Legal
Privacy Policy
Version 1.2 | Effective Date: 6 May 2026
Applies to: Bolus Brain mobile application (iOS and Android)
1. Who We Are
Bolus Brain is developed and operated by Liam Biswell, a sole trader based in Leighton Buzzard, England, United Kingdom.
For data protection purposes, Liam Biswell is the Data Controller for all personal data processed through this application.
Contact Details
For all privacy and data protection enquiries:
19 Leopold Road, Leighton Buzzard, Bedfordshire, LU7 2QU
2. About This Policy
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), as amended by the Data (Use and Access) Act 2025.
This policy is written in plain English. If anything is unclear, please contact us before using the app.
We will notify you of any material changes to this policy by in-app notification. Continued use of the app after notification constitutes acceptance of the updated policy.
3. What Data We Collect
3.1 Special Category Health Data (Highest Protection)
The following data is classified as special category data under Article 9 of the UK GDPR and receives the highest level of legal protection:
- Glucose readings (mmol/L) drawn from your connected CGM integration (e.g. LibreLinkUp, Nightscout)
- Insulin doses you log manually within the app
- Meal names, descriptions, and photographs you upload
- AI-assisted carb estimates generated from your meal photographs (see Section 8.1)
- Glucose response curves (start glucose, peak glucose, time to peak, total rise) automatically calculated after meals
- Context flags you choose to log (Exercise, Illness, Stress)
- Snack logs and quick-log entries
- Equipment profiles (insulin brand, delivery method, CGM type)
- Hypo treatment records
- Time in Range (TIR) calculations derived from your CGM glucose data
- Session grouping and meal pattern classifications (e.g. grouping meals into dining sessions and categorising glucose responses)
3.2 Account and Technical Data
- Email address and password hash (for account creation and authentication)
- Demographic information you provide during onboarding (age range, gender, T1D duration, latest HbA1c) — all optional
- Device type, operating system version, and app version (for technical support and crash diagnostics)
- Timestamps of app activity (for data accuracy and pattern calculations)
3.3 Data We Do NOT Collect or Sell
- We do not collect your name
- We do not collect location data
- We do not use advertising trackers or analytics SDKs that profile you
- We never sell, rent, or trade your identifiable personal data to any third party
- We never share your identifiable health data with insurers or employers
- If you opt in to anonymised data sharing (see Section 8.3), fully anonymised and aggregated data may be shared with research partners — but your identity is never attached and you can opt out at any time
4. Why We Process Your Data — Legal Bases
Under UK GDPR, we must have a lawful basis to process your personal data. Because we process health data (special category data), we need both a lawful basis under Article 6 and a condition under Article 9.
| Purpose | Lawful Basis & Article 9 Condition |
|---|---|
| Storing your glucose readings, insulin doses, and meal logs so the app can function | Article 6(1)(b) — Performance of a contract with you; Article 9(2)(a) — Your explicit consent |
| Calculating glucose response curves and displaying meal pattern history | Article 6(1)(b) — Performance of a contract; Article 9(2)(a) — Explicit consent |
| Sending meal photographs to Anthropic’s AI service for carb estimation (opt-in, with separate in-app consent) | Article 6(1)(a) — Consent; Article 9(2)(a) — Explicit consent |
| Sending in-app notifications (e.g. policy updates) | Article 6(1)(f) — Legitimate interests |
| Diagnosing technical errors and crashes | Article 6(1)(f) — Legitimate interests; no special category data accessed |
| Anonymised aggregate data sharing with research partners (opt-in via in-app toggle — see Section 8.3) | Article 6(1)(a) — Consent; Article 9(2)(a) — Explicit consent |
Your Explicit Consent
Because we process health data, we will ask for your explicit, informed, and freely given consent during onboarding. You may withdraw this consent at any time by deleting your account. Withdrawal will not affect the lawfulness of processing before withdrawal.
5. How Long We Keep Your Data
We apply the principle of data minimisation and do not keep your data longer than necessary.
| Data Type | Retention Period |
|---|---|
| Glucose readings and insulin logs | 3 years from the date of logging, then deleted on request or upon automated retention enforcement |
| Meal photographs | 3 years from the date of logging, then deleted on request or upon automated retention enforcement |
| Glucose response curves and pattern data | 3 years from the date of logging, then deleted on request or upon automated retention enforcement |
| Account credentials (email / password hash) | Until account deletion, or 12 months of inactivity, whichever comes first |
| Technical/crash logs | 90 days, then automatically purged |
Why 3 Years?
A 3-year retention period allows the app to identify meaningful long-term patterns in your glucose data (e.g. seasonal variation, changes after medication adjustments) while keeping data storage proportionate. You may request earlier deletion at any time — see Section 7.
6. Data Storage and Security
6.1 Where Your Data is Stored
- App data (meals, insulin, glucose curves) is stored in a PostgreSQL database hosted by Supabase in London, UK (eu-west-2)
- Meal photographs are stored locally on your device. When you use the AI carb estimation feature, photographs are sent to Anthropic's API for processing and are not retained by Anthropic after the response is generated
- Your CGM glucose data is fetched from your connected CGM service (e.g. LibreLinkUp, Nightscout) — we do not store your CGM credentials on our servers
6.2 Security Measures
- Passwords are hashed using bcrypt — we never store plaintext passwords
- All data is transmitted using TLS 1.2 or higher encryption
- Database access is restricted to application services only — no public access
- Meal photographs are stored in private, access-controlled buckets
- We carry out periodic security reviews of our infrastructure
6.3 Data Breach
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and notify you without undue delay, as required by UK GDPR Article 33–34.
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data. To exercise any of these rights, contact us at the address in Section 1. We will respond within one calendar month.
| Right | What This Means |
|---|---|
| Right of Access (Article 15) | You can request a copy of all personal data we hold about you, in a portable format |
| Right to Rectification (Article 16) | You can ask us to correct inaccurate data |
| Right to Erasure (Article 17) | You can ask us to delete all your data at any time. We will action this within 30 days |
| Right to Restriction (Article 18) | You can ask us to pause processing your data in certain circumstances |
| Right to Data Portability (Article 20) | You can request your data in a machine-readable format (e.g. JSON or CSV) for transfer to another service |
| Right to Object (Article 21) | You can object to processing based on legitimate interests |
| Right to Withdraw Consent | You can withdraw your consent to process health data at any time by deleting your account in-app |
If you believe we have handled your data incorrectly, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
8. Sharing Your Data
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
8.1 Service Providers (Data Processors)
We use the following third-party processors who act on our instructions:
- Supabase (London, UK) — cloud database hosting for app data. Subject to Supabase's Data Processing Agreement.
- Anthropic (San Francisco, USA) — AI-powered carb estimation from meal photographs. Photos are sent via encrypted HTTPS, processed ephemerally (not stored by Anthropic after the response), and are only sent when you explicitly use the "Estimate carbs" feature after granting separate in-app consent. You can revoke this consent at any time in Settings. Anthropic's API terms prohibit them from using your data to train their models.
All processors are required to implement appropriate security measures and may not use your data for their own purposes.
8.2 Legal Obligations
We may disclose data if required to do so by law, court order, or regulatory authority. We will notify you where legally permitted to do so.
8.3 Anonymised Data Sharing (Opt-In)
We will NEVER sell or share your identifiable health data. However, if you choose to opt in, we may share fully anonymised and aggregated data with selected research partners to help advance Type 1 diabetes care. Here is exactly how this works:
- What is shared: aggregated, population-level statistics only — such as average glucose responses to common meal types, carb-to-insulin ratios across demographics, and glycemic variability trends. No individual meal logs, glucose traces, or personal records are ever shared.
- How it is anonymised: data is stripped of all identifiers (email, device ID, timestamps), aggregated across many users, and subjected to statistical thresholds so that no individual can be re-identified.
- Who may receive it: academic and NHS research institutions (e.g. NIHR, Diabetes UK-funded studies) and insulin manufacturers (e.g. Novo Nordisk, Eli Lilly, Sanofi) conducting research to improve insulin therapies and diabetes outcomes.
- How you control it: the app includes a dedicated Data Sharing toggle in Settings. This is off by default. You are introduced to this choice during onboarding, but you can change it at any time. Opting out takes effect immediately — your data will no longer be included in future anonymised datasets.
- What is NOT shared: we will never share anonymised data with insurance companies, employers, or any party whose use could disadvantage individuals with diabetes.
9. International Data Transfers
Your core app data (meals, insulin, glucose curves, account information) is stored in the UK by Supabase (London, eu-west-2).
When you use the AI carb estimation feature, meal photographs are sent to Anthropic's servers in the United States for processing. This transfer is covered by your explicit, opt-in consent (UK GDPR Article 49(1)(a)). Photos are processed ephemerally and not retained by Anthropic.
If any of our processors operate outside the UK/EEA, we will ensure that appropriate safeguards are in place (such as UK adequacy decisions or Standard Contractual Clauses) as required by UK GDPR Chapter V.
Your CGM glucose data is fetched from your connected CGM service. We do not control where your CGM provider hosts their infrastructure.
10. Children
Bolus Brain is not designed for children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided data to us, please contact us and we will delete it promptly.
Users aged 13–17 should obtain parental consent before using the app.
11. Automated Decision-Making
Bolus Brain does not make automated decisions that produce legal or similarly significant effects on you. The app displays historical data and patterns from your own records to inform your personal decisions. No automated dosing recommendations are generated.
Under the UK Data (Use and Access) Act 2025, automated decision-making based on special category health data that has significant effects on you requires your explicit consent and the right to human review. We do not engage in such processing.
12. Cookies and Device Storage
The Bolus Brain mobile app uses minimal local device storage for the following purposes only:
- Authentication token — to keep you logged in between sessions
- App preferences — display settings you have configured
We do not use advertising cookies, tracking pixels, or third-party analytics frameworks.
13. ICO Registration
Liam Biswell is registered with the Information Commissioner's Office (ICO) as a data controller. ICO Registration Number: ZC100677 (registered 02 March 2026, expires 01 March 2027).
This registration covers the processing of personal data in connection with the Bolus Brain application.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- We will update the version number and effective date at the top of this document
- We will notify you via in-app notification before the changes take effect
- For material changes affecting how we process health data, we will ask for renewed consent where required
You can always find the current version of this policy in the app under Settings > Privacy Policy.
15. Contact Us
Data Controller Contact
Liam Biswell
Email: support@bolusbrain.app
19 Leopold Road, Leighton Buzzard, Bedfordshire, LU7 2QU
Response time: We aim to respond to all data requests within 30 days.