This Privacy Policy explains what data the app collects, how it is used, and the choices and rights you have. Because GLPMate is a GLP-1 medication and health tracker, some of the data you enter is sensitive health data, and we treat it with extra care.
Our privacy principles
- Your account is yours. To use the app you create an account — with your email address and a one-time code, or by signing in with Apple or Google. The data you enter is stored securely on our servers, linked to your account, so you can restore it and use it across your devices.
- Your health data is yours. You can view and delete it. We do not sell your personal data, and we do not sell or share your health data for advertising.
- We collect the minimum we need to run the app, keep it working and secure, and back up and sync your data so you can restore it.
Your identity and account data
To create an account we process one of the following:
- Email sign-in — your email address and the one-time verification code we send you.
- Apple or Google sign-in — the identity token verified by the provider (if you use Apple's "Hide My Email", this may be a private relay address).
This information is used to identify your account, keep your sign-in secure, and link your data to the right account.
Data you enter (health and profile data)
When you use the app, you may enter or generate:
- Medication and dose data — the GLP-1 medication you track, dose amounts, injection or intake times, titration steps, and missed-dose events.
- Body and health metrics — weight, and any symptoms, side effects, lab results, nutrition, glucose, blood pressure, sleep, or notes you choose to log.
- Profile data — name (optional), sex, date of birth, height, activity level, journey stage, and your unit, language, currency, and theme preferences.
This information is used to provide the app's core features (logging, the estimated drug-level curve, weight and nutrition tracking, reminders, and insights). It is stored on our servers, linked to your account, and synced across your devices.
Kept only on your device: your progress / body photos are stored only on your device and are not uploaded to our servers. The estimated drug-level (PK) curve is calculated on your device — it is an educational estimate, not a medical measurement (see the Health Disclaimer). Dose and log reminders run through your device's local notifications.
AI Assistant and AI processing
The app includes an AI assistant that answers your questions.
- The messages you share with the assistant, the documents you upload (for example lab results — processed to extract their values / OCR), and the voice input you send (transcribed to text) are processed to generate personalized answers for you.
- To produce answers and to transcribe voice, this content is transferred to third-party AI providers acting as processors: OpenAI, Google, and Anthropic (OpenAI Whisper is used to transcribe voice input). These providers use the content only under our instructions, to produce the answer or transcription.
- Your assistant conversation history, the AI memory notes derived from it, and your voice transcripts are stored on our servers, linked to your account.
- For service quality and safety, conversation content may be reviewed by our authorized staff.
- AI processing of your health data is based on your explicit consent; you can withdraw it at any time (new processing then stops; deleting existing data is a separate right — see Deleting your account and data).
Data collected automatically
- Usage analytics — collected through Amplitude to understand how features are used and to improve the app. This includes an anonymous installation identifier generated at first launch; it is not linked to your name or email.
- Crash and diagnostic data — collected through Google Firebase (Crashlytics) to detect crashes, fix bugs, and improve stability. This may include device model, app version, operating system version, crash logs, and diagnostic identifiers.
- Push notification token — processed on our own self-hosted notification infrastructure (we do not use a third-party push provider) to deliver reminders and important announcements you have enabled. To reach your device, the notification is handed to the platform push services: Google Firebase Cloud Messaging (FCM), and on iOS onward to the Apple Push Notification service (APNs). You can disable notifications at any time in your device settings.
- Advertising identifiers and ad interaction data — where advertising is enabled, processed by Google AdMob to show ads, measure ad performance, and prevent fraud. Advertising is never based on your entered health data.
- Marketing and attribution data — processed through our mobile measurement partner (such as Singular or Adjust) to measure marketing campaigns, understand where installs come from, and prevent fraud. This may include device and advertising identifiers, IP address, and install and in-app event data.
- Website analytics (glpmate.me only) — our public website uses Microsoft Clarity to produce aggregate heatmaps and session replays that show how visitors navigate the site, so we can fix confusing pages. Clarity is used only on the website, never inside the app. It is configured to mask text you type and images, so values you enter into the free calculators (such as weight, BMI or dose) are not recorded. This may include IP address, browser and device type, referring page, and pages viewed.
We do not use your entered health data (doses, weight, symptoms) to personalize ads, and we do not sell it.
Subscriptions and purchases
If you buy a premium subscription or make a purchase, your purchase and subscription status is processed through the Apple App Store or Google Play, and by our subscription-management provider Adapty, used only to unlock and validate premium access. We receive purchase and entitlement information (such as product, status, trial, renewal, and cancellation), not your full payment-card details, which are handled by the app stores. See the Terms of Use for billing and cancellation details.
Advertising and consent
Where advertising is shown, we use Google AdMob. Depending on your region, device settings, and consent choices, ads may be personalized or non-personalized. In regions where consent is required, you may be asked to make advertising and privacy choices before ads are shown, and on iOS access to the device advertising identifier may be subject to Apple's App Tracking Transparency consent. Advertising is never based on the health data you enter.
How we use your data
- To provide and maintain the app and its core features.
- To calculate the estimated drug-level curve and other on-device insights.
- To store, back up, and sync your data across your devices so you can restore it.
- To generate the AI assistant's personalized answers (see above).
- To analyze usage and improve features, performance, and reliability.
- To detect and fix crashes, bugs, and security issues.
- To manage subscriptions and premium access.
- To measure marketing performance and, where enabled, show and measure ads.
- To respond to your support requests.
- To comply with legal obligations and protect against misuse.
Legal basis for processing (EEA/UK)
Where the GDPR applies, we process data on these bases:
- Contract — to provide the features you use, including account-linked storage and sync.
- Consent — for optional analytics, advertising, and diagnostics, and for processing your health data and its AI processing where consent is required. You can withdraw consent at any time.
- Legitimate interests — to keep the app secure, prevent abuse, and improve it, balanced against your rights.
- Legal obligation — where we must retain or disclose data by law.
Your entered health data is treated as a special category of data; we process it based on your explicit consent and use of the app, and only to provide the features you choose.
Data sharing
We do not sell your personal data, and we do not sell or share your health data for advertising. Data is shared only with the service providers below, only as needed to run the app, and each acts under its own privacy policy and our instructions:
- OpenAI — AI assistant answer generation and voice transcription (Whisper) — Privacy Policy
- Google — AI assistant answer generation (Gemini) — Privacy Policy
- Anthropic — AI assistant answer generation — Privacy Policy
- Amplitude — usage analytics — Privacy Policy
- Google Firebase — crash and diagnostic reporting (Crashlytics) and push notification delivery (Cloud Messaging) — Privacy Policy
- Adapty — subscription management — Privacy Policy
- Langfuse — LLM observability and quality monitoring (EU) — Privacy Policy
- Apple Push Notification service (APNs) — push notification delivery (iOS) — Privacy Policy
- Google AdMob — advertising — Privacy Policy
- Mobile measurement partner (Singular or Adjust) — marketing attribution — Singular / Adjust
- Apple App Store — subscription and purchase processing — Privacy Policy
- Google Play — subscription and purchase processing — Privacy Policy
Some of these services (such as advertising and attribution) may be inactive in a given build or region; where a service is not active, it does not process your data. We do not add new categories of processing without updating this policy.
Data retention
- Account data: retained on our servers for as long as your account is active, so you can restore it. When you delete your account (see below), your account data and cloud backup are deleted, including from backups on our normal purge schedule.
- AI assistant content (messages, voice transcripts, memory notes) is stored together with your account data and is deleted when you delete your account.
- Analytics and diagnostics: retained only as long as needed to analyze and improve the app, and then deleted or anonymized.
- We retain data longer only where required to meet legal obligations, resolve disputes, or enforce our terms.
Deleting your account and data (your right to erasure)
You can delete your account and data from within the app, at any time, for free.
- Open the Settings tab, tap Privacy & permissions, and choose Delete account.
- You will see exactly what will be deleted (all your logs, your assistant history, and your cloud backup) and confirm with a clear two-step confirmation. Deletion is permanent and cannot be undone.
- When you confirm, your account, cloud backup, and local data are actually deleted, and you are returned to a signed-out screen.
- If you have an active subscription, deleting your account does not automatically cancel it — you must cancel your subscription separately through the App Store or Google Play. We will remind you of this before deletion.
If deletion fails, your data is not corrupted and you can try again — there is no silent failure.
Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (see above; also available directly in the app).
- Restrict or object to certain processing.
- Withdraw consent where processing is based on consent.
EEA/UK (GDPR): you have all the rights above and the right to lodge a complaint with your local data protection authority.
California (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information, and we do not use sensitive personal information for purposes beyond providing the app. You will not be discriminated against for exercising your rights.
To exercise any right, use the in-app tools where available, or contact us at [email protected]. We will respond within the time required by applicable law.
Data security
We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls on our servers. No method of transmission or storage is completely secure, but we work to protect your health data appropriately.
Children's privacy
This service is for adults aged 18 and over only. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us so we can delete it.
Your device permissions
You can manage certain choices through your device settings, such as notification permissions and app permissions. The app uses local reminders on your device for dose and log reminders; these do not require sharing your data with a third party.
International data transfers
Our servers are hosted in the European Union (Germany). Our AI providers (OpenAI, Google, Anthropic) may process data in other countries, including the United States, meaning your data is transferred abroad. We take steps to ensure appropriate safeguards are in place (such as standard contractual clauses) as required by applicable law.
Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be shown in the app with a new effective date. If we make a material change to how we handle your health data, we will make reasonable efforts to notify you.
Contact us
If you have questions about this Privacy Policy or your data, contact us at [email protected].