Privacy Policy
Ironvale RX (Ironvale Inc)
This Privacy Policy describes the data protection practices of Ironvale Inc, doing business as Ironvale RX (“Ironvale,” “we,” “our,” or “us”), when you visit any Ironvale website that links to this Privacy Policy (including https://ironvalerx.com), use any affiliated mobile applications, or otherwise provide data to Ironvale (collectively, the “Services”). This Privacy Policy is incorporated into our Terms of Use.
Important — your medical records are governed separately. Ironvale is a technology and administrative platform; clinical care is provided by an independent medical group — currently Arora Health & Aesthetics, together with any additional, affiliated, or successor professional entity engaged to provide clinical services (the “medical group”). Your medical records and other protected health information (“PHI”) are governed by HIPAA and by the medical group’s Notice of Privacy Practices, not by this Privacy Policy. Ironvale and Bask Health Inc (the telehealth technology provider) handle PHI only as business associates of the medical group under Business Associate Agreements. This Privacy Policy governs information we collect outside that clinical relationship — for example, when you browse the Websites, contact support, or make purchases. Architecture note: the Ironvale RX landing pages collect only limited contact and navigation information; account registration, health intake, consents, payment card, and other financial information are collected and processed on the secure Bask platform, and medical records are maintained by the medical group.
Information you provide directly, depending on how you use the Services:
Name, address, telephone number, date of birth, and email address; log-in credentials; demographic information such as gender and age.
Billing and transaction information, such as shipping address and payment card details, collected by our payment processors on our behalf, and information about your purchases.
Health-related information you choose to provide through the Services — for example, the conditions or treatments you express interest in, quiz or intake responses, and communications with support. Where this information is collected in connection with your care, it is handled as PHI as described in Section 1; where it is collected outside the clinical relationship, it is “consumer health data” handled as described in Section 4.
Customer service interactions, survey and research participation, and content you submit or post.
Information collected automatically: when you use the Services, we and our service providers collect information such as IP address, browser type and language, operating system, device identifiers, referring and exit pages, pages viewed and time spent, clicks, search terms, error logs, general location derived from IP address (city/state/postal code), and, only with your permission, precise GPS location. We collect this information using web server logs, cookies, SDKs, tracking pixels, and similar technologies. You can set your browser to notify you when a cookie is set or to block cookies, though some features may not function. We also receive information from social media platforms when you interact with us there, and from third parties we work with, such as analytics providers and, in connection with your care, the medical group and pharmacies.
We use information to: provide, manage, and improve the Services and facilitate the provision of healthcare services to you by the medical group; verify your identity, administer your account, process payments, and fulfill orders; communicate with you about the Services, including on behalf of your healthcare providers; provide technical support and customer service; send marketing communications, subject to your choices; conduct internal research and analytics (published only in de-identified, aggregate form); measure the effectiveness of content and advertising, subject to the limits in Section 4; keep the Services safe and secure and prevent fraud; comply with law; and establish, exercise, or defend legal rights. We may combine information collected through the Services with information from other sources, and we may de-identify or aggregate information — which we may then use and share for any lawful purpose, and which we will not attempt to re-identify.
We treat information that identifies your health status or health-seeking behavior — including the fact that you have visited a treatment page, started an intake, or expressed interest in a condition or medication — as sensitive “consumer health data.” Our commitments:
No advertising pixels on intake or assessment pages. We do not permit third-party advertising trackers to run on pages where you enter health information.
We do not disclose consumer health data to advertising platforms, data brokers, or other third parties for their own marketing purposes, and we do not sell consumer health data.
Advertising measurement is limited to non-health events (for example, that a purchase occurred and its value) transmitted through privacy-protective, server-side means without diagnosis, medication, or condition-level detail.
Where required by law — including the Washington My Health My Data Act, Nevada consumer health data law, and similar state laws — we obtain your consent before collecting or sharing consumer health data beyond what is necessary to provide the Services you request, and you may withdraw consent and exercise the rights described in Section 8.
Analytics. We use third-party analytics services (such as Google Analytics) to understand usage of the Services, subject to the limits above. You can install the Google Analytics Opt-out Browser Add-on and adjust your Google settings to limit ads personalization. Emails we send may contain pixels that tell us whether a message was opened or a link clicked; this measures the effectiveness of our communications.
Advertising. We advertise our Services on third-party platforms. Ads may be contextual or based on non-health information, and we honor the opt-out mechanisms described in Section 8, including the Global Privacy Control. For general information about interest-based advertising and industry opt-outs, you may visit the NAI and DAA consumer opt-out pages. We do not currently respond to legacy “Do Not Track” browser signals, but we DO treat the Global Privacy Control as a valid opt-out of sale/sharing where required by law.
Affiliates and subsidiaries, to deliver and improve the Services.
Healthcare providers and services — the medical group, pharmacies, and laboratories — to schedule and fulfill your care, deliver messages you send, and support treatment, payment, and healthcare operations, consistent with HIPAA and the Notice of Privacy Practices.
Service providers performing services on our behalf — billing, payment processing, shipping and fulfillment, customer support, analytics, security and fraud prevention, data storage, IT, and legal and auditing services — under contracts limiting their use of your information.
Financing providers you choose (for example, CareCredit or a buy-now-pay-later provider), to process financed purchases and any related refunds.
Protection of Ironvale and others — to comply with legal process; enforce our Terms of Use or other agreements; respond to claims; or protect the rights, property, or safety of Ironvale, our users, or the public, including fraud protection.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which user information may be among the transferred assets, subject to applicable legal restrictions (including restrictions on consumer health data).
Public forums — anything you post publicly (such as a review) is not confidential and may be displayed with the name you provide.
With your consent or at your direction.
We do not sell information that directly identifies you, such as your name, email address, phone number, or postal address, and we do not share consumer health data for third-party advertising.
You may opt out of marketing emails by using the unsubscribe link in any commercial message, opt out of marketing texts by replying STOP, and otherwise instruct us not to use your contact information for promotional purposes by emailing privacy@ironvalerx.com. Regardless of your marketing choices, we may still send operational communications, such as transactional, security, and legal notices.
We use technical and organizational measures designed to protect your information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No method of transmission or storage is absolutely secure, and any transmission is at your own risk. You are responsible for keeping your password confidential. We retain information no longer than necessary for the purposes for which it is processed, consistent with our retention schedules and legal obligations, including medical-record retention laws applicable to the medical group. The Services are intended for individuals 18 and over; we do not knowingly collect personal information from anyone under 18, and if we learn we have done so we will delete it.
Depending on where you live, you may have some or all of the following rights under state privacy laws (including the California Consumer Privacy Act as amended by the CPRA; the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana comprehensive privacy laws; the Washington My Health My Data Act; and Nevada law):
Right to know/access — to confirm whether we process your personal information and to access a copy of it, including the categories collected, sources, purposes, and categories of third parties to which it is disclosed.
Right to correct inaccurate personal information.
Right to delete personal information, subject to legal exceptions (for example, information we must retain to provide the Services, prevent fraud, or comply with law; medical records are governed by the medical group’s retention obligations).
Right to data portability.
Right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising and of certain profiling. You may exercise this via the “Do Not Sell or Share My Personal Information” link on the Websites, by emailing privacy@ironvalerx.com, or by using the Global Privacy Control, which we honor as a valid opt-out signal.
Right to limit use of sensitive personal information to purposes permitted by law; we do not use sensitive personal information to infer characteristics for advertising.
Consumer health data rights (Washington, Nevada, and similar laws) — to access and delete consumer health data, to withdraw consent, and to receive a list of third parties with which such data has been shared.
Right to non-discrimination for exercising your rights, and, in states that provide it, the right to appeal a denial of your request by emailing privacy@ironvalerx.com with the subject line “Privacy Appeal.”
To exercise any of these rights, email privacy@ironvalerx.com with your full name, email address, and state of residence, and the right you wish to exercise. We will verify your identity before responding and will respond within the time required by your state’s law. You may designate an authorized agent to act on your behalf where your state permits. California residents: the categories of personal information we collect, the sources, purposes, and categories of recipients are described in Sections 2, 3, and 5 of this Policy; we do not knowingly sell or share the personal information of consumers under 16; and under the “Shine the Light” law, we do not share personal information with third parties for their own direct marketing purposes.
This Privacy Policy does not address, and we are not responsible for, the practices of third parties, including the medical group and other healthcare providers (whose practices are described in their own notices), your device manufacturer, financing providers, or any third-party website or service to which the Services may link. We encourage you to read the privacy policies of any third-party service you use.
We may revise this Privacy Policy from time to time to reflect changes in law, our practices, or the Services. The date of the latest revision appears at the top, and material changes will be notified as required by law; your continued use after notice constitutes acknowledgment of the changes. Questions or requests: Ironvale Inc, 12-45 River Rd #117, Fair Lawn, NJ 07410; privacy@ironvalerx.com.
© 2026 Ironvale Inc. All rights reserved.