Privacy Policy
- Who we are
- Scope of this policy
- What GlucoRx Wellness is — and is not
- Information we collect
- How we collect it
- Keya AI features
- How we use information & legal bases
- Your choices and controls
- Who we share information with
- De-identified and aggregated data
- Website, cookies and tracking
- Storage and international transfers
- How long we keep information
- Deleting your account and data
- Your rights, by region
- A note on clinical-records laws
- Security and incident notification
- Health platforms and third-party links
- Children
- Complaints
- Changes to this policy
- Contact us
1. Who we are
GlucoRx Wellness is operated by GlucoRx International General Trading DWC-LLC ("GlucoRx International", "GlucoRx", "we"), Dubai South, DLC-BC-A1-4, OPO129, United Arab Emirates — the GlucoRx Wellness service operator and the data controller for the personal data described in this policy. Contact: international@glucorx.co.uk.
GlucoRx Limited, Unit 1C Henley Business Park, Pirbright Road, Guildford, Surrey, GU3 2DX, United Kingdom, is our UK parent company and the publisher shown on the app stores. Regional affiliates support GlucoRx Wellness in the markets where it is available — in India, GlucoRx Healthcare Pvt Ltd. Vixxa CGM and weighing-scale hardware purchases are handled by the relevant regional seller or authorized reseller (in India, including Bizcura Analytics LLP) under its own terms and privacy policy.
2. Scope of this policy
This policy explains what personal data the GlucoRx Wellness app and this website collect, why, who it is shared with, and the rights and controls you have. It governs GlucoRx Wellness only; hardware purchases, and third-party services you connect, are governed by their own policies. Some GlucoRx Wellness features, supported devices, and services may be unavailable or limited in your region due to product availability or local regulatory requirements.
3. What GlucoRx Wellness is — and is not
GlucoRx Wellness is a general wellness app, and Keya is the AI companion inside it — not a doctor, and not a medical device. They do not diagnose, treat, cure, or prevent any illness or medical condition. If you live with a medical condition, do not use GlucoRx Wellness or Keya in place of your medical care, prescribed devices, or treatment plan — use them only alongside that care, and never make treatment decisions based on anything the app shows or Keya says. Glucose values shown in GlucoRx Wellness are measurements produced by the separately regulated Vixxa continuous glucose monitoring system; always rely on your prescribed CGM system and qualified healthcare professionals for medical decisions. If you are experiencing a medical emergency, contact your local emergency services immediately.
4. Information we collect
Information you provide.
| Category | Details |
|---|---|
| Account | Name (optional display name), email address, account identifiers from your sign-in provider |
| Content you create | Food, activity and note logs; meal photos; lab and health documents you upload; goals and preferences (for example, glucose unit and target range) |
| Voice & chat | Voice audio and transcripts during Keya conversations you start; chat messages |
| Support | Messages you send us and the contact details you use to send them |
Information from devices and health platforms you connect.
| Category | Details |
|---|---|
| Glucose data | Readings, trends and sensor status from a Vixxa CGM you pair over Bluetooth |
| Health platform data | Only the types you approve via Health Connect (Android) or Apple Health / HealthKit (iOS), which may include: sleep, steps, exercise/workouts, distance, active energy, heart rate, resting heart rate, heart-rate variability, weight, body fat, lean body mass, oxygen saturation, respiratory rate. Access is per-type, opt-in, and revocable at any time in your device's health settings |
Information collected automatically. Technical information needed to run and support the service: app version, device model and operating-system version, sync status and error events, and — transiently, in server connection logs — your IP address and request timestamps. We do not collect your location (Bluetooth permissions on some Android versions exist solely for sensor pairing; no location is read, stored, or transmitted), advertising identifiers, or third-party analytics profiles. GlucoRx Wellness contains no advertising.
5. How we collect it
Directly from you (account setup, logging, uploads, conversations); from your paired sensor over Bluetooth; from your device's health platform with your per-type consent; automatically as described above; and when you contact support.
6. Keya AI features
Keya is the AI companion inside GlucoRx Wellness. When you log a meal by photo or description, or upload a medical lab report, the relevant content is sent to the Google Gemini API (Generative Language API) to estimate nutrition or extract structured results. This can include food photos, meal descriptions, and the contents of uploaded medical lab-report files, including PDFs or images. We use the paid tier, under which Google does not use your prompts, files, or responses to train or improve its models, and processes the data under Google's data-processing terms.
When you use Talk or chat with Keya, your microphone audio, chat text, and the minimum relevant context needed to answer you — such as recent glucose statistics, sleep and activity summaries, and items you've logged — may be processed by ElevenLabs. The real-time audio connection is provided by LiveKit. Talk and chat conversation content and relevant context may also be processed by Anthropic (Claude API) to generate Keya's responses. AI conversations are used to provide the feature, not to build advertising profiles, and conversation data is retained only for a limited operational period (up to 30 days) for quality, safety and debugging, then deleted. AI-generated responses may contain errors and do not constitute medical advice, diagnosis, or treatment; Keya is labeled as AI, declines diagnosis and dosing requests, and directs you to qualified professionals. You can use GlucoRx Wellness without the AI features, and you can report any AI response in-app.
7. How we use information, and our legal bases
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing GlucoRx Wellness: your readings, trends, scores, journal, records, and notifications you enable | Contract (Art 6(1)(b)); for health data, your explicit consent (Art 9(2)(a)) |
| AI conversations you start | Explicit consent |
| Service integrity, support, security, and abuse prevention | Legitimate interests (Art 6(1)(f)) |
| Compliance with law and legal process | Legal obligation (Art 6(1)(c)) |
We do not use your personal data for third-party advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.
8. Your choices and controls
You can, at any time: disconnect the CGM or any health-platform data type (device health settings); turn each notification category on or off; choose not to use the AI features; edit or delete individual logs and documents; correct your profile details; withdraw consent for any processing based on it (this doesn't affect processing that happened before withdrawal); and delete your account entirely (§14). We only send you marketing communications if you separately opt in, and every one includes an unsubscribe.
9. Who we share information with
We do not sell your personal information, and we do not share it with advertising platforms or data brokers. Health data is never used for advertising and never used for credit, insurance, or employment decisions. We share personal data only with:
- Service providers who process data on our behalf, under contract and only on our instructions. They process your data to provide services to us and may not use your data for their own purposes:
- Google Firebase — Authentication & Cloud Messaging. Firebase Auth manages sign-in (including Apple, Google, email, and phone sign-in where available), and Firebase Cloud Messaging issues device messaging tokens used to deliver app notifications.
- Google Cloud Platform — Cloud Run & Google Cloud Storage (GCS). Cloud Run hosts our backend. Google Cloud Storage stores private content such as meal photos, uploaded lab documents, and voice-related files.
- Google Gemini API (Generative Language API). Processes food photos/descriptions and uploaded medical lab-report PDFs or images as described in §6.
- ElevenLabs. Powers Talk with Keya; microphone audio and chat text may include health context such as glucose values.
- LiveKit. Provides real-time audio transport for voice conversations.
- Anthropic (Claude API). Processes Talk and chat conversation content and relevant context to generate Keya's responses.
- MicroTech / MTAiDEX (Vixxa CGM). Reads glucose sensor data on your device over Bluetooth to power monitoring and alerts.
- People you choose — if you use sharing features (when available), the specific data you decide to share with family members, friends, caregivers, or watchers you invite, controlled and revocable by you. This is not a sale of your data.
- When the law requires it — if we receive a legally valid demand (for example, a court order), we may have to disclose limited information. We only respond to valid legal process, we push back on overbroad requests, and where the law allows we will tell you.
If GlucoRx is ever involved in a merger, acquisition, or asset sale, your data would remain protected by this policy and you would be notified of any change of controller.
10. De-identified and aggregated data
We may create and use aggregated or de-identified data — which can no longer reasonably identify you — to improve GlucoRx Wellness, for statistics, and for research into wellness features. We commit not to attempt to re-identify de-identified data, and we require the same of anyone we share it with.
11. Website, cookies and tracking
The pages on this site are static and set no advertising or analytics cookies. Our hosting provider records standard access logs (IP address, time, page) for security and operations. If we add analytics to this website in future, we will update this policy and request any consent required.
12. Where your data is stored, and international transfers
GlucoRx Wellness runs on Google Cloud Platform, and some service providers process data outside the UK. Where personal data is transferred internationally, transfers are protected by the providers' data-processing terms incorporating the applicable safeguards — the UK Addendum / International Data Transfer Agreement and the EU Standard Contractual Clauses.
13. How long we keep information
Retention. We retain your account and health data for as long as your account is active, unless you delete an item earlier or ask us to delete your account. When you request account deletion at callkeya.com/delete-account, we delete your personal and health data across our systems — including authentication records, health and glucose data, meal photos, uploaded documents, and voice audio/transcripts — and request deletion from our service providers, typically within 30 days. We may retain aggregated or de-identified data that cannot reasonably be used to identify you.
| Data | Retention |
|---|---|
| Account & profile | While your account is active; deleted on account deletion |
| Glucose, health-platform data, logs, documents | While your account is active, or until you delete the item; deleted on account deletion |
| AI conversation data (provider-side) | Up to 30 days for quality, safety and debugging, then deleted |
| Support correspondence | Up to 24 months after resolution |
| Server connection logs | Short rolling window for security and operations |
| Aggregated / de-identified data | May be retained indefinitely (cannot identify you) |
| Records required by law | As long as the law requires, then deleted |
14. Deleting your account and data
You can request deletion of your account and data at any time at callkeya.com/delete-account — no app installation required. We confirm the request and complete deletion within 30 days. Deletion covers your account, glucose and health data, logs, photos, documents, goals, and conversation history held by GlucoRx Wellness, except the narrow legal-retention items listed in §13.
15. Your rights, by region
United Kingdom and EEA. You have the rights of access, rectification, erasure, restriction, objection, and the right to withdraw consent at any time. Contact international@glucorx.co.uk; we respond within 30 days (extendable as the law allows for complex requests). We will never discriminate against you for exercising your rights.
United States. GlucoRx Wellness is available in the US for use with your device's health platform. Depending on your state (including California and other states with consumer privacy laws), you may have rights to know/access, correct, delete, and to opt out of sale, sharing for targeted advertising, and certain profiling — we do none of those three. Where state law protects consumer health data specifically (for example, Washington's My Health My Data Act), the health data we collect is as described in §4, we do not sell it, and you may exercise access and deletion rights — and appeal a refusal — via the same contact. Authorized agents may submit requests where state law provides.
India. You have the rights provided by the Digital Personal Data Protection Act 2023, including access, correction, erasure, and grievance redressal. Write to international@glucorx.co.uk marked "Grievance — GlucoRx Wellness"; we acknowledge and respond within the statutory timelines.
UAE and Saudi Arabia. You have the rights provided by the UAE Personal Data Protection Law and the KSA Personal Data Protection Law respectively, exercisable through the same contact.
Everywhere else. We honour access, correction, and deletion requests through the same contact regardless of where you live.
16. A note on clinical-records laws
GlucoRx Wellness is a direct-to-consumer wellness app. The health information you bring to GlucoRx Wellness is governed by this policy and applicable consumer privacy laws — not by clinical-records regimes that apply to healthcare providers and insurers (such as HIPAA in the US). Do not use GlucoRx Wellness to store information you believe requires clinical-records-level legal protection.
17. Security, and if something goes wrong
How we protect your data. We use technical, administrative, and organizational safeguards to protect your health and personal information. Data is encrypted in transit (HTTPS/TLS) and encrypted at rest (our database and file storage on Google Cloud encrypt stored data by default). We enforce access controls so only authorized systems and personnel can access data, and we follow secure development and vulnerability-management practices.
No system is perfectly secure; if a security incident affects your personal data, we will notify you and the relevant authorities in accordance with applicable law — including the UK GDPR's 72-hour authority-notification requirement.
18. Health platforms and third-party links
Data you allow GlucoRx Wellness to read from Health Connect or Apple Health / HealthKit remains governed by those platforms' own controls — you can review and revoke GlucoRx Wellness's access there at any time, independent of us. Links from GlucoRx Wellness or this site to third-party services (for example, hardware store pages) lead to services governed by their own terms and privacy policies.
19. Children
GlucoRx Wellness is intended for users aged 13 and older. It is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If we learn that a child under 13 has created an account or provided personal data without verifiable parental consent, we will take steps to delete that information and close the account. If you believe a child under 13 has provided us with personal data, contact us at international@glucorx.co.uk.
Users between 13 and 17 should use GlucoRx Wellness only with the involvement of a parent or legal guardian where required by local law.
20. Complaints
We'd rather fix it first — contact international@glucorx.co.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk), your EEA supervisory authority, India's Data Protection Board, or your local data protection authority.
21. Changes to this policy
We will update this page and the date above when this policy changes, and notify you in-app of material changes before they take effect.
22. Contact us
UK parent and app-store publisher: GlucoRx Limited · Unit 1C Henley Business Park, Pirbright Road, Guildford, Surrey, GU3 2DX, United Kingdom
international@glucorx.co.uk
