The short version
- Your readings, meals, medicines and reminders are stored on your phone, and saved to your Sugar Pulse account so they are backed up and available on your other devices.
- We use your information only to run Sugar Pulse for you. We do not sell it, rent it or use it for advertising, and there are no ads in the app.
- App analytics and crash reports never include your glucose values, notes, meals or doses.
- Sugar Pulse only reads blood glucose from Health Connect or Apple Health, and only if you allow it.
- PDF reports are made on your phone and go only where you send them.
- You can ask us to delete your account and its data at any time.
1. Who we are
Sugar Pulse (“the app”) is made by Codyssey Labs (“we”, “us”, “our”). This policy covers the Sugar Pulse mobile apps for Android and iOS, our server that holds Sugar Pulse accounts, and this website, sugarpulse.codysseylabs.com. We are responsible for the personal information described here.
2. What we collect
Your account
When you create an account we collect your name, email address, phone number (with its country code), date of birth and, if you add one, a profile photo. Your password is stored only in a securely hashed form; we can never see it. When you sign in, a sign-in token is kept in your phone's secure storage.
Health information you add
This is the heart of Sugar Pulse, and it is information you choose to record:
- Blood glucose readings: the value, date and time, meal tag, notes, where the reading came from (meter, typed in, or a health platform) and any error flags from the meter.
- Meals: meal type, time, the foods and amounts you choose, carbohydrates and notes.
- Medications: names, types, usual doses and the doses you log.
- Reminders: their titles, times and how often they repeat.
- Your settings: diabetes type, preferred unit, target range and low/high thresholds, time zone and notification choices.
Glucose meters
When you pair a Bluetooth meter we store its brand, model, serial number, the name you give it, its Bluetooth identifier and when it last synced, so we can copy only new readings next time. Sugar Pulse talks to your meter directly over Bluetooth; nothing passes through us on the way.
Health Connect and Apple Health
If you turn on importing, Sugar Pulse reads blood glucose records from Health Connect (Android) or Apple Health (iPhone). See section 4.
Device and usage information
- App analytics (Google Firebase Analytics): which features are used, for example “a reading was added from a meter”, “a meter was paired” with its brand and model, or “a report was made” with its length in days. These events never contain glucose values, notes, meal contents, medicine names or doses.
- Crash and error reports (Google Firebase Crashlytics): technical details when the app crashes or a meter connection fails, such as the phone model, operating system, app version and, for meter problems, the meter's brand and model. They never include your readings.
- Notifications: an install identifier we create and a push notification token from Firebase Cloud Messaging, linked to your account so we can send service messages to your devices, plus your app version and platform.
When you contact us
If you email us or use the contact form, we receive your name, email address and whatever you choose to tell us, such as your meter or phone model. Messages sent through the form are stored on our server with the time they were sent and your IP address and browser details, which we keep only to prevent abuse of the form.
What we do not collect
We do not collect your contacts, messages or precise location. We do not read any health data other than blood glucose, and we never write to or delete anything in Health Connect or Apple Health.
3. How we use your information
- To run the app for you: show your readings, statistics, charts and reports; schedule your reminders; send low and high alerts on your phone.
- To keep your account working: sign you in, reset your password by email, back up your records and keep them the same on each device you sign in on.
- To send service messages: for example account or security notices and important announcements about the app.
- To fix and improve Sugar Pulse: using analytics and crash reports that contain no health values.
- To reply to you when you contact us.
- To meet legal obligations and protect the safety and security of our users and service.
We process your health information because you ask us to, by recording it and using the app, and with your explicit consent where the law requires it. You can withdraw consent at any time by deleting the data or your account. We never use your information for advertising, never sell it, and never use it to make decisions about you such as for insurance or employment.
4. Health Connect and Apple Health
Importing is optional and off until you turn it on. When it is on:
- Sugar Pulse asks only for permission to read blood glucose. It does not ask for, read or write any other type of health data.
- Imported readings are saved in Sugar Pulse like your other readings, so they appear in your logbook, insights and reports and are backed up to your account. Readings you already have from any source are not added twice.
- Sugar Pulse never writes to, changes or deletes anything in Health Connect or Apple Health.
- You can stop importing in the app at any time, and remove access in Health Connect's app permissions or in your iPhone's Settings → Privacy & Security → Health.
Sugar Pulse's use of information received from Health Connect and Apple HealthKit follows the Health Connect Permissions policy, including its Limited Use requirements, and Apple's HealthKit guidelines. This data is used only to show you your own readings in Sugar Pulse. It is never used for advertising or marketing, never sold, never shared with data brokers, and never used to decide eligibility for credit, insurance or employment.
5. Phone permissions
| Permission | Why Sugar Pulse asks |
|---|---|
| Bluetooth / Nearby devices | To find, pair with and copy readings from your glucose meter. |
| Location (Android 11 and older only) | Older Android versions require it to scan for Bluetooth devices. Sugar Pulse does not record or use your location. |
| Notifications | For your reminders, low and high alerts, and service messages. |
| Alarms & reminders (Android) | So reminders arrive on time. |
| Camera / Photos | Only if you choose to add a profile photo. |
| Health Connect / Apple Health | Only if you turn on importing, to read blood glucose. |
You can refuse or later turn off any permission in your phone's settings; the parts of the app that need it will then stop working, and the rest carries on.
6. Who we share information with
We share personal information only in these cases:
- Service providers who work for us, under contracts that let them use it only to provide their service to us:
- Google (Firebase Analytics, Crashlytics and Cloud Messaging) for usage statistics without health values, crash reports and notifications. See Firebase's privacy information.
- Our server hosting and email providers, who store your account data and send emails such as password-reset codes.
- When you choose to share: a PDF report you send by WhatsApp, email or any other app goes to whoever you send it to. That app's own privacy policy then applies.
- When the law requires it: to comply with a valid legal request, or to protect someone's life, safety or rights.
- If our business changes hands: if Codyssey Labs is merged or sold, your information may move to the new owner, who must keep protecting it under this policy. We will tell you first.
We do not sell, rent or trade your personal information, and we do not share it with advertisers or data brokers.
7. Storage and security
On your phone, your records are kept in the app's private storage, which other apps cannot read, and your sign-in token is kept in the phone's secure storage. Information travelling between the app and our server is always encrypted (HTTPS). On our server, your account and records are protected with encryption at rest, access controls and limited staff access.
No system is perfectly secure. Please use a strong password and keep your phone locked. If we learn of a breach that affects your information, we will tell you and the relevant authorities as the law requires.
8. How long we keep it
- Account and health records: for as long as you have an account. When you delete your account, we delete them from our active systems within 30 days, and from backups within a further 90 days.
- Records on your phone: until you delete them or uninstall the app. Signing out keeps them on the phone so nothing is lost.
- Analytics and crash reports: kept by Firebase for limited periods (Crashlytics about 90 days; Analytics data up to 14 months).
- Messages to us: for as long as needed to help you, then deleted within two years.
9. Deleting your account and data
You can delete individual readings, meals, doses and reminders in the app at any time.
To delete your whole account, use Account → Delete account in the app or ask us on the Contact us page (choose “Delete my account”) or by email at support@codysseylabs.com, from the email address on your account. We will confirm the request and then delete your profile, readings, meals, medications, reminders, meters and settings from our servers, within the times in section 8. To remove the copy on your phone too, uninstall the app.
10. Your rights
Wherever you live, you can ask us to:
- access the personal information we hold about you, and get a copy;
- correct it (you can edit most of it yourself in the app);
- delete it;
- restrict or object to how we use it, or withdraw consent;
- move it to another service in a common format.
Contact us to use any of these rights. We will reply within 30 days and will not treat you differently for asking. You can also complain to your local data protection authority.
11. Children
Sugar Pulse is not meant for children under 13, and we do not knowingly collect information from them. A young person aged 13 to 17 should use Sugar Pulse with a parent or guardian's permission. If you think a child under 13 has given us information, please contact us and we will delete it.
12. International transfers
Our service providers may store or process information in countries other than yours, including the United States. Where that happens we rely on appropriate safeguards, such as the providers' standard contractual clauses, so your information stays protected to the standard in this policy.
13. Changes to this policy
We will update this policy when Sugar Pulse changes. We will change the date at the top, and if a change is significant we will tell you in the app or by email before it takes effect.
14. Contact us
Questions, requests or worries about your privacy are welcome:
- Email: support@codysseylabs.com
- Online: Contact us
Codyssey Labs, the maker of Sugar Pulse.