Consumer Health Data Privacy Policy

01 Introduction and Scope

GlucoWorks LLC (“GlucoWorks,” “we,” “us,” or “our”) is a Wyoming limited liability company that develops diabetes management software. This Consumer Health Data Privacy Policy (“Policy”) supplements our Privacy Policy and describes how we collect, use, share, and protect Consumer Health Data as defined under the Washington My Health My Data Act (MHMDA), the Nevada Consumer Health Data Privacy Law, and similar state consumer health data privacy laws (collectively, “Consumer Health Data Laws”).

This Policy applies when Consumer Health Data Laws are applicable to the data we process. To the extent that health data we process is subject to the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, that data is exempt from Consumer Health Data Laws and is governed by our HIPAA Notice of Privacy Practices and applicable Business Associate Agreements.

02 Definitions

“Consumer Health Data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. This includes, but is not limited to:

• Individual health conditions, treatment, diseases, or diagnosis.
• Social, psychological, behavioral, and medical interventions.
• Health-related surgeries or procedures.
• Use or purchase of prescribed medication.
• Bodily functions, vital signs, or measurements of the foregoing (including blood glucose readings).
• Diagnoses or diagnostic testing, treatment, or medication.
• Reproductive or sexual health information.
• Biometric data.
• Genetic data.
• Precise location data that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies.
• Data that identifies a consumer seeking healthcare services.

03 Categories of Consumer Health Data We Collect

3.1 Website-Related Health Data

3.2 DoseAdvisor Health Data

04 How We Collect Consumer Health Data

• Through our Website: When you browse gluco-works.com, we may collect information about which health-related product pages you visit and how you interact with our site through cookies and similar technologies.
• Through contact forms and email: When you contact us via our Website or email, you may voluntarily provide health-related information in your inquiry.
• Through the DoseAdvisor application: When you use the DoseAdvisor patient app, we collect Consumer Health Data that you enter (blood glucose readings, carbohydrate counts) and data generated by the application (calculated insulin doses, IOB estimates). If you connect a continuous glucose monitor, we receive glucose data from the CGM manufacturer’s API with your authorization.

05 How We Use Consumer Health Data

We use Consumer Health Data for the following purposes:

• Providing Services: To operate our Website and respond to your inquiries about our diabetes management products.
• Website Improvement: To analyze how visitors interact with our health-related content and improve our Website.
• Insulin Dose Calculation: To calculate insulin doses based on parameters prescribed by your clinician (or configured by you in wellness mode), your blood glucose readings, carbohydrate intake, and insulin-on-board status.
• Clinical Decision Support: To provide your prescribing clinician with glucose trends, dose history, and adherence summaries through the clinician dashboard.
• Safety Monitoring: To enforce clinical safety guardrails including hypoglycemia prevention, dose stacking prevention, and maximum dose limits.
• Research (with consent): If you consent to participate in a clinical research study, to analyze de-identified or limited data sets for research purposes under an IRB-approved protocol.
• Legal Compliance: To comply with applicable laws and regulations.

06 How We Share Consumer Health Data

6.1 Service Providers (Website)

We share Consumer Health Data only with service providers who are contractually obligated to protect it and use it only for the purposes we specify:

6.2 Service Providers (DoseAdvisor)

For DoseAdvisor, our service providers additionally include:

6.3 Legal Requirements

We may disclose Consumer Health Data when required by law, in response to valid legal process, or to protect our rights, privacy, safety, or property.

6.4 With Your Consent

We may share Consumer Health Data with other parties when you provide affirmative consent.

07 Your Rights

Under applicable Consumer Health Data Laws, you have the following rights:

7.1 Right to Know / Access

You have the right to confirm whether we are collecting or sharing your Consumer Health Data and to request access to such data.

7.2 Right to Deletion

You have the right to request that we delete your Consumer Health Data. Upon verified request, we will delete your Consumer Health Data and direct our processors to do the same, subject to applicable legal exceptions.

7.3 Right to Withdraw Consent

Where we process Consumer Health Data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

7.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under Consumer Health Data Laws.

7.5 DoseAdvisor-Specific Data Rights

In addition to the rights described above, DoseAdvisor users have the following data rights:

• Device Data: DoseAdvisor stores certain health data locally on your mobile device for offline functionality. You may delete locally stored data at any time by clearing app data or uninstalling the application. Local deletion does not automatically delete data stored on our servers.
• CGM Disconnection: You may revoke DoseAdvisor’s access to your CGM data at any time through your Dexcom or LibreLinkUp account settings. Revoking access stops future data collection but does not delete previously collected data. To delete previously collected CGM data, submit a deletion request.
• Account Deletion: Upon verified request, we will delete your DoseAdvisor account and all associated Consumer Health Data from our servers within thirty (30) days. If your account was established by a prescribing clinician, we may need to coordinate with the applicable healthcare provider before completing deletion of data that also constitutes PHI.
• Data Export: You may request an export of your DoseAdvisor data in a structured, machine-readable format (JSON).

7.6 How to Exercise Your Rights

To exercise any of the rights described above, you may:

• Email us at privacy@gluco-works.com
• Write to us at: GlucoWorks LLC, Attn: Privacy, Wyoming, USA

We will respond to verified requests within the timeframes required by applicable law (typically 45 days for Washington MHMDA and 60 days for Nevada). We may request additional information to verify your identity before processing your request.

08 Data Security

We implement appropriate technical and organizational measures to protect Consumer Health Data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls limiting access to Consumer Health Data.
• Regular security assessments and vulnerability testing.
• Employee training on data protection obligations.

09 Data Retention

We retain Consumer Health Data only for as long as necessary to provide our services and fulfill the purposes described in this Policy, or as required by law. Website browsing data that constitutes Consumer Health Data is retained for no longer than twenty-four (24) months. DoseAdvisor application data is retained in accordance with the DoseAdvisor Privacy Policy and applicable data retention schedules.

10 Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy on this page with an updated effective date. Material changes will be communicated through a notice on our Website. Your continued use of our services after changes are posted constitutes your acceptance of the revised Policy.

11 Contact Us

If you have questions about this Consumer Health Data Privacy Policy or wish to exercise your rights, please contact us:

For legal inquiries: legal@gluco-works.com
Mail: GlucoWorks LLC, Attn: Privacy, Wyoming, USA