Shop Alto Essentials to add pharmacy products to any delivery!

Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Each type of user has a different product or set of products we’ve built for them. From within each product, we collect, transmit, process, and store a tremendous amount of sensitive information. However, our biggest area of security, privacy, and compliance risk is our internal pharmacy management tool called Wunderbar that is used by our operations (ops) users every day to process prescriptions. Securing access to Wunderbar is mission-critical to protect our data and our business, and, of course, we need our super-secure implementation to be super-smooth to avoid slowing down our hard-working ops users.

Developing Robust Authentication Using Rails, Omniauth, and Okta

Alto Pharmacy aims to deliver a better pharmacy experience for everyone who needs medication. To achieve that, we need to enable three different types of users:

Individual customers who need prescriptions

Healthcare providers: the nurses, doctors, physicians assistants, and other medical professionals who prescribe medications

Operations users: the Altoids who intake prescriptions, bill insurance, fill prescriptions, and more

We wanted to be able to change our Wunderbar session lifetimes without hampering either our security efforts or the usability of our product. Moreover, we wanted session lifetimes of other apps to be able to change appropriately with business risk. Before starting this project, we’d implemented a Google OAuth 2.0 authorization flow that allowed ops users to log into Wunderbar via Google and take advantage of transparent session refresh for a limited amount of time.

However, while Google Workspaces was (and is) great for our email, documents, and calendars, it isn’t as configurable or extensible as a proper SSO solution. One painful side effect of this limitation was that, in order to ensure our refresh sessions were limited to twelve hours in Wunderbar, any user of the Alto Gmail drive also had to log back in every twelve hours just to see email — even though there’s not nearly the same level of sensitive data in email.

Plus, our IT team had already picked the tool of the future: Okta. And the goal was to enable SSO, or Single Sign On: if we still used Google for SSO, it wouldn’t really be SSO!

It was clear we needed to move to Okta for authenticating in Wunderbar, too.

Okta is a big company with many different authentication mechanisms. For us, the big question was really: do we want to authenticate via SAML or Open ID Connect (OIDC)? There are a lot of great resources around comparing these two standards and what they’re good at; here’s a good chart comparing and contrasting parts of these two authentication flows:

From this Medium post, which is a great primer on the differences

For us, the most attractive thing about SAML is that it can be used to provision user accounts from your upstream IDP; for example, Okta could be configured to push username, email, group, role, etc., information to our platforms with which we could automatically provision user accounts.

In the end, we decided the OIDC implementation would provide for a very similar user experience to that which our operations users were already accustomed to, with the same capability to perform transparent token refresh.

This transition was pretty easy because we were moving from Google OAuth 2.0 flow to Okta’s OIDC flow. OAuth 2.0 and OIDC are very similar; just know that OAuth 2.0 is technically an authorization framework (once you have a user, what can they access) vs an authentication framework (actually identifying and validating the user). However, there were some odd things about our previous implementation, and I only had one person to blame for those choices: myself. It’s great to get the opportunity to re-implement our authentication system — in a fast moving startup, you rarely get the chance to revisit problems so soon!

The biggest issue at hand with our previous Google flow was the way in which I’d chosen to re-authenticate users whose Wunderbar sessions had expired. In this case, OAuth provides a handy mechanism: a refresh token. Here’s how access tokens and refresh tokens are exchanged from the client and the authentication server in OAuth 2.0 flows:

At the time, we had session lifetimes of 60 minutes when accessing Wunderbar. These cookies also lasted 60 minutes. We faced a problem: if somebody walked away from their laptop for 61 minutes after authenticating, when they came back, how could we make it so they didn’t have to go back through the Google OAuth 2.0-initiated login flow from the beginning?

My solution at the time persisted a secure cookie with the refresh token value client-side with a longer expiration length. Then, if the user didn’t have a valid access token, we’d simply present the refresh token back to the server and get a new access token all over again. This worked well, but exposing secrets to the client always presents a risk of compromise. Refresh tokens are longer-lived, so they're of even higher value to protect!

Okta’s documentation made it very easy to stand up a simple authentication server and set up a local development server. Okta has a great blog post guide with tools we were already using (Rails and Omniauth, specifically) to get up and running. Beyond that, our biggest challenge was ensuring that we had a smooth rollout.

There was an issue in how we’d test and use this flow in our staging environments, however. At the time we were working on this (early 2020), there were two issues:

Our sandbox environment URLs were non-deterministic and could be varied depending upon how an engineer user named their cluster.

Okta apps did not support wildcard redirects in their oauth redirect URLs. This controls where, upon hitting Okta’s servers, they should redirect your payload to handle the meat of authentication.

For a time, our clever infrastructure engineering team managed around these issues with the use of an intermediary keycloak server. However, Okta now supports wildcard redirects that we’re successfully using today:

The biggest functional change to our authentication flow was in our refresh flow. The biggest challenge in landing this change was in how we deployed it to end users in production.

We didn’t want to expose the refresh token because it presented too much risk. What do we do instead? Something a little bit risky, but that we preferred after threat modeling our scenarios. Security engineering is often about making tradeoffs given a number of constraints. Today, our session lifetimes are down to fifteen minutes, and our refresh lifetime for an active session (e.g. somebody making at least one request within this window) is 60 minutes. If somebody comes back after their access token expires, that’s fine; we’ve persisted the encrypted refresh token to the database, and we can use attributes from the expired but still cryptographically valid token in order to look that refresh token up.

This was crucial for Okta especially because Okta refresh tokens are valid for 100 days by default!

Disruptive change is hard. We didn’t want to disrupt the workday of our hard-working ops users who are caring for our many customers and provider partners. The biggest intent here was to keep a safety blanket fallback to the old authentication flow until we were quite confident in its functionality. This broke down into a multi-phase approach:

1. Dark-launch the new Okta flow hidden behind a URL and with a small allow-list of users (mostly just the Security team) assigned to the new application in Okta.

2. Ask for volunteers! These volunteers would go about their normal work day in a variety of functional areas (customer care, pharmacy, fulfillment, engineering) using Okta instead of Google.

3. Change the default login flow to use Okta, but keep Google working just fine as a secondary action hidden behind a URL.

This allowed us to always ensure that we didn’t disrupt peoples’ days too much!

We achieved our goals and now, nearly two years later, we’re successfully using Okta’s OIDC flow within our core pharmacy management app. What did we learn in the process?

Not every API is necessarily fully implemented in every client. At the time of implementation, Okta’s Ruby client wasn’t fully supported. In order to support our refresh flow, we needed to upstream a small change into the client library, which required a little investigation.

Exposing secrets involves risk! In our case there wasn’t a glaring need to expose refresh tokens client-side at all.

Slow rollouts are great, especially with disruptive changes! A big thank-you to our team members who were willing to be part of the experiment group last year when this rolled out.

Interested in learning more about engineering at Alto? Follow us on LinkedIn and check out our open positions.

Since certain types of cancer treatments and procedures can temporarily or permanently impact both male and female fertility, it’s important to have a discussion about fertility with your oncologist as soon as possible. Read on to learn more about fertility preservation options and financial resources for those recently diagnosed with cancer.

Fertility Preservation Options After a Cancer Diagnosis

A cancer diagnosis can bring much uncertainty. If you are considering having children in the future, you may be wondering how your options for cancer treatment will affect your reproductive health. Fertility preservation treatments like egg or sperm freezing can bring peace of mind during this potentially overwhelming time, allowing you to leave open the possibility of starting a family after cancer treatment.

There are several ways that cancer treatments can affect your fertility, including the following:

Surgery to treat cancer of a reproductive organ — such as in the prostate, testes, ovaries, or cervix — may lead to infertility.

Chemotherapy-induced changes in hormone levels can lead to early menopause for women and decrease sperm production in men.

Radiation therapy near the reproductive organs, abdomen, pelvis, or spine may damage eggs or sperm cells depending on the dose and level of radiation.

Hormone therapy used in the treatment of breast cancer and other types of cancer may affect fertility, though these effects are often temporary.

The extent to which these cancer treatments may impact your fertility depends on your personal health history — including your age and baseline fertility — and the duration and dosage of treatment. Your care team can provide a clearer sense of what to expect based on your health and treatment plan.

Many individuals of reproductive age choose to freeze their sperm or eggs for future use before beginning cancer treatment.

Sperm freezing is a fairly simple process in which a person’s sperm is collected, analyzed by a doctor, and, if viable, frozen in vials with cryoprotectant agents and stored for future use.

In the egg freezing process, fertility medications stimulate egg production and maturity. The eggs are retrieved in a minimally invasive procedure and then frozen and stored for future use. There is also the option of freezing embryos, which are eggs that have been fertilized with sperm.

There are several ways that you can use your frozen sperm, eggs, or embryos to have children biologically in the future after cancer treatment. Intrauterine insemination (IUI) is a process that allows you to use your frozen sperm and have it placed into your partner’s or a surrogate’s uterus.

In vitro fertilization (IVF) is a process in which eggs and sperm are fertilized and then placed into the uterus with the potential outcome of a pregnancy. Women who have previously undergone cancer treatment might use this process to have their frozen eggs or embryos implanted into their own uterus. If using eggs rather than embryos, there will be the additional step of fertilizing the eggs with a partner or donor’s sperm. If you had a hysterectomy to remove all or part of your uterus during cancer treatment, you can have your embryos implanted into a gestational carrier’s uterus.

Given the urgency of cancer treatment and the important timing of fertility medications during an egg freezing cycle, you will likely have to make quick decisions about fertility preservation, often within a few days of receiving a diagnosis. Your oncologist may refer you to a fertility specialist called a reproductive endocrinologist who can answer questions about cancer treatment and fertility and help you understand your fertility preservation options. It isn’t uncommon to begin taking fertility medications the same day as your consultation with a reproductive endocrinologist. 

If your oncology team does not know that fertility preservation is a priority for you, do not be afraid to take the initiative in starting the conversation. Be sure to get clarity on how moving forward with the fertility preservation process might impact the timing of your cancer treatment and what your oncologist recommends. Depending on your treatment plan, you may also want to ask about radiation shielding, which can be used during cancer treatment to protect the ovaries or testicles and limit how much radiation they are exposed to.

It’s important to take the financial aspects of fertility preservation treatments into account when planning for the future. While these treatments are significant financial investments, there are resources that can alleviate some of the costs of treatment, including programs designed specifically for those in cancer treatment and survivors.

If Alto is your fertility pharmacy, your fertility medication protocol likely includes medications manufactured by EMD Serono or Ferring Pharmaceuticals. Both companies offer financial assistance for individuals whose fertility has been affected by cancer treatment.

EMD Serono donates fertility medications to eligible cancer survivors diagnosed during their reproductive years through the Livestrong Fertility Discount program. Start the application process on Livestrong’s website to learn if you are eligible.

Ferring Pharmaceuticals provides some fertility medications at no cost for individuals pursuing fertility preservation before cancer treatment. To be eligible, you must be a female U.S. citizen or permanent resident with a cancer diagnosis who has not received chemotherapy within the previous six months. To apply, learn more about Ferring’s Heartbeat program online, or call 1-888-347-3415. (Residents of Arkansas, Massachusetts, or New Jersey can call 1-877-252-0553.)

Read our previous post on financial planning for egg freezing.

A fertility pharmacy partner you can rely on

Since 2016, Alto has supported more than 50,000 fertility journeys. We understand that fertility treatment is a significant investment — physically, emotionally, and financially — and we see ourselves as a partner in your health.

We offer free, same-day delivery seven days a week and temperature controlled packaging to ensure that your fertility medications always arrive in the right condition. And our fertility-trained pharmacists are available until 9 pm PST (12 midnight EST) on weeknights to offer any support you need.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881. You can also request a price quote online.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

Working from home offers many benefits. The lack of commute to and from the office can mean more quality time with family, mid-day workouts, or a load of laundry over lunch. And with fewer distractions, the environment of a home office is a productivity boost for certain work styles.

How to Say Healthy While Working From Home

At the same time, some individuals may find it more difficult to concentrate outside of a physical office, and remote work can also impact your mental health. In a recent public opinion poll conducted by the American Psychiatric Association (APA), nearly two-thirds of the respondents reported feeling isolated or lonely at least sometimes as a result of working from home, while 17% said that they experience isolation and loneliness all the time. And a majority of the respondents who partially work from home said that they find it difficult to step away from work at the end of the day.

With remote work on the rise — the number of U.S. adults who work from home increased from 22% to 42% between 2019 and 2020 — it is important to prioritize your mental and physical well-being and create boundaries between work and social life. Here are steps you can take to stay sane and healthy while working from home.

A physical office space naturally incorporates structure into your day. Simply sitting down at your desk and seeing colleagues allows you to mentally shift into work mode. This is important for not only productivity, but also for work-life balance — just as you are able to jump right into your to-do list once you enter the office, the clear boundary between work and home means you’re less likely to revisit that list once the day is over. Plus, watching a coworker take a break may be a much needed reminder that it’s time to grab lunch or get some fresh air.

There are several ways to give yourself structure while working from home. First, mimic the experience of going to work. It may be tempting to stay in pajamas and check emails from bed, but many remote employees find it easier to concentrate — and to leave work behind at the end of the day — by creating a morning routine and using a designated workspace that’s not in your bedroom.

In addition, having a clear plan for the day can boost both productivity and mental health, as you will have carved out time for high-priority tasks and breaks. For some individuals, planning the day the night before makes it easier to jump into work the next morning, so consider incorporating this into your end of day routine if you find it helpful. There are a variety of ways to lay out what needs accomplishing, from organizing your day entirely on a calendar to using a task management tool. Increasing focus and productivity while working from home is all about finding the system that’s right for you.

It’s just as important to consider your personal preferences and work habits when planning breaks. The frequency of your breaks should correlate to how long you can maintain a state of deep focus. Taking breaks every 75 to 90 minutes may be realistic for some individuals, but others may find shorter bursts of work more helpful. The pomodoro method has become a common approach to time management. You will focus on a single task for 25 minutes then take a five minute break, repeating the pattern three more times before taking a 15 minute break.

Whichever system you choose for breaks, remember to use some of that time for physical activity. Exercise affects both your physical and mental health and may help reduce some of the stress and isolation that often comes with remote work.

Having a designated workspace can help you create boundaries between work and social life. Working from home can contribute to burnout, and using your bedroom as the office can often lead to a workday that stretches well past eight hours. If you can, make a workspace in another room. If you don’t have space to use as a designated home office, try the kitchen table or living room.

In addition to supporting your mental health, working in a space that’s set aside for work can help minimize distractions and maximize productivity, particularly if you live with family members or roommates. Young children or anyone who’s never worked from home themselves may not know to avoid interrupting you during your workday. You can set boundaries by informing everyone at home of your working hours and communicating your expectations.

The design of your workspace can also impact your emotional well-being and physiological health. Exposure to sunlight is linked to higher levels of serotonin, a hormone believed to regulate your mood and lower anxiety. If possible, use a workspace that gets a lot of natural light, and use part of your break time to soak up some sun. Add some greenery to your home office too — research has found that having plants nearby as you work can increase productivity.

Maintaining good posture while you work can prevent tightness in your neck or back pain. If working while seated, keep your feet flat on the ground beneath your knees. Avoid working from a chair that’s too tall and prevents your feet from reaching the ground. If you can, use an ergonomic office chair or a standing desk, which offers many health benefits. If using an office chair, remember that each person’s physiological needs are different, so take time searching for the right fit.

The repetitive motion of typing in a seated position has been linked to carpal tunnel syndrome — numbness and tingling in your hand, wrist, and/or arm caused by pressure on your median nerve. A hunched posture can put strain on your wrists and hands, so using an ergonomic chair or standing desk is already a step toward preventing carpal tunnel syndrome. Be mindful of your arm and wrist position as well. Work with your elbows bent by your side and keep your forearms stretched out in front of you parallel to the floor. Using an external computer monitor or keyboard can make it easier to maintain this position.

Working in silence by yourself can lead to greater concentration and productivity in some cases, but too much isolation and loneliness affects your mental health. An office environment allows for natural socialization and conversation throughout the day, and recreating this experience at home requires a bit more intention.

If you work on a team, use workplace messaging tools to maintain connections with coworkers. Take the initiative in setting up virtual or in-person events like happy hours. And if you’re located in the same area as your colleagues, schedule a coworking session in a local coffee shop. Remote work is also a great opportunity to expand your professional network by joining a coworking space.

It’s important to maintain other social connections, too. Schedule after-work plans with friends and family, and don’t forget to pause notifications and sign off for the day.

Let Alto support your health and wellness

Practicing good self-care while working from home involves prioritizing your physical health. Alto is here to support you with exceptional pharmacy care at every step of the way. We make it simple to stay on top of your medications with free, same-day delivery and medication management tools like reminders and auto refills in our mobile app.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

How to Stay Healthy While Working From Home

If you take insulin daily to manage type 1 or type 2 diabetes, it’s important to choose a method of insulin delivery that fits your lifestyle and diabetes management needs. Many individuals who are often on-the-go find insulin pens to be most convenient given their portable size, discrete nature, and quick administration time. 

What to Know About Insulin Pens

Read on for more information about these devices, including the different types of insulin pens and what to consider when choosing one.

An insulin pen combines insulin and a syringe into a single device, allowing for a faster and easier administration than syringes. When it is time to administer an insulin injection, all you have to do is attach a new needle and dial the correct dosage on the pen. If you take multiple types of insulin every day, many insulin pen manufacturers offer color-coded pens or different designs to help you quickly identify each pen’s type of insulin.

While insulin pens simplify insulin delivery and how you measure your doses, you will still need to self-administer injections throughout the day. This is in contrast to an insulin pump, which automatically delivers doses of insulin at specific times. If you require many insulin injections each day, you may want to ask your healthcare provider if an insulin pump would be a good fit for your diabetes management needs.

There are two main types of insulin pens: disposable and reusable.

A disposable insulin pen contains a prefilled cartridge used for multidosing. You will discard the pen once the cartridge is empty or when the insulin expires, depending on the type of insulin you are using. These devices are sometimes referred to as “flex pens” or “quick pens.” Common brands include Lantus®, Tresiba®, Humalog®, Novolog®, and Basaglar®.

A reusable pen contains cartridges of insulin that are discarded once empty or when the insulin expires. You will replace the empty or expired cartridge with a new one and reuse the pen. These are sometimes referred to as “smart pens.” Common brands include InPen® and NovoPen®.

Follow the steps below to safely administer your insulin injections with a disposable or reusable insulin pen. A diabetes educator or healthcare provider can answer any questions and help you become more comfortable using the device.

1. Verify the expiration date of your insulin and do a visual check to make sure it has no clumps — most pens have a visible insulin reservoir. If the insulin is cloudy, roll the pen for a minute. (If the insulin is clear, you do not have to roll the pen.) If you take multiple types of insulin, make sure you are using the correct type.

2. Remove the pen cover or cap and sterilize the pen tip with alcohol using a cotton swab or gauze pad.

3. Attach a new needle to the pen, and have a sharps container ready for the used equipment. (You will need to use a new needle for each injection.)

4. Prime the pen if using it for the first time. Dial the dosage knob to two units, hold the pen with the needle pointing up, and tap the pen gently to let any air bubbles rise to the top. Press and hold the knob and look for a drop of insulin. If you do not see any insulin, repeat these steps as needed until at least one drop appears. This removes air bubbles from the needle and ensures that the needle is properly functioning. 

5. Choose an injection site, typically your abdomen, thigh, or arm, and wipe it with an alcohol swab. Hold the needle at the angle instructed by your doctor, most often a 90-degree angle.

6. Insert the needle into the skin and push the button on your insulin pen to deliver the injection. Wait ten seconds to make sure all of the insulin has been absorbed into your skin.

Unused pens must be refrigerated. However, do not place them in the freezer. Once in use, you may keep your insulin pen at room temperature. It’s important to avoid extreme temperatures as much as possible, so do not leave them anywhere where they will get too hot, like a car, or too cold. In addition, check the product’s package insert for an expiration date or consult your doctor about when to discard a pen or cartridge with unused insulin.

What to consider when choosing an insulin pen

You should consult with your doctor before choosing an insulin pen. In addition, consider the following factors:

The type of insulin you take — some insulin pens are only compatible with specific types of insulin.

Your insulin dosing needs — each pen has a maximum dosage. In addition, different pens can deliver insulin in increments of a half unit, one unit, or two units.

Your insurance coverage — ask your insurance provider what coverage they offer of insulin pens, if any, and explore the costs of other insulin delivery methods to determine the best fit for your needs.

Most insurance plans have separate medical and pharmacy benefits. In most cases, professional services provided by your doctor will fall under medical benefits while prescription diabetes medications — including insulin — will fall under pharmacy benefits. 

Some diabetes supplies, including many reusable insulin pens, are covered under a third type of benefits: the Durable Medical Equipment (DME) section of your policy. There may be restrictions on the brands or suppliers that are available, and it’s important to check with your specific policy to understand what will be covered and under which sections.

Many disposable insulin pens are often covered with your pharmacy benefits, in which case Alto may be able to help you get started with using an insulin pen. We will work with your insurance (if applicable) and any third party savings programs so that you can get your insulin pen at the lowest possible price.

A diabetes pharmacy partner you can rely on

At Alto, we believe a pharmacy should be a partner in your diabetes care. We have a dedicated diabetes support team to ensure that you have everything you need to follow through on your individualized treatment plan. Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

All third party trademarks (including logos and icons) referenced by Alto Pharmacy remain the property of their respective owners. Unless specifically identified as such, Alto’s use of third party trademarks does not indicate any relationship, sponsorship or endorsement between Alto and the owners of these trademarks.

In our previous post, we discussed how we designed our biometric authentication system with both privacy and a better user experience in mind. In this post, we'll show you exactly how we did it.

Considerations and Approaches for Implementing Biometric Login: Part 2

In Part 1, we discussed how we designed our biometric authentication system with both privacy and a better user experience in mind. In this post, we'll show you exactly how we did it.

To build a new authentication mechanism, we opted to use the react-native-biometrics library. This library interfaces with the device's biometrics, generates a keypair, and stores the private key within the device's keystore. When logging in with biometrics, the library creates a signature using the stored private key, and the signature is then sent to the server for validation. (Note: this library is now unmaintained. At the time of writing, this implementation can instead be accomplished with the following maintained libraries: expo-local-authentication to access device biometrics, keypair to generate a keypair, react-native-keychain to access the device keystore.)

Check if biometrics are supported and configured by the user for this device.

const { available } = await ReactNativeBiometrics.isSensorAvailable();

If yes, prompt the user for a biometric scan.

const { success } = await ReactNativeBiometrics.simplePrompt({ promptMessage: 'Confirm ID' });

If the scan succeeds, generate a keypair. The react-native-biometrics library's createKeys method will automatically save the private key to the device's keystore, and return the public key counterpart. Send the public key to your server.

const { publicKey } = ReactNativeBiometrics.createKeys('Confirm biometrics');

// Save the public key to your database
post('/save_biometric_key', { key: publicKey, device_id: 'xyz' })

When the user tries to login with biometrics, scan their biometrics. This time, if the scan succeeds, create a signature using the stored private key. The react-native-biometrics library's createSignature method handles all of this.

// Prompts for scan
// On scan success, accesses private key and uses it to generate a signature, which is then returned
const signatureResponse = ReactNativeBiometrics.createSignature({
  promptMessage: 'Face or fingerprint ID for Alto Pharmacy',
  payload: BIOMETRIC_SIGNATURE_PAYLOAD,
});

Send the signature to the server to validate against the public key. If validation succeeds, the user has successfully authenticated with biometrics and can proceed into the app.

// Call your server API to validate the signature against the public key that you've stored in the database
const validationSuccess = await post(
  `/validate_biometric_signature`,
  {
    signature: signatureResponse.signature,
    payload: BIOMETRIC_SIGNATURE_PAYLOAD,
		device_id: 'xyz',
  },
);

if (validationSuccess) {
  // Login Success
} else {
  // Login failure
}

import ReactNativeBiometrics from 'react-native-biometrics';

const setUpBiometricLogin = async () => {
  // Check if biometrics are supported and configured on this device
  const { available } = await ReactNativeBiometrics.isSensorAvailable();

  if (available) {
    // Prompt user to scan biometrics
    const { success } = await ReactNativeBiometrics.simplePrompt({ promptMessage: 'Confirm ID' });
      
    if (success) {
      // If scan is successful, generate a keypair, then save the public key to the server
      const { publicKey } = await ReactNativeBiometrics.createKeys('Confirm biometrics');

      post('/save_biometric_key', { key: publicKey, device_id: 'xyz' })
    }
  }
}

const loginWithBiometrics = async () => {
  // Scan user's biometrics. On scan success, generate a signature
  const signatureResponse = await ReactNativeBiometrics.createSignature({
    promptMessage: 'Face or fingerprint ID for Alto Pharmacy',
    payload: BIOMETRIC_SIGNATURE_PAYLOAD,
  });

  // Validate the signature against the public key saved on the server
  const validationSuccess = await post(
    `/validate_biometric_signature`, 
    {
      signature: signatureResponse.signature,
      payload: BIOMETRIC_SIGNATURE_PAYLOAD,
      device_id: 'xyz',
    },
  );

  if (validationSuccess) {
    // Login Success
  } else {
    // Login failure
  }
}

1. build a way to store a public key associated with a device

2. write a method to validate a signature against a public key

3. expose endpoints to save a public key, and validate a signature

Once biometric authentication is built, there are additional decisions to make. The right decisions for your app will depend on your goals; the approach we took here at Alto may not align with what is best for your app.

How should biometric sessions interact with our existing email and password sessions?

We opted to treat email and password sessions as longer-lived primary sessions, with biometrics as a shorter-lived secondary session on top of that primary session. This means that a user must first login with email and password in order to use biometrics on subsequent app opens. If the user logs out for any reason, they will need to log in again with email and password before they can use biometrics again.

How often should we prompt the user for biometrics vs. email and password?

We opted to prompt the user for biometrics far more frequently than email and password, but made this configurable in case we want to adjust.

We use tokens and cookies for session management.

There are plenty of edge cases to consider as you're developing biometric capabilities for your app, including: what should happen when the biometric scan fails, or when the signature validation fails? What should happen if a user disables biometric permissions from their device? What should happen when two users share a device? What should happen if 'risky' activity is flagged for this account? How can we disable biometric login if needed?

Face and fingerprint ID login has clear benefits for both the end-user and the application itself, but it comes with a host of implementation decisions. If you're considering building biometric login for your app, I hope this article gives you clarity on what biometrics is, the different ways you can integrate it into your app, and the tradeoffs and edge cases to consider.

At Alto, the Patients Engineering team worked closely with our Security Engineering and Product teams to align on our goals and build the best solution for our needs. Our Security team offered deep expertise on the authentication strategies to adopt and avoid, and our Product team kept us tethered to building the best experience for our users.

Working as a team is one of the best parts about developing at Alto. If you want to meet the awesome team I'm talking about, come join us - we're hiring!

In honor of National ERG Day, which falls on November 17 every year, we’re highlighting the important work of Alto’s six ERGs. 

Celebrating National ERG Day at Alto

The history of employee resource groups (ERGs) in the U.S. dates back to the 1960s, when a group of Black employees at Xerox self-organized to discuss their experiences of workplace discrimination and advocate for more inclusive policies. At the time, these networks of employees united by a shared identity or experience were known as affinity groups.

Today, ERGs can be found at companies of all sizes and industries where they play an important role in shaping an inclusive culture and fostering a sense of belonging in the workplace. In honor of National ERG Day, which falls on November 17 every year, we’re highlighting the important work of Alto’s six ERGs. 

At Alto, we believe that every perspective matters, and that diversity fosters creativity and leads to innovation. Our six ERGs are part of our broader commitment to diversity, equity, and inclusion (DEI), both in creating our company culture and delivering an exceptional pharmacy experience.

"At Alto, we’re committed to building and sustaining an inclusive workplace that both supports our employees and helps us deliver on our mission to improve the quality of life for everyone who needs medicine,” shared Ty Bledsoe, Head of Diversity, Equity & Inclusion. “Our ERGs help foster authentic relationships, offer safe spaces for education and conversation, and celebrate the incredible diversity of our Altoids and our communities."

By building community, providing support, and contributing to an individual’s personal and professional well-being, these groups help ensure that every Altoid feels a sense of belonging each day at work and that we appreciate the diversity of the customers we serve.

Here are just a few ways that each Alto ERG contributes to a more inclusive culture and pharmacy experience.

Umoja’s mission is to inform, educate, and empower Black Altoids and allies. The group has deepened Altoids’ understanding of the Black experience by sharing educational resources in support of Black History Month, Juneteenth, and Pride.

They also help our team explore the intersection of identity and healthcare as it relates to our services. After Dr. Reverend Stacey Edwards, founder of Fertility for Colored Girls, spoke at Alto about the fertility journeys of Black families this spring, Umoja continued the conversation by inviting Dr. Temeka Zore, OB GYN and reproductive endocrinologist at Spring Fertility, and Esther Ebeuhi, a licensed doula and birth equity analyst, to speak on Black motherhood.

Alto Auténtico aims to build community among Latinx Altoids and ensure that they have a voice at Alto. In addition to facilitating company-wide learning about the Latinx experience and the diversity within Latinx culture, Alto Auténtico’s mentorship program connects junior and senior Latinx team members for coaching sessions and professional development. The group is also working with Alto’s operations, product, and marketing teams to establish a bilingual team to better support Spanish-speaking individuals using our pharmacy services across our communities.

Proud unites LGBTQ+ Altoids and allies in creating an environment where all Altoids can be their most authentic selves. The group has led Alto in celebrating important LGBTQ+ awareness days with events such as drag queen bingo nights for Pride and LGBTQ+ history month. Two Proud members who identify as bisexual gave a talk for Bi Visibility Day on September 23 and also shared their experiences of coming out in in observance of National Coming Out Day on October 11.

Proud also invites experts to speak at Alto about a range of LGBTQ+ issues. They recently hosted a session with Chris Tompkins, author of Raising LGBTQ Allies: A Parent’s Guide to Changing the Message from the Playground, and a fireside chat with Dr. Lisa Capaldini, who has focused on HIV since the beginning of the epidemic.

Women of Alto + Allies (WOAA) helps create an inclusive community for women at Alto with mentorship and networking opportunities that advance their leadership potential. Their newly launched initiative, WOAA Project Spotlight, celebrates female-identifying team members who have helped us deliver on our mission while living our values, and a quarterly webinar series shares how various self-identifying Altoid women launched their careers.

Working Parents + Allies facilitates discussion and collaboration in celebration of our working parents. The ERG has led Alto in supporting working parents with a variety of initiatives, including a community event with the Kids & Art Foundation’s Purvi Shah in honor of Bereaved Parents Month this July; an “Ask a Parent Anything” Slack advice hotline for parents, caretakers, and allies; and free access to Outschool’s live online classes for kids ages 3-18.

And with their second annual Holiday Giveback Program, which donates gifts to kids and families in need through Marine Toys for Tots and the Boys & Girls Club of America, Working Parents + Allies is an example of how our ERGs look for opportunities to give back and show support beyond the immediate Alto community.

During Asian American Pacific Islander month, the Asians ERG shared resources for individuals like Modern Health's Healing Asian Communities Circles and highlighted community groups for volunteerism and donations.

To learn more about any of our employee resource groups, contact the emails below.

Women of Alto + Allies: womensERG@alto.com

Working Parents & Allies: parents@alto.com

Visit alto.com/careers to learn more about our open roles and join us in delivering industry-leading pharmacy care.

When you’re happy, we’re happy. That’s why we put together a quick guide with five tips for a great delivery experience, based on what we’ve learned from making more than a million deliveries to Alto customers just like you.

How to Have an Easy Alto Pharmacy Delivery Experience

When you’re happy, we’re happy. That’s why we put together a quick guide with four tips for a great delivery experience, based on what we’ve learned from making more than a million deliveries to Alto customers just like you.

Share any information needed to access your house or apartment  — for example, your intercom, gate code or apartment number/letter — by verifying your delivery address details and completing the “Delivery Instructions'' section in the Alto app. Head to Account > Delivery Addresses > Edit Address> Delivery Instructions to provide all of the specific info our delivery team needs to find your location. (If you don’t want us to ring the doorbell, this is the place to note that, too!)

2. Review your medication’s signature requirements

For controlled substances and medications of more than $500, either you or an authorized signer will need to be present to sign for your delivery. Many Alto customers with limited mobility choose to designate a caregiver as an authorized signer. Head to Account > Delivery Addresses > Edit Address> Delivery Instructions in the Alto app to add an authorized signer .

When required, you may sign electronically on your phone via a link you’ll receive by text, but your driver will need to physically see you during the delivery handoff. If an authorized signer is receiving medication on your behalf, they will be asked to sign for the medication and share their full name with our driver, who will note it in our delivery tracking system.

3. Designate a safe delivery space (and leave the front lights on!)

If your medication does not require a signature, you may schedule your delivery for a time when you are not at home by designating a safe space in the Alto app. Head to Account > Delivery Addresses > Edit Address >Delivery Instructions to provide all the specific info for your safe space. As a reminder, due to federal law, mailboxes are no longer accepted as safe spaces. Pro tip: you may also designate a separate safe space in case of rain or snow! 

We love pets, but please keep your four-legged friends secured when your delivery arrives, both for our drivers’ comfort and your animal’s safety.

At Alto, we’re more than just a pharmacy — we’re a partner in your health, and we go above and beyond to get you the medication you need at the best price possible.

Free, same-day delivery is only the beginning. Our pharmacists are available until 9 pm PST on weeknights and 6 pm PST on weekends to answer any questions you have about your medication. We also offer support with insurance and finding the best price possible on your prescriptions.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881 to learn more or transfer your prescriptions to Alto.

We explain how to manage asthma at night through a combination of asthma medications, healthy lifestyle choices, and good sleep hygiene.

How to Manage Asthma at Night

Have you noticed that your asthma symptoms like wheezing, shortness of breath, and tightening of the chest intensify in the nighttime? You’re not alone: nocturnal asthma symptoms are common, especially if you are living with more severe asthma. A Journal of Asthma study involving around 14,000 individuals with asthma found that 60% of those with chronic asthma experienced nocturnal asthma symptoms.

Below, we explain how to manage asthma at night through a combination of asthma medications, healthy lifestyle choices, and good sleep hygiene.

Nocturnal asthma occurs when your symptoms are noticeably worse at night. (If you experience intense symptoms at any time of day, including nighttime, you may need to reevaluate your overall asthma treatment plan with your doctor.)

If you have nocturnal asthma, you may experience the following symptoms while you sleep, and your sleep may be interrupted as a result.

Numerous factors can contribute to nocturnal asthma, including environmental triggers and your personal health history.

The presence of allergens like dust mites and mold can trigger asthma symptoms, especially if you have allergy-induced asthma. Dust mites are small pests that generate allergens. They often live in your pillows, blankets, and mattress, so exposure to them at night is common. In some cases, nocturnal asthma may also be a delayed reaction to exposure to an allergen during the day.

Inhaling cold air from an air conditioner or outside source may contribute to more intense asthma symptoms at night. In addition, sleeping in a reclining position causes your chest and lungs to experience additional pressure, which can also contribute to asthma symptoms. Elevating your shoulders and neck with additional pillows or lying on your left side with or without a pillow between your legs may help you sleep more comfortably.

Your circadian rhythm — the 24-hour natural process that regulates your sleep cycles — affects your nighttime levels of hormones like epinephrine, which relaxes and widens your airways, and histamine, which restricts your airways. Nightly fluctuations in these hormones may contribute to inflammation in your airways, prompting nocturnal asthma symptoms. You are most likely to experience nocturnal asthma symptoms when your epinephrine levels are at their lowest and your histamine levels are at their highest.

The following health conditions have also been linked to nighttime asthma:

Sinusitis, a condition in which there is increased drainage from your sinuses

Mental health disorders and chronic stress

If you have asthma and wake up several nights a week even after following your individual asthma treatment plan, consult with your doctor about additional treatment options. They can evaluate your symptoms, identify potential causes, and suggest modifications to your treatment plan if needed.

Common daily asthma medications can also help you manage worsening symptoms at night. Inhaled corticosteroids like Flovent® HFA and Qvar Redihaler®, which reduce inflammation and swelling in the airways, making them less likely to react to asthma triggers, are frequently prescribed for people who experience nocturnal asthma symptoms.

Quick-acting bronchodilators like albuterol (branded options include ProAir® HFA, Proventil® HFA, Ventolin® HFA) or levalbuterol (Xopenex HFA®) may also be used to treat acute asthma symptoms at night. These inhalers relax the muscles around your airways to make it easier to breathe and are taken on an as-needed basis for immediate relief of symptoms . Common side effects of bronchodilators include nervousness or shakiness, headache, throat or nasal irritation, and muscle aches.

If you have any concerns about potential side effects of asthma medications, your doctor can explain more about the potential benefits and risks of taking corticosteroids or bronchodilators.

If allergens like dust mites are contributing to your nocturnal asthma symptoms, regularly washing your sheets, blankets, and mattress protector may help you avoid triggers. Wash bedding in hot water if possible, since this will help kill dust mites. In addition, maintain a comfortable temperature — 65-70 degrees Fahrenheit is a good range for many individuals with asthma — by making sure your room is well-insulated and shutting windows to keep cold air out. Using a humidifier to add moisture to the air inside your room can also help.

Better sleep hygiene isn’t a substitute for asthma medication, but getting a good quality of sleep at night can minimize the negative effects of any sleep disturbances you experience from nighttime asthma.

Woman sleeping; asthma inhaler on bedside

Blog

Developing Robust Authentication Using Rails, Omniauth, and Okta

Fertility Preservation Options After a Cancer Diagnosis

How to Stay Healthy While Working From Home

What To Know About Insulin Pens

Considerations and Approaches for Implementing Biometric Login: Part 2

Celebrating National ERG Day at Alto

How to Have an Easy Alto Pharmacy Delivery Experience

How to Manage Asthma at Night

Introducing Alto Connect

How Alto Reduced Time to Resolution for Production Incidents

Meet Ramiah Martin, VP, Operations & Supply Chain

How to Manage and Prevent a COPD Flare-Up

Switch to a better pharmacy.