Privacy Policy

1. Introduction

iHux LLC (“we,” “us,” or “our”) operates the website at https://ihux.co and publishes mobile applications available on the Apple App Store and Google Play Store (collectively, our “Services”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website or any of our mobile applications.

2. Information We Collect

We may collect the following types of information:

• Contact information you provide through our contact form: name, email address, company name, and message content.
• Account data you provide when creating an account in our apps: name, email address, profile photo, and account preferences.
• Usage data collected automatically: browser type, device model, operating system version, unique device identifiers, IP address, pages visited, time spent on pages, in-app activity, and referring URL.
• Cookies and analytics data collected by third-party services for website and app performance and analytics.
• Health and medication data — When you use apps that offer health-related features, we collect health and medication information you voluntarily provide, which may include: medication names, dosages, and schedules; health-related queries and chat messages submitted to the AI assistant; and prescription information scanned via your device camera. This information is used solely to provide the core features of the app. We do not sell this information to advertisers or data brokers.
• Camera data — Certain apps may request access to your device camera for the following purposes: to allow you to take or update your profile photo; and to scan prescription labels or product packaging so relevant details can be filled in automatically. Camera images used for scanning are processed to extract information and are not stored on our servers. Profile photos are stored only if you choose to save them to your account.

3. How We Use Your Information

• To respond to your inquiries and communicate with you about our services.
• To provide, maintain, and improve the features and functionality of our apps.
• To analyze website and app usage and improve your experience.
• To power AI-assisted features, including transmitting relevant data to third-party AI service providers with your consent, in order to generate responses to your queries.
• To process images captured via your device camera for the purpose of automatically extracting relevant information (e.g., prescription details, product labels).
• To comply with legal obligations and protect our rights.

4. Third-Party Services

We use the following third-party services that may collect or process data:

• OpenPanel — visit counting without cookies, run by us on our own server. See Visit counting without cookies (OpenPanel) below.
• Web3Forms — contact form delivery. A message also carries the campaign source of your visit (the utm values, and the ad click identifier only if you allowed Advertising).
• Cal.com — call booking. A booking receives the campaign source of your visit (the utm values, and the ad click identifier only if you allowed Advertising).
• Twenty CRM — our customer relationship manager, self-hosted on our own servers and not shared with anyone. When you send the contact form or book a call, we keep your name, email address, company (if given), your message or booking answers, the booking time, the language of the site, and the source of your visit (the utm values, the page you landed on, the site that referred you, and the ad click identifier only if you allowed Advertising).
• Payload CMS — content management, self-hosted with this site (no user data collected).
• Google Analytics — website and app analytics. Privacy policy: Google Privacy Policy.
• OpenAI, Inc. — third-party AI service powering AI chat features in select apps. When you use AI chat features, the following data may be transmitted to OpenAI: your chat messages and queries; relevant app data (e.g., medication names and details you have entered); and your account User ID. This data is transmitted solely for the purpose of generating responses to your questions within the app. OpenAI does not use this data to train AI models or share it with advertisers. You can review OpenAI's privacy policy here: OpenAI Privacy Policy.
• Advertising (only if you allow Advertising in our cookie banner) — Google Ads (Google Ireland Ltd / Google LLC), the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) and the Meta Pixel (Meta Platforms Ireland Ltd). These set cookies and send the pages you visit, your ad click identifier (gclid, li_fat_id, fbclid), device and browser data and your IP address to these companies, so we can measure which ads lead to a booked call or a message and show our ads to people who have visited our site. Each company also uses this data under its own privacy policy: Google, LinkedIn, Meta.
• RevenueCat — in-app purchase and subscription management. Privacy policy: RevenueCat Privacy Policy.

Each third-party service operates under its own privacy policy. We encourage you to review their policies.

International Data Processing: Data transmitted to third-party providers such as OpenAI, Google, Vercel, LinkedIn, and Meta may be processed and stored in the United States. We ensure appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses where required.

AI Feature Consent: You will be asked to provide explicit consent within the app before any of your data is sent to third-party AI providers. You may withdraw this consent at any time by going to Settings → Privacy within the app. Withdrawing consent will disable AI-powered features.

5. Cookies

We use strictly necessary storage, plus analytics and advertising cookies only if you allow them in our cookie banner. Analytics (Google Analytics) shows how visitors use the site. Advertising (Google Ads, LinkedIn and Meta) measures our ads and shows them to people who have visited our site. You can change or withdraw your choice at any time through “Cookie settings” in the footer; withdrawing deletes the cookies those tools set on our site.

When you arrive from a link with campaign parameters, we keep the utm values and the page you landed on in your browser's session storage until you close the tab, so a booked call or a message shows where it came from. The ad click identifier (gclid, gbraid, wbraid, li_fat_id or fbclid) is kept and passed on only if you allow Advertising.

Visit counting without cookies (OpenPanel)

We count visits to this website with OpenPanel, a product analytics tool we run ourselves on our own server, at analytics-api.ihux.dev. It sets no cookies and keeps no identifier in your browser.

It records the pages you view, the site language, the page you came from (the referrer) and the campaign values in the link you arrived by (the utm values), links you follow to other websites, a few actions on our pages (opening a question in our FAQ, seeing our price, clicking “Book a call”, booking a call, sending our contact form), your browser, operating system and device type, and an approximate location (country and city). It does not record your name, your email address or anything you type into our forms or your booking.

We do not store your IP address. It is used only in passing, when your visit arrives, to estimate that approximate location and to tell one visit from another with an anonymous identifier that changes every day.

We do this on the basis of our legitimate interest in understanding how the website is used, so that we can improve it. It is on by default and does not depend on your cookie choices.

You can turn it off at any time: open “Cookie settings” in the footer (or “Choose” in our cookie banner) and untick “Visit counting”, then save. Your choice is kept in this browser's local storage. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as turning it off, and we do not count your visits.

6. Data Retention

We retain contact form submissions for as long as necessary to respond to your inquiry and maintain our business records. App account data is retained for as long as your account is active. Health, medication, and AI chat data is not retained beyond the active account period and is deleted within 30 days of account deletion. Analytics data is retained according to the policies of our third-party analytics providers.

Enquiries and bookings: the details kept in our CRM are deleted 24 months after your last contact with us if the enquiry does not lead to working together; for clients, they are kept for as long as the contract and our legal obligations require. You can ask us to delete them at any time by writing to [email protected].

Account Deletion: You may delete your account at any time from within our apps by navigating to Settings → Account → Delete Account. Upon account deletion, all personal data associated with your account — including health and medication information, chat history, and profile data — will be permanently deleted from our systems within 30 days. Please note that certain anonymized or aggregated data that cannot be used to identify you may be retained for analytical purposes.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your personal data.
• Object to or restrict processing of your personal data.
• Request data portability.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected].

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information.

10. GDPR — European Economic Area (EEA) Users

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have certain rights under the General Data Protection Regulation (GDPR). iHux LLC is the data controller for the personal data we process.

Lawful Bases for Processing

We process your personal data on the following legal bases:

• Consent — Where you have given explicit consent, such as opting in to AI-powered features or providing health data within our apps. You may withdraw consent at any time.
• Contract — Where processing is necessary to provide our Services to you, such as maintaining your account and delivering app functionality.
• Legitimate Interest — Where processing is necessary for our legitimate business interests, such as improving our Services, preventing fraud, and ensuring security, provided these interests are not overridden by your rights.
• Legal Obligation — Where processing is necessary to comply with applicable laws and regulations.

Your Rights Under GDPR

In addition to the rights listed in Section 7, you have the right to:

• Lodge a complaint with your local data protection supervisory authority.
• Object to processing based on legitimate interests.
• Request restriction of processing while a complaint is being resolved.
• Not be subject to automated decision-making, including profiling, that produces legal effects concerning you.

International Data Transfers

Your personal data may be transferred to and processed in countries outside the EEA, including the United States, where our third-party service providers (such as OpenAI, Vercel, and Google) operate. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your personal data in accordance with GDPR requirements.

Data Protection Contact

For any GDPR-related inquiries, you can reach us at [email protected]. We will respond to your request within 30 days.

11. California Privacy Notice

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information. The categories of personal information we collect include:

• Identifiers (name, email address, account User ID, device identifiers, IP address).
• Internet or other electronic network activity (browsing history, app usage, interactions with our Services).
• Health and medical information, such as medication names, dosages, schedules, and health queries you submit within our apps.
• Camera-derived data, such as prescription label scans used to auto-fill medication or product information.

We do not sell your personal information to third parties. You have the right to request disclosure of the personal information we collect, request deletion of your personal information, and opt out of any future sale of your personal information. To exercise these rights, contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at: [email protected]

iHux LLC — New Mexico, USA