Privacy policy

glyso ("we") is run by Glyso Ltd, a private limited company registered in England and Wales (company number 17534786), whose registered office is 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. Glyso Ltd runs glyso.health and the glyso app and is the data controller for everything below. Until 22 October 2026 glyso was run by its founder, Nikhil Shah, as a sole trader; on that date Glyso Ltd took over the service and the data it holds, for the same purposes and under this same policy. Contact: [email protected].

We collect what you give us when you join our mailing list, waitlist or pilot on glyso.health. The mailing list asks only for your email, and joining it is your request for glyso news and launch updates by email; you can leave at any time with the one-tap unsubscribe link in any of them, by replying, or by writing to [email protected] (we keep the date you left, so we never write to you again by mistake). Earlier sign-up forms also asked for your name, sensor, whether you live with type 1 or type 2, your answer to "what would you want glyso to tell you", and your marketing choice. If you are a beta tester and fill in our beta form, we also keep your answers: which phone you use, your sensor, which type of diabetes you have, your wearables, how you take insulin, why you joined, what you want glyso to help with, what you use and pay for today, whether you would join a call, and your postal address and country, so we can send you a thank-you at the end of the beta. We use them to set up the beta, improve glyso and describe our testers in anonymous totals (for example to investors), never to identify you to anyone else. Every website sign-up also records which link brought you to the page (for example which of our adverts or posts, or the site you came from; it never identifies you). In the app we collect: your account email; your name, if you sign in with — or link — Apple and choose to share it (Apple's "Hide My Email" gives us a masked address instead, and glyso works exactly as well with one); if you choose to link Apple sign-in to an account you already have, the record that the two ways of signing in belong to the same account — kept by Supabase alongside your sign-in, so that either one opens it; we do not receive your real email address when you use Hide My Email, and linking does not reveal it to us; your CGM login (stored encrypted, used solely to fetch your readings with your permission); which sensor you wear and when your current one started — the model, if you tell us (we ask Dexcom wearers once, and it is skippable), never the individual sensor's serial number, together with the time your current sensor or your connection began, so that the app can tell you a new sensor is still warming up rather than leaving an empty chart that looks like a failed connection; for Libre, both figures come from Abbott's own feed where it reports them — it tells us when the sensor was applied and how long it warms up for — and otherwise the start time is simply when you connected; your glucose readings; the meals, photos, notes, movement and insulin you choose to log; your step counts, the sustained walks your phone detects in them, workout sessions, your sleep, and — if you allow them — your heart rate (as fifteen-minute averages), resting heart rate, heart-rate variability (one figure per night), sleeping wrist temperature, respiratory rate and menstrual flow from Apple Health, if you connect it — see below; your sleep, workouts and recovery figures from WHOOP, if you connect that — also see below; your answers to the questions glyso asks you about them — what was different about a particular day, whether you skipped something you usually have, whether you took any insulin with a meal (if you tell us you took none, we record that you said so, when you answered it, and the minute it was about; it is an answer about a meal, never a dose of nothing, and nothing in the app scores or counts it), or whether a sudden overnight low was really you or you lying on your sensor (we keep your answer, when you answered it, the night and the minute it was about, and — where you say it was the sensor — which run of readings you told us to stop counting; we never delete the readings themselves, we simply stop counting that run in your figures); how you say you feel — one plain word you choose from a short fixed list (for example flat, OK, rested, wired, stressed), the minute you chose it, and whether you volunteered it or answered a question glyso put to you; when you were diagnosed — the month and year, if you choose to tell us (it is entirely optional and skippable, and we do not ask for a day), used only to show you a running count of days since diagnosis; your time zone — including when it changes, so the app can cut your days at your own midnights and show you on the chart where your clock moved, and whether you flew when it did (see "When your clock moves" below) — plus your target range and units; the questions you ask glyso in the app, read in order to answer them and not kept on our servers (see "When you ask glyso a question" below); and first-party usage analytics that never contain glucose values or meal text. We also keep the notifications glyso sends you — their wording and the screen each one opens — so that a notification you missed on your lock screen is still there to read in the app. We use it to run glyso — showing you your own data, explaining what moved your glucose, writing your coaching — and to improve it, based on contract, our legitimate interests, and your explicit consent for everything about your health.

We share it only with service providers who help us run glyso:

Database and sign-in: Supabase. Hosts our database and verifies your sign-in — your email, hashed password, or Apple sign-in. Privacy notice: https://supabase.com/privacy.
Hosting: Railway runs the backend; your data passes through it because the service runs there. https://railway.com/legal/privacy.
AI coaching: Anthropic. Each request carries only what that piece of coaching needs — the meal text or photo in question, the glucose figures for the period being explained, and, when you ask glyso a question in the app, what you typed and a table of your recent days (see "When you ask glyso a question", below), and, once a week, the few comparisons behind your weekly trends sentence (see "Your weekly trends", below). We keep no profile of you there, and Anthropic's commercial terms do not permit training on customer data. https://www.anthropic.com/legal/privacy.
Email: Resend sends our emails — sign-in codes, confirmations, pilot notices — from a glyso.health address. https://resend.com/legal/privacy-policy.
Push notifications: Expo delivers them to your device. https://expo.dev/privacy.
Weather: Open-Meteo provides the day's weather from coarse location, so a hot afternoon can be part of an explanation.
Error tracking: Sentry receives crash and error reports from the app so we can fix what breaks — technical details of the failure: where the code stopped, the app version, the device and operating system. A crash report is built without your glucose values, meals, doses or email, and the app never sends a screenshot, a recording of your session or a picture of what was on screen. We use Sentry's EU region. https://sentry.io/privacy/.
Website: Cloudflare serves glyso.health; its analytics are cookie-free and aggregate — pages, countries, referrers — and we cannot see who you are in them. https://www.cloudflare.com/privacypolicy/.
Founder calls: Calendly. What you enter when booking — name, email, your answers — goes to Calendly under its own notice, and to us. https://calendly.com/privacy.
Your CGM provider: Abbott (LibreLinkUp) or Dexcom (Share). We fetch your readings from your existing account, with your permission, under their terms; what we fetch becomes covered by this policy. https://www.diabetescare.abbott/privacy-policy.html · https://www.dexcom.com/privacy-policy.

Where data leaves the UK or EEA — several of these are US companies — we rely on UK adequacy decisions, the EU–US Data Privacy Framework, or Standard Contractual Clauses. We keep your data only as long as needed, as set out below.

What we do not do

We do not sell your personal data. Not to anyone. Not ever.
We do not run advertising trackers or pixels — not on the site, not in the app.
We do not share your data with insurers, employers, or data brokers.
We do not let anyone train third-party AI models on your data.
We do not put glucose values or meal text into analytics.
We do not email marketing to anyone who didn't tick the box.
We do not use anything from Apple Health for advertising or marketing, do not sell or share it, and never store it in iCloud.

When you ask glyso a question

The app lets you ask about your own record in your own words. Here is exactly what happens to what you type.

Your question goes to our AI provider, with the earlier messages in that same conversation and a table we build from your own record. For every day we hold for you in the last year (every day on which anything was recorded, including days with only a few sensor readings) it carries the date, that day's glucose figures (the average, time in range, how much it varied, the lowest and highest reading, whether it had only a few readings, and whether it went under your low line), your step count where a movement source sent one, your exercise that day (each workout or session's kind and minutes, from Apple Health, WHOOP or what you logged), how long you slept the night before where a device recorded it, what you logged that day in the words you logged it, with the time you ate it, whether it was breakfast, lunch, dinner or a snack, its carbohydrate and how far your glucose rose after it, and the insulin doses you logged that day, with their time, which insulin and the amount you typed. It also carries your latest glucose reading and how long ago it was taken, a month by month summary of the last year (average glucose, how much it varied, time in range, days measured, average steps and average exercise minutes), and the same kind of summary for groups of those days (for example days with 10,000 steps or more against the rest, days with and without exercise, by how long you slept, by when you ate dinner, weekdays against weekends, each week, and, when your question names a food, days with that food, days with meals logged and none of it, and days with nothing logged), each with how many of its days went under your low line. When your question needs them, it also carries each low's date, weekday, start time, minutes under your low line and lowest reading (up to the latest 80), how much of your time was above or below a level you named, your glucose by part of the day and for the night after dinner, figures for days that followed a day with exercise, the meals you logged with a food you asked about and how far you rose after each, and today's date and your local time. It also carries a ranking of the meals you logged at each time of day, by how far your glucose rose after them, and which kind of diabetes you told us you have, so the AI can quote the published targets that apply to you (from NICE and the international consensus on CGM targets) when you ask what they are. The AI may read your doses and your latest reading to explain what happened. glyso never shows a dose amount in an answer, never suggests a dose or a treatment, and never says where your glucose is heading. If your latest reading was at or under your low line when you asked, the answer says so and still answers.

The AI reads that table to answer you. It has no connection to our database and no way to look anything up beyond the table we send. The figures in the table are measured by glyso from your sensor and your log. When you compare groups of days, ask which meal raised you least, ask what a food does to you, or ask about your lows, your sleep or a level you name, glyso measures the answer itself. It sends the AI those measured figures as a list of labelled blanks, each shown with its value (for example "pasta, average rise" and "3.6 mmol/L on average"). The AI writes the wording and glyso fills in every number. The AI's sentence may only point at those blanks: it may not write a number, a unit, a date or a word such as "more", "higher" or "twice" of its own, and glyso puts its own measured value, in your units, in each blank. Which of two things is higher, lower or about the same is also glyso's: glyso writes that part of the sentence from the figures it measured, and the AI may only place it. Around the blanks the AI may use only a fixed list of plain words (the name of a food or a group, and ordinary words such as "raised", "averaged", "days" or "after"), so it cannot add a verdict of its own such as "yes", "no", "harder" or "kinder". A name the AI writes must stand with that group's own figure: "rice and pasta raised you 3.6 mmol/L" is replaced when 3.6 is pasta's alone. glyso writes and checks the answer the same way when the AI chooses a comparison or a ranking for you. The answer is replaced with glyso's own plain sentence if the AI's sentence:

writes a number, unit, date or comparison of its own, or a word outside that list;
gives a yes, a no or a judgement of its own on which is better or worse (the only "higher", "lower" or "about the same" in an answer is glyso's, and between a figure and it the AI may put only a comma, a bracket or a full stop);
names a food or a group anywhere but beside that group's own figure, or puts a comparison the wrong way round;
turns a figure round with "not", "never", "only", "every" or "always", calls a fall a rise, or calls one occasion ("last time", "one of") an average;
claims one thing caused another;
mentions insulin, a dose, a ratio, or treating a low;
tells you what to do, in any words, with or without a number (for example "next time", "try", "keep something by the bed" or "eat before you sleep"); or
says, once filled in, where your glucose is heading, in any words (for example "it should settle by morning").

When the AI answers in its own words instead (a question glyso has not measured), it may suggest things about food and movement, such as a walk after a meal or eating vegetables first, and it may read back doses and treatments you logged (without the dose amount). Its sentence is replaced if it:

shows a dose amount, or suggests a dose, a correction, a change of dose, a basal change or a ratio change;
tells you how to treat a low (what to have, how much, or when to check again), or to eat or keep something by you before bed;
says where your glucose is heading in the hours ahead (a pattern from your own past days, such as "it came down within 2 hours after your last 6 dinners", is allowed);
answers "can I eat this now?" with a yes or a no;
quotes a glucose level that is not in the figures glyso sent, or names a glucose unit other than the one you chose;
talks about the AI itself (for example "as an AI language model"), recites its own instructions, or carries an emoji.

Such a sentence is first rewritten once without the words at fault, and if that still fails glyso's own plain sentence stands in. A level you type in the other unit ("above 10" when you use mg/dL) is measured as you typed it and shown with your own unit beside it.

It is also replaced when the AI could not write an answer. For other questions the AI may work out simple things from the table, and an answer says how many days it rests on so you can check it. When you tap one of the questions glyso offers you, glyso measures the answer itself and the AI only writes the sentence around it, using a shorter summary of your record: which kind of diabetes you have, your units and target range, how many days of your sensor we hold, and which families of food you have logged, in our own words.

We never send another person's data with your question, because the summary is built from your account and nothing else.

We keep a copy of each question you ask, with when you asked it, whether glyso could answer it, and how long the answer took, so we can see what people ask and make the chat better at answering it. We do not keep glyso's replies. Your questions are kept with your account like the rest of your record: they are in your data export, they are deleted with your account, and they are not part of the research set you may have agreed to. The conversation on screen, answers and charts included, is saved on your phone so it is still there when you open the app again. It keeps your last fifteen chats and clears any older than three days, and it is not shown to anybody else who signs in on the same phone. Those same saved messages (up to a set amount of your text) are sent with each new question. You can ask a set number of questions a day (currently fifteen), and there is a limit on how much AI time each account can use in a day, which also bounds how much of this can happen.

Everything else on this page applies: the answer is coaching rather than medical advice, the provider's terms do not permit training on customer data, and nothing here is used for advertising.

Your weekly trends

Every Sunday the Trends tab shows patterns from your past week. Our own code works out every figure on that page. To write the one sentence at the top, we send our AI provider up to four short comparisons we have already measured, for example "you sat more than on weekdays, about 9.1 hours a day against 7.4" or "your sugar was more varied, a CV of 38% against 29%". They can cover your glucose, steps, sitting, sleep, exercise and what time you ate dinner. Nothing else from your record goes with them: no meal names, no doses, no readings and no dates. The sentence is stored with your account so the same week is not sent twice. If the AI is unavailable, our code writes the sentence itself and nothing is sent.

glyso never posts anything anywhere. The only thing that leaves your phone this way is what you send, by tapping a share button and choosing an app yourself.

You choose how much the card says, with a control on the sharing screen that has two positions. Whichever you pick, the card and the line of text that can go instead of it say exactly the same thing — there is not a quieter picture and a chattier message.

Numbers only. A time-in-range percentage, how many days of the week that figure was measured from, the seven daily percentages behind it, how many of your nights stayed inside your range and how many were measured, your average glucose overnight, how many meals you logged, and the week's dates. Nothing else: no meal names, no times of day, no notes and nothing you typed. That is enforced by the way the card is built rather than only promised here — apart from the one field described next, there is no field on it that a name or a time could travel in.

With meals. Everything above, plus the names of up to three meals you logged that week and what each one did to your glucose, drawn as a small curve. They are the same meals the story showed you a screen earlier, in your own words as you logged them. Still no times of day, no notes, and nothing else you have logged. This is the position the control starts in, and moving it changes the picture in front of you before you send anything.

Where your phone's share sheet can take a picture, the image is written to the app's own storage on your device and handed to that sheet. Where it cannot — or where the picture could not be produced — the same card goes as a single line of text instead. It carries exactly what the picture would have: the same figures, the same setting of the control, nothing added. The app tells you which of the two happened.

Where it goes next is whichever app you pick in your phone's own share sheet, under that app's terms; we are never told which one you picked there, and we never see the post.

We count that a share happened, and three things about it: which of the three buttons in glyso you tapped — Reddit, WhatsApp or Instagram, which chooses the card's shape and nothing else — whether the picture or the text went, and which of the two positions the "how much to say" control was in. That last one is which setting you chose, never what was under it: no meal name, no figure and nothing else about the card's contents rides on that count.

How you say you feel

glyso lets you record a mood the same way you record a meal: one tap, one plain word, timestamped onto your own curve. You can log one whenever you like, and glyso may ask — once in a morning at most — how you woke up.

It is never a number. There is no 1–10 scale and no rating, in the app or in our database, and you never type anything: the words are buttons, from a short fixed list. So we hold no free text about your mental state and no score derived from one.

Nothing about it is scored or rewarded. Logging a mood earns no points, no streak and no badge, and answering the question earns nothing either. A reward for answering would be a reason to invent an answer.

We use it for one thing: understanding your own glucose. It appears on your own chart, and once you have enough of your own days, glyso compares the days you logged one word against the days you logged a different one — over the same hours of the day, and only ever across days you actually told us something about. Days you logged nothing are used for neither side of that comparison. Those comparisons describe what happened together; they do not claim that a mood caused a glucose reading or the other way round.

Like everything else in this section, it is special-category health data — about your mental state — processed only with your explicit consent, and destroyed with your account.

When your clock moves

When your phone tells us you are in a new time zone, glyso marks the moment on your chart. If the move looks like a flight, it also draws an approximate flight on that day: where your sensor went quiet around the move, or, without that, a window before it. That guess is worked out from records we already hold (your glucose readings, the time zone change and when you last opened the app). We do not read your location, your calendar, your email or your bookings for it, and we ask for no new permission.

glyso then asks you once: did you fly, and if so roughly how many hours. We keep your answer, when you answered it, and which clock change it was about. A length you give replaces our guess on the chart. If you say you did not fly, the flight is taken off the chart and the clock change stays, because your clock did move. Answering earns nothing and is never scored; glyso does not send a notification to ask.

If you said you flew and your glucose came down noticeably around the flight, glyso shows you, once for that trip, a short note on how flying can affect insulin pumps and pods. We keep when you put that note away, so it is not shown again.

Like the rest of your record, these answers are destroyed with your account and included when you export it.

Health data

Your glucose readings, meals, diabetes type, medications, the moods you record and everything derived from them are special-category health data under UK GDPR. We process them only with your explicit consent (Article 9(2)(a)), given when you create your account and connect your sensor, and solely to provide glyso to you. Withdraw at any time — delete your account in the app, or email us — and we stop processing and destroy what identifies you, as described below.

glyso is a coaching app, not a medical device. It explains what already happened; it does not diagnose, treat, alarm, or give insulin dosing advice. Real-time alerts remain your CGM's job; decisions about your care belong with you and your clinical team.

Apple Health

If you connect Apple Health, we read eight kinds of measurement and one category from it, and nothing else: your step counts, your workout sessions — for a workout, when it started and ended, what kind it was, and the energy Health recorded for it — your sleep, your heart rate, your resting heart rate, your heart-rate variability, your sleeping wrist temperature, your respiratory rate, and the menstrual flow you record in Health. iOS asks you about each one separately, and you can allow some and refuse others — the rest of glyso carries on exactly as it did. Nothing else Health holds is read. Nothing is ever written back to it.

The five heart-and-night measurements were added in September 2026 for one reason: a glucose sensor sees what your glucose did and nothing about why, and the body's other signals — how hard your heart was working, how well you recovered overnight, where you are in your cycle — are very often the missing half of the explanation. Each one is read at the coarsest level of detail that still answers that question, and the detail is decided on your phone before anything is sent.

Step counts are read at two levels of detail: the day's total, and the minute-level pattern of steps across the day. The minute-level record is read so your phone can notice a sustained walk — ten minutes of steady steps after lunch that you would never start a workout for, which is often the missing half of why your glucose did what it did. That noticing happens on your phone: the minute-by-minute record itself is never sent to us and never stored by glyso anywhere. What reaches us is the finding — that a walk happened, when it started and ended, and how many steps it held — alongside the daily total.

The same minute-level record is also read, on your phone and in the same pass, to notice the opposite: a long stretch with no steps in it — an hour or more, during your waking day, with nothing between two spells of walking. Long unbroken sitting is one of the better-evidenced influences on what glucose does after a meal, so knowing when those hours fell is often the other missing half of the explanation. A stretch is only ever noticed between two spells of walking we actually recorded, and stretches that overlap your sleep are discarded. Again, only the finding reaches us — that a stretch happened, when it started and ended, and the handful of steps inside it — never the minute-by-minute record.

What this cannot tell apart. Apple Health records the absence of steps, not a zero, so an hour in which you sat perfectly still and an hour in which your phone was on a desk without you look exactly the same to us. If you leave your phone somewhere and come back to it, the time in between may be recorded as a stretch of sitting. We have no way to distinguish the two from step data, we do not claim to, and stretches longer than eight hours are discarded on the assumption that the phone, rather than you, stayed put.

Sleep

For sleep we read, for each night: when you fell asleep and when you woke, how long you were asleep, how long you were in bed, how long you were awake during the night, and — where your device measures them — how much of the night was light, deep and REM sleep. Naps are read the same way and are kept separately from nights.

Your phone works out the night; we store the result. Apple Health holds sleep as dozens of separate, overlapping intervals for a single night, often from more than one source at once — a watch, your iPhone's Sleep Focus schedule, and any other sleep app you use. Those intervals are merged on your phone into one night, and it is that summary — the times and the minute totals above — that reaches us. The individual intervals do not.

Where a source did not measure something, we store nothing for it rather than a zero. An iPhone that only knows the hours you told it you intended to sleep can say how long you were in bed and nothing about whether you actually slept, and we keep that distinction rather than flattening it into a number that would look like a measurement.

If you also connect WHOOP, we keep ONE record per night and choose whichever of the two contains the better evidence — a night with measured sleep stages beats one without, and a measurement beats a schedule. We do not keep two answers for the same night, because two answers is how a screen ends up telling you something we cannot stand behind.

We read sleep for one reason: to explain your glucose. Short or broken sleep is one of the strongest reasons a day behaves differently from your usual, it is something a glucose sensor cannot see, and it is very often the missing half of why a morning ran high. Sleep is never scored, graded, ranked or turned into a streak in glyso — it is a fact and a possible explanation, never a mark on a record.

Heart rate, and the wrist at night

Heart rate is read as fifteen-minute averages — for each quarter of an hour, the average, lowest and highest rate your watch recorded — and never as the second-by-second record. Your phone asks Apple Health for the quarter-hour figures directly, so the fine-grained record is not even loaded by glyso, let alone sent. We use the blocks for one thing: to count the quarter-hours in a day in which your heart was working above your own resting rate, which is the fairest measure of how much you moved when a watch is being worn. That threshold is built from your own resting heart rate and nothing else — never from your age, and never from a formula.

Resting heart rate is one figure per day, as Apple computes it — and, if you connect WHOOP, WHOOP's own figure for the day, kept separately because the two devices measure it differently and mixing them would give you a number that is neither.

Heart-rate variability is one figure per night. Your watch measures it at scattered moments through the day and those readings are noise; your phone keeps only the readings taken while you were asleep and sends us the median of them, with the count it was taken from. We never receive the individual readings, and we never use it to say where it is heading — only, looking back, whether a night's figure sat beside something that happened.

Sleeping wrist temperature and respiratory rate are one figure per night each, as your watch measures them during sleep.

Menstrual flow is read as the category you chose in Health — none, light, medium, heavy, or unspecified — for the days you recorded one. It is kept as that word and nothing more, because where you are in your cycle changes how the same food behaves, and that is something a glucose sensor cannot see. We never infer a cycle you did not record, and it is never used for anything but explaining your own glucose to you.

None of these is scored, graded, ranked or turned into a streak, and none of them can make your glyso energy score better or worse by going low, staying low, or not logging a low. Heart rate feeds the score's movement part exactly as your steps do today; the rest are facts and possible explanations, never marks on a record.

Alongside the connection record described below, we keep which of the nine kinds has ever reached us, and when it last did — so the app can tell you, per kind, whether it is coming through. iOS does not tell us which kinds you allowed, so this is the only honest way for the settings page to say "heart rate is coming through; sleep has not yet."

The rest

When you first connect, we read the last 90 days of those things, so that they join your whole history rather than only the days after you connected — your glyso energy score compares a day against your own recent normal, and a score that counted movement from Tuesday but not from Monday would not be comparable with itself. After that, the app sends recent days each time you open it, because Apple Health revises its own history when a second device syncs or you edit an entry.

Sleep is not part of your glyso energy score and does not change it.

Nothing that comes out of Apple Health is stored on your phone by glyso. It is read, and either sent to us over an encrypted connection (totals, workouts, detected walks, the sleep summary, the quarter-hour heart-rate blocks, the one-per-night and one-per-day figures) or used on the spot and dropped (the minute-level step record, the individual sleep intervals and the individual heart-rate-variability readings, none of which ever leaves the device). What the app keeps on the device is whether you have been through the permission screen and when it last synced — times and switches, no measurements.

We use it for one thing: understanding your own glucose. Movement is part of your glyso energy score — counted from your heart rate when a watch is worn, from your workouts and steps when it is not — and movement, sleep and recovery are all very often the missing half of an explanation — a morning walk can be doing work that breakfast gets the blame or the credit for. When a piece of coaching is about a day you moved, that figure goes to our AI provider with the rest of that request, on the same terms as everything else here: to write your coaching, never to train a model, never for advertising.

Apple's rules for health data are stricter than the law's, and we follow them. Data from Apple Health is never used for advertising or marketing, never sold, and never stored in iCloud. It is kept out of the aggregated, de-identified learning described in the next section — the improvement work we do without asking you excludes anything that came from Apple Health.

Two kinds of it can join the wider research set, and only if you say so. Your steps and your workouts — not your sleep, not your heart rate, not your heart-rate variability, not your wrist temperature, your respiratory rate or your menstrual flow — are part of what "movement" means in the opt-in question described below, because how much you moved is half of the explanation of what your glucose did. That is the specific ask this paragraph used to promise, it is a separate opt-in you are free to refuse, and refusing it changes nothing else about the app. If you have not said yes to that question, nothing from Apple Health leaves us in any form.

Alongside the two kinds of data, we keep a short record of the connection itself: when your phone first sent us Health data, when it last did, and whether you have switched Apple Health off inside glyso. It contains no health data — only times. We keep it because your glyso energy score has to say honestly whether movement is one of the things it counted, and because iOS does not tell us when you withdraw access.

Which apps wrote to your Health. Each time your phone sends Health data, it also tells us the names of the apps that wrote your steps, heart rate, sleep or workouts in the last two days (for example "Google Health" or your iPhone), with which of those four kinds each one wrote. It is a list of app names and nothing else: no measurement travels with it. We keep it, with when each app was first and last listed, so Settings can say whether a device that reaches glyso through Apple Health, such as a Fitbit, is actually sending. It is destroyed with your account like everything else.

A Fitbit reaches glyso through Apple Health, not directly. If you turn on the Apple Health connection in Google's Google Health app (the Fitbit app), what it writes into Apple Health is read by glyso exactly as described above. We have no connection to your Google or Fitbit account and receive nothing from Google.

You can withdraw access at any time in iOS Settings → Privacy & Security → Health, and you can allow some kinds and refuse others there — refusing sleep while allowing steps is a perfectly ordinary thing to do and the rest of glyso carries on exactly as it did. Apple does not notify us when you withdraw access, so what we notice is that your phone stops sending Health data while you carry on using glyso; after about a week of that we treat the connection as ended, stop counting movement in your score, and say so. Reconnecting starts it again. What we already hold is destroyed with your account like everything else here.

WHOOP

WHOOP is optional and entirely separate from Apple Health. You can connect either, both, or neither, and turning one off does nothing to the other.

If you connect WHOOP, you are sent to WHOOP's own website to sign in. We never see your WHOOP password — WHOOP hands us back a key that lets us read your data, and nothing else. That key is stored encrypted, exactly as your sensor login is, and it is never shown on any screen or included in any export.

We read three things:

Your sleep — when you fell asleep and woke, how long you were asleep and awake, and the time you spent in light, deep and REM sleep.
Your workouts — when they started and ended, what kind they were, the energy figure WHOOP calculates, and your average and highest heart rate during the session. WHOOP does not publish a continuous heart-rate record and we do not hold one for you: these two figures per session are the whole of the heart rate we have from a WHOOP, and they are what lets the app draw your pulse on the day's timeline at all.
Your recovery — WHOOP's recovery percentage, your resting heart rate, your heart-rate variability, and, where WHOOP measures them, blood-oxygen and skin-temperature figures.

We read this to explain your glucose. Sleep and recovery are among the strongest reasons a day behaves differently from your usual, and they are things a glucose sensor cannot see. We do not use any of it for advertising or marketing, and we do not sell it.

One kind of it can join the wider research set, and only if you say so. Your WHOOP workouts — not your sleep, not your recovery, not your resting heart rate, heart-rate variability, blood oxygen or skin temperature, and not the heart rate recorded during a session — are part of what "movement" means in the opt-in question described below, for the same reason your steps are: how much you moved is half of the explanation of what your glucose did. It is a separate opt-in you are free to refuse, and refusing it changes nothing else about the app. If you have not said yes to that question, nothing from WHOOP leaves us in any form.

Unlike Apple Health, which your phone sends to us, WHOOP data is fetched by our own servers — so it arrives even when the app is closed. WHOOP tells us when something new is ready, and we then ask WHOOP for it. When you first connect, we ask for the last 90 days so the app has enough of your history to say what is normal for you.

You can disconnect at any time inside glyso, or revoke glyso's access in your WHOOP account. Disconnecting inside glyso destroys the key immediately, and we stop fetching anything from that moment. What we have already stored stays until you delete it or your account — the same as everything else here — and reconnecting simply starts the fetching again.

The honest part about what we keep

glyso learns from patterns — that is the product, and we want to be plain about what that means. We keep and use aggregated and de-identified data to improve glyso and to build research insight into how food, movement and routine shape glucose — and the mood words you choose are part of it, because how a day felt belongs in that picture; they carry no free text and no rating, only a word from our own short list. De-identified means: your name, email, account identifiers and free text are stripped; timestamps are coarsened to day-relative form, so a record reads "07:40 on a weekday", never a date a person could be matched to; and the result sits under strict access control — nobody outside glyso can reach it. Data that came from Apple Health is not part of it, for the reason given above.

Joining the wider research set is a separate choice, and it is opt-in. During sign-up we ask, in one plain question, whether your glucose, meals, insulin doses and movement may be de-identified and used for research — by us and by researchers outside glyso — and to improve and train our own models: the ones that read your curve, name your food and write your coaching. This covers what you have already logged as well as what you log from now on: everything in your record while your consent stands, not only the days that follow it. It does not change what any third party may do — nobody trains a third-party AI model on your data, which remains true whichever way you answer this question.

The set carries no name, no email, no device identifier, timestamps coarsened to day-relative form, and a row is included only where at least three separate people's data agree, so no row can be traced back to one person. "Movement" here means the exercise you log yourself AND the steps and workouts that come from Apple Health or WHOOP — nothing else from either of them: not your sleep, not your heart rate, not your heart-rate variability, temperature, respiratory rate or menstrual flow.

The question has two buttons, "Yes, include my data" and "No thanks"; nothing is used this way unless you press yes. We record which of the two you chose and when you chose it, so that our record of your consent is accurate — a "No thanks" is stored as a refusal, with its time, and it is not consent. Only a yes is consent. Any other answer your record may hold, including one from an older version of the app, is not. It is never bundled into agreeing to these terms. The product-improvement use described in the paragraph above does not depend on this choice; this consent governs specifically the wider research set and the training described here.

If we ever want to use it for something this page does not describe, we ask again. A yes given for what is written here covers what is written here. A new purpose is a new question, put to you the same way — two buttons, nothing shared under it unless you press yes — and until you do, nothing changes.

Withdrawing is one tap, and it is as easy as joining. Settings › Privacy › Research data carries the control: press "Withdraw my data", read the confirmation, press it again, and it is done — or email [email protected] and we will do it for you. We keep the dates of the choice you are on: when it began and, if you have withdrawn, when it ended. It is a record of where you stand and how you got there, not a log of every answer you have ever given.

What withdrawing does, and what it cannot do. From the moment you press, nothing further of yours is used this way, and your record is not eligible for any future release or any future training run. What has already gone into the set cannot be taken back out, and we would rather say so than promise otherwise: the whole point of de-identifying is that a row carries no name, no email and no device identifier and is pooled with other people's, so there is nothing left in it that says it was yours to find. Nothing else about your account changes: your readings, meals, doses and scores stay exactly as they are, glyso works the same, and you can join again whenever you like.

When you delete your account, everything that identifies you is destroyed immediately and permanently: your account row, name and email; your encrypted sensor login; your push tokens and history; your analytics rows; your settings; your cached coaching text and day stories; the words you typed into the logger; the moods you recorded. There is no soft delete, and the list of tables deletion covers is checked by an automated test against the application's own schema, so a table added in future cannot silently escape it. The only thing that may survive is de-identified science — a curve and what a meal did to it, belonging to no one — as the section above describes.

Security

Sensor logins are encrypted at rest; the key lives only in our backend's environment, never in the database.
Everything travels over TLS.
The API fails closed: a missing or wrong key means it refuses to serve rather than serving openly, and repeated wrong keys are blocked.
Least-privilege access: data is touched only by the code that needs it, and each provider receives only the slice its job requires.
AI spending is hard-capped per user and per day, which also bounds how much of your data can flow in a day.
A meal you log is saved in the background, so it can be kept on your phone for a short while until it reaches us (for example if you are offline, or close the app straight after logging). It is kept only for the account that logged it, sent the next time the app can reach us, and removed from the phone once it has arrived.

If a breach ever puts your data at risk, we notify the ICO and, where the risk to you is high, you — within the timescales UK GDPR sets.

Retention

Website sign-ups: until you ask to be removed — one email does it — or an app account supersedes them. App data: as long as you keep your account. On deletion: everything identifiable destroyed at once; de-identified data may be retained and used as described above. Backups roll off on their own short cycle.

Your rights

Under UK GDPR you can access, correct, delete, export, restrict, or object, and withdraw any consent. Email [email protected] — we answer within a month. Research consent has its own one address and its own one-tap control, described above: Settings › Privacy › Research data, or [email protected]. Writing to either mailbox reaches us; we name one per act so that there is never a question about where a withdrawal was sent. You can complain to the ICO at ico.org.uk, or to your own country's authority. glyso is intended for adults and is not directed at children under 13; if you believe a child has an account, email us and we will delete it.

Changes

When the product changes in a way that matters — new data collected, a new provider, a new use — this page changes with it, and for material changes we tell you by email before they take effect. The date at the top is always current.

Governing law

This policy is governed by the law of England and Wales, and the courts of London have jurisdiction over any dispute about it. Nothing here removes rights your local consumer or data protection law gives you.

Contact

[email protected] · Glyso Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom · company number 17534786

glyso — know the 'why' behind your glucose.