Privacy notice

Glucosteps helps people with diabetes understand how their meals affect their glucose. We collect the food and glucose information you choose to add, store it securely in the UK/EU, and use it only to show you your own insights and improve the app. We do not sell your data. You can download or delete everything at any time.

Glucosteps is an educational self-management tool, not a medical device. It does not diagnose, treat or replace clinical care. Always consult your diabetes nurse, GP or NHS 111. Call 999 in an emergency.

Glucosteps is operated by Glucosteps Ltd ("we", "us"). For pilot data-protection questions contact contact@glucosteps.co.uk. We are the data controller for the information you add to the app.

• Account: email address, sign-in identifiers (Google sub if you use Google), hashed password if you use email/password.
• Profile (optional): name, date of birth, gender, ethnicity, postcode prefix, diabetes type, diagnosis year, medications, HbA1c, target glucose range, preferred cuisines.
• Health data you add: meals, food items, glucose readings, notes. This is special-category health data under UK GDPR.
• App usage: feedback you submit, basic technical logs (errors, page paths, user-agent) to keep the app running.

• To run the app for you. Article 6(1)(b) performance of contract; Article 9(2)(a) explicit consent for health data.
• To improve the app during the pilot. Article 6(1)(f) legitimate interests in delivering and refining the service, balanced against your rights.
• Anonymised research (optional). Only if you opt in on the consent screen. You can withdraw any time.

We do not use your data for advertising. We do not perform automated decisions that have legal or similarly significant effects on you.

When you describe a meal or use the AI coach, your text is sent to a third-party AI processing provider for analysis. We send only the meal text and your profile guidance context — never your account email or raw identifiers. Our provider is contractually bound not to retain your inputs for model training. AI output is guidance, not clinical advice, and may be incorrect.

• You.
• A small Glucosteps team for support, debugging and aggregate pilot review.
• A short list of sub-processors who only act on our instructions, covering: cloud hosting, database and authentication (UK / EU); edge runtime and content delivery; AI processing for meal analysis; and public food reference data (no user data sent).
• We do not share your data with the NHS, employers, insurers, or marketing partners.

A current list of named sub-processors is available on request from contact@glucosteps.co.uk.

Data is stored in the UK / European Economic Area. Some sub-processors may process data in other countries under UK-approved transfer mechanisms (e.g. Standard Contractual Clauses, UK addendum).

Pilot data is kept for the duration of the pilot and up to 12 months after the pilot ends, unless you delete your account first. Aggregated, anonymised statistics that cannot identify you may be kept indefinitely.

Under UK GDPR you can, at any time:

• Request a copy of your data by emailing contact@glucosteps.co.uk. We'll send it within 30 days, usually much sooner.
• Delete your account and all linked data (Settings → Delete my account).
• Withdraw a consent (Settings, or by emailing us).
• Ask us to correct anything wrong or restrict processing.
• Complain to the UK Information Commissioner's Office (ico.org.uk).

Data is encrypted in transit (TLS) and at rest. Database access is restricted with row-level security so your records are only readable by your account. We do not store payment data. If we ever suspect a breach affecting your data we'll notify you and the ICO within 72 hours as required.

Glucosteps is not for under-18s during the pilot. Please do not sign up if you are under 18.

If we materially change how we handle your data we'll bump the consent version and ask you to re-agree the next time you open the app.