Privacy Policy

What we collect and why

• Account details: name, email and profile photo from Google sign-in, or a guest ID linked to your browser.
• Health information: glucose and ketone readings, HbA1c and other test results you enter, insulin doses, carb ratios and dose settings, meals and carbs, diabetes type, birth year, sex, weight, height, basal insulin, and Health Connect heart rate, steps and sleep if you connect it.
• CGM logins: your Dexcom Share or Nightscout details, stored encrypted, so we can fetch your readings.
• Photos and text you submit: Carb Cam meal photos, food searches, barcodes and Kl8 AI chat messages.
• Emergency and family contacts: names and phone numbers you add for the SOS screen and caregiver check-ins, and the people you link as followers or as your doctor or care team.
• Location (optional): if you allow it, your device location is used to find nearby restaurants and food places. We don't track your location in the background.
• Payment status: your Stripe customer and subscription IDs and plan status if you buy GlucoHome Plus (never your card number).
• Device and technical data: push notification subscriptions, Hub and watch pairing tokens, app version and basic server logs used for security and fixing faults.
• Your agreement: the version of the Terms and this policy you accepted, and when.

We use this information to run GlucoHome for you: to show your readings and history, work out estimates, run the features you turn on, share data with the people you choose, take payments, keep the service secure, and answer you. We don't use your health information for advertising.

Health information and your consent

Health information is “sensitive information” under the Privacy Act. We only collect it with your consent and only where it is reasonably necessary for GlucoHome's features. You give that consent when you tick the box agreeing to this policy at sign-up (or when asked after an update), and each time you choose to connect a CGM, Health Connect or an AI feature. We record the version you accepted and when. You can withdraw consent by disconnecting a feature or deleting your data or account; some features will then stop working.

If you are under 18, a parent or guardian must consent for you. A parent or guardian can also give consent for a child they manage GlucoHome for.

Overseas disclosure

Some of our service providers store or process data outside Australia. By agreeing to this policy you consent to your information, including health information where noted, being sent to them for the purposes below. We choose providers that publish privacy and security commitments, but overseas providers may not be bound by the APPs, and if they mishandle your information you may not be able to seek redress under the Privacy Act. If you don't want this, please don't use the feature concerned.

• Google (United States and other countries): Google sign-in; Gemini AI for Carb Cam, food search, Kl8 chat, coaching, recipes and insights (your photo or text and relevant glucose, meal and dose context); Google Home if you link it; Android push notifications.
• Cloudflare (United States and global network): Workers AI models for Carb Cam and other AI features (the same kinds of data as above), website delivery and cookieless analytics.
• Dexcom (United States, or Dexcom's servers outside the US depending on your account region): your Share login is sent to Dexcom to fetch your readings. Nightscout data comes from the server you choose.
• Stripe (United States and other countries): payments and receipts for GlucoHome Plus.
• Hostinger (our hosting provider): hosts the website, servers and account database, including your health information. Its data centre may be outside Australia.
• Resend (United States): emails you ask us to send, such as invitations to family or your care team.
• Push services run by your browser or phone maker (for example Google, Mozilla, Apple or Microsoft) deliver notifications you turn on.
• Food and map data: food searches and barcodes may be looked up with USDA FoodData Central (United States) and Open Food Facts (France); map tiles and place searches use OpenStreetMap services (Europe). These lookups don't include your name or health data.

Health Connect

On Android, you may choose to connect Health Connect. This is opt-in and read-only. GlucoHome never reads Health Connect data until you grant access in Health Connect’s own permission screen, and it never writes data back to Health Connect. We do not read blood glucose from Health Connect. Dexcom Share (or another CGM connection you choose) remains the glucose source.

Health Connect data is only used to provide user-facing features of GlucoHome: it is shown alongside your glucose so you can see patterns (for example, recent heart rate and steps next to a reading, last night’s sleep on the trend estimate card, and the same values on a share link or PDF report you create). Those readings can also label the on-device 60-minute glucose trend estimate (activity may be lowering glucose, or heart rate is higher while you are still) and, if several recent step and heart-rate buckets look like a walk, add a walking / aerobic exercise event to your log. If you use AI insights, GlucoHome may include derived activity summaries (average resting heart rate and counts of recent activity or still-elevated-heart-rate windows) — not the raw Health Connect samples — as context for that feature.

GlucoHome is informational only. It is not a medical device and provides no treatment advice. The forecast is an estimate, not a measurement; always check your CGM before acting.

If you grant access, GlucoHome reads only these Play-declared Health Connect permissions:

• Heart rate (READ_HEART_RATE) — the last two hours of beats-per-minute samples, grouped into about five-minute buckets. Shown as your latest heart rate on Wearable / Health settings and on the glucose trend estimate card.
• Resting heart rate (READ_RESTING_HEART_RATE) — the latest valid resting value from the last seven days. Shown as RHR and used as the resting baseline next to your current heart rate.
• Steps (READ_STEPS) — the last two hours of step counts, grouped into about five-minute buckets. Shown as recent steps / steps per minute alongside glucose.
• Sleep (READ_SLEEP) — last night’s sleep sessions, stored as a duration in minutes. Shown as last night’s sleep on settings, the trend estimate card and share pages.
• Background reading (READ_HEALTH_DATA_IN_BACKGROUND) — on Android 14 and 15+, Health Connect may offer this extra permission. GlucoHome checks that the feature is available, then asks for it together with the four data types. If you grant it, a battery-friendly hourly job refreshes heart rate, resting heart rate, steps and last night’s sleep into the app’s on-device cache while the app is closed. The hourly job does not upload those samples to your account; the signed-in app uploads them when you next open GlucoHome. This is optional and opt-in. If you decline it, revoke it, or your device does not support it, GlucoHome does not read Health Connect in the background and still updates those types when you open the app.

Synced to your account? Yes, if you are signed in (not a guest). The app POSTs the buckets to your GlucoHome account so the estimate, summary card and any share or PDF report you create can include them on this device and others. Guest sessions keep a local copy only. The background hourly job only updates the on-device cache.

Encryption and storage. Samples travel to glucohome.id over HTTPS. On your account they are stored as numbers (beats per minute, step counts, sleep minutes) in the GlucoHome database — they are not separately encrypted the way Dexcom Share passwords are. On the phone they are cached in GlucoHome’s app-private storage (and, in the web view, local device storage) so the cards still work offline.

How long we keep it. There is no automatic expiry. The copies on your account stay until you disconnect Health Connect in Wearable / Health settings (that deletes the Health Connect rows we stored), wipe your health data, or delete your account. See https://glucohome.id/delete-account. The on-device cache is cleared when you disconnect or delete data on that device.

Health Connect data is never sold. It is never used for advertising or ad targeting. It is never used for credit or insurance decisions. It is never shared with third parties except as needed to provide the service (our hosting provider stores the account database, and derived summaries are sent to our AI providers only when you use an AI insight), or with people you choose (family or doctor sharing via a share link or report you create). Humans at GlucoHome do not read these samples except with your consent, for security investigations, or where the law requires it.

GlucoHome complies with the Health Connect Permissions policy, including the Limited Use requirements. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

How to revoke: You can revoke access at any time in Health Connect settings (Android Health Connect → App permissions → GlucoHome) or in the GlucoHome Android app under Settings → Wearable / Health → Disconnect. After revoke, GlucoHome will show as not connected (or will stop hourly background refresh if only that permission is turned off) and will not read those types until you opt in again.

How to delete: Disconnect Health Connect to delete the Health Connect samples stored on your account, or delete your data or account at https://glucohome.id/delete-account.

GlucoHome Hub and local network

GlucoHome Hub always reads glucose from glucohome.id as its main source. A parent watching a child keeps getting readings after the child leaves home because the child’s phone uploads to the server. The Hub does not use another phone as the primary feed.

If you opt in on the Android phone, and only while the internet is down, the phone can advertise itself on the same Wi-Fi (NSD / mDNS) so a paired Hub can pull stored readings over a read-only link. That uses the Nearby Wi-Fi devices permission (NEARBY_WIFI_DEVICES, never for location) plus multicast Wi-Fi. Names and pairing codes stay on the devices. They are not uploaded and are not used for advertising.

The Hub switches back to glucohome.id as soon as the internet returns. This is a safety aid only. It does not give treatment or dosing advice.

How to revoke: More → GlucoHome Hub → turn off local Wi-Fi fallback, or Android Settings → Apps → GlucoHome → Permissions → Nearby devices.

Driving Mode and Bluetooth

On Android, Driving Mode can optionally turn on when a Bluetooth device you mark as My car connects — for example a car stereo or a CarPlay / Android Auto head unit. This is a safety aid and reminder only. It does not decide whether you are fit or safe to drive and does not give treatment or dosing advice.

This uses the Nearby devices permission BLUETOOTH_CONNECT on Android 12 and later (on older Android, the install-time BLUETOOTH permission). GlucoHome only lists devices you have already paired in Android settings. It does not scan for unknown nearby devices, advertise, or read files or contacts from those devices.

The names and addresses of devices you mark as My car stay on this phone in GlucoHome’s app-private storage. They are not uploaded to your GlucoHome account and are not used for advertising, analytics, or credit or insurance decisions.

Connection is noticed with Android’s Bluetooth ACL connect and disconnect broadcasts (a Play-compliant, battery-light receiver). There is no foreground service and no background location for this feature.

If you deny Nearby devices, Driving Mode still works from the manual Start / End control. Auto-on from the car will not run until you allow the permission.

How to revoke: Android Settings → Apps → GlucoHome → Permissions → Nearby devices, or clear My car in More → Driving Mode.

4. Signing in with Google & guest mode

We use Google only to sign you in. We ask Google for your basic profile (the standard “openid”, “email” and “profile” permissions), so we receive your name, email address and profile photo. We never see your Google password, and we do not request access to Gmail, Google Drive, contacts, calendar or any other Google data.

We store your name, email and profile photo on your GlucoHome account, plus the sign-in record our login system keeps for Google (your Google account ID and the sign-in tokens Google issues for those basic-profile permissions). These tokens cannot read any other Google data.

If you used GlucoHome as a guest first, the data from that browser (profile, glucose readings, meals, insulin logs, settings and connections) is moved into your account when you sign in. If your Google account already has data, we keep it and add what was saved as a guest.

5. Website analytics

We use Cloudflare Web Analytics to count visits to glucohome.id, so we can see which pages are useful and how fast they load. It is cookieless: it does not set cookies or use local storage, and it does not track you across sites or build a profile of you. We only see aggregate numbers such as page views, referring sites, country and page-load speed. No glucose, food, insulin or account data is sent to it.

The analytics script loads from static.cloudflareinsights.com and sends its counts to cloudflareinsights.com. See Cloudflare Web Analytics and Cloudflare’s privacy policy for details.

6. Share links and PDF reports

Nothing is shared unless you choose to. If you're signed in, you can create a read-only link for family or your diabetes team. It shows your recent glucose readings, meals and insulin doses, and — if you connected Health Connect — recent heart rate, steps and last night’s sleep. No name, email or other account details, and nobody can edit anything through it. Links expire after the period you pick (7, 30 or 90 days), and you can turn one off at any time. We store only a scrambled (hashed) version of the link, count how often it's viewed, keep share pages out of search engines, and don't run analytics on them. Anyone you send the link to can see that data until it expires or you turn it off, so only share it with people you trust.

PDF reports are made on request from your own data and downloaded straight to your device. We don't keep a copy.

7. Payments (GlucoHome Plus)

GlucoHome Plus is optional, and everything you need to stay safe stays free. If you subscribe, payments are processed by Stripe. Your card details go straight to Stripe and never reach GlucoHome. We store only your Stripe customer ID, subscription ID and plan status (plan, monthly or yearly, and renewal date) so we know your account has Plus. Your email is shared with Stripe for receipts. Stripe handles your payment information under its own privacy policy. You can update your card, switch plans or cancel at any time from GlucoHome Plus, using Stripe's secure billing page.

8. AI features and service providers

Some features use third-party AI services. When you use Carb Cam (meal photos), KL8 chat, food search/parsing, meal coaching or recipe suggestions, the photo or text you submit, and relevant context such as recent glucose readings and meals, is sent from our servers to Google’s Gemini API and/or Cloudflare Workers AI to generate the result. These providers process the data under their own terms and privacy policies (see Google and Cloudflare). AI estimates can be wrong and are not medical advice.

We also use: Hostinger to host the GlucoHome website, servers and database; Resend to send emails (for example, invitations you ask us to send to your diabetes team); and your browser or device’s push service to deliver notifications you turn on.