Sign in Join free

Glapp Consumer Health Data Privacy Policy

Effective Date: June 8, 2026

At Glapp, we help people taking GLP‑1 medications track their journey, understand their own patterns, and prepare for more informed conversations with qualified healthcare professionals. Because Glapp is built around sensitive health information, we treat privacy as a core part of the product.

This Consumer Health Data Privacy Policy explains how Glapp, Inc. ("Glapp," "we," "us," or "our") collects, uses, shares, and protects consumer health data when you use the Glapp mobile apps, web app, website, and related services (collectively, the "Service").

This Policy supplements our general Privacy Policy. If this Policy gives you additional rights or protections for consumer health data, we will honor those additional rights and protections where required by law.

This Policy applies to the Glapp mobile apps, web app, websites, and related services, which we call the "Service."

Our health-data commitments.

1. Who we are and how to contact us

Controller / Responsible Entity:
Glapp, Inc.
1111B S Governors Ave, STE 37955
Dover, DE, USA

Privacy requests and questions:
hi@glapp.io

You may use this email address to ask questions, access or delete your data, withdraw consent, request a list of third parties or affiliates with whom we have shared consumer health data, appeal a denied request, or exercise any other privacy right described in this Policy.

2. What "consumer health data" means

For purposes of this Policy, consumer health data means personal information that is linked or reasonably linkable to you and that identifies, relates to, describes, or could reasonably be used to infer your past, present, or future physical or mental health status.

This may include information you enter directly, information you authorize us to import, information generated by Glapp features, and inferences we create from your use of the Service.

Consumer health data may include, for example:

3. Important health and medical limits

Glapp is a wellness, education, tracking, and organizational tool. Glapp does not provide medical care, practice medicine, diagnose, treat, prescribe, dispense medication, or replace a qualified healthcare professional.

Glapp may help you organize your information, visualize patterns, and prepare for conversations with your clinician. Glapp does not recommend that you start, stop, skip, delay, increase, decrease, split, compound, switch, or otherwise change any medication, dose, injection interval, or treatment plan.

Do not make medical decisions based on Glapp, AI outputs, charts, reports, community content, or third-party content. Always consult a qualified healthcare professional.

Glapp offered directly to consumers is generally not a HIPAA covered entity or business associate. If we later provide services on behalf of a covered healthcare provider, health plan, clinic, pharmacy, insurer, or other HIPAA-regulated entity, HIPAA, a Business Associate Agreement, and additional notices may apply.

4. Categories of consumer health data we collect

We may collect the following categories of consumer health data, depending on which features you use.

4.1 GLP‑1 medication and injection data

This may include medication name, medication type, dose, dose unit, injection date and time, injection site, injection schedule, missed or delayed injections, dose history, refill-related reminders, and related treatment-stage information.

4.2 Weight, body, and progress data

This may include weight entries, body measurements, BMI or other calculated metrics, goal weight, progress trends, weight-change percentages, and other progress information you choose to log or import.

4.3 Symptoms, side effects, and wellness signals

This may include nausea, vomiting, diarrhea, constipation, GI issues, fatigue, pain, injection-site reactions, mood, hunger, appetite, food noise, cravings, energy, sleep-related information if you choose to provide it, and other symptoms or wellness signals.

4.4 Notes, journal entries, and support communications

This may include free-text notes, journal entries, messages to support, email contents, attachments, screenshots, or other information you choose to send us that may contain health-related information.

4.5 Connected health data

If you choose to connect Apple HealthKit, Google Health Connect, or another supported health integration, we may collect the specific health metrics you authorize us to read or write.

The exact data depends on your device permissions and the features you enable. You can change or revoke permissions through your device, Apple Health, Google Health Connect, or Glapp settings.

4.6 AI feature data

If you use AI-powered features, we may process the information needed to provide the output you request. This may include your logs, notes, questions, prompts, generated responses, reports, summaries, insights, and uploaded photos or images, including vial or medication-label images used for parsing.

4.7 Uploaded images and parsing results

If you upload photos, screenshots, vial images, medication-label images, or other files, we may process the image, extracted text, structured parsing results, and related metadata to provide the feature you requested.

4.8 Derived, inferred, or generated health data

We may generate data from your use of Glapp, such as charts, summaries, progress reports, medication-level estimates, body-phase estimates, pattern explanations, correlations, reminders, flags, insights, or other inferences about your GLP‑1 journey.

4.9 Account, subscription, device, and app data linked to health-feature use

Some account, subscription, device, and app-usage data may become consumer health data when linked to your use of Glapp as a GLP‑1 companion. This may include your account identifier, subscription status, purchase channel, feature usage, app interactions, device/app metadata, and security logs where they are connected to health-feature use.

We do not collect or store full payment card numbers. Payment information is processed by Stripe, Apple App Store, or Google Play, depending on where you purchase. We receive subscription status, entitlement, purchase channel, transaction, renewal, refund, cancellation, and fraud-prevention metadata.

5. Sources of consumer health data

We collect consumer health data from the following sources:

  1. You directly. For example, when you create an account, log injections, enter weight, record symptoms, write notes, upload images, ask questions, use AI features, contact support, or use tracking features.
  2. Your device and app use. For example, when Glapp records app settings, reminders, feature usage, account activity, device type, app version, time zone, crash information, or security logs.
  3. Health integrations you authorize. For example, Apple HealthKit or Google Health Connect, if you choose to connect them and grant permissions.
  4. AI and parsing features you request. For example, when Glapp generates reports, insights, summaries, or vial-label parsing results based on your inputs.
  5. Payment and app-store providers. For example, Stripe, Apple App Store, or Google Play may provide subscription, transaction, renewal, cancellation, refund, and entitlement metadata.
  6. Service providers. Our service providers may return processed outputs, store data, transmit communications, detect errors, or help us operate the Service on our behalf.
  7. Third parties you direct or authorize. In the future, if you choose to connect, export, share, or send information to a healthcare provider, telehealth provider, pharmacy, lab, insurer, coach, or other third party, we may collect or share data as you direct and as disclosed at the time.

We do not currently receive identifiable consumer health data from employers, insurers, clinics, telehealth providers, pharmacies, or healthcare professionals unless you direct or authorize that sharing.

6. Why we collect and use consumer health data

We collect and use consumer health data for the following purposes.

6.1 To provide the Service you request

We use consumer health data to operate Glapp features, including injection tracking, weight tracking, symptom and side-effect tracking, wellness logging, reminders, trend charts, reports, insights, and account features.

6.2 To help you understand your own patterns

We use your data to generate charts, summaries, progress views, estimates, pattern explanations, and other informational features. These features are designed to help you understand your own journey and prepare for discussions with a qualified healthcare professional.

6.3 To provide AI-powered features you request

If you use AI features, we process the data needed to answer your question, generate a report, summarize your logs, parse an uploaded image, or provide another AI-powered output.

We aim to send the minimum data needed for the requested feature, remove direct identifiers where feasible, and disable provider training on your data where provider controls allow us to do so.

6.4 To operate connected health integrations

If you connect Apple HealthKit, Google Health Connect, or another supported integration, we use authorized data only for user-requested health features in Glapp.

We do not use Apple HealthKit or Google Health Connect data for advertising, marketing, sale, data brokering, unrelated data mining, insurance eligibility, employment decisions, credit decisions, or lending decisions.

6.5 To provide customer support

We use information you send us to respond to support requests, troubleshoot issues, investigate bugs, explain features, and resolve account or subscription problems.

6.6 To manage subscriptions and billing

We use subscription and transaction metadata to provide paid features, manage entitlements, process renewals, support cancellations and refunds, prevent fraud, and handle billing support.

6.7 To protect the Service and users

We use data to authenticate users, secure accounts, prevent abuse, detect fraud, troubleshoot errors, protect against security threats, enforce our Terms, and maintain reliability.

6.8 To improve Glapp

We use limited app and product information to understand feature adoption, fix bugs, improve usability, and develop better user-facing features.

We configure analytics and diagnostic tools to avoid consumer health data wherever feasible.

6.9 To create aggregated or de-identified insights

We may use aggregated or de-identified data to understand broad trends, improve the Service, publish insights, or support research-like analyses.

We do not treat data as de-identified unless we take reasonable measures to prevent it from being associated with you, publicly commit not to re-identify it, and require recipients to agree not to re-identify it.

6.10 To comply with law

We may use consumer health data when necessary to comply with applicable law, respond to lawful requests, enforce our legal rights, or protect users, Glapp, or others.

7. Consumer health data we share

We do not sell consumer health data.

We do not share consumer health data for targeted advertising, cross-context behavioral advertising, advertising platforms, data brokers, information resellers, insurance eligibility, employment decisions, credit decisions, or lending decisions.

We share consumer health data only as described below.

7.1 Service providers and processors

We use service providers to operate Glapp. These providers process data on our behalf and under contractual restrictions.

Current categories of service providers include:

Current service providers may include:

We may update service providers over time. When changes are material, we will update this Policy or provide another legally required notice.

7.2 AI providers

If you use AI-powered features, we may share the information needed to provide the requested AI output with AI service providers.

This may include relevant logs, notes, questions, prompts, generated outputs, and uploaded photos or images. We send the minimum information needed for the requested AI feature, remove direct identifiers where feasible, and configure and contract with AI providers so they may process your data only to provide the requested feature and not to train their general models or use your data for their own independent purposes, except where required for security, abuse prevention, or legal compliance.

7.3 Payment and app-store providers

Stripe, Apple App Store, and Google Play may process payments, subscriptions, renewals, cancellations, refunds, fraud-prevention data, and related transaction metadata.

We do not share your detailed health logs with these providers for advertising or unrelated purposes. Subscription metadata may be linked to your Glapp account so we can provide paid features and support your purchase.

7.4 Health integrations

Apple HealthKit and Google Health Connect integrations are optional and controlled by you. We access only the data types you authorize.

We do not disclose Apple HealthKit or Google Health Connect data to third parties except as needed to operate the Service on our behalf, as you direct, or as required by law.

7.5 User-directed sharing and exports

If you use an export, share, download, provider-report, or similar feature, we share or disclose the information you choose to export or direct us to share.

You are responsible for deciding whether to share exported information with a healthcare professional, telehealth provider, pharmacy, insurer, coach, family member, community, or other third party. Their privacy practices will apply after they receive it.

We may test or display third-party links, referral offers, affiliate offers, or sponsored offers, including offers related to telehealth, pharmacies, labs, insurance, savings tools, or other services.

If an offer is sponsored, paid, or affiliate-based, we will label it where required. We may receive compensation if you click, sign up, or purchase.

We do not share your health logs, medication details, AI content, connected-health data, notes, uploaded images, or other identifiable consumer health data with referral partners or affiliates unless you direct us to do so or give separate consent. Referral tracking is limited to non-health commercial attribution unless we disclose otherwise and obtain any legally required consent.

Third-party services are independent from Glapp and have their own terms and privacy notices.

We may disclose consumer health data if we believe it is reasonably necessary to comply with law, respond to lawful legal process, protect rights and safety, investigate fraud or abuse, enforce our Terms, respond to security incidents, or protect Glapp, users, or others.

7.8 Corporate transactions

If Glapp is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, consumer health data may be disclosed or transferred as part of that transaction, subject to this Policy and applicable law.

8. Categories of consumer health data shared

Depending on the feature and purpose, the categories of consumer health data shared with service providers or other recipients may include:

We do not share all categories with all recipients. We limit sharing based on the purpose and the recipient's role.

For example, AI providers may receive the information needed to generate a requested AI response; payment providers receive transaction and subscription metadata; analytics tools are configured to avoid health-revealing data; hosting and storage providers may process data needed to operate the Service.

9. Categories of third parties and specific affiliates

Categories of third parties or recipients

We may disclose consumer health data to the following categories of recipients as described in this Policy:

Specific affiliates

Current specific corporate affiliates with whom we share consumer health data: none.

If this changes, we will update this Policy and obtain any legally required consent before sharing consumer health data with a new affiliate for a new purpose.

We collect consumer health data when you choose to provide it, authorize an integration, upload content, use an AI feature, contact support, or otherwise request a Glapp feature that requires health data.

Where applicable law requires consent, we will request your consent before collecting, using, or sharing consumer health data for the disclosed purpose. Where applicable law requires separate consent for sharing, we will request separate consent before sharing consumer health data unless the sharing is necessary to provide a product or service you requested.

You may withdraw consent by:

Withdrawing consent does not affect processing that occurred before withdrawal. Some Glapp features may stop working or become limited if you withdraw consent or delete required data.

11. Apple HealthKit and Google Health Connect

Health integrations are optional.

When you connect Apple HealthKit or Google Health Connect, you control which data types Glapp can access through your device and the Glapp app.

We use Apple HealthKit and Google Health Connect data only for user-requested health features. We do not use this data for advertising, marketing, sale, data brokering, unrelated data mining, insurance eligibility, employment decisions, credit decisions, or lending decisions.

You can disconnect integrations through Glapp settings, Apple Health, Google Health Connect, or your device settings. Previously synced data in Glapp remains in Glapp until you delete it, delete your account, or we delete it under our retention rules.

12. Analytics, diagnostics, and health-revealing data

We use analytics and diagnostics to understand product performance, identify crashes, fix bugs, secure the Service, and improve user experience.

We configure analytics and diagnostic tools to avoid consumer health data wherever feasible.

Diagnostic logs may include technical information such as app version, operating system, device type, request metadata, account identifiers, crash traces, and limited context needed to troubleshoot the Service. We restrict access to diagnostics.

13. Third-party collection over time and across services

We do not allow third parties to collect consumer health data through Glapp over time and across different websites or online services for targeted advertising or cross-context behavioral advertising.

We do not use third-party advertising SDKs, data brokers, or advertising pixels to collect consumer health data.

Some service providers may process technical data, such as IP address, device data, request metadata, cookie or similar identifiers, or usage data, to provide security, hosting, analytics, diagnostics, payment, or support services to us. These providers may process such data only as described in this Policy, our Privacy Policy, and our agreements with them.

14. No sale of consumer health data

We do not sell consumer health data.

We do not exchange consumer health data for money or other valuable consideration.

If we ever propose to sell consumer health data, we will first provide a separate, legally valid authorization that describes the specific data, seller, purchaser, purpose, use, expiration, revocation right, redisclosure risk, and other information required by law. We will not condition your use of Glapp on signing an authorization to sell consumer health data.

15. No targeted advertising or data brokering

We do not share consumer health data for targeted advertising, cross-context behavioral advertising, advertising platforms, data brokers, information resellers, or unrelated marketing.

We do not use consumer health data to determine creditworthiness, insurance eligibility, employment suitability, lending eligibility, or similar decisions.

16. No health-facility geofencing

We do not use geofencing around hospitals, clinics, pharmacies, weight-loss clinics, reproductive-health clinics, mental-health facilities, or other healthcare facilities to:

17. De-identified and aggregated data

We may use aggregated or de-identified information to operate, secure, improve, and analyze Glapp, and to publish or share insights about broad GLP‑1 trends.

We will treat data as de-identified only when we take reasonable measures to prevent it from being linked to you or your device.

For de-identified data, we commit that we will:

You may opt out of having your data included in future aggregated or de-identified research-like insights by emailing hi@glapp.io. This will not affect already-created aggregate reports or de-identified datasets that cannot reasonably be linked back to you.

18. Retention of consumer health data

We keep consumer health data only as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Our default retention periods are:

We may retain aggregated or de-identified information that does not identify you.

If you request deletion, we will delete consumer health data as required by applicable law. Data stored in archived or backup systems may take additional time to delete, but will be protected from ordinary use and deleted according to our backup lifecycle unless retention is legally required.

19. Your consumer health data rights

Depending on where you live and how you use Glapp, you may have the right to:

  1. Confirm whether we collect, share, or sell consumer health data about you.
  2. Access consumer health data we maintain about you.
  3. Receive a copy or export of consumer health data where required by law and technically feasible.
  4. Delete consumer health data we maintain about you.
  5. Withdraw consent for future collection or sharing of consumer health data.
  6. Review and request correction of consumer health data where available or required by law.
  7. Receive a list of third parties and affiliates with whom we have shared or sold your consumer health data, including contact information where required by law.
  8. Appeal a refusal to act on your request.
  9. Not be unlawfully discriminated against for exercising your rights.

20. How to exercise your rights

You may submit a consumer health data request by:

Please include enough information for us to understand and verify your request. We may ask for additional information if needed to authenticate you or protect your account.

You do not need to create a new account to exercise your rights. If you already have a Glapp account, we may ask you to use that account or verify control of the email address associated with it.

We generally respond within 45 days where required by law. If a request is complex or we receive multiple requests from you, we may extend the response period where allowed by law and will tell you why.

We generally provide responses free of charge up to the number of free requests required by applicable law. If a request is manifestly unfounded, excessive, repetitive, or abusive, we may charge a reasonable fee or decline the request where permitted by law.

21. Authorized agents

Where applicable law allows you to use an authorized agent, your agent may submit a request on your behalf.

We may require proof that you authorized the agent to act for you. We may also require you to verify your identity directly with us, unless applicable law provides otherwise.

22. Appeals

If we deny your request, you may appeal by emailing hi@glapp.io with the subject line: "Consumer Health Data Appeal."

Please include your original request, our response, and why you believe the decision should be reconsidered.

We will respond to appeals within the time required by law. If we deny your appeal, we will explain our decision and, where required, provide information about how to contact the relevant regulator or attorney general.

23. Security

We use administrative, technical, and physical safeguards designed to protect consumer health data.

These safeguards may include:

No method of transmission or storage is 100% secure. If you believe your account or data may be at risk, contact us at hi@glapp.io.

24. Breach notification

If a security incident affects consumer health data or other personal data, we will investigate and provide notices to affected users, regulators, service providers, media, or others where required by applicable law, including the FTC Health Breach Notification Rule where it applies.

25. Children

Glapp is intended for individuals 18 years or older.

We do not knowingly collect consumer health data from anyone under 18. If you believe a minor has provided consumer health data to Glapp, contact us at hi@glapp.io and we will take appropriate steps to delete it.

26. Changes to this Policy

We may update this Policy from time to time.

If we make material changes, we will update the effective date and provide notice as required by law, such as through the app, website, email, or another appropriate method.

We will obtain affirmative consent where required before collecting, using, or sharing additional categories of consumer health data, sharing consumer health data with additional categories of recipients, or using consumer health data for additional purposes not disclosed in this Policy.

27. Questions

For questions or requests about this Policy or your consumer health data, contact:

Glapp, Inc.
1111B S Governors Ave, STE 37955
Dover, DE, USA
hi@glapp.io