Legal

Privacy policy

Last updated: [DATE]

This policy explains what GDM Companion collects, why, and what you can do about it. Your glucose readings and meals are health data, and we treat them as such.

Who we are

GDM Companion is operated by [LEGAL ENTITY NAME], [TRADING ADDRESS], United Kingdom. [COMPANY NUMBER, IF REGISTERED.] We are the data controller for the personal data described here. You can reach us at hello@gdmcompanion.com.

What we collect

Information you give us

• Account details — your first name and email address.
• Health information — your glucose readings, the meals you log, your pregnancy week, the week you were diagnosed, the glucose targets your care team gave you, and how many times a day you have been asked to test.
• Preferences — the cuisines and dietary preferences you choose, and your reminder settings.

Information we collect automatically

• Technical data — IP address, browser type and device information, collected as part of serving and securing the site.
• Usage events — for example that a meal was logged. These records never include your actual glucose values or what you ate.

Payments

Payments are processed by Stripe. We never see or store your card details. We keep a record of your subscription status and plan so we know what your account has access to.

Why we can use your health data

Health data is "special category" data under UK GDPR and needs a stronger basis than ordinary personal data. We rely on your explicit consent (Article 9(2)(a)) to store and process the glucose and meal information you enter. You give that consent when you create an account, and you can withdraw it at any time by deleting your data or your account — see "Your rights".

For everything else, we rely on the performance of our contract with you (providing the service you signed up for) and our legitimate interests in keeping the service secure and working properly.

What we do with it

• Show you your own logs, dashboard and patterns.
• Generate observations about your own data, using fixed rules rather than any automated decision-making that has legal or similarly significant effects on you.
• Send the reminders you have switched on.
• Manage your account, subscription and support requests.
• Keep the service secure and diagnose faults.

We do not sell your data. We do not use your health data for advertising, and we do not share it with advertisers or data brokers.

Who else processes it

We use a small number of providers, each bound by a data processing agreement:

• Supabase — database and account authentication.
• Cloudflare — hosting, content delivery and security.
• Stripe — payment processing.
• [ANY EMAIL PROVIDER YOU ADD, e.g. Resend, for account emails.]

Some of these providers operate outside the UK. Where data is transferred abroad, it is protected by UK adequacy regulations or by standard contractual clauses. [CONFIRM YOUR SUPABASE REGION — choosing a UK or EU region reduces transfers.]

How long we keep it

We keep your account data and health data for as long as your account exists. If you delete your account, we delete your personal and health data within 30 days, except where we must keep limited records for legal or accounting reasons — for example, payment records, which are kept for [6] years.

Your rights

Under UK GDPR you can:

• ask for a copy of the data we hold about you;
• ask us to correct anything that's wrong;
• ask us to delete your data, including from within the app;
• ask us to restrict or stop processing it;
• ask for your data in a portable format;
• withdraw your consent to health data processing at any time.

You can delete your data or your whole account from your profile in the app, or email us at hello@gdmcompanion.com. We respond within one month.

Storage on your device

We use local browser storage to keep you signed in and remember small interface preferences. We do not use advertising or tracking cookies.

Security

Traffic is encrypted with HTTPS. Access to your records is restricted at the database level so that your account can only ever read and write its own rows. No system is perfectly secure, but we take this seriously and design for it.

Children

This service is intended for adults aged 18 and over and is not directed at children.

Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this policy we'll update the date at the top, and tell you in the app if the change is significant.