Privacy Policy

AviyanLabs LLC (“AviyanLabs”, “we”, “us”) controls the personal data processed when you use the GlucIQ mobile application (the “App”, listed in the stores as “GluciQ: Diabetes Food Scanner”), the website at gluciq.com (the “Website”), and the documentation and support channels we operate (together, the “Services”).

This notice is the privacy notice required by the EU and UK General Data Protection Regulation, the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law, and the California Consumer Privacy Act as amended. AviyanLabs LLC, a Wyoming limited liability company at 30 N Gould St, Ste N, Sheridan, WY, United States, is the operator of the Services and the controller of your personal data. The GlucIQ privacy contact is [email protected].

Scope: what this policy covers, and what it does not

Covered. Personal data processed by AviyanLabs through the App, the Website, and our support and documentation channels.

Not covered. These sit outside our control and outside this policy:

1. Connected data sources. If you connect a continuous glucose monitor or a pump platform, the readings we import come from that provider, and the provider’s own privacy policy governs its collection. We list the providers we support in Information we receive from connected services.
2. Store transactions. Apple and Google process purchases, subscriptions, renewals and refunds. We receive subscription status, not your payment card.
3. Clinician tools. If you export or share a record with a clinician, that clinician processes it under their own obligations.

Summary of what we collect and why

We practise data minimisation. We ask for the fields the App needs to calculate and display your records, and you can skip or change most profile fields, including the fields that affect meal suggestions.

Information you give us

Account. You create an account with an email address and password, with Sign in with Apple, with Google, or with a passkey-style biometric unlock on your device where the platform supports it. Identity and credential management is provided by Clerk, our authentication processor. We store your session token in the operating system keychain of your device, not in plain storage.

Diabetes profile and health records. During onboarding and in Settings you can provide: age, height, weight and target weight, biological sex, country and language, diabetes type, current and target A1c, how long you have managed diabetes, how you describe your current control, whether you use insulin and by which method, the medications you take, total daily dose and basal dose, carbohydrate ratios by meal, correction factors by time of day, glucose targets and critical thresholds, and whether you use a CGM or pump and which brand.

Health records. The App stores the records you create: glucose readings and their source, insulin events, pump data imported from a connected provider, meals with nutrition values, meal weight, notes and comments, weight, fasting sessions with the mood and energy values you enter, and barcode scans.

Dietary profile, including ethnicity. Dietary preferences, restrictions, allergies, ingredients you avoid, preferred cuisines, protein preferences, goals, cooking skill and available time, meals and snacks per day, household size, and ethnicity. Ethnicity is special-category data under EU and UK law, and similar restrictions apply in the UAE. We ask for ethnicity only to calibrate nutrition guidance. Leave it blank if you prefer, and change or delete it in Settings at any time. We do not use it to infer health status.

Meal photos and notes. Photos you take or choose, the meal description you type, and any notes attached to a meal record.

Communications. Support requests, feedback, review responses, and any attachments you send us.

Consent records. The insulin-guidance consent you give during onboarding (version 2026-07-03.v1), your analytics preference, and your website cookie choice. We keep the version and timestamp so we can show what you agreed to.

Information we collect automatically

• Service operation data. Requests to our API gateway, timestamps, response status, app version, build channel, device type, operating system version, and a per-session identifier that helps us correlate a single session in logs.
• Push token. If you enable notifications, the push token issued by the platform, the provider (APNs or FCM), and the device model and operating system version.
• Crash and performance data. Sentry receives exception reports, structured logs, and performance traces. Sentry reports are configured to remove email, phone number, date of birth, and authentication tokens; they retain a user identifier so we can link a crash to an account and tell you when it is fixed.
• Operational logs and traces. Where remote logging is enabled, Grafana Cloud receives structured logs and traces with device context, app version, session identifier, and user identifier.
• Analytics events. If analytics sharing is on, we record product events such as the type of action you completed. Some events include the values involved in that interaction, for example the dose you logged or the glucose value in view at the time. We do not use advertising identifiers, and we do not append health values to events for marketing purposes. You can turn analytics off at any time in Settings, Privacy and Security.
• Website. The Website sets no cookies before you consent. With your consent, Google Analytics 4 records page views with IP anonymisation. Details are in the Cookie Policy.

Information we receive from connected services

You can connect these services, and each connection is initiated and authorized by you:

You can disconnect any of these services in Settings, which stops future imports. Data already imported stays in your records until you delete it or delete your account.

We are independent of these providers. Abbott, FreeStyle, Libre and LibreLinkUp are trademarks of Abbott and its affiliates. Dexcom is a trademark of Dexcom, Inc. Glooko is a trademark of Glooko, Inc. GlucIQ is not affiliated with, endorsed by, or sponsored by any of them, and we name them only to identify the service you asked us to connect. Their services, their terms, their availability and the accuracy of the readings they produce are theirs to stand behind, not ours. Your use of a provider is governed by your agreement with that provider, and you need the right to use the credentials you supply. If a reading is wrong, raise it with the manufacturer that produced it.

Identity providers (Apple, Google, Clerk) return the identifier and the email or name you choose to share. Apple and Google return subscription status for purchases; Superwall validates entitlements against the stores. We never receive your full payment card number.

How we use information, and our legal bases

We process personal data to:

1. Provide the Services (account creation, syncing your records, meal analysis, calculation and display, device import): performance of our contract with you.
2. Process health data, sensitive dietary data and meal photos: your explicit consent, which you give when you enter the data or turn the feature on, and which you can withdraw by deleting the data or turning the feature off.
3. Keep the Services secure (abuse prevention, rate limiting, authentication, integrity checks, debugging): our legitimate interests in protecting users and the service.
4. Diagnose and fix faults (crash reporting, traces, incident response): our legitimate interests in operating a reliable service.
5. Measure product usage (only with analytics sharing on): your consent.
6. Meet legal obligations (tax, accounting, lawful requests, dispute defense): legal obligation and legitimate interests.
7. Communicate with you about your account, security events, material changes to legal documents, and, only where permitted, product announcements. You can opt out of announcements without losing service messages.

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. The App’s estimates are informational outputs that you review. They are not decisions about your care.

Meal photos and AI processing

When you use photo analysis:

• The App captures or selects an image and sends it, together with the meal context you supplied and the health context the analysis uses (for example your carbohydrate ratio, correction factor, current glucose, target glucose, active insulin, diabetes type, weight, age, sex, activity level, height and total daily dose), to our backend through our API gateway. The App does not send your photo directly to any model provider.
• Our backend sends the image and the context to a third-party model provider to produce the nutrition estimate. Our configured default is Google Gemini through OpenRouter; our platform supports other providers, and we name the current provider in the Security and data handling document.
• We use the output to build the itemised estimate, including the portion we assumed and the reference values we checked it against, all of which you can correct. Corrections are stored with the meal record.
• Training. We do not use your health records or your meal photos to train our own models. We do not authorize a provider to train its models on your content. Where a provider’s terms would allow it to use API content for model improvement, we configure the integration to prevent it.
• No autonomous clinical action. The model does not dose, prescribe, adjust therapy, or change your parameters. It produces an estimate for you to review.
• You can avoid AI processing entirely. Log meals by manual entry, barcode scan, or by searching the nutrition library. The App remains usable without photo analysis.
• Accuracy. Nutrition estimates are approximations produced from an image and are wrong more often than users expect, particularly for mixed dishes and portion size. Check the portion and the items before you rely on a record, and never dose from an estimate without confirming it using your own plan.

Limits on our use of personal data

GlucIQ does not sell personal data or share it for cross-context behavioral advertising. The App carries no advertising SDKs, no advertising identifiers, and no HealthKit or Health Connect integration; we process none of that platform data today.

We do not use consumer health data for marketing, for eligibility decisions, or to target advertising, and we do not geofence health facilities.

GlucIQ is a consumer tool. It is not a HIPAA covered entity or business associate, and it creates no protected health information for a clinician. If your clinician asks you to use a system that must be HIPAA-compliant, GlucIQ is not that system.

GlucIQ holds no regulatory clearance in any market and makes no diagnostic or therapeutic claim. It does not provide medical advice, treatment, or insulin dosing recommendations, and it does not replace your care team. The Medical Device Position sets out where the boundary sits.

Who we share personal data with

We share personal data only with the processors and recipients in this table, under written agreements that limit them to our instructions.

We do not sell personal data, and we do not otherwise disclose health data to third parties for their own purposes.

International transfers

We are based in the United States, and our processors operate data centres in the United States and other countries. Where we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum as incorporated into our processor agreements. Where personal data is transferred from the UAE or Saudi Arabia, we rely on the transfer conditions in the applicable law, including the safeguards and consent mechanisms those laws provide. Write to [email protected] to request the current list of processing locations.

Retention and deletion

We may retain data longer where we are legally required to, where a legal claim is open, or where the data has been aggregated or de-identified so that it no longer identifies you. If you delete your account, the deletion flow tells you what will be deleted immediately and what will be retained, and why. Deleting an account does not cancel a subscription purchased through Apple or Google; you must cancel it in the store.

Your rights

Depending on where you live, you have some or all of the following rights. We apply them to every user who asks, without charging a fee and without degrading your service.

• Access and portability. Obtain a copy of your personal data. The App can export your local device data to a file, and we can provide a server-side export.
• Rectification. Correct inaccurate data. Most fields are editable in the App; write to us for anything you cannot change.
• Erasure. Delete your account and the records attached to it, in the App or by email.
• Restriction and objection. Ask us to stop a processing activity, including analytics and product announcements.
• Withdraw consent. Turn analytics off, disconnect a CGM or pump provider, remove the dietary profile, use the App without photo analysis, or delete the account.
• Non-discrimination. We will not deny service, charge more, or reduce quality because you exercised a right.
• Complaint. Lodge a complaint with your data protection authority. In the UAE you may complain to the UAE Data Office. In the EU or UK you may complain to your national supervisory authority. In California and other US states you may complain to the state attorney general.

To exercise any right, email [email protected] with the subject “Privacy request”. We verify that the request comes from the account holder, using the account email or an authenticated in-App action, and we respond within 30 days (one month under EU and UK law). If we need longer, we tell you why. You may use an authorized agent; we may ask for written authorization.

Regional notices

EEA, UK and Switzerland. AviyanLabs LLC is the controller. We process special-category data (health, ethnicity) on the basis of your explicit consent, which you provide when you enter the data or enable the feature. You can withdraw consent at any time, which stops future processing but does not make past processing unlawful. Where we rely on legitimate interests, we balance them against your rights and you can object.

United Arab Emirates. We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Your rights include access, correction, erasure, restriction, portability, objection, and withdrawal of consent, and you may complain to the UAE Data Office. Health data is treated as sensitive and is processed only with your consent, which you give through the App’s consent screens and by entering the data. Cross-border transfers rely on a permitted ground under the PDPL, including appropriate safeguards or your consent. The Executive Regulations have not been issued, so we apply the law’s requirements directly rather than a fixed penalty schedule. Send requests to [email protected].

Saudi Arabia. Where the Saudi Personal Data Protection Law applies, we process health data only with your explicit consent, provide the rights listed in Your rights, and transfer data outside the Kingdom only on a permitted ground. You can contact us at [email protected] and may complain to the Saudi Data and Artificial Intelligence Authority.

India. Under the Digital Personal Data Protection Act 2023, consent must be free, specific, informed, unconditional, and unambiguous. You give it through the App’s consent screens or by entering the data. A child is anyone under 18 in India, so a user under 18 needs verifiable parental consent, and we do not track or serve targeted advertising to children. Where the Significant Data Fiduciary duties apply to us, we appoint an India-based data protection officer and meet the accompanying obligations. The substantive duties in the Act, including the children’s and Significant Data Fiduciary provisions, are deferred to 13 May 2027. We apply the standard to Indian users today.

United States. We do not sell personal data or share it for cross-context behavioral advertising, and we have not done so in the past 12 months, so there is no opt-out link to provide for those activities. We honor access, deletion, correction, and portability requests from California residents and from residents of states with similar laws, and we honor the consent requirements that apply to consumer health data under Washington’s My Health My Data Act and Nevada’s consumer health data law.

Security

We encrypt data in transit, store credentials in managed services with access controls, and restrict production data access to engineers who need it for a specific task. The Security and data handling document describes our controls, our processors, and our vulnerability and incident processes in detail. No system is perfectly secure. Keep your device passcode enabled and your account email secure.

If we become aware of a breach that affects your personal data, we notify the competent authority where the law requires it and we notify you where the breach is likely to result in a high risk to your rights.

Children and age limits

The Services are for people aged 16 and older. We do not knowingly collect personal data from anyone under 16. If we learn that we hold data from a person under 16, we delete it. If you believe a child has provided us with personal data, write to [email protected] and we will act on it. We do not use the Services to serve behavioral advertising to anyone, and we do not knowingly process data of children for any purpose.

Changes to this policy

We version this policy and publish the date of the last substantive revision at the top of the page. We record material changes in the Security and data handling document so the history is auditable. If a change materially expands what we process or with whom we share it, we notify account holders by email or in the App at least 30 days before it takes effect, and where the law requires consent we ask for it. Continuing to use the Services after the effective date means you accept the revised policy.

Contact and complaints

AviyanLabs LLC, 30 N Gould St, Ste N, Sheridan, WY, United States. Privacy contact and data subject requests: [email protected]. We acknowledge privacy requests within 2 business days and complete them within the period stated in Your rights. If you are not satisfied with our response, you can complain to your data protection authority, the UAE Data Office, SDAIA in Saudi Arabia, or your state attorney general.