SigSources
Show the source.
Keep the patient private.
Every item names the source and section it came from. There is no account, no analytics, and no server of ours.
Sources and privacy
Built to be checked.
Every quote is checked.
New content is drafted from a verbatim quote of 25 words or fewer and a locator such as a section, page, or table. A machine check rejects any quote that isn’t a literal span of its source.
Review status is shown, not implied.
Anything a named pharmacist reviewer hasn’t cleared says In Development, and every data set shows the date it was last reviewed.
No account. No analytics.
Patient values stay on the device and clear when you leave the tool. There is no Sig account to breach, and no server of ours for data to reach.
Works in the basement pharmacy.
The reference is on the device, so it works with no signal. Live lookups go straight from your device to the NLM, FDA, and CMS services that hold the answer.
A report button on every page.
Spot an error and send it from the page it’s on. The report is encrypted on your device before it leaves, and a pharmacist reads every one.
Label first.
Drug information starts from FDA labeling. Where practice differs from the label, the difference is called out and cited, not blended in.
Questions
Asked and answered.
Where does Sig's drug information come from?
Sig's primary source is FDA-approved labeling, taken through DailyMed and openFDA, plus 384 published guidelines and labels across 15 specialties. Drug names and classes come from RxNorm and RxClass (National Library of Medicine), prices from CMS NADAC, and lactation data from LactMed.
For example, a renal dose rule in Sig names the FDA label section behind the rule, such as Dosage and Administration (2.1). New guideline content is drafted from a verbatim quote of 25 words or fewer, and a machine check rejects any quote not found word for word in the source.
Our data show that 100% of the 15,497 recommendations name the source section, and 34% also give a page number, as of November 3, 2026.
Additionally, where practice diverges from the label, Sig calls out the divergence and cites the practice source rather than blending the two. When two documents give different numbers, each keeps a separate row with a separate citation. Where a source needs a number and prints none, Sig says so.
How current is Sig's content?
Each bundled data set in Sig shows the date of last review. Dose rules, antimicrobial guidance, and boxed warnings are re-reviewed at least every six months. The counts on this site were taken from the app's catalogs on November 3, 2026.
Additionally, Sig is built so catalog corrections can arrive as signed content updates delivered through Apple. A correction then does not wait for an app update. Live data, for example labels, shortages, and recalls, reflects what the government service returned at the moment of the lookup.
The current editions in our data are: (1) the FDA Orange Book of October 9, 2026; (2) the FDA Purple Book release of September 2026; (3) the DailyMed archive of August 23, 2026 for pill identification; (4) federal and state controlled-substance schedules as of October 9, 2026.
Is Sig HIPAA compliant?
Sig is not designed to receive protected health information, so HIPAA obligations do not attach to Sig the way they do to a record system. Sig has no account, no analytics, and no server of its own. Values typed into a calculator stay on the device and are discarded on leaving the tool.
Additionally, HIPAA compliance is a property of how an organization handles patient data, not a certificate an app holds. Because Sig does not receive PHI, HARRIS CLINICAL SOFTWARE LLC is not a covered entity or business associate and does not sign business associate agreements.
Pharmacists using Sig should not enter names, dates of birth, or record numbers anywhere in the app. None of our data comes from patients. Every service the app contacts is named in Sig's privacy policy, effective November 2, 2026.
For example, according to HHS, the HIPAA Privacy Rule applies to covered entities, such as health plans and most health care providers, and to the business associates of covered entities.
Will Sig sign a BAA so my health system can approve it?
No, because Sig has no data flow for a business associate agreement to cover. A BAA governs vendors who create, receive, maintain, or transmit PHI for a covered entity. Sig does none of the four. Sig has no account, no analytics, no third-party SDK, and no Sig server for patient data to reach.
A security reviewer usually needs the data-flow answer, in three points. (1) Bundled content works offline. (2) Live lookups go from the device straight to named United States government services, such as the National Library of Medicine. (3) The only thing reaching us is a problem report a user chooses to send, encrypted first.
For example, a hospital IT reviewer working with Sig's privacy policy, effective November 2, 2026, can check each network request service by service. Our data contain no patient records, only published guidelines and FDA labeling. According to the policy, problem reports are deleted once resolved, and in any case within twelve months.
What data leaves my device when I use Sig?
Very little. Sig's bundled content works in airplane mode. When a pharmacist looks up something not bundled, such as a specific FDA label, an NDC, or a code, Sig sends only the query directly to the government service holding the record. No name, account, patient identifier, or calculator input is ever included.
Additionally, two other things can leave the device, both only on a user's action: (1) a Report a Problem submission, encrypted before sending, and (2) a result shared through Apple's share sheet. Sig downloads content updates from Apple, which carry no information about the user.
For example, opening the current label for a drug sends the drug's identifier directly to DailyMed or openFDA, per Sig's privacy policy, and nothing else. Our data flow is listed service by service in the privacy policy, effective November 2, 2026, and includes no account and no analytics.
How do I report a content error if the screen shows patient values?
Turn the screenshot off, for example when a Dose Adjustment result shows a creatinine. Pharmacists using Sig's Report a Problem form, on every page, see the captured screen before anything is sent, with an Include Screenshot switch to remove the image. Reports carry no name, email address, or Apple Account and are encrypted on the device before leaving.
A pharmacist reads every report. According to Sig's privacy policy, effective November 2, 2026, reports are deleted when the problem is resolved, and in any case within twelve months.
In short: (1) tap Report a Problem on the page; (2) switch Include Screenshot off; (3) describe the error in words and tap Send. Each report records the page of origin, so the reviewing pharmacist can find the row without a screenshot.
Additionally, none of our data from a report identifies the sender.
Can I suggest a feature or help review content?
Yes. Feature requests and content corrections sent to support@get-sig.app are read by a pharmacist, and corrections reported from inside the app arrive through Report a Problem on every page.
Pharm.D. reviewers interested in a specialty are welcome to say which one. The reviewer roster is being built now, and named reviewers are credited in the app for the sections cleared. A public corrections log is part of the launch plan.
For example, a report of a wrong dose goes through three steps: (1) a pharmacist reads the report; (2) the pharmacist checks the claim against the guideline or FDA label the row cites; (3) the catalog changes only if the source supports the change, and the fix ships in the next build or content update.
Additionally, our data show the scale a reviewer would join: 15,497 recommendations from 384 guidelines and labels, as of November 3, 2026.
Be in the first build.
Sig opens as a TestFlight beta before it reaches the App Store. One email is the whole sign-up: no account, no marketing list.