Privacy Policy

Summary

Diabetes Action Layer ("DAL") is operated by GENAK ("GENAK", "we", "us"). DAL helps people with diabetes track glucose, meals, vitals, and activity, and provides coaching grounded in published clinical guidelines, with optional AI-written summaries. This policy explains what we collect, why we collect it, how we protect it, and the rights you have over your data. We do not sell your data. We do not use your identifiable health data to train AI models. We do not share your data with advertisers.

Who we are

DAL is operated by GENAK. The brand site is diabetesactionlayer.com. The app is available at diabeteslayer.com and through the DAL iOS and Android apps. For privacy questions or to exercise your rights, contact [email protected].

What we collect

Account information

• Email address and a hashed password (we never store your password in readable form).
• Display name, date of birth, and diabetes type if you choose to provide them.

Health data you enter

• Blood glucose readings, meals, medications, blood pressure, weight, activity, and notes.
• Meal photos you choose to analyze for a carb estimate. Photos are analyzed and then discarded; DAL does not store them.
• Onboarding responses used to personalize coaching (e.g. comfort with technology, goals).

Device and integration data

• Dexcom CGM. If you connect your Dexcom account, we receive your estimated glucose values (EGVs), timestamps, trend arrows, and Dexcom-provided metadata for the period you authorize. We use OAuth 2.0 and store encrypted access and refresh tokens; we never see or store your Dexcom password.
• FreeStyle Libre (LibreLinkUp). If you connect a LibreLinkUp follower account, we sign in on your behalf, retrieve the glucose measurements the patient has shared with that follower account, and store your follower credentials encrypted at rest (AES-256-GCM) so we can refresh your session.
• Bluetooth meters. If you pair a Bluetooth glucometer via your browser, we read measurements directly from the device using the Bluetooth Glucose profile.

Usage data

• Application logs (timestamps, endpoints accessed, success/error status) for security and debugging.
• HIPAA-style audit entries recording every access to your own protected health information.
• Approximate IP address and user-agent, used for rate limiting and fraud prevention.

How we use your data

• To show you your own data in charts, summaries, and estimates.
• To generate personalized action steps, pattern insights, and predictions with DAL's own rule-based algorithms.
• If you have DAL Pro and turn on AI features, to have some text written, and meal photos analyzed, by an AI model from Anthropic. See "AI features and Anthropic" below.
• To let you share a time-limited summary with a clinician via a read-only link that you explicitly create.
• To send you transactional email required to operate your account (e.g. password reset). We do not send marketing email without separate opt-in.
• To secure the service: detect abuse, enforce rate limits, and satisfy our legal obligations.

AI features and Anthropic

DAL sends data to an AI service only if you have DAL Pro and you turn on AI features on the "Allow AI features?" screen. You can turn them off at any time in Settings → AI features; from then on nothing is sent.

Who receives it

Anthropic, PBC, the maker of Claude, through its API. Anthropic processes the data only to produce the result for you and, under its commercial terms, does not use it to train its AI models. DAL currently uses Anthropic only; if that changes we will ask for your permission again before sending anything.

What is sent, for each feature

• Weekly summary: your glucose averages, estimated A1c, time in range, number of readings, the patterns DAL detected, and this week's action and streak counts.
• Visit prep notes: the same glucose figures, plus your diabetes type, whether you use insulin, and the names and doses of medications you have entered.
• Meal photo carb estimate: the photo you take or choose, and the meal type.

What is never sent

Your name, email address, date of birth, or account ID. DAL does not store meal photos. We keep a record that an AI request was made (time, feature, size), not its contents.

If AI features are off

Weekly summaries and visit notes are written by DAL's own rules, and meal photos are not analyzed. Everything else in DAL works the same.

Legal bases (GDPR)

If you are in the EEA or UK, we process your data under the following bases: (a) performance of our contract with you to deliver the service; (b) your explicit consent for processing of health data and for each third-party integration you connect; (c) our legitimate interest in keeping the service secure; and (d) compliance with our legal obligations.

How we protect your data

• TLS 1.2+ for all traffic to and from the service.
• AES-256-GCM encryption at rest for sensitive fields, including OAuth tokens and integration credentials.
• Passwords stored as salted bcrypt hashes; no plaintext password is ever logged or stored.
• HIPAA-aligned audit logging of every access to protected health information.
• Role-based access controls and strict separation of user data in the database.
• Security headers (HSTS, CSP, X-Frame-Options, referrer-policy) and CSRF protection on every mutating request.
• Regular dependency scanning and vulnerability patching.

No system is perfectly secure. If we discover a breach that affects you, we will notify you without undue delay.

Who we share data with

We share the minimum data necessary, and only with the following categories of recipients:

• Infrastructure providers that host the application (cloud hosting, managed database, managed Redis, email delivery). These providers act as data processors under contract and cannot use your data for their own purposes.
• Anthropic, only if you have turned on AI features, to write AI summaries and analyze meal photos. See "AI features and Anthropic" above for exactly what is sent. Anthropic does not use this data to train its models under its commercial terms.
• Device vendors you connect (Dexcom, Abbott via LibreLinkUp). When you authorize an integration we exchange tokens with the vendor on your behalf, and we pull only the data that integration returns.
• People you explicitly share with. When you create a provider-share link, anyone with that link can view the summary for the period and scope you selected. The link is time-limited and revocable.
• Law enforcement or regulators when required by a valid legal process.

We do not sell personal information, ever. We do not share personal information with advertisers.

Retention

• We keep your data for as long as your account is active.
• When you delete your account, we remove your personal data within 30 days, except for audit logs that we are required to retain for up to 6 years under HIPAA-aligned retention practices. Those audit logs do not contain health data; they record who accessed what and when.
• Aggregated, de-identified analytics (counts, trends across all users) may be retained indefinitely.

Your rights

• Access. You can view your own data in the app at any time and can request a machine-readable export.
• Correction. You can edit or delete individual entries directly in the app.
• Deletion. You can delete your account from Settings. This removes your personal data from our active systems within 30 days.
• Portability. You can request a copy of your data in JSON or CSV format by emailing [email protected].
• Withdraw consent. You can disconnect any third-party integration from the Devices page; future syncs stop immediately.
• Complaint. If you are in the EEA or UK, you have the right to lodge a complaint with your supervisory authority.

Children

Diabetes Action Layer is not intended for children under 13 (or under 16 in the EEA), and we do not knowingly collect personal data from them. If a parent or guardian wants to use the service on behalf of a minor, they must create the account and remain responsible for oversight of its use.

International transfers

Our infrastructure is hosted in the United States. If you access the service from outside the U.S., your data will be transferred to and processed in the U.S. under the protections described in this policy.

Cookies

We use strictly necessary cookies for authentication and CSRF protection. We do not use advertising cookies or third-party tracking cookies.

Changes to this policy

We may update this policy from time to time. If changes are material, we will notify you by email or through an in-app notice before the changes take effect. The "Last updated" date above always reflects the most recent revision.