Privacy Policy

Version 2.8 · Effective 2026-09-24

This revision adds to section 5.1 the AI scribe a nurse may use during your intake phone call, and the Microsoft service (Azure AI Speech, in Canada) that turns the call into text. The nurse starts it only after recording that she asked you and you agreed, and we make no recording of the call. This revision takes effect today, without the 30 days’ email notice described in section 13.

This revision says that your Personal Health Number, when it is printed on a referral your doctor faxed to your clinic, is now read from the pages (section 5.1), and that once a member of the clinic’s staff has checked it against the fax it is added to your chart when you join, if your first name, last name and date of birth match the referral (section 2). This revision takes effect today, without the 30 days’ email notice described in section 13.

This revision adds your Personal Health Number (PHN) to what we collect (section 2). Clinic staff record it on your chart to match your records and fill in lab forms. You never enter it yourself, and it is not shown to you in the app or sent to you by email or text. It also adds to section 5.1 how a faxed referral is read, which this page had not described. This revision takes effect today, without the 30 days’ email notice described in section 13. The notes below are from earlier revisions and still apply.

This revision rewrites sections 2, 6 and 9 for more than one clinic. Before today this page named one doctor and said your account was linked to that doctor by default; it now describes the clinic your account is connected to, says what that clinic can see (the same things the app tells you when you connect), says what happens if you move to another participating clinic, and adds a new section on support access by our own staff — a reasoned session of at most 4 hours that your clinic can see on its own access log. The notes below are from earlier revisions and still apply.

This revision records a change to how your referral letter is prepared. Before today the app asked you to tick a box agreeing that an AI could draft it. That box has been removed. The letter is prepared as part of the referral your doctor sent you here for, from your clinical details with your name, date of birth and contact information removed, and a nurse calls you to go through your answers as part of that assessment. If you would rather your letter were written by hand, tell the nurse on that call and it will be. The box was removed because it did not work as a choice: it was presented unticked, so leaving it alone was being recorded as a refusal by patients who had simply not answered it. “Scan my results” is unchanged — it is still optional, still yours to start, and still asks your permission at the moment you use it.

This revision corrects section 7, which described the photo of a lab requisition you save in the app as being kept in one place when the app has kept it in two since June 2026. It is stored on the device you used and as a copy on our Canadian servers, and that copy is what the tick box you agree to before uploading is asking you to allow. The old wording described a device-first default and an optional setting to have us hold a copy; neither has existed since that date, and this page should have been corrected then. It was wrong in the direction that made us look better. What it got right and this revision keeps: you can withdraw your consent at any time and we delete our copy — section 7 now says where the button is. Nothing about how the app handles your photo has changed; what changed is that this page now says what it does. If this is not what you expected, you can delete any requisition you have saved, at any time, from the app — which removes both copies.

iViron (the “app”) is operated by iViron Tracker App Ltd. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have under Canadian privacy law — the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA).

1. Who is responsible for your information

iViron Tracker App Ltd. is the organization accountable for the personal information collected through this app (PIPEDA Principle 1, PIPA s. 4).

Privacy Officer: Matthew Conway, Founder
Email: welcome@iviron.ca
Phone: 604-987-3397
Mailing address: 200–101 West 16th Street, North Vancouver, BC V7M 1T3

2. What we collect

• Email address (used to sign you in)
• First name (used to personalize the app)
• Your last name and phone number, where you or your clinic give them — so the clinic can reach you about an appointment, and for text reminders if you turn them on.
• The clinic your account is connected to. If you signed up through a clinic’s QR code or invitation, that is the clinic. If you signed up on your own, your account is connected to no clinic until you connect to one — and before that connection is made we show you exactly what the clinic will be able to see and ask you to agree (section 6). Your account is connected to one clinic at a time.
• Iron-deficiency related health information you choose to enter: symptoms, fatigue ratings, infusion records, bloodwork values, and treatment dates
• The same health information when your clinic records it for you. This happens only where your own doctor has already referred you into the program: a nurse then completes your intake with you over the phone, and the answers you give on that call — symptoms, medical history, and any bloodwork you read out — are saved to your iViron record, in the same form as if you had typed them yourself. Your clinic does not do this for anyone who has not been referred.
• Optional health-profile fields used by the predictive engine: date of birth, biological sex, pregnancy status, menopausal status, and current medications relevant to iron metabolism (for example aspirin or blood thinners)
• Your date of birth on an appointment your clinic books for you, used only to check it is you if you ask to cancel that appointment from a link we email you.
• Your Personal Health Number (PHN), when your clinic records it. Clinic staff type it onto your chart from your referral or your card. Where your clinic has referrals read (section 5.1), they can instead check it as read from the referral your doctor faxed, and a number they have checked there is added to your chart when you join, if your first name, last name and date of birth match the referral. They use it to match your records and fill in lab forms. You never enter it yourself and it is not shown to you in the app. It can be seen by staff at the clinic your account is connected to, and by our own staff during a recorded support session (section 6). The chart shows only its last three digits until a staff member asks for the whole number, and each time they do is recorded. If you have no BC PHN (for example, you are from out of province), the clinic can record that instead. It is not included in the “Export your data” download; ask our Privacy Officer if you want a copy.
• Account events such as sign-in time and last-seen timestamp
• Bloodwork requisition images you save through the app. Each one is stored bothon the device you used and as a copy on our secure Canadian servers, so you can open it on your other devices and we can remind you before it expires. We ask you to agree to this before the app will accept the photo. The copy on our servers is deleted automatically when the requisition expires, when you delete the requisition in the app, when you withdraw your consent to our holding it, or when you delete your account (see section 7).
• Photos of lab results you upload to the optional “Scan my results” feature. With your consent, the photo is sent to our AI provider to read the values off it; we keep the values you confirm, not the photo (see section 5.1).
• If you begin signing up but don’t finish, the information you entered so far is saved on our Canadian servers for up to 14 days so you can resume, then deleted.
• If you subscribe to a paid plan, basic billing details. Your card number is handled directly by our payment processor (Stripe) — we never see or store it; we keep only a customer reference and your subscription status.
• If you install our iOS app: a push notification token (used to deliver reminders), and your preference for biometric unlock (Face ID / Touch ID).

We do not use third-party analytics, advertising trackers, or social-media pixels. The only cookies we set are essential cookies needed to keep you signed in.

3. Why we collect it (purposes & consent)

We collect this information to provide the service you signed up for: track your iron levels over time, deliver reminders you opt into, run the predictive engine that flags possible re-infusion timing, and communicate with you about your account (PIPEDA Principles 2 & 3, PIPA s. 6–8).

At signup we ask for your express consent to the Terms of Service, this Privacy Policy, and to receive service-related email. You can withdraw consent at any time (see section 10).

If your clinic set up your account for you. Where a nurse takes your intake over the phone, they can create your iViron account during that call so your answers have somewhere to go. We do not record you as having agreed to these terms at that point, because you have not read them. The first time you sign in we ask you directly — your name, this Privacy Policy, the Terms of Service, and separately whether we may email or text you — and your iron tracker does not open until you have. Some pages are reachable before you accept: your settings, including deleting your account, and the intake and booking pages. We do not put your tracker or your history behind them. Your referral from your doctor is what brings you into the program in the first place, and is your consent to care — a nurse only takes an intake for someone who has been referred. It is not, on its own, agreement to our terms, and we do not treat it as one.

We collect only the information we reasonably need for these purposes, and we do not collect personal information indiscriminately. Information beyond the basics needed to run your account — such as the optional health-profile details listed in section 2 — is yours to provide or leave blank.

Preventing duplicate accounts: To help keep your health information in one place, we may check whether the name and date of birth you enter already match an existing account. We use this only to suggest signing in to your existing account. It is never shared, and it never reveals any health information.

4. Automated decision-making

We run a predictive engine on your symptom and infusion history to estimate when you may benefit from a clinical check-in or another infusion. This engine produces “risk category” suggestions (for example: book an appointment, request a callback, or none). These are suggestions, not diagnoses or treatment decisions.

Final clinical decisions are always made by a human — you and your clinician. If you want to know how a specific suggestion was produced, or you want a clinician to review it, contact our Privacy Officer at the address above.

5. Where your information lives

Your record is kept in Canada, and the part of the app that reads it runs in Canada too. Some other pieces are outside the country, and this section says which.

The database holding your health record and your account is in Canada (Supabase, ca-central-1 region), and that is where your record itself remains.

The software that reads and writes that record — every screen you use and every request you make, including anything with your health information in it — runs in Canada, on Vercel in Montréal. So the work of running the app is done here: your information is worked on in Montréal, not simply passed through on its way somewhere else.

Two exceptions, stated plainly. First, a small piece of code runs ahead of every request on servers around the world — whichever is nearest, which is often in the United States even when you are at home in Canada. It checks whether you are signed in, notes that your account was used today, and for some pages reads whether you are a patient or clinic staff. It does not read your health record. Second, some of the companies listed in 5.1 below are based in the United States, and information sent to them goes there.

Your health information also reaches the United States by email. The emails we send you carry your first name, and a progress summary may say how your ferritin sits against your group’s typical range — in it, below it or above it — never the value itself; the service that delivers our email is US-based.

All traffic is encrypted in transit (TLS 1.2 or higher) and stored data is encrypted at rest.

While your information is in the United States, it is subject to the laws of that country, which are not the same as Canada’s (PIPA s. 30 transborder disclosure).

You can ask us for more detail about this at any time. The app itself now runs in Canada, so the information that reaches the United States is what goes to the companies in 5.1 — email in particular — and the sign-in check described above. Those are part of running the app, so declining them would mean closing your account rather than turning something off. We would rather say that plainly than imply a choice that isn’t there. (“Scan my results” in 5.1 is different: that one you can simply decline, and nothing is sent.)

By creating an account and using the app, you agree to your information being stored in Canada and processed in the United States as described in this section — by the providers in 5.1 below that are part of running the app normally.

Sending information to the companies in 5.1 is necessary; without them there is no app. Running the app itself in the United States is no longer one of those necessities — it runs in Canada.

“Scan my results” is not covered by that agreement. It asks for your consent separately, at the point you choose to use it — and if you never use it, nothing is sent.

Consult-letter drafting is part of the referral itself. Your doctor referred you to us to be assessed for an iron infusion, and the letter back to them is that assessment. It is prepared from the clinical details you gave us with your name, date of birth and contact information removed, and a nurse goes through your answers with you by telephone as part of that assessment. If you would rather your letter were written by hand, tell the nurse on that call and it will be. You may withdraw your agreement at any time by closing your account.

5.1 Subprocessors we use

We will update this list before adding any new subprocessor that handles personal information.

6. Who else can see your information

Aside from the subprocessors above, we share your information only:

• With you, through the app
• With your clinic — the clinic your account is connected to — and its care team, the doctors and nurses who hold a seat there. Your clinic can see your blood tests and infusion history, including any from before you joined them, and any intake form you fill in for them. They will not see forms or letters written for another clinic. Alerts about a significant change in your data are flagged to that clinic for clinical review (PIPEDA Principle 5; PIPA s. 17). Your clinicians are bound by their professional regulators’ confidentiality rules. If you connect to a different participating clinic later, the new clinic sees the same set once you agree, and the previous clinic’s access to your blood tests and infusion history in iViron ends; it can still open the intake forms and letters that were written for it, and it keeps its own clinical record of your care.
• When required by law (court order, subpoena) — we will tell you unless legally prohibited
• If we ever undergo a change of control, with your consent or under terms substantially similar to this policy

We do not sell your information. We do not share it for marketing purposes with anyone outside iViron Tracker App Ltd.

Your clinic. When clinical information is shared with your clinic for review (above), your clinic is a separate organization responsible for that information under its own professional and privacy obligations, and it keeps its own clinical record of your care. For anything held in iViron — a copy of your data, a correction, or deleting your account — contact our Privacy Officer. For your clinical chart, your test results as your clinic holds them, or anything about your treatment, contact your clinic directly.

Support access by iViron staff. Our own staff do not read your clinic’s record as a matter of course: in the care app a member of our staff sees a clinic’s patients only as a member of that clinic’s team. When one of our staff needs to act for a clinic — for example because you or the clinic reported a problem with a record — they start a support session for that clinic: they must give a reason, it lasts at most 4 hours at a time, and during it they see that clinic’s patients as a nurse at that clinic would. The clinic does not have to approve the session first; instead, every session and every read made in it is recorded with the reason, and the clinic can see them on its own access log.

Aggregate, de-identified data. We may create and use statistics that are aggregated and stripped of anything that could identify you (for example, “the average time between infusions across all patients”) to understand and improve the service. This information cannot be traced back to you. We do not use your identifiable health information for this, and we do not use your data to train AI models.

7. Bloodwork requisition images (special case)

When you photograph a lab requisition in the app, the image is saved in two places: in your browser’s private storage (IndexedDB) on the device you used, and as a copy on our secure Canadian servers (Supabase, ca-central-1). The copy on our servers is what lets you open the requisition on your other devices, and what lets us remind you before it expires.

The app asks you to agree before it will accept the photo, and it will not take the file until you do — that tick box is your consent to our keeping the copy. There is no setting that saves the photo on your device without also saving our copy. If you would rather we did not hold one, do not upload the photo; keep the paper.

The copy on our servers:

• is kept in a private storage area reachable only by you, through the app — never a public or shareable link;
• has its location and camera metadata (EXIF) stripped before it is stored, if it is a JPEG photo — the format phone cameras produce, and the format we convert an iPhone HEIC photo into. A PDF or a PNG is stored exactly as you sent it, including any metadata it carries;
• is recorded in our access log when it is uploaded, and whenever one of your devices downloads it from us. Opening a requisition that is already on your device happens entirely on that device, so there is nothing for us to log;
• is deleted automatically once 12 months have passed since you saved it, when you delete the requisition in the app, and when you delete your account — account deletion after the 7-day grace period described in section 8, not the moment you press the button.

You can remove our copy in two ways. Deleting the requisition in the app removes both copies — ours and the one on the device you are using. Withdrawing your consent removes ours and leaves yours: on the Consent & Preferences page in your settings, under “Holding your lab requisition”, the Withdraw button deletes our copy of every requisition you have saved and keeps the copy on your device. After that the photo is gone from our servers, and we can no longer remind you before it expires or put the requisition on a new device for you — but a device that has already opened it keeps its own copy until you delete the requisition there or clear that browser’s data. The record that you saved a requisition, and when, stays on your account until you delete the requisition itself. You can withdraw as often as you like; saving another photo asks for your consent again.

The copy on your device stays on that device until you delete the requisition or clear your browser data — including after the automatic deletion above has removed ours, which reaches our copy only. Opening the requisition on another device saves a copy on that device too, so the copies on your devices depend on you keeping those devices passcode-locked.

8. How long we keep it (retention)

We keep your information for as long as you have an active account. After you delete your account, your data is held in a 7-day soft-delete grace state, then permanently removed from active databases.

We do not currently delete your health record automatically after a set period of time, and it does not expire if you stop using the app. Deleting your account, as described above, is how you remove it.

iViron holds patient-controlled app data — your own logs and observations — rather than your clinician’s primary clinical chart. Your clinic keeps its own clinical record of your care separately, under the retention rules that apply to medical records in BC, and those are not ours to set or shorten.

Some information is deleted automatically on a shorter schedule: our copy of a requisition image is removed 12 months after you save it, or sooner if you delete the requisition or withdraw your consent to our holding it; and an unfinished signup draft is removed after 14 days.

If iViron Tracker App Ltd. ever ceases operations, we will give you reasonable advance notice by email so you can export your data, and we will then securely delete it — or, where the law requires it to be retained, transfer it under terms substantially similar to this policy.

9. How we protect it (safeguards)

We use the following safeguards (PIPEDA Principle 7, PIPA s. 34):

• Encryption in transit (TLS 1.2 or higher)
• Encryption at rest in our Canadian database
• Per-row access controls so each patient can only see their own data
• Two-factor authentication for staff and administrative sign-in: a code from an authenticator app, in addition to their email or Google/Apple account
• Audit logging of every administrative read of patient information, including the staff member’s IP address and browser details for security investigation. We do not log patient IP addresses. Each clinic can see the log of who read its patients’ information, including any access by iViron staff acting for it
• An incident response plan covering breach detection, internal triage, and notification of the BC Office of the Information & Privacy Commissioner (OIPC) and affected patients without unreasonable delay (PIPA s. 34.1; PIPEDA s. 10.1)

10. Your rights

You have the right to:

• Access — request a copy of your data. Use the “Export your data” button at /settings/data, or email our Privacy Officer (PIPEDA Principle 9, PIPA s. 23).
• Correction — ask us to correct anything inaccurate (PIPA s. 24).
• Withdraw consent — you can unsubscribe from non-essential email using the link at the bottom of every message, or withdraw consent for a specific purpose by contacting our Privacy Officer (PIPEDA Principle 4.3.8, PIPA s. 9).
• Delete your account — use the “Delete account” button at /settings/data. After a 7-day grace window the data is removed permanently.
• Complain to a regulator — if you are not satisfied with how we handled a privacy concern, you can file a complaint with the BC Office of the Information & Privacy Commissioner at oipc.bc.ca, or the Office of the Privacy Commissioner of Canada at priv.gc.ca (PIPA s. 47, PIPEDA s. 11).

11. Email and CASL

We send two kinds of email: service emails (sign-in codes, account notices, clinically-flagged alerts — required for the app to function) and helpful-nudge emails (weekly check-ins, trial-ending reminders). Helpful-nudge emails always include a one-click unsubscribe link as required by Canada’s Anti-Spam Legislation (CASL s. 6).

iViron Tracker App Ltd.’s mailing address (CASL identification requirement): 200–101 West 16th Street, North Vancouver, BC V7M 1T3.

12. Children

iViron is intended for individuals 15 years of age or older. We do not knowingly collect information from anyone under 15. If you are a parent or guardian and believe your child under 15 has signed up, please contact our Privacy Officer and we will delete the account.

If you are between 15 and the age of majority, we recommend that a parent or guardian review this policy and the Terms of Service with you before you sign up, because the app handles health information.

13. Changes to this policy

If we make a material change, we will notify you by email at least 30 days before it takes effect, and update the version and effective date at the top of this page (PIPEDA Principle 8 — openness).

14. Product-usage analytics

To run and improve the app, we record which in-app actions happen — for example that a bloodwork upload or infusion log occurred — tied to a pseudonymized id, not your name. This usage information never includes your name or any health values (such as symptom ratings, bloodwork results, or infusion details); it only records that an action of a given type took place. We keep it for up to 13 months, after which it is deleted automatically. It is handled entirely by us (iViron Tracker App Ltd.) — we do not share it with, or process it through, any third-party analytics provider — and it is stored in Canada, in the same database described in section 5.

15. Contact

Privacy questions, access requests, or to withdraw consent:
welcome@iviron.ca
604-987-3397
200–101 West 16th Street, North Vancouver, BC V7M 1T3