Privacy Policy
◉ THE SHORT VERSION
We collect the account and health-tracking data you choose to enter so the App can function. We don't sell your data, we don't use your health data for advertising, and you can export or delete it at any time. Full details below.
CONTENTS
1. Who We Are
Iron Labs Software Ltd, trading as Protocol Tracker ("we," "us," "our") operates Protocol Tracker. This policy explains what personal data we collect through the App and website, why, and what rights you have over it.
2. What We Collect
| Category | Examples |
|---|---|
| Account data | Email address, password (hashed), account creation date |
| Health & tracking data | Compounds, dosages, and schedules you log; blood work results you enter; notes you write; injection site history |
| Billing data | Subscription status and billing history (payment card details are handled directly by Stripe — we never see or store your full card number) |
| Usage data | Basic technical data (device/browser type, IP address, pages visited) collected automatically for security and reliability |
3. Health & Medication Data — Special Care
- The compound, dosage, schedule, and lab-result data you enter is sensitive personal information, and we treat it accordingly.
- We do not use your health data for advertising, marketing, or sell it to any third party for any purpose.
- We do not share your health data with third parties except where necessary to operate the App (see Section 5) or where required by law.
- Access to your health data within our systems is restricted to what's necessary to provide and maintain the service.
4. How We Use Your Data
- To provide the core functionality of the App — storing your logs and calculating pharmacokinetic projections;
- To process subscription payments and manage your account;
- To send you service-related communications (e.g., password resets, billing notices);
- To maintain security, prevent abuse, and debug technical issues;
- To improve the App, using de-identified or aggregated data where possible.
5. Who We Share Data With
We use the following third-party service providers to operate the App. Each processes data only as needed to perform their function for us:
| Provider | Purpose |
|---|---|
| Supabase | Database hosting, authentication, and storage of your account and tracking data |
| Stripe | Subscription billing and payment processing |
| Netlify | Website and application hosting |
We do not sell your personal data. We may disclose data if required by law, subpoena, or to protect the rights, safety, or property of our users or the public.
6. Storage & Security
- Data is stored with Supabase, using row-level security policies restricting access to your own account's data.
- Passwords are hashed and never stored in plain text.
- We take reasonable technical and organizational measures to protect your data, but no system is 100% secure, and we cannot guarantee absolute security.
7. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within [30 days], except where retention is required for legal, billing, or fraud-prevention purposes.
8. Your Rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you;
- Export your data (available directly in the App at any time);
- Correct inaccurate data;
- Delete your account and associated data;
- Object to or restrict certain processing.
To exercise any of these rights, contact us at support@protocoltracker.io. If you are in the EU/UK, you also have the right to lodge a complaint with your local data protection authority. If you are in New Zealand, you may contact the Office of the Privacy Commissioner.
9. Cookies & Tracking
We use essential cookies/local storage required for login sessions to function. We do not currently use third-party advertising or tracking cookies. If this changes, this policy will be updated and, where required, we will request your consent.
10. Children's Privacy
The App is not directed at, and must not be used by, anyone under 18. We do not knowingly collect data from minors. If we become aware that we have, we will delete it promptly.
11. International Users
We are based in New Zealand, and your data may be stored or processed in other countries where our service providers operate (including the United States, via Supabase/Stripe/Netlify infrastructure). By using the App, you consent to this transfer.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified via the App or email. The "Last updated" date at the top reflects the most recent revision.
13. Contact
Questions about this policy or your data can be sent to support@protocoltracker.io.