Pre-release revision — country-specific review pending Last revised: September 22, 2026
This draft describes the current Service, including Google Play billing. Before public release, the Provider must confirm international-transfer details and the disclosures and translations required in the countries where the Service will be offered. This revision does not establish a new effective date or certify worldwide legal compliance.
Woongthcorporation (웅쓰코퍼레이션, "Provider") processes only the information needed to operate IV Guardian ("Service") and works to protect it.
1. Information We Process
A. Information created or received during sign-in
- Firebase account identifier (UID), sign-in provider, verified email address, and authentication status
- Device-specific app identifier, platform, Firebase Cloud Messaging (FCM) token, and token status
- IP addresses and user-agent information processed by Firebase Authentication for sign-in security, and Firebase installation IDs used for messaging
B. Profile information entered or selected by the user
- Name, IVG ID, hospital, ward, affiliation, profile photo, and optional reply email
C. Service-use information
- Team contacts, contact requests, team-room invitations and membership
- Active team room, room entry history, assigned areas, work or break status, delegation, return, and shift handoff
- Room and bed identifiers, entered medication or IV names, IV settings, care-alert settings, alert events, and synchronization status
- Support-inquiry category, subject, message, reply email, and delivery status
- Operational and security logs, including request or event identifiers, account or room identifiers, processing results, and error information
D. Trial, entitlement, and billing information
- Trial start and end dates, Free or Premium entitlement, Premium expiry, and billing status
- Google Play product and base plan, purchase and renewal state, access expiry, purchase token, account-to-purchase mapping and hashes, and billing-notification processing records
- Payment-card numbers and card security codes are not received or stored by IV Guardian; payment-method processing is handled by Google Play and its payment providers
E. Information stored only on the device
- Language, calculation values, app settings, local alarm schedules, and other account-specific cached data
F. QR-scanner diagnostics
- Google ML Kit processes device model and OS, app and SDK versions, an installation-specific identifier, latency, scanner configuration, and initialization, detection, and error events for diagnostics and usage analytics
G. Official website access
- Firebase Hosting processes visitor IP addresses to deliver and protect the official website; visiting the website is separate from creating an App account
2. Purposes of Processing
- Sign-in, account creation, recovery, and prevention of duplicate trials
- Profile, team-contact, invitation, and team-room collaboration
- Assigned-area filtering, break delegation, return, and shift handoff
- Calculation, scheduling, delivery, synchronization, modification, and cancellation of IV and care alerts
- Free, Trial, and Premium entitlement decisions; billing verification, restoration, cancellation, and prevention of incorrect account mapping
- Security, error response, service operation, and customer support
- QR-scanner reliability, technical diagnostics, and usage analysis by Google ML Kit
- Delivery and security of the official website through Firebase Hosting
3. Information Visible to Other Users
When needed for team-contact and team-room features, signed-in users may view another user's name, IVG ID, hospital, ward, affiliation, profile photo, and work status. Email address, FCM token, device information, entitlement, and billing information are not included in the public profile.
Members of the same team room can view and edit the room, bed, assigned-area, work-status, delegation, IV, and care-alert information required for collaboration. IV Guardian does not sell personal information.
4. Patient Information
Medication and IV names may be entered to distinguish items used in the workflow. Do not enter patient names, resident registration numbers, medical-record numbers, contact details, diagnosis notes, or other information that identifies a patient. Use room and bed labels that do not themselves identify a person.
Room or bed labels combined with medication and other information may still identify a patient in context. Omitting a name does not necessarily make the information anonymous. Users must follow their institution's privacy rules and permitted scope of use, and must not add identifiable patient details to names, notes, or support inquiries.
5. External Services and Processing Infrastructure
IV Guardian uses Google Firebase services, including Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, and Firebase Cloud Messaging, for sign-in, synchronization, file storage, server processing, and push delivery. Support inquiries are delivered to the Provider's Gmail account through Google infrastructure. Google Play Billing and related Google Play services are used to process and verify purchases, restore access, stop auto-renewal, and receive subscription-status updates.
These services do not all have the same agreement. Authentication, Firestore, Functions, and Storage are covered by Google Cloud terms; FCM and Hosting have their own applicable Firebase/API terms. Gmail, Google Play, and ML Kit must be reviewed separately. Google's standard contracting-entity table names Google Cloud Korea LLC for Google Cloud customers billed in South Korea, unless otherwise agreed. A contracting entity is not necessarily the entity that receives or processes data overseas. This does not identify all overseas recipients or their processing countries.
Selected resource locations confirmed on September 17, 2026:
- Cloud Firestore (work data) and Cloud Functions (server processing): Seoul, South Korea (asia-northeast3)
- Cloud Storage (profile images): United States (us-east1)
- Firebase Authentication: United States, according to Google's service documentation
- Cloud Logging (operational and audit logs): global; not restricted to South Korea
Information sent for each purpose:
- Sign-in: account identifiers, email, authentication information, IP address, and user-agent information are processed by Firebase Authentication
- Profile upload: the selected photo and account-linked storage path are sent to Cloud Storage
- Alert delivery: FCM receives device tokens, recipient identifiers, room and bed labels, medication or IV names, care-alert names, times, and event information as needed for the alert
- Support: when an inquiry is submitted, Gmail receives its category, subject, message, language, reply email, and the associated name, IVG ID, affiliation, account UID, and inquiry ID
- Purchase verification and restoration: purchase tokens, product information, and account-binding identifiers are exchanged with Google Play; IV Guardian does not receive card details
- Server operation: processing and security records are sent to Cloud Logging when requests or events are handled
- QR scanning: ML Kit sends technical metrics to Google over HTTPS. Recognition runs on the device; ML Kit does not send camera images or decoded QR content to Google. IV Guardian separately uses decoded invitation information to request the selected room or contact
The App has no separate switch for ML Kit diagnostics. Camera permission controls camera access, not all SDK processing.
Information is transmitted to the relevant services when users sign in, synchronize work data, upload a profile image, receive alerts, make or restore purchases, or submit an inquiry. Messaging, Gmail, Google Play, and other supporting infrastructure may process information internationally; the selected database region is not a promise that all data stays in South Korea. Before release, the Provider must finalize the actual contracting and receiving entities, service-specific transfer details, applicable legal grounds, retention, and any required notice of refusal and its consequences.
You can choose not to upload a profile photo or use QR scanning. Declining notification permission limits notifications, but does not stop all network or SDK processing. There is currently no in-App switch that keeps all processing in South Korea. Sign-in and synchronized collaboration depend on the listed infrastructure; requests to stop related processing may limit those features. Contact the Provider for a processing-restriction or deletion request. These explanations do not constitute separate consent to international transfers or a promise that every transfer can be switched off individually.
Google’s service information: https://firebase.google.com/support/privacy ML Kit data disclosure: https://developers.google.com/ml-kit/android-data-disclosure ML Kit privacy information: https://developers.google.com/ml-kit/terms
6. Retention and Deletion
- Account, private profile, team-contact, and current membership information: retained while the account is active and deleted when account deletion is completed
- Shared team-room data: retained for remaining members; account identifiers in managed fields are removed or replaced, without guaranteeing anonymity of all retained data
- Inactive shared team room: eligible for scheduled deletion after 14 consecutive days without activity; the personal Free room is excluded from inactivity deletion
- Personal Free room and profile images: deleted when account deletion is completed
- Account-deletion completion receipt containing a hashed identifier, and inactive-room deletion receipt: scheduled for cleanup after 30 days
- Google Play billing-notification processing receipt: scheduled for cleanup after its 90-day retention period; account deletion resets that receipt's retention period to 90 days
- Raw purchase token: removed from the account record on account deletion
- Identity and purchase hashes, trial-used status, and limited billing-mapping records: currently remain after account deletion to prevent repeated trials or incorrect purchase reuse. No automatic expiry is currently set. Remaining billing records can include account-linked record keys and purchase status; hashing does not necessarily make these records anonymous. The necessary fields, retention grounds, and deletion criteria must be finalized before release
- Support inquiry: its subject, message, reply email, and accompanying profile/account information remain in the Provider's Gmail mailbox until the Provider deletes the email. App account deletion does not automatically delete these emails. Firestore does not store the inquiry subject or message, but keeps account-linked category, language, delivery-status, and rate-limit metadata until account deletion. The mailbox retention period and deletion procedure must be finalized before release
- Cloud Logging: as verified on September 17, 2026, the _Default operational-log bucket is configured for 30 days and the _Required mandatory-audit bucket for 400 days. These are log-retention settings, not a promise that all user information is deleted on those dates
- Device-only data: retained until cleared in the App, deleted with the account where supported, or removed by uninstalling the App
Firebase Hosting retains visitor IP addresses for a few months according to Google's service documentation. App account deletion does not automatically erase website access data.
ML Kit diagnostics follow Google's service and privacy policies. Their retention period and deletion procedure remain unconfirmed; deleting an IV Guardian account does not guarantee their deletion.
The proposed operating rule for ordinary support emails is deletion one year after case closure. Case classification, closure-date recording, and actual enforcement have not yet been verified, so this is not a statement that automatic deletion is running. Billing disputes and legally required records need separate classification. Support-delivery metadata has no age-based expiry while the account remains active.
Where South Korean electronic-commerce record-retention rules apply, the relevant categories have different periods: six months for display/advertising records, five years for contract/withdrawal and payment/supply records, and three years for consumer-complaint/dispute records. These periods do not automatically apply to every support email, identity hash, or billing log. The Provider must identify the applicable records and establish separate retention, access, and deletion procedures; those procedures have not yet been verified as operational.
Scheduled deletion can occur after the threshold at a subsequent cleanup run and can be delayed by processing failures. Billing-notification deduplication receipts are not a substitute for transaction records that applicable law requires retaining. Required transaction/support records and a separate retention/deletion procedure remain to be confirmed before release.
For undelivered Android messages, the current FCM delivery lifetime is 24 hours for ordinary alarm events and 28 days for account/room cleanup messages. This is a delivery-queue limit, not the retention period for all messaging identifiers or logs. Deleting an FCM token is not the same as deleting a Firebase installation ID; installation-ID deletion handling remains a pre-release review item.
The current App cleanup requests FCM-token deletion but does not explicitly request Firebase installation-ID deletion. Google's installation-ID deletion period of up to 180 days applies after the appropriate deletion request; account deletion alone does not establish that start date. Continuing to use Firebase services may create a new installation ID.
Provider-initiated deletion and removal from a service provider's backup systems are not necessarily simultaneous. Google states that Firebase Authentication data is removed from live and backup systems within 180 days after an account-deletion request. Other services have their own deletion and retention processes; this does not promise immediate deletion from every Google system.
7. Account Deletion
Users can request deletion through Settings > Delete Account. A recent sign-in may be required to protect the account. When server-side deletion completes, it removes the private profile, public profile, team contacts, invitations, personal Free room, and profile images.
If a required billing check, auto-renewal cancellation, or deletion step fails, the server keeps the request pending and retries it. Returning to the sign-in screen does not prove that server-side deletion has completed.
The deletion process ends the shift, removes registered device links, and requests alarm cleanup on other devices. Devices that are offline or unable to receive messages may apply cleanup later; immediate removal of every local alarm is not guaranteed.
Shared team-room data remains available to other members. The deletion process removes or replaces the account identifiers in fields it manages, such as creator and updater identifiers. This does not guarantee that every retained field or user-entered item is anonymous. Deleted account and personal data cannot be restored.
8. User Rights
Users can view or update their profile in the App and can request access, correction, deletion, or processing restriction by email. Requests may require identity verification using the account email or IVG ID. Do not send passwords, verification codes, or patient information. If correction or deletion is required, the Provider will take action without undue delay, except where retention is required by law or necessary to protect other users' rights.
9. Automated Processing
The server automatically determines the effective Free, Trial, or Premium entitlement and eligible alarm recipients based on account, active-room, assigned-area, work-status, delegation, and billing states. Users may request a review or correction through the contact email.
The App does not include advertising or an analytics SDK used to create advertising profiles. ML Kit technical diagnostics and usage analysis are separate from advertising profiling.
10. Security Measures
The Provider separates private account information from coworker-facing profile information, restricts database and file access through authentication and security rules, uses hashed identifiers where raw identifiers are unnecessary, and invalidates unusable FCM tokens.
11. Device Permissions
Notification, exact-alarm, vibration, boot-completion, and wake-lock permissions are used for alarm delivery. Camera access is used only when scanning a QR code, and photo access is used only when the user selects a profile image.
12. Children
The Service is not directed to children under 14. If information from a child under 14 is found to have been processed without legally required consent, deletion may be requested through the contact email.
13. Changes and Contact
Material changes will be announced in the App or through another appropriate channel before they take effect where required. Country-specific requirements, international transfers, and translations remain subject to review before public release.
Provider: Woongthcorporation (웅쓰코퍼레이션) Representative: Hwang Jung Woong (황정웅) Business registration number (South Korea): 291-28-01841 Mail-order business registration (South Korea): 2026-경북안동-0252 Business address: Unit 201, 60 Bulmugol 1-gil, Andong-si, Gyeongsangbuk-do, Republic of Korea Privacy contact person: Hwang Jung Woong (Representative) Privacy and service contact: woongthcorporation@gmail.com