Privacy Policy for Drug Infusion

Last Updated: December 20, 2025 Version: 2.1

Introduction

Drug Infusion (“we,” “us,” “our,” or “the App”) is an educational iOS application designed for healthcare students and professionals to practice intravenous (IV) medication calculations. We are committed to protecting your privacy and being transparent about our data practices.

This Privacy Policy explains what information we collect, how we use it, the limited circumstances under which we share it, and your rights regarding your data. This policy applies to all users of the Drug Infusion application available through the Apple App Store.

Key Privacy Commitment: Drug Infusion operates on a privacy-first, local-first architecture. We have zero third-party analytics, zero advertising networks, and zero external data transmission beyond Apple’s native services for subscriptions and optional device sync.

1. Information We Collect

1.1 Information Stored Locally on Your Device

All of the following data is stored exclusively on your device using Apple’s secure storage frameworks (SwiftData and UserDefaults). This data is never transmitted to our servers because we do not operate data collection servers.

Practice and Learning Data

Drug Calculations: Drug names (generic medication names only), concentrations, dose rates, bag volumes, and calculation results
Learning Progress: Quiz scores, practice problem completion, dimensional analysis mastery levels, and spaced repetition intervals
Practice Sessions: Problem completion history, error patterns, time spent, and hints used
Custom Scenarios: Practice scenarios you create with drug configurations

Infusion Monitoring Data (Educational Simulation)

Simulated Infusions: Drug name, rate, volume, start time, duration
Room Identifiers: Optional room/bed numbers for workflow organization (NOT patient identifiers)
Rate Adjustments: History of rate changes for educational tracking
Status Information: Infusion status (running, paused, completed)

App Preferences and Settings

Display Settings: Decimal precision, warning preferences, theme
Verification Settings: Timeout duration, transport preferences
Shift Configuration: Day/night shift times
Audit Retention: How long to keep calculation history (30-365 days)

Usage Metrics (Local Only)

Calculation Counts: Number of calculations performed (for free tier limits)
Quiz Question Counts: Number of questions answered (for free tier limits)
Verification Counts: Number of P2P verifications performed (for free tier limits)
Trial Status: Trial start date for 7-day free trial tracking

1.2 Information Synced via Apple iCloud (Optional)

If you are signed into iCloud on your device, the following limited data may sync across your devices:

Subscription Status: Whether you have grandfathered/lifetime premium access
Granted Date: When premium access was granted

Important: This uses Apple’s iCloud Key-Value Store (not CloudKit). This data:

Is encrypted by Apple in transit and at rest
Is accessible only to you via your Apple ID
Can be disabled in iOS Settings
Does NOT include your calculations, progress, or practice data

Your practice data, calculations, quiz progress, and scenarios do NOT sync via iCloud and remain exclusively on your device.

1.3 Information Collected by Apple

When you use certain features, Apple may collect information according to their privacy policies:

App Store Purchases: When you subscribe to Premium, Apple processes the transaction. We receive only a confirmation of your subscription status, not your payment details.
Crash Reports: If you opt into Apple’s crash reporting (iOS Settings > Privacy > Analytics), Apple may collect anonymized crash data.

2. Information We Do NOT Collect

We want to be explicitly clear about data we never collect, store, or transmit:

Personal and Health Information

NO patient names, medical record numbers, or patient identifiers
NO Protected Health Information (PHI) under HIPAA
NO real patient data of any kind
NO personal health information about you or others
NO your name, email, or account credentials (the app has no accounts)

Device and Location Data

NO precise or coarse location data
NO unique device identifiers sent to external servers
NO IP addresses logged or tracked
NO device serial numbers or hardware identifiers

Communication and Content Data

NO contacts or address book access
NO photos, camera roll, or media library access (except temporary QR scanning)
NO microphone or audio recordings
NO browsing history
NO emails, messages, or communications

Third-Party Data

NO social media profiles or connections
NO advertising identifiers (IDFA)
NO cross-app tracking
NO data from other apps on your device

Analytics and Tracking

NO third-party analytics services (Firebase, Mixpanel, Amplitude, etc.)
NO third-party crash reporting (Crashlytics, Sentry, Bugsnag, etc.)
NO behavioral analytics or user tracking
NO A/B testing services
NO marketing or advertising analytics

3. How We Use Your Information

3.1 To Provide App Functionality

Local data on your device is used to:

Perform IV medication calculations
Track your educational progress and mastery
Enable infusion monitoring simulations with Live Activities
Store your custom practice scenarios
Facilitate peer-to-peer verification sessions
Manage subscription entitlements and free tier limits
Customize your app experience based on preferences

3.2 To Improve the App

We use aggregated, non-identifying information to:

Identify and fix bugs through Apple’s crash reporting (if you opt in)
Improve app performance and user experience
Develop new educational features

3.3 What We Do NOT Do

We do NOT:

Sell, rent, or trade your data to any third party
Use your data for advertising or marketing
Share identifiable information with anyone
Use data for purposes other than app functionality
Profile users for commercial purposes
Make automated decisions affecting you based on your data

4. Data Storage and Security

4.1 Local Storage Architecture

All user data is stored using Apple’s secure frameworks:

Data Type	Storage Method	Encryption
Calculations & Progress	SwiftData (SQLite)	iOS Data Protection
App Preferences	UserDefaults	iOS Data Protection
Widget Data	App Group UserDefaults	iOS Data Protection
Subscription Status	iCloud KeyValue Store	Apple End-to-End
Audit Logs	SwiftData	iOS Data Protection

4.2 Security Measures

We implement comprehensive security measures:

On-Device Encryption: All stored data is protected by iOS Data Protection, encrypted when your device is locked
No Remote Servers: We do not operate servers that store your data, eliminating server-side breach risks
Secure P2P Communications: All peer-to-peer verification uses TLS 1.3 encryption (network) and CoreBluetooth encryption (Bluetooth)
Minimal Data Collection: We only store data necessary for app functionality
No Plaintext Credentials: We do not store passwords, API keys, or sensitive credentials
Apple’s Security Infrastructure: Subscription data uses StoreKit 2’s cryptographic verification

4.3 Data Breach Response

In the unlikely event of a security incident affecting user data:

We will notify affected users within 72 hours of discovery
We will provide details of what data was affected
We will describe remediation steps taken
We will report to relevant authorities as required by law

Note: Because we do not collect personal data on servers, the risk of data breaches affecting your information is extremely limited.

5. Third-Party Services

5.1 Apple Services

The App integrates exclusively with Apple’s native services:

Service	Purpose	Data Processed	Our Access
App Store / StoreKit 2	Subscription management	Purchase transactions	Subscription status only (no payment details)
iCloud KeyValue Store	Cross-device premium sync	Subscription status (2 keys)	Read/write subscription status
Apple Push Notifications	Live Activity updates	Activity tokens	Activity display only
Core Bluetooth	P2P verification	Encrypted P2P data	Local only, no cloud
Network.framework	P2P verification	Encrypted local network data	Local only, no cloud

Apple’s privacy practices are governed by Apple’s Privacy Policy.

5.2 No Third-Party Integrations

We explicitly do NOT integrate with:

Advertising networks or ad exchanges
Social media platforms or login providers
Third-party analytics services
Marketing automation platforms
Data brokers or data aggregators
Crash reporting services (beyond Apple’s built-in system)
Customer support platforms that track users
A/B testing or experimentation platforms

5.3 External Links

The App contains links to:

Our Terms of Service (https://druginfusion.com/terms)
This Privacy Policy (https://druginfusion.com/privacy)
Support resources (https://druginfusion.com/support)

These links open in Safari outside the App. We do not track clicks on these links.

6. Peer-to-Peer Verification

The Two-Person Verification feature enables direct device-to-device communication for calculation verification. Here’s how it works and protects your privacy:

6.1 Connection Methods

Method	Technology	Range	Encryption
Bluetooth (Primary)	Bluetooth Low Energy (BLE)	~30 feet	CoreBluetooth encryption
Local Network (Fallback)	Bonjour/mDNS over Wi-Fi	Same network	TLS 1.3
QR Code (Manual)	Camera scan	Visual range	One-time codes

6.2 Data Exchanged

During a verification session, only calculation parameters are transmitted:

Drug name (generic medication name)
Concentration (mass/volume)
Patient weight (if weight-based, educational example only)
Calculation mode (standard, weight-based, bolus, etc.)
Proposed result (flow rate, drip rate)
Verification outcome (match/mismatch)

6.3 What is NOT Transmitted

Patient names or identifiers
Personal health information
Location data
Device identifiers beyond session ID
Historical calculations
Your name or user information

6.4 Privacy Protections

Local Only: All P2P data stays between the two connected devices. NO data is transmitted to the internet or any server.
User Approval Required: Both devices must approve the connection before any data exchange.
Ephemeral Sessions: Verification data is NOT stored after the session completes.
No Logging: P2P session contents are not written to persistent storage.
End-to-End Encryption: All transmissions are encrypted; no intermediary can read the data.

6.5 Required Permissions

To use P2P verification, you must grant:

Bluetooth: For BLE-based verification (primary method)
Local Network: For network-based verification (fallback method)
Camera (optional): Only if using QR code scanning

These permissions are requested only when you initiate P2P verification.

7. Your Rights and Choices

7.1 Access Your Data

All your data is stored locally on your device. You can access it anytime:

Calculations: View in History tab
Progress: View in Learn tab
Scenarios: View in Scenarios tab
Audit Logs: Export via Settings > Data Management

7.2 Export Your Data

You can export your data in portable formats:

Audit Logs: Export as CSV via Settings > Data Management
Calculation History: Available through the audit export feature

7.3 Delete Your Data

You have complete control over data deletion:

Individual Items: Delete specific calculations, scenarios, or progress within the app
Bulk Deletion: Settings > Data Management > Clear All Data
Automatic Cleanup: Completed infusions are automatically deleted after 30 days
Complete Removal: Deleting the app removes all local data permanently

7.4 Control Permissions

Manage app permissions in iOS Settings:

Permission	Location	Purpose
Bluetooth	Settings > Privacy > Bluetooth	P2P verification
Local Network	Settings > Privacy > Local Network	P2P verification
Notifications	Settings > Notifications > Drug Infusion	Live Activity alerts

7.5 Control iCloud Sync

To disable the limited iCloud sync:

Go to iOS Settings > [Your Name] > iCloud
Find “Drug Infusion” in the app list
Toggle off

Note: This only affects subscription status sync, as practice data is never synced.

7.6 Manage Subscription

View subscription status in the app’s Settings
Manage or cancel via Settings > [Your Name] > Subscriptions
Restore purchases using the Restore button in Settings

8. Data Retention

8.1 Retention Periods

Data Type	Retention Period	Deletion Method
Running Infusions	Until completion + 30 days	Automatic
Completed Infusions	30 days	Automatic
Calculations	Until you delete them	Manual
Quiz Progress	Until you delete it	Manual
Practice Sessions	Until you delete them	Manual
Scenarios	Until you delete them	Manual
Audit Logs	Configurable: 30-365 days (default 90)	Automatic
App Preferences	Until app deletion	With app
Usage Counters	Reset monthly	Automatic
P2P Sessions	Deleted immediately after completion	Automatic

8.2 Data After App Deletion

When you delete the Drug Infusion app:

Local Data: Permanently deleted from your device
iCloud KeyValue Store: Subscription status may persist until manually cleared
App Store: Your purchase history remains with Apple per their retention policies

9. Children’s Privacy

9.1 Age Requirement

Drug Infusion is designed for healthcare students and professionals, typically adults. The minimum age to use this App is 17 years old, consistent with Apple’s App Store guidelines for medical and healthcare professional apps.

9.2 COPPA Compliance

We do not knowingly collect personal information from children under 13 years of age. If you believe we have inadvertently collected such data, please contact us immediately at support@ianesthesia.org, and we will take steps to delete the information.

9.3 Parental Rights

Parents or guardians may:

Review any data stored locally on their child’s device
Delete the app and all associated data
Contact us with questions about data practices

10. International Users

10.1 Data Location

Because the App stores data locally on your device:

Your data stays in your physical jurisdiction
No cross-border data transfers by us
You control where your device travels

10.2 Apple’s International Operations

If you use iCloud features:

Data may be processed according to Apple’s international data transfer policies
Apple maintains data centers in multiple countries
Apple’s privacy practices apply to their processing

10.3 Compliance with Local Laws

We design the App to comply with privacy laws in jurisdictions where it is available, including:

United States (state and federal laws)
European Union (GDPR)
United Kingdom (UK GDPR)
Canada (PIPEDA)
Australia (Privacy Act)

11. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

11.1 Right to Know

You have the right to know what personal information we collect. As detailed above, we collect only local functional data and do not sell or share personal information.

11.2 Right to Delete

You can delete your data at any time through the app or by deleting the app entirely.

11.3 Right to Opt-Out of Sale

We do not sell your personal information. We have never sold personal information and have no plans to do so.

11.4 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

11.5 Categories of Information

Under CCPA, we disclose the following categories:

Category	Collected	Sold	Disclosed for Business Purpose
Identifiers	No	No	No
Personal Information	No	No	No
Protected Classifications	No	No	No
Commercial Information	Limited (subscription status)	No	Apple only (payment processing)
Biometric Information	No	No	No
Internet Activity	No	No	No
Geolocation Data	No	No	No
Sensory Data	No	No	No
Professional Information	No	No	No
Education Information	No	No	No
Inferences	No	No	No

11.6 Contact for CCPA Requests

California residents may contact us at support@ianesthesia.org with “CCPA Request” in the subject line.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

12.1 Legal Basis for Processing

Processing Activity	Legal Basis
App functionality (calculations, progress)	Contract performance
Subscription management	Contract performance
P2P verification	Legitimate interest (safety verification)
Local analytics (usage counts)	Legitimate interest (service improvement)

You have the right to:

Access: Request a copy of your data (available locally in-app)
Rectification: Correct inaccurate data (edit within app)
Erasure: Delete your data (delete via app or uninstall)
Restriction: Limit processing (adjust settings)
Portability: Export your data (audit log export)
Object: Object to processing (limited applicability due to local storage)

12.3 Data Controller

For GDPR purposes, you are the data controller of data stored on your device. We act as a data processor only for the limited iCloud sync functionality.

12.4 Data Protection Officer

For GDPR inquiries, contact our privacy team at support@ianesthesia.org.

12.5 Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority.

13. Changes to This Policy

13.1 Notification of Changes

We may update this Privacy Policy periodically. When we make changes:

We will update the “Last Updated” date at the top
For material changes, we will notify you via in-app notification
We will maintain a version history of significant changes

13.2 Your Continued Use

Your continued use of the App after changes constitutes acceptance of the updated policy. If you do not agree with changes, you may delete the app and all associated data.

13.3 Version History

Version	Date	Summary of Changes
2.1	December 20, 2025	Updated domain to druginfusion.com
2.0	December 8, 2025	Comprehensive rewrite with GDPR/CCPA compliance
1.0	November 25, 2025	Initial privacy policy

14. Contact Us

For privacy questions, concerns, data requests, or to report issues:

Email: support@ianesthesia.org Support: https://druginfusion.com/support Response Time: We aim to respond within 5 business days

For legal or regulatory inquiries:

Email: support@ianesthesia.org

Summary

Question	Answer
Do you sell my data?	No, never
Do you share my data with advertisers?	No
Do you track my location?	No
Do you use third-party analytics?	No
Is my data sent to your servers?	No (we have no data servers)
Can I delete my data?	Yes, anytime
Is P2P data stored?	No, deleted after session
Do you collect health information?	No
Is my data encrypted?	Yes, via iOS Data Protection
Do you comply with GDPR/CCPA?	Yes

Apple App Store Privacy Label

Based on our data practices, our App Store privacy label reflects:

Data Not Collected: We do not collect data that is linked to your identity.

Data Used to Track You: None

Data Linked to You: None

This Privacy Policy is effective as of December 20, 2025.

Drug Infusion is an educational simulator. It is NOT intended for clinical decision support, medical diagnosis, treatment recommendations, or patient care. All calculations and drug information are for educational practice purposes only.

Privacy Policy