` looking for matches against your products' `product_code`, `sku`, `id`, or `name`.
```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/prescriptions/electronic_prescriptions \
-H "Authorization: Bearer {access_token}" \
-H "Content-Type: application/xml" \
--data-binary @newrx.xml
```
## Attaching it to an order
An order can be created before or after the prescription. If the order already exists, pass its `id` or `order_number` in the `order` object. If it doesn't, create it afterwards with `POST /orders` and optionally list the prescription in `electronic_prescription_ids` to help matching along. To do all of it in one request, use the [composite endpoint](/guides/composite-creation).
POST /prescriptions/electronic\_prescriptions
Valid NCPDP `units` codes
Add `include_xml=true` for raw SCRIPT
Prescription + order in one call
# How do I choose the carrier, service level, and signature confirmation on an order?
Source: https://docs.byblend.com/guides/shipping-preferences
Send a shipping object with carrier, service_level, and signature_confirmation on POST /orders or PATCH /orders/{order_id}. Use a generic service level to let Blend pick the carrier, or name both.
Pass a `shipping` object when you create or update an order. You can specify a `carrier` (`ups`, `usps`, `fedex`), a `service_level`, a `signature_confirmation` (`standard` or `adult`), or any combination. Give a generic service level on its own — `ground`, `2_day`, `next_day` — and Blend selects the most appropriate carrier to meet it.
```json theme={null}
{
"patient": { "external_id": "clinic-pt-4471" },
"shipping": {
"carrier": "usps",
"service_level": "usps_ground_advantage",
"signature_confirmation": "adult"
},
"products": { "prescription": [{ "product_code": "HC-RAPA31", "quantity": 1 }] }
}
```
Shipping preferences need to be enabled for your account. Confirm with your Blend contact before building against them.
## Service levels
| Carrier | Service levels |
| - | - |
| USPS | `usps_ground_advantage`, `usps_priority`, `usps_priority_express` |
| FedEx | `fedex_ground`, `fedex_2_day`, `fedex_express_saver`, `fedex_standard_overnight`, `fedex_priority_overnight`, `fedex_first_overnight` |
| UPS | `ups_ground`, `ups_second_day_air`, `ups_3_day_select`, `ups_next_day_air`, `ups_next_day_air_saver` |
| Generic | `ground`, `2_day`, `next_day` |
If you send **both** `carrier` and `service_level`, the service level's prefix must match the carrier. `carrier: "usps"` with `service_level: "fedex_ground"` is rejected. Send the generic level alone if you don't care which carrier is used.
`GET /api/v1/orders/shipping_options` returns the carriers and service levels currently available to your account — read it rather than hardcoding this table.
## Signature confirmation
* `standard` — anyone at the address may sign
* `adult` — signature from someone 21 or over
## Updating shipping later
```bash theme={null}
curl -X PATCH https://api.byblend.com/api/v1/orders/ORD250312003548IAU4 \
-H "Authorization: Bearer {access_token}" \
-H "Content-Type: application/json" \
-d '{ "shipping": { "service_level": "next_day" } }'
```
Update semantics are worth reading twice:
* Omitted fields are **left unchanged**.
* Send `"signature_confirmation": null` to **clear** a previously set signature preference.
* Sending `carrier` or `service_level` **does not** clear an existing signature preference.
Shipping stays editable later in the order's life than line items do — a label hasn't been purchased yet at `picked` or `verified`. Once an order is `shipped` or `delivered`, shipping is fixed and the order returns tracking information instead.
## Bringing your own label
If you generate labels yourself, send `custom_shipping` instead of `shipping`.
Bringing your own shipping label is only available to pre-authorized accounts. Talk to your Blend contact before building against it.
All four fields are required: `label_url` (a printable 4x6), `tracking_number`, `tracking_url`, and `carrier`.
```json theme={null}
{
"custom_shipping": {
"label_url": "https://yourcompany.com/labels/abc.pdf",
"tracking_number": "1Z999AA10123456784",
"tracking_url": "https://ups.com/track?tracknum=1Z999AA10123456784",
"carrier": "UPS"
}
}
```
Shipping preferences on an individual order can also be changed in the Blend Dashboard while the order is still editable — a quicker path for a single customer-service request than an API call.
Live carriers and service levels
PATCH the `shipping` object
`shipping` or `custom_shipping`
Shipments and tracking
# Why is my order stuck, and what do I do about it?
Source: https://docs.byblend.com/guides/stuck-orders
An order in exception status is blocked by something — a missing prescription, an expired prescriber license, missing patient ID. Most clear automatically once the data arrives, and the order returns to where it was in the queue.
An order enters `exception` status — "stuck" — when something blocks fulfillment. It steps out of the queue and returns to exactly where it was once the blocker clears. It is not cancelled, and its place in line is preserved.
Most stuck reasons resolve **automatically**. If the blocker is missing data, supplying that data is the entire fix; Blend re-evaluates and releases the order without anyone clicking anything.
## Find your stuck orders
```bash theme={null}
curl "https://api.byblend.com/api/v1/orders?status=exception&page_size=200" \
-H "Authorization: Bearer {access_token}"
```
## Reasons that clear themselves
| Blocker | What clears it |
| - | - |
| Missing prescription | The prescription arrives and matches |
| Prescription expired or out of fills | A new prescription arrives |
| Prescriber license expired or missing | The license is updated in Blend |
| Missing patient driver's license or SSN | The value is added to the patient record |
You don't need to ask for a re-check. Blend re-evaluates these conditions on its own and releases the order. Supplying the data **is** the action.
## Reasons that need a decision
Some exceptions are clinical or commercial judgments rather than missing fields — a possible duplicate order, a refill arriving earlier than the patient's supply should allow, a product that couldn't be matched. These are worked by pharmacy staff, and often need a conversation with you. You can have that conversation over the API or in the Blend Dashboard.
In the Blend Dashboard, stuck orders have their own queue with the reason and any staff commentary attached. For non-technical team members that's the place to work from. Responses posted over the API show up in the same discussion.
## Respond to a stuck order
In an `order.stuck` webhook, `id` is not the exception. Like every `order.*` webhook, `id` identifies the stuck item, and `entity_type` says what kind of item it is:
* `entity_type: "order"`: `id` is the order ID.
* `entity_type: "prescription"`: `id` is the prescription ID.
The exception itself is `exception_id`. Use it to read or respond to the exception.
Read the exception and its discussion so far:
```bash theme={null}
curl "https://api.byblend.com/api/v1/exceptions/entity/order/{order_id}?include_responses=true" \
-H "Authorization: Bearer {access_token}"
```
`{order_id}` accepts the order's UUID, order number, or your external ID. For an order, the list also includes exceptions on the order's prescriptions.
Reply on a specific exception, with the name of the person responding:
```bash theme={null}
curl -X POST "https://api.byblend.com/api/v1/exceptions/{exception_id}/responses" \
-H "Authorization: Bearer {access_token}" \
-H "Content-Type: application/json" \
-d '{"text": "Corrected shipping address is on the order now.", "first_name": "Charlie", "last_name": "Customer"}'
```
`first_name` and `last_name` are required, at least 2 characters each. For regulatory purposes, Blend must identify and keep a record of the authorized person behind every response. API credentials are usually shared by a team, so the account alone doesn't say who that is. Blend appends the name to the end of the response, as `[Response from: Charlie Customer]`.
A response puts the exception back in front of the pharmacy team, including an exception they had set aside to revisit later. It does not resolve the exception; that still happens when Blend clears it or the missing data arrives.
When Blend replies, you receive an `order.stuck_response` webhook. Its `id`, `entity_type`, and `exception_id` mean the same as in `order.stuck` and have the same values, so `id` is still the order or prescription, not the exception or the response. The reply itself is in `response`, with its own `response.id`. Subscribe to it alongside `order.stuck` to keep the conversation in your own system.
With `include_responses=true`
Reply to Blend
By `exception_id`
`status=exception`
When it stuck and when it cleared
Find unmatched prescriptions
What `exception` means in context
# How do I transfer a prescription out to another pharmacy?
Source: https://docs.byblend.com/guides/transfer-out
The receiving pharmacy requests the transfer from Blend directly — by email at support@byblend.com, by phone at (800) 292-0499, or by fax at (380) 215-3850. Blend handles the transfer and cancels the prescription once it's complete.
Transfers out are initiated by the **receiving pharmacy**, not by you and not in the Blend Dashboard. The destination pharmacy contacts Blend directly and requests the transfer:
[support@byblend.com](mailto:support@byblend.com)
(800) 292-0499
(380) 215-3850
Blend handles the transfer digitally from there, and **cancels the prescription in Blend once it has been transferred**. That cancellation is the expected end state — the receiving pharmacy now holds the prescription, so it must not remain fillable at Blend.
## What you need to do
Nothing, in most cases. If a patient tells you they want their prescription moved to another pharmacy, direct them — or the receiving pharmacy — to the contact details above.
Check for open orders before a transfer is requested. Transferring cancels the prescription, but an order already in the pharmacy is a separate object with its own lifecycle — [cancel or pause it](/guides/cancel-an-order) explicitly if it shouldn't ship.
## Confirming the outcome
```bash theme={null}
curl https://api.byblend.com/api/v1/prescriptions/{prescription_id} \
-H "Authorization: Bearer {access_token}"
```
A transferred prescription reads as cancelled. Cancelled prescriptions are excluded from all matching, so a transferred prescription can't be picked up by a future order.
**A cancelled prescription cannot be un-cancelled through the API.** There is no reversal endpoint. If a transfer was requested in error, contact Blend support — and expect the practical remedy to be a new prescription from the prescriber.
Confirm status after transfer
Filter by status
Deal with open orders first
What happens to orders in flight
# How do I get notified when an order ships?
Source: https://docs.byblend.com/guides/webhooks
Subscribe a webhook endpoint with POST /api/v1/notifications/webhooks, passing the event codes you care about — order.shipped, order.delivered, or 'all'. Blend POSTs to your URL, and can sign each delivery with an optional webhook secret.
Blend pushes events to your systems over webhooks. Create a subscription with `POST /api/v1/notifications/webhooks`, giving it your HTTPS URL and a list of `event_codes` such as `order.created`, `order.shipped`, or `order.delivered`. Pass `"all"` to receive everything. You can optionally generate a webhook secret, and Blend will sign every delivery so you can verify it came from Blend.
Webhooks are managed through the API. There is not yet a way to create or edit webhook subscriptions in the Blend Dashboard.
## Set it up
```bash theme={null}
curl https://api.byblend.com/api/v1/notifications/events \
-H "Authorization: Bearer {access_token}"
```
Each event returns a `name`, `description`, and the `event_code` you subscribe with.
```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/notifications/webhook-secret \
-H "Authorization: Bearer {access_token}"
```
Optional, but recommended. If you generate one, Blend sends it as `Authorization: Bearer {secret}` on every webhook delivery, so you can verify the request came from Blend. Without a secret, deliveries are unsigned.
```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/notifications/webhooks \
-H "Authorization: Bearer {access_token}" \
-H "Content-Type: application/json" \
-d '{
"url": "https://yourcompany.com/hooks/blend",
"event_codes": ["order.shipped", "order.delivered"]
}'
```
```bash theme={null}
curl -X POST https://api.byblend.com/api/v1/notifications/sample \
-H "Authorization: Bearer {access_token}" \
-H "Content-Type: application/json" \
-d '{
"event_code": "order.shipped",
"webhook_url": "https://yourcompany.com/hooks/blend"
}'
```
This delivers a real, illustrative payload to your endpoint. To inspect the shape without sending anything, use `GET /notifications/sample/{event_code}`.
## What your endpoint has to do
Blend requires your listener to be a valid SSL endpoint that accepts `POST` and returns a `2xx` status code **within 10 seconds**. Do your real work asynchronously — acknowledge first, process after. Deliveries that fail are retried with exponential backoff.
Every payload carries at minimum an `id` and a `url` that deep-links to the relevant record in the Blend Dashboard, so a notification can be turned into a clickable link for your staff with no extra lookup.
Prefer webhooks over polling. If you do poll, filtered list calls (`GET /orders?status=shipped`) are much cheaper than draining the full order list — see [pagination](/guides/pagination).
## Email instead of (or alongside) webhooks
If a human needs to know rather than a system, subscribe to the same event codes by email with `PUT /api/v1/notifications/email`. Email notifications go to the address on your Blend user profile.
POST /notifications/webhooks
GET /notifications/events
POST /notifications/webhook-secret
POST /notifications/sample
# Can I use my own IDs instead of Blend IDs?
Source: https://docs.byblend.com/guides/your-own-ids
Yes. Blend accepts your external_id for patients and orders, and your sku or product_code for products.
You do not have to store Blend UUIDs to use the Blend API. Almost every path parameter and product reference accepts your own identifier as an alternative, so your system can stay the source of truth for IDs. Set `external_id` when you create a patient or an order, map your `sku` and `product_code` onto Blend products during onboarding, and you can address Blend resources entirely in your own vocabulary.
## What each resource accepts
| Resource | Blend identifier | Your identifier | Also accepted |
| - | - | - | - |
| Patient | `id` (UUID) | `external_id` | — |
| Order | `id` (UUID) | `external_id` | `order_number` (e.g. `ORD250312003548IAU4`) |
| Product | `id` (UUID) | `sku` | `product_code` (prescription products only) |
## Fetch an order by your own ID
```bash theme={null}
curl https://api.byblend.com/api/v1/orders/my-system-128318AA2 \
-H "Authorization: Bearer {access_token}"
```
The same path position accepts a Blend UUID or the human-friendly order number — you don't need separate code paths for each.
## Set your IDs at creation time
```json theme={null}
{
"external_id": "my-system-128318AA2",
"patient": { "external_id": "clinic-pt-4471" },
"products": {
"prescription": [
{ "product_code": "HC-RAPA31", "quantity": 1 }
],
"non_prescription": [
{ "sku": "SHARPS-SM", "quantity": 1 }
]
}
}
```
A patient's `external_id` is also used for prescription matching. When you send an electronic prescription referencing `external_id`, Blend links it to the right patient without a name-and-date-of-birth lookup — which is the most reliable matching path available. See [how Blend matches prescriptions to patients](/overview#prescription-to-patient).
`sku` and `product_code` are not interchangeable. Non-prescription products and order materials can be referenced by Blend `id` or `sku` only; `product_code` is available for **prescription products**.
You can set or change `external_id` on an existing order with `PATCH /orders/{order_id}` — useful when your own record is created after the order reaches Blend. External IDs are editable in the Blend Dashboard.
Accepts UUID, order number, or external ID
Accepts UUID or external ID
Set your sku and product\_code
# Licensing
Source: https://docs.byblend.com/licensing
Blend holds an active pharmacy license in all 50 U.S. states and the District of Columbia. Every license includes controlled-substance authority.
Blend is a 503A compounding pharmacy licensed to dispense and ship into **all 50 U.S. states and the District of Columbia** — 51 jurisdictions. Every license below is active, and includes the ability to ship controlled substances (when prescribed by a state-licensed prescriber with active DEA registration). There are no inactive, pending, or non-controlled-only licenses.
U.S. territories (Puerto Rico, Guam, U.S. Virgin Islands, American Samoa, Northern Mariana Islands) are not included.
Accreditations
- VPP inspected
- NABP Healthcare Merchant accredited
- LegitScript certified
## Jurisdiction coverage
51 active pharmacy licenses. Controlled substances: yes, in every jurisdiction.
| Jurisdiction | Code | Status | Controlled |
| - | - | - | - |
| Alabama | AL | Active | Yes |
| Alaska | AK | Active | Yes |
| Arizona | AZ | Active | Yes |
| Arkansas | AR | Active | Yes |
| California | CA | Active | Yes |
| Colorado | CO | Active | Yes |
| Connecticut | CT | Active | Yes |
| Delaware | DE | Active | Yes |
| District of Columbia | DC | Active | Yes |
| Florida | FL | Active | Yes |
| Georgia | GA | Active | Yes |
| Hawaii | HI | Active | Yes |
| Idaho | ID | Active | Yes |
| Illinois | IL | Active | Yes |
| Indiana | IN | Active | Yes |
| Iowa | IA | Active | Yes |
| Kansas | KS | Active | Yes |
| Kentucky | KY | Active | Yes |
| Louisiana | LA | Active | Yes |
| Maine | ME | Active | Yes |
| Maryland | MD | Active | Yes |
| Massachusetts | MA | Active | Yes |
| Michigan | MI | Active | Yes |
| Minnesota | MN | Active | Yes |
| Mississippi | MS | Active | Yes |
| Missouri | MO | Active | Yes |
| Montana | MT | Active | Yes |
| Nebraska | NE | Active | Yes |
| Nevada | NV | Active | Yes |
| New Hampshire | NH | Active | Yes |
| New Jersey | NJ | Active | Yes |
| New Mexico | NM | Active | Yes |
| New York | NY | Active | Yes |
| North Carolina | NC | Active | Yes |
| North Dakota | ND | Active | Yes |
| Ohio | OH | Active | Yes |
| Oklahoma | OK | Active | Yes |
| Oregon | OR | Active | Yes |
| Pennsylvania | PA | Active | Yes |
| Rhode Island | RI | Active | Yes |
| South Carolina | SC | Active | Yes |
| South Dakota | SD | Active | Yes |
| Tennessee | TN | Active | Yes |
| Texas | TX | Active | Yes |
| Utah | UT | Active | Yes |
| Vermont | VT | Active | Yes |
| Virginia | VA | Active | Yes |
| Washington | WA | Active | Yes |
| West Virginia | WV | Active | Yes |
| Wisconsin | WI | Active | Yes |
| Wyoming | WY | Active | Yes |
# Building by Blend
Source: https://docs.byblend.com/overview
Welcome to the Blend API documentation
Task-focused answers to specific questions — sending prescriptions, creating and editing orders, resolving stuck orders, and managing prescribers, products, and reporting. Start here if you know what you need to do.
# General Concepts
### Products
Products are your business's individual "SKUs," whether prescription or non-prescription. These entities contain descriptive information, pricing, your own product code/identifier, and other (generally) patient-facing information. Blend will manage underlying inventory for your products.
### Prescribers
The healthcare professionals who will prescribe your prescription products, and who will be sending Electronic Prescriptions. Prescriber regulatory information (NPI/SPI), licensing credentials, supervisory relationships (if applicable), address/contact and biographical information are required to be kept up-to-date within Blend.
### Electronic Prescriptions
Electronic Prescriptions, sent via either the Surescripts network or directly via API, are required to fill an order containing prescription products. Each prescription product in an order needs an active/non-expired prescription with fills remaining.
### Patients
The individuals who will receive products directly fulfilled by Blend. Patient profiles in Blend must be kept up-to-date, including name, address, contact information, and (critically) any risk factors: allergies, drug interactions, pre-existing conditions, pregnancy state, etc.
### Orders
Orders are the unification of the above that result in (in most cases) a filled prescription, packaged product(s) in your custom packaging, and a shipping box sent straight to your patient.
# Blend End-to-End
Each of the above is required to be created within Blend for an order to be filled end-to-end.
*For the most part*, the above entities can be created in any order. Blend systems will match accordingly when all data is available. The happiest path, however, is the following:
```mermaid theme={null}
flowchart TB
subgraph live[Order Flow]
direction TB
subgraph 3[New Patients]
direction TB
patient(Create Patient) -->prescription(Send Prescription) -->order(Create Order)
end
subgraph 4[Existing Patients]
direction TB
prescription2(Send Prescription) -->order2(Create Order)
end
subgraph 5[Refill]
direction TB
order3(Create Order)
end
end
subgraph before[Onboarding]
direction LR
top1(Create Products)
bottom1(Create Prescribers)
end
style live fill:#fff,stroke:#5d6b68
style before fill:#FEE0A8
style 3 fill:#f9fbfb,stroke:#5d6b68
style 4 fill:#f2f7f7,stroke:#5d6b68
style 5 fill:#dfecec,stroke:#5d6b68
```
*Please also note the single Composite Creation option, below, for specific use cases of specific customer types.*
### During Onboarding: Create Products and Prescribers
During your Blend onboarding, we will work with you to create initial products and match them accordingly with your own EMR or similar systems.
We will likewise work with you to bulk import existing prescribers and their licensing and other information.
Depending on your approach to existing patients and prospective refill prescriptions, we can also import / create patient records in advance.
### For New Patient Orders: Create (a New) Patient, Prescription, and Order
At the time of an order, your systems should be prepared to create the following entities within Blend.
* A **patient**, using the `/patients` endpoint.
* Alternatively, this can be created within an Order in a single request
* Not applicable for refills, as patient data already exists
* An **electronic prescription** (assuming the patient requires a prescribed product)
* This can be sent via Surescripts, or directly via API (`/prescriptions/electronic-prescription`) depending on your integration
* An **order**, using the `/orders` endpoint, containing the product(s) to be fulfilled by Blend
*While a patient must be created before sending an order, a prescription can be sent at any time (even before patient creation). Blend will match accordingly regardless of which is created first.*
### For Existing Patient Orders: Create a Prescription and Order
For existing patients (non-refill) orders, your system needs to only send:
* An **electronic prescription**, either via Surescripts or directly via API
* An **order** containing the product(s) to be fulfilled
### For Refill Orders: Create an Order
* Refills of existing prescriptions can be fulfilled simply be sending a new order
# Composite Creation
For customers who wish to streamline their API usage, Blend offers a "composite" endpoint, a convenience function wherein you can create an Electronic Prescription, Order, and even a new Patient and Prescriber, in a single request.
This Composite endpoint expects up to four objects in a request -- `electronic_prescription`, `order`, `patient`, `prescriber` -- with each adhering to its individual endpoint required fields. Patients and prescribers can be passed by reference.
# How Blend Matches Patients, Orders, Prescribers, Prescriptions and Products
There are a few key data fields Blend uses to match entities.
### Prescription to Patient
* If directly provided via API, Blend will look for a patient's `id` (Blend ID) or `external_id` (your own identifier that can be stored in Blend patient profiles).
* For Surescripts prescriptions, Blend will match on patient name (or preferred name) and date of birth; or patient contact information and date of birth.
### Prescription to Prescriber
* Prescribers will be matched based on NPI, DEA number, or SPI, with a fallback to name and date of birth
### Prescription to Product
* If directly provided via API, Blend will look for a `product` ID (Blend ID) or `product_code` in your request
* For Surescripts prescriptions, Blend will parse the ``, the `` or `` fields for matches to your products' `sku`, `product_code`, `ID`, or even its `name`.
### Prescription to Order
* Because a `patient` must be sent with an order, Blend will leverage the above mapping to tie orders to prescriptions via patient-match.
# Order Merging
Blend will attempt to consolidate open orders for the same patient. If a new order is created (either via API or in the Blend Dashboard) while a patient has an existing "open" order, the new order will be automatically merged into the existing order.
### Open (Mergeable) Orders
An open or mergeable order is one in `received` or `paused` status, or an `exception` (stuck) order created within the last 24 hours. That lets same-day prescriptions still ship together if a Too Early to Fill hold is released. Older exception orders are not merged into, so a long-standing hold on one medication does not delay unrelated new prescriptions. Once an order has entered the physical picking phase (`picked` or later), it can no longer be merged-into, and a new order will be created for that patient.
### Shipping Updates Upon Merge
If a new order is merged into an existing order, any shipping address or preference updates **will** be inherited by the original order:
* If a new shipping address is provided, the merged order will be sent to the new shipping address.
* If a new/different shipping preference is provided (e.g., carrier or service level), the merged order will use the new preference.
### Merge response
If your attempt to create a new order has been merged with an existing open order for that patient, you will receive the original (existing) order information in response to your Create Order request.
In addition, this response will include `"merged_into_existing": true` to confirm a merge has occurred.
### Overriding order merge
You may send the `force_new=true` querystring argument when creating a new order (in either the Create Order or Composite endpoints) to prevent order merging. For instance, if a patient has requested a separate order be sent to a different location, you will want to maintain separate orders.
# Privacy Policy
Source: https://docs.byblend.com/privacy
Blend Innovations, Inc. – Privacy Policy
Effective Date: January 26, 2026
## **Introduction**
Blend Innovations, Inc. and its subsidiaries and affiliates (“Blend,” “we,” “us,” or “our”) operate a technology-enabled compounding pharmacy platform, including our website, platform, and APIs (the “Services”).
This Notice of Privacy Practices and Privacy Policy (“Notice”) explains how we collect, use, share, and protect your personal and health information. It also describes the rights you have regarding your health information and how you can exercise them.
This Notice applies to all of our Services and is incorporated into our [Terms of Service](https://docs.byblend.com/terms).
## **Information We Collect**
We collect information that is necessary to provide our pharmacy services and operate our platform, including:
* **Information you provide**: such as your name, contact details, shipping address, and payment information.
* **Health information**: including prescriptions, prescriber details, medical history, allergies, and other information required to dispense medications.
* **Information from others**: including prescribers, clinics, or telehealth platforms who send us your prescription or related information.
* **Automatically collected information**: such as device/browser type, IP address, and site usage analytics.
* **Marketing prospect data**: collected separately through cookies, analytics, and similar tools. This data is **not combined with your health information**.
## **How We Use Information**
We use your information for purposes allowed by law, including:
* Filling, dispensing, and shipping your prescriptions.
* Communicating with you and your prescriber about your medications.
* Meeting our legal and regulatory obligations as a pharmacy.
* Conducting internal analytics and improving our services using **only de-identified and aggregated data**.
* Managing business operations such as audits, quality assurance, and compliance.
We do **not** use your health information for marketing purposes, and we do **not** sell your information.
## **How We Share Information**
We may share your information in the following situations:
* **With your prescribers or clinics** as needed to fulfill your prescriptions.
* **With service providers** that help us operate (such as shipping companies, technology providers, and communication tools).
* **As required by law** for audits, inspections, reporting, or in response to valid legal processes.
* **For safety or public health purposes**, if disclosure is needed to prevent a serious threat to health or safety.
* **In business transactions**, such as a merger, acquisition, or transfer of assets.
## **Your Rights**
You have important rights with respect to your health information, including the right to:
* **Access**: You can request a copy of your health information.
* **Amend**: You may request corrections if your information is inaccurate or incomplete.
* **Accounting of disclosures**: You may request a list of certain disclosures we have made of your information.
* **Request restrictions**: You can ask us to limit how your information is used or shared, though we may not always be able to agree when restricted by law.
* **Confidential communications**: You may request that we communicate with you in a specific way (for example, by using a different address).
* **Paper copy**: You may request a paper copy of this Notice at any time.
To exercise these rights, please first contact your prescriber. If your prescriber cannot resolve your request, you may contact us directly at **[privacy@byblend.com](mailto:privacy@byblend.com)**.
## **Cookies and Tracking**
We use cookies, pixels, and analytics tools on our website to understand how visitors interact with our Services. This information is used for business prospecting and operational purposes and is never linked with patient health information.
Marketing prospect data is retained for **5 years** and then securely deleted.
## **Text Messaging and Business Communications**
We may collect and use phone numbers provided by our customers and business partners (including clinics and their authorized personnel) for the purpose of operational, administrative, and customer support communications. These communications may occur via text message (SMS), phone call, or similar messaging technologies and may be facilitated through third-party service providers.
Text messaging is used solely for business-related purposes, including but not limited to:
* Responding to support inquiries
* Resolving operational issues
* Providing account-related information
* Communicating about services, features, or system status
We do not use text messaging for unsolicited marketing or promotional messages without appropriate consent.
By providing a phone number to us, you represent that you are authorized to do so and consent to receiving business-related communications from us at that number. Message frequency will vary based on the nature of the interaction. Standard message and data rates may apply.
You may opt out of text communications at any time by replying "STOP" or by contacting us directly. Opting out of text messages may limit our ability to provide timely support or operational updates.
We may share phone numbers and related communication data with trusted service providers that assist us in delivering these communications, subject to contractual confidentiality and data-protection obligations. We do not sell phone numbers or use them for third-party advertising.
## **Data Retention**
* Prescription and medical records are retained for **10 years** as required by pharmacy law.
* Health information cannot be deleted early, even if requested, because of legal retention requirements.
* Prospect marketing data is retained for **5 years**.
* De-identified data may be retained for analytics purposes.
## **California Privacy Rights (CCPA/CPRA)**
If you are a California resident, you have additional rights under California law:
* **Right to know**: You can request details about the personal information we collect, use, and disclose.
* **Right to delete**: You can request deletion of personal information, subject to pharmacy record retention laws.
* **Right to correct**: You can request that we correct inaccurate personal information.
* **Right to opt-out of sale/sharing**: You can request that we do not sell or share your personal information. (Blend does not sell patient health information.)
* **Right to non-discrimination**: You will not be treated differently for exercising your privacy rights.
To make a request under CCPA/CPRA, email us at **[privacy@byblend.com](mailto:privacy@byblend.com)**. We will take steps to verify your identity before fulfilling your request.
## **Children’s Privacy**
Blend does not knowingly collect personal information directly from children under 13 years of age through its websites, apps, or digital Services. Our digital Services are directed to adults, including parents and legal guardians, and are not designed for use by children. If you are under 13, you may not register for or directly use Blend’s digital Services.
At the same time, as a licensed pharmacy, Blend does dispense medications to patients under the age of 13. In those cases, all prescription and account activity occurs through the child’s parent or legal guardian, who is responsible for managing the child’s prescription orders. Any personal or health information we maintain for pediatric patients is collected and used solely to provide pharmacy services in coordination with the child’s prescriber and parent or guardian, and is protected under our Privacy Policy.
If Blend learns that we have inadvertently collected information directly from a child under 13 through our digital Services, we will promptly delete such information. Parents or guardians who believe we may have information collected directly from a child through the website should contact us at [privacy@byblend.com](mailto:privacy@byblend.com).
## **Security**
We implement reasonable administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of personal and patient-related information. These include access controls, encryption in transit and at rest, secure storage practices, auditing of system access, and regular monitoring for unauthorized activity.
However, no system or method of data storage is completely secure. While we take steps to reduce risk, we cannot guarantee that information will never be accessed, disclosed, altered, or lost in a manner inconsistent with this Privacy Policy.
Where the Services allow individuals to submit content directly (e.g., forms or messages), we recommend excluding any sensitive information not required for appropriate treatment. Personal and health-related data should be submitted only through Blend-provided secure forms, not via external messaging applications.
## **Changes to this Notice**
We may update this Notice from time to time. When we do, we will post the updated version on our website with a new **Effective Date**. If we make material changes to how we use or share your information, we will notify you by email.
## **Contact Us**
If you have any questions about this Notice or your privacy rights, you can contact us at:
* **Chief Privacy Officer**
* Blend Innovations, Inc.
* 6171 Huntley Rd STE J
* Columbus, OH 43229
* Email: **[privacy@byblend.com](mailto:privacy@byblend.com)**
## Notice of Privacy Practices
### Your Rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
**Get an electronic or paper copy of your medical record**
* You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this.
* We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
**Ask us to correct your medical record**
* You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this.
* We may say “no” to your request, but we’ll tell you why in writing within 60 days.
**Request confidential communications**
* You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address.
* We will say “yes” to all reasonable requests.
**Ask us to limit what we use or share**
* You can ask us not to use or share certain health information for treatment, payment, or our operations.
* We are not required to agree to your request, and we may say “no” if it would affect your care.
* If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer.
* We will say “yes” unless a law requires us to share that information.
**Get a list of those with whom we’ve shared information**
* You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why.
* We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.
**Get a copy of this privacy notice**
* You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.
**Choose someone to act for you**
* If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
* We will make sure the person has this authority and can act for you before we take any action.
**File a complaint if you feel your rights are violated**
* You can complain if you feel we have violated your rights by contacting us using the information on page 1.
* You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting [www.hhs.gov/ocr/privacy/hipaa/complaints/](http://www.hhs.gov/ocr/privacy/hipaa/complaints/).
* We will not retaliate against you for filing a complaint.
### Your Choices
For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.
**In these cases, you have both the right and choice to tell us to:**
* Share information with your family, close friends, or others involved in your care
* Share information in a disaster relief situation
* Include your information in a hospital directory
* Contact you for fundraising efforts
*If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.*
**In these cases we never share your information unless you give us written permission:**
* Marketing purposes
* Sale of your information
* Most sharing of psychotherapy notes
**In the case of fundraising:**
* We may contact you for fundraising efforts, but you can tell us not to contact you again.
### Our Uses and Disclosures
How do we typically use or share your health information? We typically use or share your health information in the following ways.
**Treat you**
* We can use your health information and share it with other professionals who are treating you.
* Example: A doctor treating you for an injury asks another doctor about your overall health condition.
**Run our organization**
* We can use and share your health information to run our practice, improve your care, and contact you when necessary.
* Example: We use health information about you to manage your treatment and services.
**Bill for your services**
* We can use and share your health information to bill and get payment from health plans or other entities.
* Example: We give information about you to your health insurance plan so it will pay for your services.
**How else can we use or share your health information?** We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. For more information see: [www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html](http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html).
**Help with public health and safety issues**\
We can share health information about you for certain situations such as:
* Preventing disease
* Helping with product recalls
* Reporting adverse reactions to medications
* Reporting suspected abuse, neglect, or domestic violence
* Preventing or reducing a serious threat to anyone’s health or safety
**Do research**
* We can use or share your information for health research.
**Comply with the law**
* We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
**Respond to organ and tissue donation requests**
* We can share health information about you with organ procurement organizations.
**Work with a medical examiner or funeral director**
* We can share health information with a coroner, medical examiner, or funeral director when an individual dies.
**Address workers’ compensation, law enforcement, and other government requests**\
We can use or share health information about you:
* For workers’ compensation claims
* For law enforcement purposes or with a law enforcement official
* With health oversight agencies for activities authorized by law
* For special government functions such as military, national security, and presidential protective services
**Respond to lawsuits and legal actions**
* We can share health information about you in response to a court or administrative order, or in response to a subpoena.
### Our Responsibilities
* We are required by law to maintain the privacy and security of your protected health information.
* We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
* We must follow the duties and privacy practices described in this notice and give you a copy of it.
* We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
For more information see: [www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html](http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html).
**Changes to the Terms of This Notice**\
We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our web site.
This Notice of Privacy Practices applies to the following organizations: By Blend LLC
# Security
Source: https://docs.byblend.com/security
Blend's approach to data and system security
Our platform is designed with security, compliance, and accountability as core principles. We adhere to security practices aligned with **HIPAA** and **SOC 2** frameworks to safeguard sensitive information.
## Data
* **Encryption in Transit**: All network traffic is encrypted via TLS 1.2+ with strong cipher suites.
* **Encryption at Rest**: All persistent data is encrypted with AES-256. Databases and snapshots are encrypted at rest. Object storage uses server-side encryption (SSE-S3, AES-256) by default.
* **Auditing**: All access to any customer, inventory, or protected health information (PHI) via API or dashboard is logged. All attempted, failed, and successful logins, as well as data edits or modifications, are recorded and auditable, and regularly audited.
## Infrastructure
* **Private Networking**: Services communicate over an internal private network using secure internal DNS.
* **System Monitoring**: Continuous collection of logs and performance metrics (CPU, memory) with alerting for anomalous behavior.
* **Observability Dashboards**: Custom dashboards provide real-time visibility into system health, performance, and deployment activity.
* **Backups**: Automated backups with tested restoration procedures are performed daily, weekly, and monthly.
* **Patch Management**: Operating systems and dependencies are regularly updated to remediate vulnerabilities.
## Application & Operational
* **Secure Development Practices**: Code reviews, dependency vulnerability scanning, and secrets management.
* **Identity Verification**: Positive ID procedures are required and enforced for all in-pharmacy operations for prescription review or medication dispensation.
* **Audit Trails**: Comprehensive audit trails for all system access, data changes, and pharmacy operations.
## Network Controls
* **Encrypted Transport**: All external connections are served over HTTPS with modern TLS protocols (1.2+). Certificates are automatically issued and renewed.
* **Connection Limits & Rate Controls**: Baseline rate limiting and connection caps are enforced at the network edge to prevent abuse and ensure service stability.
* **Resilience Against Attacks**: Network layer is protected against denial-of-service attempts, with safeguards in place to maintain availability.
## Compliance & Certifications
* **EPCS / DEA 21 CFR Part 1311**: Certified and audited (every two years) for Electronic Prescriptions for Controlled Substances (EPCS) under DEA 1311 standards. *Most recent audit September 2025.*
* **Surescripts Certification**: Certified for interoperability with the Surescripts network, which enforces **mutual TLS (mTLS)** and strict identity controls for all electronic prescription interchange.
* **HIPAA Alignment**: We implement HIPAA-aligned controls for auditing, access restrictions, and confidentiality.
* **SOC 2 Alignment**: We follow SOC 2 security principles, including:
* Access controls (least privilege, audit logs).
* Encryption in transit and at rest.
* Change management and code review. All changes pass through version control, automated test suites, and a staging environment before production deployment.
* Incident response procedures. We continuously and automatically monitor systems and have escalation processes in place to respond rapidly to anomalies or security events. Any incidents are documented, reviewed, and addressed as part of a structured post-incident review process.
* Vendor Risk & Redundancy. Critical vendors are evaluated for compliance with recognized security and industry standards. Vendor dependencies are periodically reviewed. Key infrastructure is deliberately provisioned across multiple vendors to improve resilience and reduce the risk of single points of failure.
# Terms of Service
Source: https://docs.byblend.com/terms
Blend Innovations, Inc. – Terms of Service
**Effective Date: August 29, 2025**
## **1. Agreement to Terms**
These Terms of Service (“Terms”) govern your access to and use of our websites (including byblend.com), technology platform, software, APIs, and pharmacy fulfillment services (collectively, the “Services”) provided by Blend Innovations, Inc. and its subsidiaries and affiliates (together, “Blend,” “we,” “us,” or “our”).By accessing or using the Services, you agree to be bound by these Terms. Your acceptance is implied by your continued use of the Services.
If you are a clinic, platform, or other business partner that has entered into a separate written agreement with Blend, the terms of that written agreement will control in the event of any conflict with these Terms. These Terms apply to all other users, including individual patients who access limited features of the Services.
## **2. Services Provided**
Blend provides technology-enabled compounding pharmacy services, including prescription fulfillment, logistics support, and digital access tools. Blend does not provide medical advice or clinical care other than pharmacy services. All medical advice, diagnoses, and prescribing decisions are the sole responsibility of licensed healthcare providers. The Services include both the provision of pharmacy fulfillment services and access to digital technology tools that support those services.
## **3. Users Covered**
These Terms apply both to business accounts, including clinics and telehealth platforms, and to individual patients who may use certain limited features of the Services.
## **4. Section for Patients**
If you are an individual patient, please note the following: Blend is not your healthcare provider and does not provide medical advice. Any diagnosis, treatment plan, or prescribing decision is made solely by your licensed healthcare provider. Your access to the Services is limited to viewing, managing, and receiving prescription orders. Your personal information is protected in accordance with Blend’s [Privacy Policy](https://docs.google.com/document/d/1GfTeV1FU7DYcxTGP_9BWsPDXi5vCu-L06rTXPlC8Sq4/edit?tab=t.0). If you have concerns about your prescription, you must contact your prescriber directly. Blend’s liability to you as a patient is limited to one hundred dollars (\$100), except where prohibited by law.
## **5. Accounts and Responsibilities**
Both individuals and organizations may create accounts to use the Services. You agree to provide accurate and complete information when creating an account and to safeguard your login credentials. Unless otherwise provided in a separate written contract, Blend reserves the right to suspend or terminate accounts at any time, including immediately where we suspect fraud, diversion, regulatory risk, or other noncompliance. Suspension or termination does not relieve you of any payment obligations incurred prior to termination.
## **6. API Terms**
Blend may provide access to application programming interfaces (“APIs”) for integration purposes. Your use of any API is subject to these Terms and any API documentation provided by Blend. You may use the APIs only for lawful, authorized purposes and in accordance with applicable documentation. You may not access internal-only (undocumented) APIs, reverse engineer APIs, resell or sublicense your access to APIs, or use APIs to build competing services. The use of any third-party tool to extract data (“scrape”) from Blend systems, or otherwise replicate or expand upon existing API functionality, is unauthorized. Blend may monitor API usage, impose limits, and revoke access at any time. Blend also reserves the right to introduce fees for API access in the future.
## **7. Payments and Fees**
Payment terms depend on how you access the Services. If you are invoiced, the terms set out in your invoice will govern, including due dates and any late payment provisions. If you pay by credit card or other electronic method, you will be presented with applicable payment and privacy terms at the time of payment. If you are a patient who does not directly pay Blend, no billing will occur unless explicitly stated.
## **8. Privacy**
Your use of the Services is also governed by Blend’s Privacy Policy, available at [byblend.com/privacy](https://docs.byblend.com/privacy). These documents are incorporated by reference into these Terms.
## **9. Intellectual Property**
All rights, title, and interest in and to the Services, including the software, trademarks, content, and documentation, belong exclusively to Blend and its licensors. You are granted a limited, revocable, non-exclusive, non-transferable license to use the Services for their intended purposes. You may not copy, modify, reverse engineer, or distribute the Services or related content. No right to co-branding or use of Blend’s trademarks is granted without our express written consent.
## **10. Prohibited Uses**
You agree not to use the Services in violation of any laws or regulations, including those governing pharmacy practice and controlled substances. You may not submit fraudulent or forged prescriptions, attempt to gain unauthorized access to systems or data, or interfere with the operation of the Services through malware, scraping, or other disruptive activities.
## **11. Third-Party Providers**
Blend is not responsible for the clinical decisions of independent prescribers, the performance or timeliness of delivery carriers, or the operation of third-party technology vendors or platforms that may integrate with Blend.
## **12. Dispute Resolution**
These Terms are governed by the laws of the State of Ohio, without regard to conflict-of-law principles. Except where prohibited by law, any dispute arising under these Terms shall be resolved by binding arbitration conducted in Ohio on an individual basis, and not as part of a class or collective action. If you are a business partner and have a separate written agreement with Blend, the dispute resolution provisions in that agreement will govern in the event of conflict.
## **13. Modifications**
Blend may update these Terms from time to time by posting changes on our website. Changes are effective immediately upon posting. For material changes affecting access by business partners, Blend will provide reasonable notice, which may be delivered by email or through the Services portal. Your continued use of the Services after changes take effect constitutes acceptance of the updated Terms.
## **14. Disclaimers and Limitations of Liability**
The Services are provided “as is” and without warranties of any kind, whether express or implied. Blend disclaims liability for indirect, incidental, or consequential damages. For business accounts, Blend’s aggregate liability for all claims is limited to the total amounts paid to Blend in the twelve (12) months preceding the claim. For individual patients, Blend’s liability is limited to one hundred dollars (\$100). These limitations apply to the maximum extent permitted by law.
## **15. General Provisions**
Blend may assign these Terms without restriction. You may not assign or transfer these Terms without Blend’s prior written consent. Blend will not be liable for delays or failures in performance caused by circumstances beyond our reasonable control, including acts of God, natural disasters, strikes, or governmental actions. Notices to Blend must be sent electronically to [admin@byblend.com](mailto:admin@byblend.com). These Terms, together with the Privacy Policy and any other referenced policies, constitute the entire agreement between you and Blend regarding your use of the Services. If any provision of these Terms is held unenforceable, the remaining provisions shall remain in full force and effect.
**Contact Information**
* Blend Innovations, Inc.
* Email: [admin@byblend.com](mailto:admin@byblend.com)
* Website: [byblend.com](https://www.byblend.com)