Privacy notice

1. Who we are and what this notice covers

Ionyx is run by Ionyx AI of P.O. Box N-10899, Nassau, The Bahamas ("Ionyx", "we" or "us"). This notice covers ionyxai.com and any Ionyx app.

We follow the Data Protection (Privacy of Personal Information) Act, 2003 of The Bahamas.

Who is in charge of your information

• Ionyx is responsible for your account, your health profile, your checks and the running of the platform.
• Your provider is responsible for the clinical records they make about you. These include visit notes, their private clinical notes, sick notes and referrals. They decide how those records are used for your care. We store them on Ionyx for your provider.

Read, not accepted

This is a notice, not a contract. We ask you to tick that you have read it. Some uses of your information need your separate agreement. We ask for each one on its own, at the time it matters.

2. What we collect

About you

• Account: your name, email, phone number, date of birth, sex and password (stored in a scrambled form no one can read). If you sign in with Google, we get your name and email from Google.
• Health profile: conditions, medicines, allergies, family history, height, weight, smoking, alcohol, activity, race and ethnicity if you give them.
• People you care for: the same details for each child or adult you add, plus your relationship to them.
• Checks: what you tell Ion, any photos or files you add, the reports Ion writes and the care level it suggests.
• Bookings and visits: who you booked, when, where, the type of visit and its status.
• Video visits: the island you say you are on, that you confirmed you are in The Bahamas, when people joined and left, call quality and any note you send before the visit. We never record the picture.
• AI note helper: if everyone agrees, the sound of the visit for a short time. See section 7.
• Messages: messages with your provider and photos or PDFs you send. Photos lose their location details.
• Documents: visit summaries, sick notes and referrals from your provider.
• Follow-ups: how you are feeling after a check or visit. Also what a provider told you if you choose to tell us.
• Medical ID: what you put on your card and when the card was opened.
• Ratings: your star rating and comments about a visit.
• Help and support: what you write to Ionyx Support. If you use "Still need help?", we also get the page you were on, your device type and the last error on that page.
• Agreements: what you agreed to, the version, the name you typed, the date and time and your internet address.
• Technical details: your internet address, device and browser type, sign-in history and failed sign-in attempts.
• Payments: once payments go through Ionyx, what you paid and any refunds. Card details are handled by our payment provider. We do not see your full card number.

If you are a provider

We also collect your licence and training details, the documents you upload to prove them, your photo, your fees, your hours, your ratings, how quickly you answer and a log of every patient record you open. Once payouts go through Ionyx, we also collect your bank details.

What we do not collect

• We do not keep search words about health. Recent searches stay only on your device.
• We do not use advertising or tracking cookies.

3. Why we use your information

• To run your health check and write your report.
• To help you find, book and see a provider. To send messages and documents between you.
• To keep people safe. For example, to show urgent advice, to tell a provider when you feel worse and to review cases where Ion may have been wrong.
• To send you reminders and updates about your care.
• To check providers' licences and keep the platform honest.
• To answer your questions and fix problems.
• To keep Ionyx secure and to stop misuse.
• To meet our legal duties, such as keeping medical records.
• To improve Ionyx using de-identified information. We only do this if you say yes. See Using de-identified information to improve Ionyx.

4. Our legal reasons

We only use your information when we have a lawful reason. Our reasons are:

• Your agreement. We ask for it before we use your health information and before we store it outside The Bahamas. You can take it back at any time.
• To give you the service you asked for. For example, to book the visit you chose.
• Our legal duties. For example, to keep medical records for as long as the law requires.
• To protect life. For example, to act when someone may be in danger.
• To run Ionyx properly. For example, to keep it secure. We only do this when it does not unfairly affect your rights.

5. Your health information

Health information is sensitive personal data under the law. We take extra care with it.

• We only collect it with your agreement or when the law allows it.
• Only people who need it can see it.
• We never use it for advertising.
• Emails and phone notifications from Ionyx do not include medical details. They tell you something is waiting and link to Ionyx.

6. Who can see your information

• You. When you are signed in.
• A provider you book. Before they accept, they see a short brief. After they accept, they see your full report, full name and phone number. They also see your messages, visit notes and documents for that visit.
• A provider you show your report to. If you show a verified Ionyx provider your QR code or report code, they can open that report for a limited time. We record each opening and tell you.
• People you allow. If you add someone you care for, you can see their profile and checks. They cannot see yours. Read Family, helpers and children.
• Anyone with your medical ID card, if you turn scanning on. They see only what you chose to show.
• An employer or school who has your sick note code. They see only what the note shows.
• The Ionyx team. A small team runs Ionyx. They can see information when they need to: to help you when you ask, to check providers, to fix problems and to review safety concerns. Everything the team opens is logged. They must keep it confidential.
• Our service providers. See section 7.
• When the law requires it. For example, a court order. We share only what is required.
• A new owner. If Ionyx is sold or joins another company, your information may pass to the new owner. They must keep the promises in this notice. We will tell you first.

Every time a provider opens your brief, record or report from their Ionyx pages, it is logged. Attempts to open a report without permission are logged too.

7. Our service providers

We use other companies to run parts of Ionyx. They may only use your information to do that work for us. We are putting written agreements in place with each of them.

• Hosting, storage and backups: Amazon Web Services. Our servers, database, files and encrypted backups.
• Email: Microsoft 365. Sends our emails.
• Ion's AI: OpenAI. Helps Ion ask questions and write reports. Before anything is sent, we take out names, email addresses, phone numbers, street addresses, dates of birth and long numbers like card or NIB numbers that we can spot. OpenAI sees words like "the patient" instead of a name. If we cannot check a message, we do not send it. We do not send your contact details, photos, video visits, AI note helper recordings or messages. OpenAI must not use what we send to train its models. It may keep it for up to 30 days to check for misuse.
• Video: Amazon Chime SDK from Amazon Web Services. Carries the call. Sound and picture are encrypted on the way. Ionyx does not record the picture.
• AI note helper: AWS HealthScribe from Amazon Web Services. Turns the sound of a visit into a draft for your provider. It is only used if everyone on the call agrees. The recording and the service's copies are deleted as soon as the draft is made. Amazon must not use it to train its models.
• Sign-in: Google, only if you choose "Sign in with Google".
• Fonts and code: some pages load fonts from Google Fonts and code from jsDelivr and Cloudflare. These services see your internet address.
• Phone notifications: Google Firebase, once phone notifications start. They never show health details.
• Payments: our payment provider, once payments go through Ionyx. We will name it here before payments start.

We do not send text or WhatsApp messages yet. If we start, we will update this notice first.

8. Storing your information outside The Bahamas

Our main servers and storage are run by Amazon Web Services in the United States. Our other service providers may also handle your information outside The Bahamas.

The law can restrict sending personal information abroad. We do it with your agreement. We ask for it separately in Storing your information outside The Bahamas.

To protect your information abroad we:

• use encrypted connections
• encrypt our backups
• use companies that sign agreements to protect it and not use it for their own purposes
• remove personal details before Ion's questions go to our AI service

9. How long we keep your information

• Checks no provider has looked at: deleted after 90 days, unless they are part of ongoing care. You can delete them sooner.
• Reports a provider has used: these are part of your medical record. We keep them as the law requires, generally at least 6 years after your last visit. If you delete them or your account, they are hidden from your account and kept securely. After 6 years a person reviews them before anything is removed.
• Visit notes, messages and documents: these are medical records. We keep them for your provider for as long as the law requires, which is at least 6 years after the last visit.
• AI note helper recordings: deleted as soon as the draft is made. A draft your provider has not used is cleared after 30 days.
• Medical ID openings: 1 year.
• Help searches and "still need help" records: 90 days. "Did this help?" answers: 1 year.
• Records of what you agreed to: for as long as your account is open and for 6 years after. They contain no health details.
• Sick notes: 6 years. This lets codes still be checked.
• Your account details after you delete your account: your account closes at once and you can no longer sign in. Your details stay with your medical records for as long as the law requires. To have anything else removed sooner, write to techsupport@ionyxai.com.
• Backups: we keep daily copies for 30 days and monthly copies for 12 months. Deleted information leaves our backups as they roll over.

10. Your rights

You can ask us to:

• See the information we hold about you.
• Correct information that is wrong.
• Delete your information. We will delete what the law allows. Medical records must be kept for the legal period.
• Stop direct marketing. You can stop it at any time. Use the link in the email or write to us. We will stop.
• Take back your agreement. For example, to the AI note helper, to medical ID scanning or to research use. This does not affect what we did before.

You can change your health profile, delete a check or delete your account yourself in Ionyx. For anything else, write to techsupport@ionyxai.com. We may need to check who you are. We will reply within 30 days.

Records your provider made are theirs to manage. We will pass your request to them and help them answer it.

11. How we protect your information

• Every page uses an encrypted connection (HTTPS).
• Our database cannot be reached from the internet.
• Backups are encrypted every night and kept in private storage.
• Passwords are stored in a scrambled form.
• Files you send are kept in private storage that only the right people can open.
• The Ionyx team must enter a code sent by email to sign in to the team panel. Their actions are logged.
• Providers are signed out after 8 hours.
• We limit how many times anyone can try a password or a code.

No system is perfectly safe. If a security problem puts you at risk, we will tell you and the Data Protection Commissioner as the law requires.

12. Children

You must be 18 or over to have an Ionyx account. A parent or legal guardian can add a child to their own account. The parent then makes choices for the child.

Teens can have health matters they want to keep private. We ask parents to talk with their teen about what they save. When a child turns 18, they need to agree before their profile is used for new checks.

13. Cookies and "keep me signed in"

Cookies are small files your browser stores. We only use the cookies Ionyx needs to work:

• a sign-in cookie that keeps you signed in
• a security cookie that stops other websites acting as you
• for the Ionyx team only, a cookie that remembers a trusted browser
• if you use the symptom checker without an account, a cookie that remembers for one year that you read "Not for emergencies" and the notices about your information. Then we do not ask every time.

We do not use advertising cookies or analytics cookies.

Your browser also stores a few settings on your device, such as your recent searches. Searches about health are never kept.

"Keep me signed in on this device"

If you tick this when you sign in, your sign-in cookie lasts up to 30 days after you last use Ionyx. If you do not tick it, it ends when you close your browser. Only tick it on your own device that has a screen lock.

14. Emails and marketing

• We send emails about your care, such as booking updates and reminders. You can turn most of these off. Safety alerts are always sent.
• We only send marketing if you agreed to it. You can stop marketing at any time.

15. Changes to this notice

We may update this notice. If we make an important change, we will tell you before it applies and ask you to confirm you have read it. This version starts on 28 October 2026.

16. Questions and complaints

• Write to us at techsupport@ionyxai.com or P.O. Box N-10899, Nassau, The Bahamas.
• If you are not happy with our answer, you can complain to the Data Protection Commissioner of The Bahamas: the Office of the Data Protection Commissioner, P.O. Box N-3017, Nassau, The Bahamas. Phone (242) 604-1001. Email dataprotection@bahamas.gov.bs. Website dataprotection.gov.bs.