01Who this policy applies to
This policy applies to everyone who uses Gluci through any of our channels, including iMessage, Telegram, our iOS app, and our Android app. Some features differ by platform, but our data practices are the same across all of them unless stated otherwise.
02Information we collect
We collect only what we need to run the app.
Meal photos
When you send a photo of a meal, we receive that image and process it to produce a glucose prediction. Photos may include whatever is visible in the frame, so please avoid including other people or sensitive details you would not want processed.
Account information
This includes your name and email address, used to create and manage your account, authenticate you, and contact you about the service.
Usage analytics
We collect information about how you use Gluci, such as app interactions, feature usage, device and platform type, and diagnostic or crash data. This helps us improve reliability and the product.
Information we generate
When we analyze your meal photos, we create a glucose prediction. This is health-related information about you that we generate; we treat it as sensitive data (see Section 9).
We do not collect blood glucose readings directly from you or from connected medical devices unless we tell you otherwise at the point of collection.
03How we use your information
We use your information to:
- Generate glucose predictions from your meal photos.
- Create, secure, and manage your account.
- Operate, maintain, and improve the app, including debugging and analytics.
- Communicate with you about the service, including important notices.
- Process payments for paid features.
- Comply with legal obligations and enforce our terms.
Legal bases (GDPR / UK GDPR). Where the EU/UK GDPR applies, we rely on: contract (to provide the service you request), legitimate interests (to secure, maintain, and improve the app), consent (for processing health-related predictions and any optional features that ask for it), and legal obligation (where the law requires it). You can withdraw consent at any time (see Section 8).
04How we share your information
We do not sell your personal information. We share it only with the categories of service providers needed to run Gluci:
- AI image/LLM provider — to analyze your meal photos and generate predictions. Provider: OpenAI.
- Cloud hosting and storage providers — to host the app and store data securely. Our web experience is hosted on Netlify, and our application backend runs on cloud infrastructure providers acting as our processors.
- Payment processor — to process payments for paid features. We do not store full payment card details ourselves. Provider: Stripe.
These providers act as our processors and are bound by contract to protect your data and use it only to provide services to us.
We may also disclose information when required by law, to protect our rights or users' safety, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).
05International data transfers
We operate globally, and your information may be processed in countries other than your own, including Canada, the United States, and the EU. Where we transfer personal data out of the EU/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may contact us for more information on these safeguards.
06Data retention
We keep personal data only as long as needed for the purposes described in this policy.
- Meal photos: deleted immediately after processing.
- Glucose predictions: retained for 24 months.
- Account information: kept for as long as your account is active, then deleted or anonymized within 30 days after closure.
- Usage analytics: retained for 24 months.
When data is no longer needed, we delete or anonymize it.
07Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and secure hosting. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you and relevant regulators of a breach where required by law.
08Your rights and choices
Depending on where you live, you may have some or all of the following rights:
EU / UK (GDPR): access, correction, deletion, restriction, portability, objection to processing, and the right to withdraw consent. You may also lodge a complaint with your local data protection authority.
California (CCPA/CPRA): the right to know what personal information we collect, to access and delete it, to correct it, to opt out of "sale" or "sharing" (we do not sell or share personal information as those terms are defined), and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.
Canada (PIPEDA): the right to access your personal information and request corrections, and to ask about how it is handled.
To exercise any right, contact us at hello@gluci.app. We will verify your request and respond within the timeframe required by applicable law. You can also delete your account at any time within the app.
09Sensitive and health-related data
Glucose predictions are health-related information. We treat them as sensitive and process them only to provide the service to you. Where the law requires explicit consent to process health data, we ask for it before generating predictions, and you may withdraw that consent at any time by deleting your account.
10Children's privacy
Gluci is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it.
11Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Your continued use of Gluci after changes take effect means you accept the updated policy.
12Contact us
If you have questions about this policy or how we handle your data, contact us at:
Alkemi Labs Inc
88 Bathurst St, Toronto, Ontario, Canada
hello@gluci.app
We are not required to appoint an EU/UK representative or Data Protection Officer. If this changes, we will update this policy with their contact details.