Privacy Policy

1. Information We Collect

To deliver clinical-grade insulin calculation, continuous glucose monitoring (CGM) telemetry sync, and nutritional tracking, Glyco 8 processes the following categories of information:

• Health & Biometric Data: Real-time blood glucose readings (mg/dL or mmol/L), glucose trend arrows, active insulin on board (IOB), personal insulin-to-carb ratios (ICR), insulin sensitivity factors (ISF), basal regimens, target glucose thresholds, and logged insulin injection doses.
• Nutritional & Meal Data: Food ingredient selections, meal portion weights (in grams or servings), carbohydrate totals, and optional meal photos captured to inspect post-prandial excursions.
• CGM Integration Credentials: When you connect a Dexcom Continuous Glucose Monitor, your session tokens and credentials are securely stored to pull telemetry from Dexcom Share APIs.
• Account Information: If you register an account, your verified email address, hashed password, and profile preferences are collected for cross-device synchronization and security recovery.

2. How We Use Your Data

Your health and telemetry data is utilized strictly for:

• Executing mathematical meal bolus, correction bolus, and active IOB calculations.
• Synchronizing continuous glucose graphs and calculating Ambulatory Glucose Profile (AGP) consensus metrics (Time in Range, GMI, standard deviation).
• Enabling voluntary doctor-patient clinical sharing when you provide your unique 6-character patient link code to your verified endocrinologist or diabetes clinic.
• Providing essential account authentication and verification codes via email.

3. Third-Party Data Sharing & Zero Advertising

We only share data with infrastructure subprocessors essential to operating the service:

• Hosting & Server Infrastructure: Encrypted hosting providers based in certified European and US data centers.
• Transactional Email Services: Encrypted email dispatch (e.g. Resend) strictly to deliver login verification codes.
• Payment Processors: Apple App Store and Google Play Store for in-app subscriptions. Glyco 8 never receives or stores your credit card numbers.

4. Doctor-Patient Clinical Portal Sharing

5. Data Security & Encryption

We employ strict technical and organizational measures to safeguard your medical data:

• All telemetry and API communications are encrypted in transit using Transport Layer Security (TLS 1.3).
• Database volumes and session records are stored with AES-256 bit encryption at rest.
• Passkeys and passwords are protected with salted cryptographic hashes (Argon2/bcrypt); plain-text passwords are never accessible to our staff.

6. Your Rights & Account Deletion (GDPR, UK GDPR, CCPA)

Under the UK GDPR, EU General Data Protection Regulation, and California Consumer Privacy Act, you have the absolute right to:

• Access & Portability: Request a complete export of your glucose logs, basal schedules, and meal entries.
• Rectification: Modify or correct any inaccurate clinical parameters at any time directly in the app.
• Right to Erasure (Permanent Deletion): You can permanently delete your account and all associated health data directly in the app by navigating to Settings → Delete Account, or by submitting a request to privacy@glyco8.app. Deletion is instantaneous and irrevocable across all live databases and backups within 30 days.

7. Children’s Privacy (COPPA & GDPR-K)

Glyco 8 is not directed at children under the age of 13 (or under 16 in the European Union) without verifiable parental or guardian consent. If a parent or guardian discovers that a child has created an account without supervision, please contact us immediately for complete account deletion.