Glapp Privacy Policy

Effective Date: August 25, 2026

We built Glapp to help people taking GLP‑1 medications feel supported, organized, and in control of their journey. Using Glapp means sharing some personal and health information with us — and we take that responsibility seriously. This Privacy Policy explains what we collect, how we use it, the choices you have, and how to contact us.

If anything here conflicts with platform‑specific rules (e.g., Apple HealthKit or Google Health Connect), those platform rules apply in addition to this Policy.

This Privacy Policy applies to the Glapp mobile apps, web app, websites, and related services, which we call the "Service."

1) Who we are & how to contact us

Controller: Glapp, Inc., 1111B S Governors Ave, STE 37955, Dover, DE, USA

Email (all privacy requests & questions): hi@glapp.io
EEA/UK privacy contact: ak@glapp.io
We accept all privacy rights requests via email (see Section 11). If you are in the EEA/UK/CA/AU, you may also contact your local data protection authority about your rights.

2) What we collect

We collect the following categories of information when you use Glapp. In this Policy, "health data" means health-related personal data you provide, authorize, or generate through Glapp, including medication, injection, weight, symptom, side-effect, connected-health, uploaded-image, AI, and health-inference data. We treat health data as sensitive. Depending on where you live, some health data may also be consumer health data under U.S. law or special category data under EU/UK data protection law.

Account & contact — name, email, password hash, region, marketing preferences.
Health logs (health) — injection logs (including medication name, dose, date/time, and injection site), weight entries, side‑effect and symptom entries (including pain), wellness signals (e.g., mood, hunger, "food noise"), and free‑text notes you choose to record.
Device & app — device type, OS version, app version, language, time zone, crash reports, basic event telemetry (e.g., which screens/features were used).
Support — messages you send us (including email contents and attachments).
Subscriptions & billing — subscription status, plan, renewal dates, purchase channel, transaction identifiers, refund/cancellation status, and related metadata. Payments and subscriptions may be processed by Stripe, Apple App Store, or Google Play, depending on where you purchase. These providers may send us subscription status and transaction metadata so we can provide paid features, manage renewals, prevent fraud, and support purchases.

Integrations (optional; health) — if you connect Apple HealthKit or Google Health Connect, the health metrics you authorize us to read/write.
AI feature data — inputs and outputs used for AI-powered features you request, such as reports, insights, Wisdom Q&A, and pen or vial label/photo parsing. This may include relevant logs, questions you ask, generated responses, and photos or images you upload for parsing. AI feature data may be stored with your account unless you delete it, delete your account, or we delete it under our retention rules.

We do not knowingly collect data from anyone under 18.

3) Why we use data & legal bases

We use your information for the purposes below. If you are in the EEA/UK, we also indicate our legal bases under the GDPR/UK GDPR.

Legal bases explained. For users in the EEA/UK, "contract" means processing necessary to provide the Service you request; "legitimate interests" means processing necessary for our or others' legitimate interests where those interests are not overridden by your rights; "legal obligations" means processing necessary to comply with applicable law; and "consent" means processing based on your permission, which you can withdraw where applicable. Health data may also require a separate special-category condition, such as explicit consent.

Provide & secure the Service — create your account, maintain features, authenticate, prevent abuse, fix bugs, and secure the platform.
Legal bases: contract (Art. 6(1)(b)); legitimate interests (security/fraud, Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)).

Wellness tracking & insights (health) — store your injection/weight/side‑effect logs, visualize trends, and provide in‑product insights you request.
Legal bases: explicit consent for health data (Art. 9(2)(a)) + contract (Art. 6(1)(b)). You can withdraw consent at any time by emailing hi@glapp.io or using in-app controls where available. See Section 9 — Your choices and Section 11 — Exercising your rights.

AI-generated reports & insights (health) — if you use AI-powered features such as reports, insights, Wisdom Q&A, or pen or vial label/photo parsing, we process the information needed to provide the output you request. This may include relevant logs, notes you choose to provide, questions you ask, generated outputs, and uploaded pen or vial photos or images. We aim to minimize the data sent to AI providers and remove direct identifiers where feasible. Legal bases: explicit consent for health data (Art. 9(2)(a)) + contract (Art. 6(1)(b)). You can withdraw consent at any time by emailing hi@glapp.io (and in-app where available) (Section 11).

Analytics & product improvement — understand feature adoption, diagnose performance issues, and improve UX.
Anonymized research and insights — We may use aggregated or de-identified data to operate, secure, improve Glapp, and publish broad insights. We do not share identifiable health logs, AI content, uploaded images, or user-level datasets with researchers, media, or industry partners unless you give separate consent. We treat data as de-identified only after applying safeguards reasonably designed to prevent re-identification, publicly committing not to re-identify it, and requiring recipients not to re-identify it. If we conduct health-related human-subject research, we will obtain consent and independent ethics review where required. To opt out of having your data included in future anonymized research, email hi@glapp.io.
Legal bases: legitimate interests; consent where required by law. We do not use analytics for advertising or cross-context behavioral tracking. Analytics events may include limited structured metadata about actions taken in tracking features, as described in Section 6.

Communications — send transactional messages (account/security/legal), respond to support, and send marketing messages with your consent where required.
Legal bases: contract and legitimate interests for service, account, security, legal, and support communications; consent where required for marketing communications and electronic tracking technologies, including under EU/UK ePrivacy rules.

Compliance — comply with law, enforce our Terms, and protect our rights and users.
Legal bases: legal obligations; legitimate interests.

4) Member Referral Program Data

Participation in the member-to-member referral program is optional. If you participate, we process the referral code; the referrer's and referred user's account IDs; the time the code is applied; the discount eligibility window; qualifying subscription status; reward amount and status; redemption history; billing source; provider purchase, subscription, and redemption references; referral-related analytics; and error information.

Sources. We receive this information from participants' actions, Glapp's account and billing systems, and the applicable billing provider, such as Apple, Google Play, or Stripe.

Purposes. We use referral program data to validate codes, determine discount eligibility, administer and redeem rewards, display aggregate referral statistics, send referral-related notifications, provide support, measure program performance, secure the Program, and prevent or correct errors.

Legal bases. For users in the EEA/UK, we rely on contract where processing is necessary to provide the referral benefit or reward you request, and on legitimate interests for Program administration, reliability, security, limited analytics, and error prevention, subject to your rights.

What the referrer can see. The referrer can see aggregate totals showing code uses, referred users who began qualifying paid access, and rewards earned or redeemed. We do not give the referrer the referred user's identity, email address, health logs, medication information, weight information, or other health records.

Who processes this information. Authorized Glapp personnel and our existing service providers may process referral program data where necessary to operate and support the Program. These providers include the applicable billing provider, Amplitude for limited referral analytics, and our hosting, infrastructure, messaging, security, and support providers described in Section 6.

Applying a referral code is optional. Once a code is successfully applied, the referral attribution cannot be changed.

5) Health data integrations (Apple HealthKit & Google Health Connect)

Integrations are optional and controlled by you. When enabled, we only access data types you authorize.

• We use Apple HealthKit and Google Health Connect data only for user-requested health features. We do not use this data for advertising, marketing, sale, data brokering, unrelated data mining, AI model training, insurance eligibility, employment decisions, credit decisions, or lending decisions.
• We do not use HealthKit/Health Connect data for advertising, sale, or data brokering; we do not combine it with third‑party ad platforms.
• We will not disclose HealthKit/Health Connect data to third parties except to process it on our behalf to operate the Service or where required by law.
• You can disconnect at any time in the app; previously synced data in Glapp remains until you delete it.

6) Sharing & processors

We do not sell personal data and we do not share it for cross‑context behavioral advertising (as defined by California law). We share data only as described below:

Service providers (processors). We engage vendors who process data on our instructions and for our purposes:

• Analytics: Amplitude. We use product analytics to understand how Glapp features are used and to improve reliability and usability. Analytics events may include structured information about actions taken in the app, such as the type of log created, selected options, or feature settings. We do not send free-text notes, uploaded photos, AI report contents, passwords, payment card details, or full health-log histories to analytics providers.
• Error monitoring and diagnostics: Sentry and internal logs. We use Sentry and limited internal server logs to detect crashes, diagnose errors, protect the Service, and improve reliability. These diagnostics may include technical information such as device/app details, request metadata, account identifiers, and limited context about the action being performed. We restrict access to diagnostics.
• Cloudflare: security, CDN, web analytics, and storage. We use Cloudflare for security, DDoS protection, CDN services, privacy-preserving web analytics for our site, and cloud object storage for certain uploaded, generated, or backup files, such as pen or vial photos, profile images, related image assets, and database backups.
• Email and messaging: Resend and Brevo. We use email service providers to send transactional messages, service updates, and preference-based communications. Resend may be used for email delivery, and Brevo may be used for contact management, email preferences, and mailing lists.
• Hosting: Render.com (cloud hosting/infrastructure in the U.S.).
• Support: Google Workspace (Gmail) (support email handling).
• AI report generation: AI service providers, currently including Google Gemini and Perplexity. We use AI service providers to power user-requested features such as reports, insights, Wisdom Q&A, and pen or vial label/photo parsing. We may send the information needed to provide the requested feature, which can include relevant logs, questions, generated outputs, and uploaded pen or vial photos or images. We do not enable provider training on your data where provider controls allow us to disable it. We may store prompts, inputs, outputs, and parsing results to provide the feature, show your history, troubleshoot issues, and maintain safety and reliability.
• Other processors as needed: security, support tooling, and storage/backup.

We enter Data Processing Agreements (DPAs) with processors, require appropriate technical and organizational measures, and use lawful transfer mechanisms (e.g., adequacy, EU Standard Contractual Clauses, UK IDTA) when data moves internationally. Processors may change over time; we will update this Policy or an in‑app list when material changes occur.

Corporate transactions. We may transfer data in connection with a merger, acquisition, or asset sale, subject to this Policy and applicable law.
Legal & safety. We may disclose data to comply with law or protect users, the Service, or our rights, where permitted by law.

Affiliate links & third-party offers (including telehealth). We may include links to third-party services (including telehealth providers). Some links may be affiliate links, meaning we may receive a commission if you sign up or make a purchase. We do not share the contents of your health logs (e.g., injection/weight/side-effect values or notes) with affiliates for advertising. If you choose to use a third-party service, that third party's terms and privacy notice apply.

7) International transfers

We operate in the United States and may transfer personal data to countries outside your own. When we transfer personal data from the EEA/UK/Switzerland to other countries (including the U.S.), we rely on appropriate safeguards, such as:

• an adequacy decision (e.g., the EU–U.S. Data Privacy Framework for certified recipients), and/or
• the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), plus supplementary measures as needed.

Details are available on request at hi@glapp.io.

8) Data retention

We keep data only as long as necessary for the purposes in this Policy or as required by law.

We may retain aggregated or de‑identified information that does not identify you.

9) Your choices

• Access & export your data (email us).
• You can request account deletion in the app, by emailing hi@glapp.io, or through our mobile app account-deletion page at your profile page. Account deletion deletes account-associated user data except limited records retained for legal, tax, accounting, payment, security, fraud-prevention, dispute, or compliance purposes. Deleting your Glapp account does not automatically cancel an active Apple, Google Play, or Stripe subscription; you must cancel through the original purchase channel.
• Opt out of marketing at any time using the unsubscribe link or by emailing us.
• Withdraw consent for health data processing at any time; this won't affect prior processing already performed with your consent but may limit features.
• Disconnect integrations (HealthKit/Health Connect) in the app.
• Opt out of anonymized research by emailing us; this won't affect already-published aggregate findings.

We also honor Global Privacy Control (GPC) signals as an opt‑out of sale/share where applicable—today, we do not sell/share personal data.

10) Region‑specific disclosures

10.1 European Economic Area (EEA) & United Kingdom

Controller: Glapp, Inc.
Legal bases: See Section 3.
Your rights: access; rectification; erasure; portability; restriction; objection (including to processing based on legitimate interests); and the right to withdraw consent at any time.
Complaints: You can lodge a complaint with your local supervisory authority. We welcome contacting us first at hi@glapp.io.

If we appoint an EU/UK representative or DPO, we will update this Policy.

10.2 United States — California (CCPA/CPRA)

If you are a California resident, you may have rights under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioral advertising. We use service providers.

Your CCPA rights: to know, access, correct, delete, and port certain personal information; to limit use and disclosure of sensitive personal information; and to not be discriminated against for exercising your rights. We honor GPC signals as an opt‑out of sale/share (not currently applicable). You can submit requests via hi@glapp.io.

Categories collected: identifiers (email), account records, internet/activity data (event telemetry), health information you provide, and inferences we generate to provide insights.
Sources: directly from you; your device/app; integrations you connect.
Purposes & disclosures: see Sections 3, 4, and 6.

Sensitive personal information: we use health data only to provide features you request; we do not use it to infer characteristics for advertising.

10.3 United States — Washington (My Health My Data Act) & Nevada (Consumer Health Data)

U.S. Consumer Health Data. We collect and process consumer health data as described in our Consumer Health Data Privacy Policy. That policy explains the categories of consumer health data we collect, sources, purposes, sharing, third parties and affiliates, consent, withdrawal, deletion, appeals, and our commitments not to sell consumer health data or share it for targeted advertising.

Your rights (WA/NV): access, delete, withdraw consent, and appeal denials. Submit requests at hi@glapp.io. We will verify your request and respond within the timelines required by law.

10.4 Canada & Australia

We process your data in accordance with applicable law. You may request access, correction, and deletion via hi@glapp.io and contact your local privacy regulator.

11) Exercising your rights (all regions)

You may submit privacy rights requests by emailing hi@glapp.io from the email associated with your account. Where available, you may also use in-app controls, such as account deletion. We may keep records of privacy requests, verification steps, our responses, and any appeals for up to 24 months to document compliance and protect against misuse.

For authorized agents (where allowed), include proof of authorization and identity verification for the consumer you represent.

12) Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data we process, including encryption in transit, access controls, and regular review of systems and logs. We also use network and application protections (for example, Cloudflare) to mitigate abuse and threats. No method of transmission or storage is 100% secure.

13) Breach notification

If a security incident affects personal data or consumer health data, we will investigate and notify affected users, regulators, service providers, media, or others where required by applicable law, including the FTC Health Breach Notification Rule where it applies.

14) Children

Glapp is intended for individuals 18 and older. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact hi@glapp.io and we will delete it.

15) Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide notice (e.g., in‑app or by email) and indicate the effective date at the top. If changes materially affect how we collect, use, or share consumer health data, we will provide notice and obtain consent where required before the new practice applies.

16) Additional information

• We do not use third‑party targeted advertising or data brokers.
• We may use aggregated or de-identified data to operate, secure, improve Glapp, and publish broad insights about GLP‑1 trends. We do not share identifiable health logs, AI content, uploaded images, or user-level datasets with researchers, media, or industry partners unless you give separate consent.

Questions or requests? Email us at hi@glapp.io.