Privacy Policy

1. What we collect

• Account information: name, email address, password (stored as a hash), and shipping address.
• Health information: the medical intake you submit with an order (health history, current medications, and related answers). This is the most sensitive data we hold, and it is collected only because provider review requires it.
• Order and payment information: what you ordered, order status, and amounts. Card details are collected and processed by our payment processor; card numbers never touch IronMend’s servers.
• Usage data: pages visited and device/browser information, via the analytics tools described in Section 4.
• Communications: emails and messages you send us.

2. How we use it

• To process orders: intake review by independent licensed providers, pharmacy fulfillment, shipping, and payment.
• To run your account and send transactional emails (order status, receipts, password resets).
• To send optional emails such as refill reminders. Every such email has an unsubscribe link, and opting out never affects your care.
• To improve the Site, prevent fraud, and meet legal obligations.

We do not sell your personal information, and we never sell or share your health information for advertising.

3. Who receives your data

We share data only with the parties needed to deliver the service:

• Independent medical providers and partner pharmacies (via our medical network partners): your intake, identity, and order details, so a licensed provider can review and a licensed pharmacy can dispense. These relationships are governed by business associate agreements.
• Infrastructure vendors: our database and authentication provider (Supabase), payment processor (Bankful), transactional email service (Resend; order-status emails intentionally exclude product names), and hosting (Vercel).
• Legal: when required by law, subpoena, or to protect rights and safety.

We never give third parties access to your medical intake for marketing.

4. Cookies, analytics, and advertising tools

We use cookies for sign-in sessions. Analytics (Google Analytics) and advertising pixels (Meta, TikTok) run only on marketing pages: home, marketplace browsing, blog, and informational pages. They are deliberately disabled on ordering, intake, account, and dashboard pages so that advertising platforms never receive information connecting you to a health service. Session-recording tools are disabled on those pages for the same reason.

5. Security and retention

Your data is encrypted in transit and at rest, access is restricted by role (intake data is visible only to you, the reviewing provider, and authorized administrators), and administrative access requires authentication. We retain order and intake records for as long as needed to provide the service and meet legal, pharmacy, and tax record-keeping requirements, then delete or de-identify them. No internet transmission is guaranteed 100% secure; if a breach affects your data we will notify you as required by law.

6. Your rights and choices

You may request access to, correction of, or deletion of your personal information by emailing carloruggiero08@ironmendllc.com. We respond within 30 days (45 for complex requests). Deletion is subject to records we must keep by law (e.g., pharmacy and payment records). Residents of California, Colorado, Virginia, and Connecticut have specific rights under their state privacy laws, including access, deletion, correction, and portability, which we honor through the same contact. Washington and Nevada residents: see the Consumer Health Data Privacy Policy. We do not discriminate against you for exercising any right.

7. Children

IronMend is for adults 18+. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.

8. Changes and contact

Updates will be posted here with a new effective date. Questions: carloruggiero08@ironmendllc.com · IronMend LLC, 2310 N Henderson Ave, Ste B #1102, Dallas, TX 75206.