’s PIN. The PIN itself is never stored.
  • While the PIN lock is on, the name of the staff member who took each count, saved on that count.

Count records

Each time a count is saved, the record contains:

  • The drug: NDC, drug name and strength, and, where the bottle has one, the lot number, expiry date and serial number from its 2D barcode.
  • The prescription number and required quantity read from the script label, the counted quantity, and any owed quantity.
  • The outcome of the checks: whether the bottle matched the script, any substitution, and any override a staff member made.
  • The date, time and time zone of the count.
  • Photographs of the counting tray, one plain and one with the count marked on it, taken when the count is saved.
  • For a fill recorded without counting, such as a sealed package handed over whole, a photograph of the package instead. The app asks for it to be taken with the label readable, so if a pharmacy label is on the package, the photograph shows that label and whatever it prints.

The app also stores the outline and colour of each pill a pharmacy teaches it, so it can tell whether the pills on the tray match the bottle.

Training captures

The iPad has a dataset capture mode for collecting pictures to train the counting model. It is off for every pharmacy unless we switch it on for that pharmacy, and the app shows it only when it is on. When it is used, each saved capture uploads a frame from the camera, cropped to the counting area, together with the position of each pill in it, the NDC, the type of device, and any Rx number, quantity or note entered with it.

Cookies

This website sets no cookies. The dashboard sets two, both needed for it to work: one keeps you signed in (for 12 hours, or 14 days if you choose “Trust this computer”), and one remembers which branch that computer is at. The dashboard also remembers your light or dark appearance setting in the browser. None of these is used for advertising or to follow you anywhere else.

What we do not collect

  • Tabulora is not designed to collect patient information. It does not ask for patient names, addresses, dates of birth or other patient details. A photograph can still show a label that prints them, such as the package photograph described above.
  • The live camera picture is analysed on the iPad and is never sent anywhere to be counted. Pictures leave the iPad in two cases only: the photographs saved with a count, and, where dataset capture is switched on, the frames a staff member saves with it.
  • There is no advertising, no third-party analytics, and no tracking across other companies’ apps or websites. We do not collect location, contacts, or the iPad’s advertising identifier.

How we use it

  • To provide the service: saving counts, syncing them between the pharmacy’s iPads and its dashboard, and making them searchable later by prescription number, NDC, lot or date.
  • To keep accounts secure and each pharmacy’s records separate.
  • To answer support requests.
  • To improve counting accuracy. We may use saved tray photographs, with the pill positions and drug details saved alongside them, to train and test the model that finds pills on the tray. Dataset captures exist for this purpose and are used for it too. Package photographs from fills recorded without counting are not used. A pharmacy can ask us not to use its photographs this way by emailing access@tabulora.com.

We do not sell data, and we do not use it for advertising.

Who processes it

  • Google Firebase (Google Cloud) runs sign-in, stores records and photographs, and syncs them between devices.
  • Vercel hosts the dashboard and this website.
  • The U.S. Food and Drug Administration’s openFDA service is sent a drug’s NDC so the app can look up its name, strength and equivalents. Only the NDC is sent, never a prescription number or account details.

We may also disclose information when the law requires it, or to a successor if Tabulora is sold or merged, in which case this policy continues to apply to it.

How long we keep it

Count records are the pharmacy’s dispensing records, so they are kept for as long as the pharmacy’s account is open. Saved counts are not rewritten: a count can be voided on the dashboard, with a reason, and it stays on file marked void. When a pharmacy account is closed, we delete its account, every branch, the staff list, count records, photographs and training captures within 30 days, except where we are legally required to keep something longer.

Your choices

  • Export: the pharmacy’s count records can be exported from the dashboard at any time, as a CSV file, one branch at a time. Voided counts are included and marked as voided, with their history of voids and restores. The file does not include the photographs.
  • Access or correction: email us and we will help.
  • Deletion: the account holder can ask us to close the pharmacy’s account and delete its data. Start from Settings › Privacy & support › Delete pharmacy account in the iPad app, or see how to delete an account.
  • Staff: the pharmacy owner can remove a staff member on the dashboard. A staff member who wants their name removed from the pharmacy’s records should ask the pharmacy first; we will help the pharmacy do it.

Depending on where you live, you may have further rights over your personal information, such as to receive a copy of it or to object to how it is used. Email us to use them.

Security

Data is encrypted in transit and at rest. Each pharmacy’s records are kept apart from every other pharmacy’s. An iPad reaches them through the database’s security rules, which admit a login only to its own pharmacy’s branches. The dashboard reads them through our server, which checks the signed-in pharmacy before every read. An iPad can save a count but cannot change or delete one. On the dashboard, a count can be voided or restored, each with a reason, and the count keeps a history of every void and restore: when, why, and which login did it. The login is the pharmacy’s shared sign-in, so the history records the account, not the person. A count cannot be deleted from there. iPads can be locked with per-person PINs that the owner manages on the dashboard.

Children

Tabulora is a workplace tool for pharmacy staff. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Where data is processed

Our service providers may process data in the United States and other countries where they operate.

Changes

If we change this policy we will update the date at the top. If a change affects how existing records are used, we will tell the pharmacy’s account email first.

Contact

Questions about privacy, or a request about your data: access@tabulora.com.