GluApp Privacy Policy

1. Who we are

GluBear / MyGluBear (“we”, “us”) provides GluApp, a diabetes education and secondary-monitoring app for parents, caregivers, and adult users, with optional child care profiles and an optional GluBear companion device. Contact: hello@myglubear.com.

2. Who this app is for

The GluApp account holder (the person who creates the login) must be 13 or older. Care profiles may be for children under 13. A parent or legal guardian provides consent at registration, controls the Parent PIN, and manages privacy settings, sharing, export, and deletion.

REGULATORY NOTICE: GluApp stores personal health information (glucose, medications, and related care data). You have rights under GDPR and other privacy laws. We apply encryption and access controls aligned with health-data best practices.

3. Information we collect

We collect only what is needed to run GluApp. Categories include:

• Account identifiers: name, email, password (hashed), optional phone, date of birth (age gate), Parent PIN (hashed), experience mode (kids or adult).
• Sign-in with Apple or Google: the identity token and the name/email the provider shares with us.
• Care profiles: name, date of birth, diabetes type, CGM type, insulin type, target ranges, and related care settings.
• Health information (special category): glucose readings (CGM or manual), insulin and medications, medical notes, diary/care events, and related reports.
• CGM connections you authorize: Dexcom Share credentials, LibreLinkUp credentials, or Nightscout site URL and API secret. These are stored encrypted on our servers.
• Emergency contacts: name, phone, and/or email used for optional alert escalation.
• Followers and caregivers: emails and roles of people you invite to view shared care-profile data.
• In-app purchases: App Store / Google Play product id, transaction identifiers, and receipts we validate on our server so your subscription works. We do not store your full card number.
• Device and app data: app version, OS, crash/diagnostic events if you leave Help Improve GluApp on, and usage needed to operate features.
• Photos you choose: watercolor paintings saved to your photo library, and optional screenshots attached to a bug report. We do not use the camera.
• Voice recordings: optional GluBear voice messages stored locally on the device, not uploaded as a default cloud archive.
• Push tokens: so we can send optional supplemental alerts you enable.
• Optional marketing email if you leave product updates on (you can turn this off).
• Optional Health Outcomes research: de-identified glucose, engagement, labs you enter, and surveys, if you leave that option on.

We do not collect GPS or physical location. We do not sell personal data. We do not use third-party advertising or tracking SDKs (no ads, no ad networks).

4. App permissions

GluApp requests permissions only when a feature needs them:

• Bluetooth: find and set up your GluBear companion and optional companion alerts. Glucose readings do not come from CGM sensors over Bluetooth; they come from Dexcom, Libre, or Nightscout over the internet. On Android 12+, Bluetooth scan/connect is marked as not used for location.
• Photo library: save watercolor paintings and attach a screenshot when you report a bug. We do not request camera access.
• Microphone: record a voice message for GluBear (stored locally).
• Notifications: optional supplemental glucose reminders and care alerts. These are not a replacement for your CGM’s primary alarms.
• Face ID / Touch ID (optional): quick unlock of the app after you have already signed in.
• Internet: sync health data, CGM feeds, subscriptions, and education content with our servers.

GluBear and GluApp are not intended to replace primary CGM alarms or medical advice. They are secondary displays and educational/comfort tools. Always keep your CGM system’s built-in alerts and your care team’s emergency plan.

5. How we use information

We use this information to:

• Create and secure your account and care profiles.
• Display glucose, send the supplemental alerts you configure, and support education, games, and GluBear companion features.
• Invite followers/caregivers you choose and notify emergency contacts you add.
• Validate App Store / Google Play subscriptions and restore purchases.
• Respond to support and bug reports (including screenshots you attach).
• Honor GDPR/privacy requests, legal obligations, and security investigations.
• If you opt in: send product emails; enroll in Health Outcomes research; collect first-party product/crash diagnostics (Help Improve GluApp).

Health data is processed with your explicit consent at registration so we can provide diabetes-care features. You can withdraw optional marketing, research, and product-telemetry consents in Settings without deleting required care processing (required processing ends if you delete the account).

6. Data sharing

We do not sell your personal or health data. We share only as needed to operate the service:

• People you invite: followers/caregivers see the care-profile data you share.
• Emergency contacts you add: may receive alert emails/SMS you configure.
• CGM providers you connect: Dexcom Share, Abbott LibreLinkUp, or your Nightscout instance, using credentials you provide.
• Service processors: hosting/database; Mailjet (email); Twilio (SMS/voice where used); Expo (push); Apple and Google (sign-in and in-app purchases). The myglubear.com shop may use Stripe for hardware bundles; that is not in-app billing.
• Law enforcement or regulators when required by law.

We do not use your data for advertising. Optional product telemetry is first-party and can be turned off in Settings → Privacy & Security → Help Improve GluApp.

7. Security

We use TLS (HTTPS) in transit. Selected personal health information and CGM credentials are encrypted at rest with AES-256-GCM. Access is limited to authenticated accounts and authorized caregivers. No security measure is perfect; please use a strong password and keep your Parent PIN private.

8. Children’s privacy (COPPA)

GluApp is designed for families managing pediatric diabetes. The account holder must be 13+. For children under 13, we collect information only after a parent/guardian creates the account, accepts these terms and this policy, and consents to health-data processing.

• Parents can review, export, or delete a child’s information from the app.
• Parents control sharing, export, and external links. Outbound links (for example education videos) use a parental gate.
• We collect the minimum needed for diabetes care, education, and safety features you enable.
• Delete the account in Settings → Profile & Account to erase the parent account and associated care profiles, subject to limited legal/audit retention described below.

9. Your rights and account deletion

Depending on where you live (including GDPR), you may access, correct, export, restrict, object to, or delete personal data, and withdraw optional consents.

• In-app: Settings → Privacy & Security → Your Data Rights (export JSON, submit a privacy request, marketing opt-out).
• Delete account: Settings → Profile & Account → Delete Account. This permanently removes the account and associated care data from the live service.
• Health Outcomes: Settings → Health Outcomes (Participate off).
• Product telemetry: Settings → Privacy & Security → Help Improve GluApp.
• Email: hello@myglubear.com.

We aim to respond to formal data-subject requests within 30 days. Some records (consent ledgers, legally required billing identifiers) may be retained in limited form after erasure.

10. Retention

We keep account and health data until you delete the account or we complete an erasure request, unless a longer period is required by law (for example tax records related to a paid subscription). Hosted Nightscout instances we provision for you are deprovisioned on account erasure.

11. Changes

We may update this policy. We will post the new version in the app and at https://myglubear.com/app/privacy and update the Last Updated date. Material changes may be highlighted at next launch or by email.

12. Contact

Questions about this Privacy Policy: hello@myglubear.com. Public copy: https://myglubear.com/app/privacy.