Privacy Policy
- Who we are
- Scope of this policy
- What Keya is — and is not
- Information we collect
- How we collect it
- Keya's AI features
- How we use information & legal bases
- Your choices and controls
- Who we share information with
- De-identified and aggregated data
- Website, cookies and tracking
- Storage and international transfers
- How long we keep information
- Deleting your account and data
- Your rights, by region
- A note on clinical-records laws
- Security and incident notification
- Health platforms and third-party links
- Children
- Complaints
- Changes to this policy
- Contact us
1. Who we are
Keya is published by GlucoRx Limited ("GlucoRx", "we"), Unit 1C Henley Business Park, Pirbright Road, Guildford, Surrey, GU3 2DX, United Kingdom — the technology provider and the data controller for the personal data described in this policy. Contact: support@glucorx.co.uk.
Day-to-day operations and customer support for Keya are managed by our affiliate GlucoRx International General Trading DWC-LLC (Dubai South, Dubai, UAE), acting on behalf of GlucoRx Limited, together with regional affiliates in the markets where Keya is available — in India, GlucoRx Healthcare Pvt Ltd. Vixxa CGM and weighing-scale hardware purchases are handled by the relevant regional seller or authorized reseller (in India, including Bizcura Analytics LLP) under its own terms and privacy policy.
2. Scope of this policy
This policy explains what personal data the Keya app and this website collect, why, who it is shared with, and the rights and controls you have. It governs the Keya app only; hardware purchases, and third-party services you connect, are governed by their own policies. Some Keya features, supported devices, and services may be unavailable or limited in your region due to product availability or local regulatory requirements.
3. What Keya is — and is not
Keya is a general wellness companion — not a doctor, and not a medical device. It does not diagnose, treat, cure, or prevent any illness or medical condition. If you live with a medical condition, do not use Keya in place of your medical care, prescribed devices, or treatment plan — use it only alongside them, and never make treatment decisions based on anything Keya shows or says. Glucose values shown in Keya are measurements produced by the separately regulated Vixxa continuous glucose monitoring system; always rely on your prescribed CGM system and qualified healthcare professionals for medical decisions. If you are experiencing a medical emergency, contact your local emergency services immediately.
4. Information we collect
Information you provide.
| Category | Details |
|---|---|
| Account | Name (optional display name), email address, account identifiers from your sign-in provider |
| Content you create | Food, activity and note logs; meal photos; lab and health documents you upload; goals and preferences (for example, glucose unit and target range) |
| Voice & chat | Voice audio and transcripts during Keya conversations you start; chat messages |
| Support | Messages you send us and the contact details you use to send them |
Information from devices and health platforms you connect.
| Category | Details |
|---|---|
| Glucose data | Readings, trends and sensor status from a Vixxa CGM you pair over Bluetooth |
| Health platform data | Only the types you approve via Health Connect (Android) or Apple Health (iOS), which may include: sleep, steps, exercise/workouts, distance, active energy, heart rate, resting heart rate, heart-rate variability, weight, body fat, lean body mass, oxygen saturation, respiratory rate. Access is per-type, opt-in, and revocable at any time in your device's health settings |
Information collected automatically. Technical information needed to run and support the service: app version, device model and operating-system version, sync status and error events, and — transiently, in server connection logs — your IP address and request timestamps. We do not collect your location (Bluetooth permissions on some Android versions exist solely for sensor pairing; no location is read, stored, or transmitted), advertising identifiers, or third-party analytics profiles. Keya contains no advertising.
5. How we collect it
Directly from you (account setup, logging, uploads, conversations); from your paired sensor over Bluetooth; from your device's health platform with your per-type consent; automatically as described above; and when you contact support.
6. Keya's AI features
Keya includes an AI companion you can talk or type to. When you start a session, the minimum relevant information needed to answer you — such as recent glucose statistics, sleep and activity summaries, and items you've logged — is transmitted to our conversational-AI service providers to generate the response. AI conversations are used to provide the feature, not to build advertising profiles, and conversation data is retained only for a limited operational period (up to 30 days) for quality, safety and debugging, then deleted. AI-generated responses may contain errors and do not constitute medical advice, diagnosis, or treatment; Keya's assistant is labeled as AI, declines diagnosis and dosing requests, and directs you to qualified professionals. You can use Keya without the AI features, and you can report any AI response in-app.
7. How we use information, and our legal bases
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing Keya: your readings, trends, scores, journal, records, and notifications you enable | Contract (Art 6(1)(b)); for health data, your explicit consent (Art 9(2)(a)) |
| AI conversations you start | Explicit consent |
| Service integrity, support, security, and abuse prevention | Legitimate interests (Art 6(1)(f)) |
| Compliance with law and legal process | Legal obligation (Art 6(1)(c)) |
We do not use your personal data for third-party advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.
8. Your choices and controls
You can, at any time: disconnect the CGM or any health-platform data type (device health settings); turn each notification category on or off; choose not to use the AI features; edit or delete individual logs and documents; correct your profile details; withdraw consent for any processing based on it (this doesn't affect processing that happened before withdrawal); and delete your account entirely (§14). We only send you marketing communications if you separately opt in, and every one includes an unsubscribe.
9. Who we share information with
We do not sell your personal information, and we do not share it with advertising platforms or data brokers. Health data is never used for advertising and never used for credit, insurance, or employment decisions. We share personal data only with:
- Service providers who process data on our behalf, under contract and only on our instructions — cloud hosting and storage, sign-in/authentication, and the AI and voice technology that powers Keya's conversations and nutrition estimates (companies such as Google and ElevenLabs). They may not use your data for their own purposes.
- People you choose — if you use sharing features (when available), the specific data you decide to share with family members or friends you invite, controlled and revocable by you.
- When the law requires it — if we receive a legally valid demand (for example, a court order), we may have to disclose limited information. We only respond to valid legal process, we push back on overbroad requests, and where the law allows we will tell you.
If GlucoRx is ever involved in a merger, acquisition, or asset sale, your data would remain protected by this policy and you would be notified of any change of controller.
10. De-identified and aggregated data
We may create and use aggregated or de-identified data — which can no longer reasonably identify you — to improve Keya, for statistics, and for research into wellness features. We commit not to attempt to re-identify de-identified data, and we require the same of anyone we share it with.
11. Website, cookies and tracking
The pages on this site are static and set no advertising or analytics cookies. Our hosting provider records standard access logs (IP address, time, page) for security and operations. If we add analytics to this website in future, we will update this policy and request any consent required.
12. Where your data is stored, and international transfers
Keya's backend runs on Google Cloud Platform, and some service providers process data outside the UK. Where personal data is transferred internationally, transfers are protected by the providers' data-processing terms incorporating the applicable safeguards — the UK Addendum / International Data Transfer Agreement and the EU Standard Contractual Clauses.
13. How long we keep information
| Data | Retention |
|---|---|
| Account & profile | While your account is active; deleted on account deletion |
| Glucose, health-platform data, logs, documents | While your account is active, or until you delete the item; deleted on account deletion |
| AI conversation data (provider-side) | Up to 30 days for quality, safety and debugging, then deleted |
| Support correspondence | Up to 24 months after resolution |
| Server connection logs | Short rolling window for security and operations |
| Aggregated / de-identified data | May be retained indefinitely (cannot identify you) |
| Records required by law | As long as the law requires, then deleted |
14. Deleting your account and data
You can request deletion of your account and data at any time at callkeya.com/delete-account — no app installation required. We confirm the request and complete deletion within 30 days. Deletion covers your account, glucose and health data, logs, photos, documents, goals, and conversation history held by Keya, except the narrow legal-retention items listed in §13.
15. Your rights, by region
United Kingdom and EEA. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. Contact support@glucorx.co.uk; we respond within 30 days (extendable as the law allows for complex requests). We will never discriminate against you for exercising your rights.
United States. Keya is available in the US for use with your device's health platform. Depending on your state (including California and other states with consumer privacy laws), you may have rights to know/access, correct, delete, and obtain a portable copy of your personal information, and to opt out of sale, sharing for targeted advertising, and certain profiling — we do none of those three. Where state law protects consumer health data specifically (for example, Washington's My Health My Data Act), the health data we collect is as described in §4, we do not sell it, and you may exercise access and deletion rights — and appeal a refusal — via the same contact. Authorized agents may submit requests where state law provides.
India. You have the rights provided by the Digital Personal Data Protection Act 2023, including access, correction, erasure, and grievance redressal. Write to support@glucorx.co.uk marked "Grievance — Keya"; we acknowledge and respond within the statutory timelines.
UAE and Saudi Arabia. You have the rights provided by the UAE Personal Data Protection Law and the KSA Personal Data Protection Law respectively, exercisable through the same contact.
Everywhere else. We honour access, correction, and deletion requests through the same contact regardless of where you live.
16. A note on clinical-records laws
Keya is a direct-to-consumer wellness app. The health information you bring to Keya is governed by this policy and applicable consumer privacy laws — not by clinical-records regimes that apply to healthcare providers and insurers (such as HIPAA in the US). Do not use Keya to store information you believe requires clinical-records-level legal protection.
17. Security, and if something goes wrong
Data is encrypted in transit (TLS) and stored on encrypted infrastructure, with access limited to what operating Keya requires. No system is perfectly secure; if a security incident affects your personal data, we will notify you and the relevant authorities in accordance with applicable law — including the UK GDPR's 72-hour authority-notification requirement.
18. Health platforms and third-party links
Data you allow Keya to read from Health Connect or Apple Health remains governed by those platforms' own controls — you can review and revoke Keya's access there at any time, independent of us. Links from Keya or this site to third-party services (for example, hardware store pages) lead to services governed by their own terms and privacy policies.
19. Children
Keya is intended for adults 18+. It is not directed at children and we do not knowingly collect children's data; if you believe a child has created an account, contact us and we will delete it.
20. Complaints
We'd rather fix it first — contact support@glucorx.co.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk), your EEA supervisory authority, India's Data Protection Board, or your local data protection authority.
21. Changes to this policy
We will update this page and the date above when this policy changes, and notify you in-app of material changes before they take effect.
22. Contact us
support@glucorx.co.uk