ForMyGluco Privacy Policy

Last updated: 1 August 2026

Data controller and service provider: Erdoğan Dağdelen (independent developer), referred to in this document as "ForMyGluco" or "we".

Address: İzmir, Türkiye

Single contact address for all questions, requests, complaints and data protection enquiries: support@formygluco.app

We respond to your requests within 30 days at the latest, or within a shorter period where local law requires one.

This Privacy Policy explains how your personal data is collected, used, stored, protected and shared when you use ForMyGluco.

1. Data Controller and Contact

Data controller and service provider: Erdoğan Dağdelen (independent developer), referred to in this document as "ForMyGluco" or "we".

Address: İzmir, Türkiye

Single contact address for all questions, requests, complaints and data protection enquiries: support@formygluco.app

We respond to your requests within 30 days at the latest, or within a shorter period where local law requires one.

ForMyGluco is not a medical service provider or a healthcare institution. The app is a digital tool that makes it easier for you to keep your personal health records organised and accessible.

This policy has been prepared in accordance with the data protection laws applicable in your country, including the GDPR (General Data Protection Regulation), the UK GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK), CCPA/CPRA, PIPEDA, APPI, LGPD and the Australian Privacy Act 1988.

By using the app, you acknowledge that you are aware of the data processing activities described in this policy. Where the law requires explicit consent, your consent is obtained separately and on a separate screen.

2. Scope

This document applies to the ForMyGluco iOS app and the formygluco.app website (marketing and support pages). The Services may be offered on other platforms in the future; these documents will be updated accordingly.

This policy does not apply to third-party websites or third-party applications. Where ForMyGluco directs you to a third-party service, that service's own privacy policy applies. We are not responsible for the privacy practices of those services, which are outside our control; we recommend that you review their policies separately.

3. Medical Disclaimer (Important)

ForMyGluco is not a medical device and must not be used as one. The app does not diagnose, does not recommend treatment, does not calculate medication or insulin doses, and does not replace any healthcare professional. All values, estimates, charts and reports in the app are informational summaries generated solely from the data you enter. Always consult your doctor or a qualified healthcare professional before making any decision about your health. In a medical emergency, contact your local emergency services immediately.

The estimated HbA1c (eA1c), averages, time in target range, trend analyses and reports shown in the app do not replace a laboratory result or a physician's assessment. Do not change your medication, your insulin dose or your treatment based on any information in the app.

4. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Health Data: Blood glucose records, insulin records, medication records, blood pressure measurements, weight information, lab results, water intake and similar health-related information that you add to the app.
• User: The natural person who uses the ForMyGluco app.
• Service Provider: Third-party companies that provide specific technical services on behalf of ForMyGluco (data storage, subscription validation, error monitoring, email delivery).
• Processing: The collection, recording, storage, display, transfer, deletion of personal data, or any other operation performed on it.

5. Information We Collect

5.1 Account Information

You can create your account in one of three ways: (a) email address and password, (b) Sign in with Apple, (c) Sign in with Google.

When you sign in with Apple or Google, the relevant provider passes on to us only your email address and, if you choose to share it, your name, in order to verify your identity; your password never reaches us. If you use the "Hide My Email" option with Sign in with Apple, we receive a relay address generated by Apple (@privaterelay.appleid.com) instead of your real email address, and we never see your real address. Passwords are not stored by us in plain text.

You may optionally add a display name. During setup, your diabetes type, your unit of measurement and your target blood glucose range are saved. Adding your year of birth, sex and chronic condition information is entirely optional; these fields are used only to enrich your doctor's report and may be left blank.

5.2 Health Data

The health information you add to the app of your own accord is processed:

• Blood glucose measurements and target blood glucose ranges
• Insulin records (insulin name, type, units, injection site)
• Medication definitions and medication intake records
• Weight records, and your height and goal weight if you enter them
• Blood pressure and pulse measurements
• Laboratory / lab results
• Water intake records
• Free-text notes you add to records

This data is provided solely by you and is processed in order to deliver the app's health tracking functions.

5.3 Doctor Appointments and Health Planning

You can create appointment and routine health check-up records within the app. These records may include the hospital or healthcare institution, the department, the reason for the appointment, the doctor's name and your own notes.

You are not required to enter information relating to third parties, such as your doctor's name. If you do enter it, that information is processed solely for your own appointment planning; it is not shared with third parties and is not used for marketing purposes.

5.4 Technical and Usage Information

The following technical information may be processed so that the service can be delivered securely:

• Operating system version, device model, app version
• Language and region settings
• Crash and error logs
• IP address (only when you connect to our servers, in access logs, for security and abuse prevention)
• The user identifier assigned to your account (a randomly generated number that does not contain your name)

ForMyGluco does not collect an advertising identifier (IDFA), does not use ad networks, does not track you across other companies' apps and websites, does not request App Tracking Transparency permission, and contains no third-party analytics or tracking tools. No data is collected in the app for third-party analytics purposes; the technical data processed is limited to the items listed above.

5.5 Notification Preferences

If you grant notification permission, your reminder preferences are processed. These preferences remain on your device and are not transmitted to our servers (see section 19). You can change your notification permissions at any time from your device settings or from within the app.

5.6 Apple Health (HealthKit) Data

On iOS devices, and only if you grant permission, only your daily step count is read from the Apple Health app and shown on the home screen together with your blood glucose values.

Granting this permission is not mandatory; if you do not grant it, all other functions of the app continue to work.

Step data read from Apple Health stays on your device: it is not sent to our servers, not stored, not shared with our service providers or third parties, and not used for advertising, marketing, profiling or data mining.

ForMyGluco writes no data to Apple Health. You can withdraw the permission at any time from iOS Settings → Privacy & Security → Health.

6. For What Purposes Do We Process Your Personal Data?

We process your personal data only for the purposes set out in this policy and in accordance with applicable law:

Account and access

• Creating and managing your account
• Authenticating you and providing secure access to your account
• Synchronising your records across your devices

Health tracking

• Storing and displaying blood glucose, insulin, medication, blood pressure, weight, lab and water intake records
• Showing your health history and summaries derived from your own data (averages, estimated HbA1c, charts)
• Planning doctor appointments and routine health check-ups
• Storing your personal notes

Reporting and export

• Generating a PDF doctor's report
• Exporting data in Excel format
• Enabling you to share your records with anyone you choose

Service quality and security

• Detecting software errors and crashes
• Fixing security vulnerabilities and preventing abuse
• Responding to your support requests

Legal

• Complying with legal obligations and protecting our legal rights

Our commitment regarding your health data: We never use your health data for advertising, never share it for marketing purposes, and do not build a health profile of you to serve targeted advertising. We do not sell your health data.

7. Legal Basis for Processing

Your health data is special category personal data and is processed solely on the basis of your explicit consent (GDPR Art. 6(1)(a) + Art. 9(2)(a); the equivalent provisions of the UK GDPR; KVKK Art. 6; LGPD Art. 11(I); Australian Privacy Act APP 3.3). This consent is recorded during account creation on a screen separate from the other terms, together with the version number.

Your account and contact data are processed on the basis of performance of a contract (GDPR Art. 6(1)(b)), and technical and security data on the basis of legitimate interests (GDPR Art. 6(1)(f)). Where required by legal obligations, GDPR Art. 6(1)(c) applies.

How to withdraw your consent: Your explicit consent to the processing of your health data is the foundation of all of the app's health tracking functions; withdrawing that consent therefore means the deletion of your account and your data. To withdraw it, follow Settings → Delete My Account in the app, or write to support@formygluco.app. Withdrawal does not affect the lawfulness of processing carried out beforehand. So that you do not lose your data, we recommend that you export your records as PDF or Excel before withdrawing your consent.

8. Automated Decision-Making and Profiling

Within the meaning of GDPR Art. 22, the UK GDPR and KVKK Art. 11, we take no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

The estimated HbA1c, averages, charts and analyses you see in the app are informational indicators calculated solely from the data you enter; they do not produce any assessment, score or classification about you and are not transferred to any third party.

9. Advertising and Tracking

ForMyGluco contains no advertising or tracking SDK whatsoever. No advertising is shown in the app, no advertising identifier is collected, no behavioural advertising takes place, and no tool that tracks you across other apps or websites is run.

10. With Whom Do We Share Your Personal Data?

ForMyGluco does not sell your personal data. Your data is shared only to the extent necessary to deliver the service, and only with the service providers listed below. Our service providers process your data solely on our instructions and are subject to confidentiality and security obligations.

Performance monitoring and the transmission of personal identifiers are disabled in Sentry: your IP address, email address and user identifier are not attached to Sentry, and error logs contain none of your health data, record contents or notes.

You may request a copy of the transfer safeguards from support@formygluco.app.

Apart from the above, we may share your personal data only where, and to the extent, necessary to comply with a legal obligation or to protect our legal rights.

11. Where Data Is Stored and International Transfers

Your health records and account information are stored on servers in the European Union (Frankfurt, Germany). Error logs are likewise sent to an endpoint in the European Union (Germany).

If you are located outside the European Union, delivering the service means that your data is transferred to the EU. Where local law requires it (for example in Türkiye), these transfers are additionally based on your explicit consent.

Transfers to our service providers headquartered outside the European Union are carried out under appropriate contractual safeguards, namely the Standard Contractual Clauses (SCCs) adopted by the European Commission and, where necessary, together with the UK Addendum. Our aim is to ensure that your data receives the same level of protection even when it is processed outside your country.

12. Device-First Architecture and Offline Operation

Your data is stored primarily on your device, in the app's own local database, and the app works without an internet connection. When a connection is established, your records are copied to the server, linked to your account, so that they are accessible across your devices.

Deleting the app from your device removes only the local copy; your records on the server remain until you delete your account.

Synchronisation may be delayed due to a network outage, a device failure or removal of the app. We strongly recommend that you export your important health records as PDF or Excel at regular intervals and keep them in your own environment.

13. Retention Period for Personal Data

• Your account information and health records are retained for as long as your account is active.
• Crash and error logs are retained for a maximum of 90 days.
• Technical access logs are kept for as long as necessary for security and system integrity.
• Records that must be retained under legal obligations are kept for the period prescribed by the relevant legislation.

When you delete your account, deletion takes place immediately. Copies of your data may remain temporarily only in encrypted system backups kept for disaster recovery purposes, and they disappear entirely within 30 days at the latest as part of the backup cycle.

14. Security of Your Personal Data

We apply up-to-date technical and organisational measures to protect the confidentiality, integrity and availability of your data:

• All data transmission is encrypted with TLS/HTTPS.
• Your session token is protected on your device in the iOS Keychain and is not stored in plain text.
• Every record on the server is accessible at row level only to its owner; access to another user's data is blocked at the database level.
• Account deletion works only for the account of the authenticated user themselves.
• Transmission of personal identifiers is disabled at our error monitoring provider.
• Access to personal data is limited to the smallest possible number of people needed to keep the service running.
• Regular security updates and access reviews are carried out.

Although reasonable and up-to-date measures are applied, no method of data transmission over the internet or of electronic storage is completely secure; absolute security cannot be guaranteed.

15. Data Breach Notification

If a breach occurs that affects the security of your personal data, we notify the competent data protection authority within the periods prescribed by applicable law (as a general rule, within 72 hours of becoming aware of the situation).

If the breach carries a high risk to your rights and freedoms, we also inform you directly without undue delay. In the notification we explain the nature of the breach, the categories of data affected, its likely consequences, the measures we have taken and the protective steps you can take.

If you notice a security vulnerability, please report it to support@formygluco.app.

16. Your Rights

Under the data protection law applicable in your country, you may have the following rights:

• To request access to your personal data and to learn which of your data is processed
• To request the correction of incomplete or inaccurate data
• To request the deletion of your personal data
• To request the restriction of certain processing activities
• To object to processing
• To withdraw your explicit consent at any time
• To request that your data be provided to you in a structured, commonly used and machine-readable format (data portability)
• To lodge a complaint with the competent data protection authority

To exercise your rights, write to support@formygluco.app. Where your identity needs to be verified, additional information may be requested from you. We respond to your requests within 30 days at the latest, or within a shorter period where local law requires one.

You can also exercise your rights of access and portability directly and without waiting, using the PDF and Excel export features in the app (see section 20).

17. Right to Complain

If you are not satisfied with how we handle your requests, you retain the right to lodge a complaint with the data protection authority in your country. For example:

• European Union: The supervisory authority of the country where you reside or work (list: edpb.europa.eu)
• United Kingdom: Information Commissioner's Office (ICO)
• Türkiye: Turkish Personal Data Protection Authority (kvkk.gov.tr)
• Canada: Office of the Privacy Commissioner (OPC)
• Australia: Office of the Australian Information Commissioner (OAIC)
• Brazil: ANPD
• Japan: Personal Information Protection Commission (PPC)
• California: California Privacy Protection Agency (CPPA) or the State Attorney General

You are not required to write to us before complaining; however, we can resolve most requests directly: support@formygluco.app

18. Deletion of Your Account and Your Data

You can delete your account from within the app via Settings → Delete My Account, with a two-step confirmation. Once you confirm:

1. Your account on the server and all health records linked to it are deleted permanently and at the same time; there is no waiting period or "deletion queue".
2. The local database copy on your device is deleted in the same operation.
3. You are signed out.

This operation is irreversible and recovery of your data is not possible. We recommend that you take a backup using the PDF or Excel export feature before deleting.

IMPORTANT: Deleting your account does not cancel the Premium subscription you purchased through the App Store. To stop being charged, you must separately cancel the subscription via iOS Settings → (your Apple ID) → Subscriptions. In addition, RevenueCat, which we use for subscription validation, may continue to keep purchase records in line with its own retention period and Apple's accounting obligations; those records contain no health data.

Limited records that must be retained for legal obligations, fraud prevention or security reasons may be excluded from this scope.

19. Notifications and Permissions

ForMyGluco does not send push notifications from a server. All reminders are scheduled and triggered locally on your device. Notification contents (which medication, which appointment, which check-up), their timing and your reminder preferences are not transmitted to our servers; they stay on your device. For this reason, we do not collect, store or transmit to any third party a device notification identifier (push token).

Types of reminder that can be scheduled on your device:

• Medication intake reminders
• Routine health check-up and screening reminders (such as eye, foot, dental and HbA1c)
• Water intake reminders
• Weekly summary notification
• Doctor appointment reminders
• A reminder that the free usage period is about to end

Notifications are shown only if you grant permission. Not granting notification permission does not affect the other functions of the app. You can change your preferences at any time from your device settings or from within the app, or turn them off entirely; if you delete the app or revoke the permission, scheduled reminders also disappear.

ForMyGluco does not send notifications based on your health data for marketing purposes. Before your free usage period expires, a one-time informational notification about your subscription may be shown; this notification is not derived from your health data.

20. Data Portability and Export

You can export your health records from within the app as a PDF doctor's report or an Excel file.

PDF reports and Excel files are generated entirely on your device; the content of the report is never sent to our servers or to third parties at any stage. You alone decide with whom you share the file.

These features are the in-app expression of your right to data portability (GDPR Art. 20 and equivalent provisions) and therefore remain available even after your free usage period ends.

Storing and sharing exported files securely is your responsibility.

21. Cookies and Website Measurement

We do not use cookies. No advertising, analytics or tracking cookies are used on our formygluco.app website; nothing is written to your device and nothing is read from it. For this reason there is no cookie consent banner on our site.

Website visitor measurement. Our website is delivered through Cloudflare, and Cloudflare Web Analytics is enabled on it. This is a privacy-focused measurement tool: it uses no cookies, neither writes to nor reads from your device, does not fingerprint your browser, and does not track you across other websites. Only aggregate counts are kept: the page viewed, the referring page, browser and operating system type, country, and page load timing. No profile is built about you, and this information is not combined with your app account or your health data. Cloudflare processes this information as our service provider.

The mobile app. The app does not use browser cookies; it uses only the secure local storage areas provided by your device's operating system, in order to keep your session open and remember your preferences. The app contains no analytics tool: the website measurement described above applies to the website only.

22. Children's Privacy

ForMyGluco is not directed at children under the age of 16, and we do not knowingly collect personal data from persons under 16. If the law applicable in your country sets a higher age limit, that limit applies; if local law sets a lower age, that age applies.

Users between the ages of 16 and 18 must use the app with the knowledge and supervision of a parent or legal guardian.

If we determine that we have collected data from a person under the age of 16, we delete the account concerned and all data without undue delay. If you believe that your child has provided us with data without permission, write to support@formygluco.app; the account will be closed immediately upon your request.

23. Additional Information for Users in the United States

We do not sell your personal data within the meaning of CCPA/CPRA and do not share it for cross-context behavioural advertising; nor have we sold or shared it in the past 12 months. For this reason, there is no need to provide a separate "Do Not Sell or Share My Personal Information" link; this statement is that right itself.

Your health data is Sensitive Personal Information within the meaning of the CPRA and is used only to provide the service you have requested; it is not used for profiling or advertising.

We do not apply different pricing or service levels to you because you exercise your rights. You may also submit your request through an authorised agent.

The same address applies to your consumer health data rights under the Washington My Health My Data Act and Nevada SB370: support@formygluco.app

24. Changes to This Policy

This Privacy Policy may be updated from time to time. Changes in legislation, the introduction of new features or security requirements may be the reason for this.

We announce material changes by email, within the app or via our website. The current version of the policy will always be accessible through the app and the website. The "Last updated" date at the top of the page shows when the policy was most recently changed.

If you continue to use the app after the updated policy takes effect, this means that you accept the updated policy, to the extent permitted by applicable law. Where the law requires new explicit consent, your consent is obtained separately.

25. Language

The official and binding version of this document is the English version. Versions in other languages may be provided for information purposes; in the event of any discrepancy in interpretation, the English version prevails to the extent permitted by applicable mandatory law.

26. Final Provisions

This Privacy Policy explains the principles governing the processing of your personal data during your use of the ForMyGluco services and has been prepared in accordance with applicable data protection law.

If any provision of this policy is held to be invalid, this does not affect the validity of the remaining provisions.

27. Contact Us

Data controller and service provider: Erdoğan Dağdelen (independent developer), referred to in this document as "ForMyGluco" or "we".

Address: İzmir, Türkiye

Single contact address for all questions, requests, complaints and data protection enquiries: support@formygluco.app

We respond to your requests within 30 days at the latest, or within a shorter period where local law requires one.

Related documents

• Privacy Policy
• Terms of Use
• Premium Subscription Terms