Privacy Policy

01 Who we are

DoseAdvisor is a clinical decision support platform developed and operated by GlucoWorks LLC, a healthcare technology company. DoseAdvisor enables licensed clinicians to configure structured insulin dosing regimens, which are then executed safely by patients through the DoseAdvisor mobile application.

GlucoWorks LLC is the data controller for information collected through the DoseAdvisor platform. Our principal place of business is in the United States.

02 Information we collect

We collect the minimum information necessary to operate the DoseAdvisor platform safely and effectively.

Clinician account information

• Full name, professional credentials, and email address
• Organization affiliation and clinical role
• Account credentials (password stored as a salted hash — never in plaintext)
• Session activity logs (login timestamps, IP address, device type)

Patient information (collected and managed by the clinician)

• Patient name, date of birth, and contact information — as entered by the prescribing clinician
• Insulin regimen parameters — insulin type, correction factors, carb ratios, dosing targets, and safety limits
• Blood glucose readings entered at the time of dose calculation
• Carbohydrate estimates (for carb-counting regimens)
• Calculated dose outputs and insulin-on-board values
• Dose history and timestamps

Automatically collected technical information

• Device type, operating system, and app version
• Network connectivity status (online/offline)
• Application error logs and crash reports (anonymized)
• Feature usage analytics (aggregate, non-identifiable)

03 How we use your information

Information collected through DoseAdvisor is used exclusively for the following purposes:

Platform operation

• Executing insulin dose calculations based on clinician-configured regimen parameters
• Enforcing safety guardrails including insulin-on-board tracking, dose caps, and blood glucose thresholds
• Delivering dose reminders and notifications to patients
• Synchronizing regimen data between the clinician dashboard and patient app

Clinical documentation and reporting

• Generating immutable audit logs of every dose calculation for clinician review
• Producing exportable clinical reports for documentation, billing, and continuity of care
• Supporting Remote Patient Monitoring (RPM) workflow documentation

Platform improvement and safety

• Monitoring platform reliability and diagnosing technical errors (using anonymized, non-PHI data only)
• Improving calculation accuracy and safety logic (using aggregated, de-identified data)

04 HIPAA compliance and PHI

DoseAdvisor is built on a HIPAA-ready architecture. Where GlucoWorks LLC operates as a Business Associate to a Covered Entity (such as a medical practice or health system), all PHI is handled in accordance with HIPAA's Privacy Rule (45 CFR Part 164, Subpart E) and Security Rule (45 CFR Part 164, Subparts A and C).

Our HIPAA commitments

• We execute a Business Associate Agreement (BAA) with every covered healthcare organization using DoseAdvisor
• Access to PHI is strictly limited to personnel and systems with a documented need for that access
• PHI is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher
• All access to PHI is logged in a tamper-evident audit trail
• We maintain written policies and procedures governing PHI access, use, and disclosure
• We conduct regular security risk assessments and employee HIPAA training
• In the event of a breach affecting PHI, we will notify affected parties in compliance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D)

Minimum necessary standard

We apply the HIPAA minimum necessary standard to all PHI access and disclosure. Users of the clinician dashboard may only access records of patients assigned to them within their organization. Platform administrators have access controls that are role-based and logged.

05 Data sharing and third parties

We do not sell, rent, or trade personal information or PHI. We share information only in the following limited circumstances:

Infrastructure providers (under BAA)

DoseAdvisor is hosted on Google Cloud Platform (GCP). GlucoWorks LLC maintains a signed BAA with Google covering all services that process PHI. GCP services used include Cloud Run (compute), Cloud SQL (database), Cloud Storage (file storage), and Secret Manager (credentials). All data remains within GCP's HIPAA-eligible services.

Clinician's organization

Patient data entered or generated within DoseAdvisor is accessible to the prescribing clinician and authorized members of their organization as configured in the platform. Patients are informed of this at the time of enrollment by their clinician.

Legal obligations

We may disclose information where required by law, court order, or governmental authority — including HIPAA-mandated disclosures to the Secretary of Health and Human Services for compliance investigations.

Business transfers

In the event of a merger, acquisition, or sale of assets, PHI and user data will only be transferred to a successor entity that agrees in writing to be bound by terms at least as protective as this policy and applicable law, including HIPAA.

06 Data retention

We retain information for as long as necessary to provide the DoseAdvisor service and comply with our legal, regulatory, and clinical documentation obligations.

Upon account termination or a valid deletion request, we will de-identify or securely delete personal information within 30 days, subject to our legal retention obligations above. PHI subject to a BAA will be handled as specified in the applicable agreement.

07 Security

We implement technical, administrative, and physical safeguards designed to protect information collected through DoseAdvisor.

Technical safeguards

• AES-256 encryption for all PHI at rest; TLS 1.2+ for all data in transit
• Role-based access control with principle of least privilege across all platform tiers
• Immutable, tamper-evident audit logging of all PHI access and dose calculations
• Automatic inactivity timeout and biometric re-authentication on the mobile app
• Private VPC network isolation for all backend services on GCP
• Secrets and credentials managed via GCP Secret Manager — never hardcoded
• Regular automated vulnerability scanning and dependency auditing

Administrative safeguards

• Background checks and HIPAA training for all personnel with PHI access
• Written security policies and incident response procedures
• Regular security risk assessments per HIPAA Security Rule requirements
• Vendor due diligence for all third-party subprocessors

No method of electronic transmission or storage is 100% secure. While we strive to protect your information using commercially reasonable means, we cannot guarantee absolute security. In the event of a security incident affecting PHI, we will notify affected parties as required by the HIPAA Breach Notification Rule and applicable state law.

08 Your rights

Depending on your role and jurisdiction, you may have the following rights with respect to your information. To exercise any of these rights, contact us at privacy@gluco-works.com.

We will respond to verified requests within 30 days. For PHI-related requests, we may need to coordinate with the applicable Covered Entity (your clinician's practice or health system) before we can fulfill the request.

09 Children's privacy

DoseAdvisor is a clinical platform intended for use under the supervision of a licensed healthcare provider. Patients under the age of 18 may use the DoseAdvisor patient app only with the explicit involvement of a parent or legal guardian and under the care of a licensed clinician who has established the patient account.

We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. If you believe we have inadvertently collected information from a child under 13 without appropriate consent, please contact us immediately at privacy@gluco-works.com and we will take prompt action to delete it.

10 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, platform capabilities, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered clinicians by email at least 14 days before the change takes effect
• Display a prominent notice in the clinician dashboard

Your continued use of DoseAdvisor after the effective date of a revised policy constitutes acceptance of the updated terms. If you do not agree with the changes, you may close your account by contacting us at privacy@gluco-works.com.

For BAA-covered organizations, material changes that affect the handling of PHI will be communicated in accordance with the terms of the applicable Business Associate Agreement.

11 Contact us

For questions, requests, or concerns about this Privacy Policy or your information, please contact us:

For general inquiries: info@gluco-works.com
For clinical partnership inquiries: clinical@gluco-works.com