Consumer Health Data Privacy Policy

Last updated: October 2, 2026  ·  Effective date: October 2, 2026
See also: Privacy Policy  ·  Terms of Service

This Consumer Health Data Privacy Policy applies to "consumer health data" collected by GlucoWorks LLC ("GlucoWorks," "we," "us") through the SuperGlu App and our websites. It is written to meet the requirements of the Washington My Health My Data Act (RCW 19.373); Nevada law (SB 370, NRS Chapter 603A); and the consumer health data provisions of the Connecticut Data Privacy Act.

It supplements our Privacy Policy. If you are a resident of one of these states, or your data is collected there, these terms apply to you. We extend the same rights to all users.

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This includes information derived or inferred from non-health data.

1. Consumer Health Data We Collect and Why

  • Health conditions and status — the mode you select (Type 1, Type 2, or metabolic health), whether you take medications that can cause low blood sugar, insulin delivery method. Purpose: to configure scoring and features for you.
  • Biometric and bodily measurements — glucose readings, ketone readings, weight, heart rate, heart rate variability, blood oxygen, sleep, steps, activity, workouts. Purpose: to score meal outcomes, show your history, and note context such as exercise.
  • Medications and treatment — medications, doses and schedules, insulin dose records, carb ratio settings you enter. Purpose: to show your records alongside meal outcomes and send reminders you set.
  • Diet and substance use — meal photos, nutrition estimates, alcohol entries. Purpose: to estimate nutrition and show how meals related to glucose.
  • Health-related inferences — meal outcome scores, difficulty indicators, time-in-range, summaries of your historical patterns, auto-detected carb ratio patterns. Purpose: to show you descriptive information about your own past data.
  • Location linked to health activity — precise location of logged meals. Purpose: to identify restaurants and recognize places you regularly cook.
  • Health-related free text — notes, support messages, questions you type in the query box. Purpose: to provide the features and support you request.

We collect and use consumer health data only as needed to provide the SuperGlu features you request, or as you otherwise consent.

2. Sources of Consumer Health Data

  • You, through the App and website forms.
  • Your device, for meal location and time zone, with your permission.
  • Services you connect: Apple Health, Dexcom, FreeStyle Libre (through LibreLinkUp), and Tandem (through Tandem Source / t:connect).
  • Our own processing, for derived and inferred information.

3. Consumer Health Data We Share, and With Whom

We do not sell consumer health data. We do not use it for advertising.

We disclose consumer health data only to the processors below. Each processes it on our behalf, under a contract, to provide the Service:

  • Supabase — all categories. Purpose: data storage and authentication.
  • Vercel — all categories, in transit. Purpose: hosting.
  • OpenAI — meal photos, notes, meal location, relevant past meals and estimates. Purpose: AI nutrition estimates.
  • Anthropic — alcohol and medication label photos; your query text and the names of available data types; aggregate statistics. Purpose: AI features.
  • Google (Places API) — meal location coordinates only. Purpose: restaurant identification.
  • GitHub — insulin records in transit, during scheduled Tandem synchronization. Purpose: running sync jobs.
  • Resend — support messages; meal photos and details you submit as feedback. Purpose: email delivery.
  • Expo — notification text. Purpose: push notifications.

Affiliates: GlucoWorks has no affiliates with which it shares consumer health data.

Other disclosures: we may also disclose consumer health data where required by law; to protect you or others; or as part of a merger, acquisition, or sale of assets, as described in our Privacy Policy. In that case, the recipient must honor this policy.

We will ask for your separate consent before sharing consumer health data for any other purpose.

4. Your Consent

We ask for your consent to collect and process consumer health data in the App. This consent is separate from your agreement to our Terms of Service. We also ask separately for your explicit permission before your data is sent to third-party AI providers.

You can withdraw consent at any time in Settings → Privacy or by emailing privacy@glucoworks.com. If you withdraw consent to collection of consumer health data, we will stop collecting it, and you may delete your account and data. Most SuperGlu features cannot work without this data.

5. Your Rights

You have the right to:

  • Confirm whether we collect, share, or sell your consumer health data.
  • Access your consumer health data. This includes a list of all third parties and affiliates with which we have shared it, and an active email address or other online way to contact them.
  • Withdraw consent to our collection and sharing of your consumer health data.
  • Delete your consumer health data. When you request deletion: we delete it from our records; we notify all processors and third parties we shared it with so they delete it too; and we delete it from backup systems no later than six months after we authenticate your request.
  • Appeal our decision about your request.

How to exercise your rights. Delete your account in the App (Settings → Account → Delete Account), or email privacy@glucoworks.com from your account email address with the subject "Health Data Request."

We will authenticate your request using your account email. We respond within 45 days. We may extend this once by 45 additional days if reasonably necessary, and if we do, we will tell you within the first 45 days. Requests are free of charge at least twice per 12-month period.

Appeals. If we decline to act on your request, email privacy@glucoworks.com with the subject "Health Data Appeal" within a reasonable time. We will respond in writing within 45 days and explain our decision. If we deny your appeal, you may submit a complaint to your state’s Attorney General:

We will not discriminate against you for exercising these rights.

6. Geofencing

We do not use geofences around healthcare facilities, and we do not use location data to identify or track visits to them.

7. Security and Access

We restrict access to consumer health data to personnel who need it to provide the Service, support you, or keep the Service secure. We use reasonable administrative, technical, and physical safeguards, including encryption in transit and at rest.

8. Changes

If we change how we collect, use, or share consumer health data, we will update this policy and obtain your consent before applying the change to you.

9. Contact

GlucoWorks LLC · privacy@glucoworks.com