Version 1.0 · October 2026

App privacy policy

This policy explains what data of yours the LifeSugar app processes, what for, on what legal basis, who we share it with, where and for how long we keep it, and how you can exercise your rights. The lifesugarcare.com website has its own privacy policy.

LifeSugar is a diary for logging your glucose, your insulin, your meals and your activity, and a help for counting the carbs in what you eat, also from a photo. It does not interpret your blood glucose, does not calculate or suggest insulin doses and does not replace your healthcare team. It is not a medical device.

Not yet in force. This policy describes the version of the app that is about to be released; it is not yet the one in force. If you have any questions about your data, write to us at info@lifesugarcare.com.

The essentials in one minute

Who: Lifesugar Care, S.L., with its registered office in Tres Cantos (Madrid). For anything to do with your data, write to us at info@lifesugarcare.com.
What data: what you log in your diary (glucose, insulin, meals, activity), your profile, what you talk about with Glucy and the photos you send her, and data about your account, your subscription and your phone. Much of it is health data.
With your permission: we process your health data only with your explicit consent. Glucy, usage and performance measurement and sharing your diary with your doctor each have their own permission, and you can withdraw them whenever you like from Settings › Privacy and legal. To improve Glucy we review her conversations (section 4), and crash reports are always sent, without your name or your health data, so that the app works; you can turn them off in Settings › Privacy and legal › Crash reports (section 9).
Who with: with the providers that make the app work (mainly Google and RevenueCat), with Open Food Facts if you scan a barcode and with your doctor only if you authorise it. We don't sell your data or use it for advertising.
Where: almost everything is stored in the European Union. Some providers process data outside it, mainly in the US, with the safeguards in section 7. Among them is the Google artificial intelligence that Glucy uses, which may process your messages and photos outside the European Economic Area.
How long: as long as you have the account; conversations with Glucy, 180 days. If you delete your account, we delete your data within 30 days at most. We only keep, blocked, what the law requires us to keep or what we need in order to defend ourselves, and some technical copies disappear on their own within the periods in section 8 (Google's backups, within 180 days at most).
Your rights: you can see your data, correct it, take it with you and delete it, and complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
Age: LifeSugar is only for people aged 18 and over.

1. Who is the controller of your data

Controller: Lifesugar Care, S.L.
Tax ID (NIF): B05736038
Registered office: Calle Ciudad de Columbia 30, 28760 Tres Cantos (Madrid), España
Registration details: Registro Mercantil de Madrid, hoja M-899427, IRUS 1000480114340
Email (privacy, your rights and support): info@lifesugarcare.com
Phone: +34 684 27 30 98
Data protection officer: we have not appointed one. With the number of people who use the app today, the processing is not “large scale” (art. 37.1.c GDPR), and we will review this decision when the app grows. In the meantime, privacy matters are handled by the member of the team we have designated as privacy contact, at the same email address.

2. What data we process, what for, on what basis and for how long

Each use of your data has a purpose and a legal basis under the General Data Protection Regulation (GDPR):

Contract (art. 6.1.b): what is necessary to provide you with the service you sign up for.
Consent (art. 6.1.a) and, for health data, explicit consent (art. 9.2.a). You can withdraw it whenever you like, without affecting what we did before.
Legal obligation (art. 6.1.c): what a law requires us to do or to keep.
Legitimate interest (art. 6.1.f): above all, the security of your account and of the service, and the app working without faults. You can object (section 9).

Purpose	What data	Legal basis	Where it comes from	How long
Creating your account and letting you sign in	The name and email of your Google account, your user ID and the session open on your phone. We don't receive your Google password.	Contract	From Google, when you choose “Continue with Google”	As long as you have the account. When you delete it, it is deleted immediately; Google erases its backups within 180 days at most.
Protecting your account with a second step by SMS	Your phone number and the one-time code we send you	Contract: it is the security measure for an account with health data, and without it we can't open one for you.	From you	As long as you have the account; it is deleted with it.
Checking that you are 18	Your date of birth. It doesn't feed any other calculation; if you share your diary, your doctor sees your age (section 5).	Contract: it is a condition for using the app	From you, when you sign up	As long as you have the account.
Your profile	First name and surname, sex, weight, height, year of diagnosis, type of diabetes and treatment, all required to create your profile. Your weight is used to calculate the calories of your physical activity; your treatment, to adapt your insulin settings (for example, asking whether you use a pump for your basal insulin). Your first name and surname, sex, height, year of diagnosis and type of diabetes don't feed any calculation: they are your profile and you see them in Settings. If you share your diary, your doctor sees your first name, your sex, your weight, your height, your type of diabetes, how long you've had it and your treatment (section 5).	Contract (art. 6.1.b) for your profile; for its health data (weight, height, year of diagnosis, type of diabetes and treatment), in addition, your explicit consent (art. 9.2.a)	From you	As long as you have the account.
Your diary and your settings	Glucose (including post-meal glucose), rapid and basal insulin, meals with their foods, grams, carbs, calories and nutrients; activity (type, minutes, intensity, calories and notes); your glucose ranges, your insulin-to-carb ratio and your correction factor by time of day, your insulin details, your units and your goals; your own foods (including with their barcode), menus, favourites and achievements	Explicit consent	From you: you log it by hand. The app doesn't read data from other apps, sensors or glucose meters.	As long as you have the account.
Reminding you to measure your glucose after eating and to take your basal insulin	The time of the reminder, which is stored with the diary entry or with your basal insulin details	Explicit consent: it is part of your diary and reveals health data	From you	The reminders are scheduled by your phone and don't leave it; the time is stored with your diary, as long as you have the account.
Glucy: chat and carb estimation from a photo	What you type or dictate to Glucy, the photos of plates you send her, the foods and corrections you pass to her from the Food tab, her replies and the plates she estimates (grams, carbs, portions, calories, nutrients, glycaemic index); your language; your name, if you tell her	Explicit consent, separate from the one for your diary	From you and from Glucy	Each conversation, 180 days from when it starts. The photos you send are kept with the conversation and deleted along with it.
Letting Glucy remember things about you between conversations	Facts about you that Google's artificial intelligence draws from your conversations with Glucy when you ask her general questions about diabetes and nutrition, raise a complaint with her or tell her your name: for example, your name, your type of diabetes, the device you use or your habits. Glucy takes them into account in later conversations. They may be health data.	Your consent to use Glucy	From your conversations	180 days from the last time it is updated, or until you delete your account. If you want us to delete it sooner, ask us (section 9).
Logging your conversations so that Glucy works and to detect faults and abuse	Your messages, Glucy's replies, what her tools do (plates, corrections), your name if you tell her, your user ID and the conversation. If you raise a complaint with her, also its category and the tone Glucy infers from your message (for example, frustration or anger). No photos. Emails and phone numbers you type are masked; the rest of the text is stored as it is.	Your explicit consent to use Glucy (arts. 6.1.a and 9.2.a GDPR): the log is part of how Glucy works and we tell you about it here, linked from the “Before using Glucy” sheet. If you withdraw the permission, we stop sending anything to Glucy and, with that, stop logging new conversations.	From your conversations with Glucy	180 days.
Reviewing the quality of Glucy's replies	The text of your conversations with Glucy, without photos: your messages, her replies and what her tools do, with your user ID and everything you have written in them. It is scored by another Google artificial intelligence (Gemini) and reviewed by the LifeSugar team that carries out the review.	Your explicit consent to use Glucy (arts. 6.1.a and 9.2.a GDPR): the review is part of that purpose and we tell you about it here and in the “Before using Glucy” sheet. It doesn't have a separate permission. If you withdraw the Glucy permission, your conversations also stop being included in the review.	From your conversations with Glucy	180 days.
Sharing your diary with your doctor, if you ask to	The email of the professional you authorise and what they see about you (section 5)	Explicit consent, one for each professional	From you	As long as you keep them authorised (section 5).
Your LifeSugar Prime subscription	The plan, the dates, the status of the purchase and of the renewal, the store country and the price; your user ID, which is your ID in RevenueCat; and the technical data its component sends (platform, versions and IP address). We don't see your card: the payment is made through Google Play.	Contract	From Google Play and from RevenueCat	As long as you have the account; when you delete it, we also delete it from RevenueCat. What commercial law requires us to keep is in the row below.
Complying with commercial and tax law	The purchase, renewal, cancellation and refund notifications that Google Play sends us	Legal obligation	From Google Play	6 years (art. 30 of the Spanish Commercial Code, Código de Comercio).
Looking up a product by its barcode	The code you scan and the IP address of your connection, which your phone sends to Open Food Facts. The camera image is processed on your phone and doesn't leave it.	Contract: you request it when you scan	From you	We don't store it, unless you save the product as your own food. Open Food Facts processes it according to its policy: https://world.openfoodfacts.org/privacy.
Receiving crash reports so that the app works	When the app crashes: what it was doing, the state of the phone (model, Android and app version, memory), the previous technical steps and an identifier of this installation, not that of your account. Without your name or your account, and without your entries, messages, photos or any other health data. If the app detects that the phone is rooted or modified, it also sends a security alert with fixed text. We don't send which other apps you have installed.	Legitimate interest in the app working, in fixing its faults and in knowing when it is used on a modified phone (art. 6.1.f GDPR). They are always sent, without asking for your permission, because they are essential to provide the service you ask us for (art. 22.2 of the Spanish Information Society Services Act, LSSI): without them we can't know that the app is failing or fix it. You can object by writing to us at info@lifesugarcare.com (art. 21 GDPR, section 9).	From your phone	90 days (after that, Google starts deleting them).
Measuring the app's usage and performance, only if you accept	Which areas of the app you open (diary, food, Glucy, settings…), the subscription purchases that Firebase Analytics records automatically, loading and network times, the phone model, the version, the language and an approximate location deduced from your IP (such as the country or the city). Never your entries, your messages or your photos.	Consent (art. 6.1.a GDPR and art. 22.2 of the Spanish Information Society Services Act, Ley de Servicios de la Sociedad de la Información, LSSI). If you don't accept, nothing is activated.	From your phone	Usage: 14 months at most; reports with figures added up across all users may be kept longer. Performance: 60 days at most, and 30 days for what is linked to your IP.
Keeping proof of what you accept	Which permission you gave or withdrew, when, in which language and with which version of the text (with a fingerprint that identifies it), from which platform and app version; the version of the terms you accepted and of the medical notice you saw; each authorisation and withdrawal of your doctor's access	Legal obligation: we must be able to demonstrate your consent (art. 7.1 GDPR)	From the app	As long as you have the account. After you delete it, the proof is kept pseudonymised and blocked, without health data, for 3 years from the closure, the period after which the most serious data protection infringements become time-barred, and is then deleted.
Security and abuse prevention	Your phone's identifier (ANDROID_ID or, if there isn't one, a random one stored encrypted), its manufacturer and model, the platform and the app version, so that your account has only one open session; the App Check and Play Integrity attestation that the app and the phone are genuine; your daily use of Glucy (requests and cost); and our servers' technical logs, with your user ID and the foods Glucy analyses	Legitimate interest: protecting your account, your data and the service; for what comes from your use of Glucy (the foods she analyses), also your consent to use Glucy	From your phone and from our servers	Session: as long as you have the account. Daily use of Glucy: 30 days. Technical logs: 30 days.
Reviewing the Glucy replies you report	The conversation and the message you report, the reason and your language. The text of the reported reply, only while it is being reviewed.	Legitimate interest in correcting the AI's replies, which Google Play also requires; if the reply contains health data, your consent to use Glucy.	From you	A member of the team reviews it within 30 days at most; the text of the reported reply is deleted when the review ends. The rest of the report, 180 days, like the conversation, or until you delete your account.
Sending you the emails about your subscription and about changes to the terms	The email and name of your Google account, your plan, its dates and its price, and the version of the terms you accepted	Legal obligation: confirming the contract, notifying you before each renewal, acknowledging receipt if you withdraw and notifying you of changes to the terms (Spanish General Law for the Defence of Consumers and Users, Ley General para la Defensa de los Consumidores y Usuarios, arts. 97 and 98)	From you, from Google Play and from RevenueCat	The emails sent are kept for 6 years from each sending (art. 30 of the Spanish Commercial Code), so that we can prove we informed you.
Dealing with your enquiries and your rights	Your email and whatever you tell us; what is necessary to check that it's you	Legal obligation for rights; legitimate interest for other enquiries	From you	Enquiries, 1 year from when we close them. Rights requests and our reply, 3 years from when we reply to you, so that we can prove we dealt with them.

What is required and what isn't

To have an account you need a Google account, a phone number for the second step by SMS, your first name and surname and your date of birth.
To create your profile we also need your sex, your weight, your height, the year of your diagnosis, your type of diabetes and your treatment. What each one is for is in the “Your profile” row in section 2.
To use the diary we need your explicit consent to process your health data: the diary can't work without it. If you don't give it, you won't be able to use the app and we'll offer to delete your account.
LifeSugar is paid: to use it you need a LifeSugar Prime subscription on Google Play.
Everything else is optional: Glucy, usage and performance measurement and sharing with your doctor. If you don't give them, the app works just the same, except for that feature.
No separate permission: crash reports, which are always sent so that the app works, without your name, your account or your health data, and which you can object to (section 9); and Glucy's quality review, which is part of using Glucy (section 4). If you withdraw the Glucy permission, you also leave the review.

What we don't do

We don't sell your data or transfer it for commercial purposes.
There is no advertising in the app, no ad components, and we don't use your data to profile you for commercial purposes. The app doesn't read your phone's advertising ID.
We don't use your data to train AI models. Under the Vertex AI terms, Google doesn't use what we send it to train its own models without our permission either, and we don't give it. The only thing we take from our logs is an aggregated list of food names with how many times they appear, with nothing that identifies you, to improve searching in the food database.
We don't collect your precise location, your contacts, your calendar or your messages, and the app doesn't access your gallery: only the photo you choose with the system picker.

3. Your health data and your permissions

Your glucose, your insulin, your ratios and correction factor, your ranges, your type of diabetes and your treatment, your meals and your activity are health data, and so are the photos of your plates and what you talk about with Glucy, because they reveal how you look after yourself. We use them only for what this policy says and never for advertising or marketing, not even through providers.

Your health data and each optional use have their own permission, which we ask you for separately and before you start, with “I don't accept” just as visible as “I accept”:

Permission	What it allows	When we ask you	If you don't accept	Where you withdraw it
Your health data	Storing and syncing your health profile and your diary	When you sign in for the first time, before asking you for any health data	We can't provide you with the service: the diary is the app. You can delete your account.	Settings › Privacy and legal
Glucy (AI)	Sending your messages and photos to Google's artificial intelligence (section 4)	Before your first message or your first photo to Glucy, in the chat and in the Food tab, and when you turn her on in Settings	You use the whole app and log your meals by hand	Settings › Privacy and legal › Glucy (AI)
Usage and performance measurement	Activating Firebase Analytics and Performance	The first time you open the app, with “Accept” and “Reject” at the same level	Nothing is activated	Settings › Privacy and legal
Sharing with your doctor	Letting a professional see your diary (section 5)	When you authorise a professional, one by one	Nobody else sees your diary	Settings › Privacy and legal › Share with my doctor, or by removing their email

Two uses don't have their own permission, and we tell you about them all the same: crash reports, which are always sent so that the app works, with an installation identifier and without your name, your account or your health data (section 2), and which you can object to (section 9); and Glucy's quality review, which is part of using Glucy (section 4): if you withdraw the Glucy permission, your conversations stop being included in it.

Withdrawing a permission is as easy as giving it and doesn't affect what we did before. From that moment we stop doing what it allowed: for example, if you withdraw the Glucy one, the app stops sending her anything.
If you withdraw the permission for your health data, we delete the health data you have stored: from the app, immediately, and from the copies in our systems, within 30 days at most. Your doctor stops seeing it and we only keep the proof that you gave the permission and withdrew it (section 8). It can't be undone: if you want to keep your diary, download a copy first (section 9).
Withdrawing the other permissions doesn't by itself delete what has already been stored: for example, your conversations with Glucy remain stored until they reach their 180 days. If you want us to delete them sooner, ask us (section 9) or delete your account (section 8).
We keep proof of each permission you give or withdraw: which one, when, in which language and with which version of the text. If we change the text of a permission, we ask you for it again.

4. Glucy, the artificial intelligence assistant

What she is. Glucy is an artificial intelligence, not a person. She gives you general information about diabetes and nutrition and estimates the carbs in a plate from a photo or from what you tell her. She doesn't interpret your blood glucose, doesn't calculate or suggest doses and doesn't replace your healthcare team. Her replies and estimates may contain errors: estimates carry the “AI-generated” label and you can correct them before saving them. In an emergency, call 112.
What we send her. What you type or dictate, the photos you choose and, from the Food tab, the name, grams and nutrients of the food and your corrections, together with your user ID and the conversation ID. We don't send her your glucose, your doses or your profile, and our server doesn't read them. But if you type them in a message, Glucy receives them.
Photos. Before sending it, the app reduces the size of the photo and compresses it again, which removes its metadata, such as where it was taken. On our server, the photo is kept with the conversation, so Glucy can look at it again if you ask her to, and it is deleted along with it: after 180 days or when you delete your account. On your phone, Glucy's photos are deleted when you start a new conversation or sign out.
Dictation. If you dictate instead of typing, the audio is transcribed by your phone's speech recognition service (usually Google's, depending on your phone), which may need a connection. LifeSugar doesn't receive or store the audio: only the text, which stays in the message box and doesn't reach Glucy until you tap send.
Who processes it. Google Cloud, with its Gemini models on Vertex AI, on our behalf (as data processor). Under its terms, Google doesn't use what we send it to train its models without our permission. Google may keep a technical cache of requests in memory for 24 hours at most to respond faster.
Where. Glucy runs on Google Cloud. The Gemini model, which generates her replies and analyses your photos, and the artificial intelligence that draws from your conversations what Glucy remembers about you don't have a fixed region: Google may process your messages, your photos and your conversations outside the European Economic Area, in any country where it operates, with the safeguards in section 7. For some general questions about diabetes and nutrition, Glucy searches selected sources with Google Search: Google receives the search query formed from your message, not your name or your account, and keeps it for up to 3 days without linking it to us. To search the food database we use Vertex AI Search, which receives food names and nothing that identifies you. These two services don't have a fixed region.
How long. Each conversation is stored for 180 days from when it starts and is then deleted automatically. “Start a new conversation” clears the screen and the photos on your phone, but doesn't delete the conversation stored on the server: that is deleted after 180 days or when you delete your account. If you want us to delete it sooner, ask us.
What Glucy remembers about you. Glucy has a memory between conversations: when you ask her general questions about diabetes and nutrition, raise a complaint with her or tell her your name, Google's artificial intelligence draws facts about you from that conversation (for example, your name, your type of diabetes, the device you use or your habits) and Glucy takes them into account later on. That memory is kept for 180 days from the last time it is updated, or until you delete your account. If you want us to delete it sooner, ask us (section 9).
Quality review. To improve Glucy we review her conversations: the text, without photos, with your user ID and everything you have written in them. It is scored by another Google AI (Gemini) and reviewed by the LifeSugar team that carries out the review. It isn't a separate permission: it's part of using Glucy. We keep it for 180 days. If you withdraw the Glucy permission, your conversations stop being included in the review.
Reporting a reply. On every Glucy reply and every plate estimate you can tap “Report” without leaving the app. A member of the team reviews it and we use it to correct Glucy. We keep what is stated in section 2.
Usage limit. Glucy has a daily usage limit that is the same for everyone and resets every day; if the service reaches its overall daily cap, Glucy stops replying until the next day. These are automatic technical caps.

5. Sharing your diary with your doctor

Only if you ask. You authorise a healthcare professional who treats you from the option to share with your doctor in the app: you type their email and give your explicit consent for that professional. By doing so you give them access to your diary on a web dashboard (diario.lifesugarcare.com), which they sign in to with their Google account. To change that email we ask for your phone's screen lock and for you to sign in with Google again.
What they see. Your blood glucose readings, your insulin, your meals and your activity from the last 180 days (up to 500 entries), your first name, your age, your sex, your weight, your height, your type of diabetes, how long you've had it and your treatment. They don't see your surname or your conversations with Glucy. On the dashboard you appear with a code, not with your email.
Where. The dashboard is on Google Cloud, in the European Union (europe-west1). Only the professionals you authorise can sign in, with their Google account.
Copies. Your doctor is a recipient you choose. They can download what they see as CSV or PDF: that copy stays in their possession and they process it as the controller of its clinical use, under their own professional responsibility and their duty of secrecy, not on our behalf.
How long it lasts and how to withdraw it. Your doctor has access while your authorisation is valid: each one lasts 12 months from when you give it, and to keep sharing after that you need to authorise them again. To withdraw it, use the option to stop sharing in the app or remove their email: they stop seeing your diary within minutes (6 hours at most). If you delete your account, they lose access.
The “Share report” button sends whoever you choose a fixed link to the dashboard, which doesn't identify you: without your authorisation, nobody sees anything when they open it.
Your own access to the dashboard. You can also see your own diary on the dashboard, by signing in with the email of your Google account. For that we keep that email on the dashboard's access list; when you sign in, it goes through Google's access control and is recorded in the dashboard's access logs. We remove it from the list when you delete your account.
We inform the professional, before they sign in for the first time, of what data about them we process (their email and their logins), what for and with what rights, and they undertake to use your data only to treat you and to keep professional secrecy.

6. Who we share your data with

We share your data with providers that process it on our behalf (data processors, art. 28 GDPR), under contract and following our instructions; with other companies' services that you use when you request it (Google Play when you pay, Open Food Facts when you scan a code, your phone's voice service when you dictate), which process the data according to their own terms; with some providers that don't work on our behalf but under their own terms, as controllers of what they do with that data (Google in the barcode scanner and in Google Search, and Apple, which hosts our mailbox), and we tell you so in their row; with your doctor, if you authorise it; and with the authorities, only when the law requires us to.

Who	What they receive	What for	Role	Where
Google — Firebase Authentication and Google Sign-In	Name and email of your Google account, your phone number, your user ID; it sends the SMS for the second step	Your account and your access	Processor. Your Google account itself belongs to Google, with its own policy.	Google LLC, may be processed in the US
Google — Cloud Firestore	Your profile, your diary, your settings, your permissions, your subscription status, your session and your daily use of Glucy	Storing your data and syncing it	Processor	European Union (eur3 multi-region)
Google — Firebase App Check and Play Integrity	An attestation that the app and the phone are genuine	Security	Processor	Google LLC, may be processed in the US
Google — Firebase Installations and Remote Config	An identifier of the app installation	Making Firebase services work and the app's configuration	Processor	Google LLC, may be processed in the US
Google — Firebase Cloud Messaging	We don't use it in this version: we don't send you push notifications and we don't store your phone's identifier for them. Reminders are local notifications.	—	Processor	Google LLC
Google — Firebase Analytics (only if you accept)	Areas of the app you open, subscription purchases, installation identifier, model, language and approximate location by IP	Measuring usage	Processor	Google LLC, US
Google — Firebase Crashlytics	Crash reports with an installation identifier (not that of your account), the state of the phone and the technical steps before the crash, without your name, your account or your health data	Finding and fixing faults so that the app works	Processor	Google LLC, US
Google — Firebase Performance Monitoring (only if you accept)	Start-up and network times, CPU and memory use, country by IP	Measuring performance	Processor	Google LLC, US
Google — ML Kit (barcode scanner)	The camera image is analysed on your phone and doesn't leave it; ML Kit sends Google diagnostic, usage and device data	Making the scanner work	Controller of that usage data, under its own terms: according to the ML Kit terms, Google uses it to measure, maintain and improve the service and to detect abuse, as its privacy policy says.	Google LLC, may be processed in the US
Google Cloud — Cloud Run (our Glucy server)	Your messages and photos for Glucy and your user ID	Receiving your requests and calling the model	Processor	Google Cloud; what you talk about with Glucy may be processed outside the EEA (sections 4 and 7)
Google Cloud — Vertex AI (Gemini)	Your messages, your photos and what you send from the Food tab	Generating Glucy's replies and estimating plates	Processor	No fixed region: it may be processed outside the EEA (sections 4 and 7)
Google Cloud — Vertex AI Agent Engine	Your conversations and what Glucy remembers about you (facts that her artificial intelligence draws from your conversations)	Storing the conversations, drawing from them what Glucy remembers and storing it	Processor	Google Cloud; what Glucy remembers may be drawn outside the EEA (sections 4 and 7)
Google Cloud — Google Search (grounding)	The search query formed from your message, without your name or your account	Searching selected sources	Controller of the search, under its own terms: it is a Google service with specific terms; Google keeps the query for up to 3 days without linking it to us.	No fixed region
Google Cloud — Vertex AI Search	Food names, with nothing that identifies you	Searching the food database	Processor	No fixed region
Google Cloud — BigQuery and Dataform	A copy of your diary and your profile, the log of your conversations, the quality review (scored with Gemini), what your doctor sees on the dashboard, the proof of your permissions and Google Play's purchase notifications	Internal analysis of the service, quality review, doctor's dashboard and legal obligations	Processor	European Union (europe-west1)
Google Cloud — Cloud Logging and Cloud Trace	Technical logs with your user ID and the foods Glucy analyses; technical traces without the content of your conversations	Making the service work and detecting errors	Processor	No guaranteed fixed region: they may be processed outside the EEA (section 7)
Google Cloud — Identity-Aware Proxy	Your doctor's email and their logins to the dashboard; yours and your logins, if you sign in to see your own diary (section 5)	Making sure that only the person you authorise gets into the dashboard	Processor	Google
Google Play	Your purchase and your payment	Charging you for the subscription and sending you the receipt	Independent controller of your payment. In the European Economic Area it appears as the registered merchant for the sale and collects payment as our agent; the service is provided to you by Lifesugar Care, S.L. (terms, section 10.2)	According to Google's policy
RevenueCat, Inc.	Your user ID, your purchase data (product, dates, price, store country) and technical data from your phone (platform, versions, IP). We don't give it your email or your name.	Managing your subscription between the app and Google Play	Processor	US
Apple — iCloud Mail (the info@lifesugarcare.com mailbox)	The emails you send us: your address, what you tell us and your rights requests	Hosting the mailbox where we receive your enquiries	Controller of its service, under its own terms: Apple hosts the mailbox under the iCloud terms, without a processing agreement with us (in the EEA, Apple Distribution International, in Ireland).	Apple generally stores the data in the US (Apple Inc.), with standard contractual clauses (section 7).
Open Food Facts	The barcode you scan and the IP of your connection	Looking up the product in its open database	Third party: it doesn't process data on our behalf, it decides about its own service	France: Open Food Facts is an association based there, in the European Union, and is responsible for its service according to its policy (https://world.openfoodfacts.org/privacy).
Your phone's voice service (usually Google, depending on your phone)	Your voice, only when you dictate	Turning your voice into text	Third party chosen by your phone, with its own terms: LifeSugar sends it nothing and doesn't receive the audio, only the text that stays in the message box.	Depending on your phone
Your doctor, if you authorise them	What is described in section 5	Seeing it on the dashboard	Recipient you choose	Accesses it from wherever they work
Email delivery provider	Your email, your name and what each email says (plan, dates, price)	Sending you the emails about your subscription and about changes to the terms	Processor	European Union
Authorities, judges and courts	What the law requires us to provide	Complying with the law	Recipient by legal obligation	—

Within LifeSugar, only the staff who need it to provide you with the service or to deal with you have access to your data, under a duty of confidentiality.

We don't share your data with anyone else.

7. Transfers outside the European Economic Area

Almost all your data is stored in the European Union. These providers may process some of it outside the European Economic Area (EEA), and they do so with a GDPR safeguard:

Recipient	What data	Where	Safeguard
Google LLC (Firebase Authentication, App Check, Installations, Remote Config, Analytics, Crashlytics, Performance; ML Kit)	Those in its row in section 6	US and other countries where Google operates	EU-US Data Privacy Framework: Google LLC appears as a participant on the official list. ML Kit is also provided by Google LLC, under its own terms, and the same participation covers it.
Google (Google Search, Vertex AI Search, Cloud Trace and Cloud Logging)	The search query formed from your message; food names; technical traces without content; technical logs with your user ID and the foods Glucy analyses	No fixed region	EU-US Data Privacy Framework (Google LLC). For Vertex AI Search, Cloud Trace and Cloud Logging, the Google Cloud processing agreement applies that Framework and, if it stops being valid, the European Commission's standard contractual clauses it includes.
Google Cloud (Vertex AI with Glucy's Gemini models, and Glucy's memory in Vertex AI Agent Engine)	Your messages and photos for Glucy, what you send from the Food tab and what Glucy draws from your conversations to remember it (health data)	No fixed region: the US or any other country where Google operates	The European Commission's standard contractual clauses included in the Google Cloud processing agreement and, in the US, the EU-US Data Privacy Framework (Google LLC).
RevenueCat, Inc.	Your user ID, your purchases and technical data	US	The European Commission's standard contractual clauses (RevenueCat is not in the Data Privacy Framework).
Apple (iCloud Mail, the info@lifesugarcare.com mailbox)	The emails you send us	US, where Apple Inc. generally stores the data	Standard contractual clauses, according to Apple's privacy policy. Apple processes these emails under its own terms (section 6).

Gemini, Glucy's model, doesn't have a fixed region: it may process your messages and photos outside the EEA, with the safeguard in the table (section 4).

You can ask us for a copy of these safeguards by writing to info@lifesugarcare.com.

8. How long we keep your data and what happens when you delete your account

We keep your data as long as you have the account, except for what has its own period:

Data	While you have the account	When you delete it
Account, phone number, profile, diary, activity, settings, own foods, menus, favourites, achievements, session and subscription status	As long as you have it	Deleted immediately. Google erases the backups of your sign-in account within 180 days at most.
Copy of your diary and your profile in our internal analysis	As long as you have it; older versions of each record, 30 days	30 days at most
Conversations with Glucy	180 days from when each one starts	30 days at most
What Glucy remembers about you	180 days from the last time it is updated	30 days at most
Conversation log and quality review	180 days	30 days at most
Your subscription in RevenueCat	As long as you have it	30 days at most
Daily use of Glucy (requests and cost)	30 days	Deleted with the account; the cost of each query remains, without your identifier or that of the conversation
Our servers' technical logs	30 days	They expire on their own after 30 days
Crash reports (with the installation identifier, not that of your account)	90 days	They expire on their own after 90 days
Usage and performance measurement (if you accepted)	Usage, 14 months at most (reports with figures added up across all users may be kept longer); performance, 60 days at most	Not linked to your account; they expire at the end of their period
Your doctor's access	As long as you keep it (section 5)	Withdrawn within minutes (6 hours at most)
Proof of your permissions, of the terms you accepted and of your doctor's access	As long as you have it	Kept pseudonymised and blocked for 3 years from the closure, and then deleted
Record that you closed your account (it keeps a fingerprint of your identifier, not the identifier)	—	Blocked, for 3 years from the closure, and then deleted
Google Play purchase notifications	6 years (art. 30 of the Spanish Commercial Code)	6 years from each notification
Emails about your subscription and about changes to the terms	6 years from each sending (art. 30 of the Spanish Commercial Code)	6 years from each sending
What you write to us	Enquiries, 1 year from when we close them; rights requests and our reply, 3 years from when we reply to you	The same period

How to delete your account

From the app: Settings › Delete account. We ask you to confirm it's you with your Google account and a code by SMS. You can tick why you're leaving: neither what you tick nor what you type in the free-text field leaves your phone.
Without the app, without having to install it again: on the Delete your LifeSugar account page of our website or by writing to info@lifesugarcare.com.
If you have LifeSugar Prime and it renews, you can still delete the account: we warn you that deleting it doesn't cancel the subscription and that Google Play will keep charging you for it until you cancel it there, with a button to do so. If you can't cancel it, write to us and we'll help you.

What happens when you delete it

Deleted immediately: your sign-in account, your profile, your diary, your activity, your settings, favourites, menus, own foods and achievements, your session, the record of your subscription in our database and the data the app stores on your phone. Your doctor loses access within minutes (6 hours at most).
Deleted later, within 30 days at most: your conversations with Glucy and what she remembers, the copies of your diary and your profile in our internal analysis, the log of your conversations, the quality review and your customer record in RevenueCat. We do this ourselves with a daily process; the copies in our analysis database can be technically recovered for 7 more days, and Google keeps a further 7 days of safety copies that only Google can access.
Expires on its own: technical logs (30 days) and crash reports (90 days).
Kept, with restricted access: what commercial law requires us to keep, such as Google Play's purchase notifications and the emails about your subscription (6 years), and the proof of your permissions and of your doctor's access and the record of your account closure, pseudonymised and blocked for 3 years from the closure, while any possible liabilities may still be claimed. After that, it is deleted.
Not up to us: your purchase history on Google Play, whatever Open Food Facts keeps of your searches and the copies your doctor has downloaded.

9. Your rights and how to exercise them

Right	What you can ask for	From the app	By email
Access	Knowing what data we hold about you and receiving a copy	You see your diary and your profile in the app, and you ask for a copy in Settings › Privacy and legal › Download my data	We send you a full copy: profile, diary, activity, conversations with Glucy and what she remembers
Rectification	Correcting anything that is wrong	Settings › Personal data and Medical data; each diary entry can be edited	Yes
Erasure	Having us delete your data	Settings › Delete account (section 8)	Yes, also for specific data, such as a conversation with Glucy
Restriction	Having us keep your data without using it while we resolve a complaint	—	Yes
Objection	Having us stop processing the data we use on the basis of legitimate interest (security and abuse prevention, crash reports)	Crash reports are turned off in Settings › Privacy and legal › Crash reports	Yes. If it is essential to protect your account or the service, we'll explain why.
Portability	Receiving your data in a structured, machine-readable format (JSON or CSV)	Settings › Privacy and legal › Download my data	Yes
Withdrawing your consent	Having us stop doing what it allowed, without affecting what came before. If you withdraw the one for your health data, we also delete the health data you have stored (section 3)	Settings › Privacy and legal	Yes

How: write to us at info@lifesugarcare.com, preferably from the email of your Google account. Otherwise, we may ask you to confirm it's you.
Time limit: we reply within one month at most. If the request is complex or there are many requests, the period may be extended by two more months, and we'll tell you within the first month. It's free.
Deceased persons: their relatives or heirs can ask us to access their data, rectify it or delete it, unless the person expressly prohibited it or a law prevents it (art. 3 of Spanish Organic Law 3/2018, Ley Orgánica 3/2018).
Complaining: if you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es, C/ Jorge Juan 6, 28001 Madrid) or to the data protection authority of the EEA country where you live or work. We would appreciate it if you gave us the chance to resolve it first.

10. Minors

LifeSugar is only for people aged 18 and over. We check your age with the date of birth you give us when you sign up and, if you are not 18, we don't create your profile. On Google Play the app is restricted to people aged 18 and over. If we learn that an account belongs to a person under 18, we close it and delete their data, as when an account is deleted (section 8).

The doctor's email is only for healthcare professionals: it can't be used for a family member or a carer to follow your diary.

11. Automated decisions

We don't make decisions about you based solely on automated processing that have legal effects on you or affect you in a similar way (art. 22 GDPR). There are things the app or our systems do on their own, and none of them decides for you:

Glucy's estimates are approximate: you review them, correct them and decide what to log.
Your diary summaries (averages of your entries, portions) are calculated by the app with your data and don't decide anything for you.
Glucy's daily limit is the same for everyone and resets every day.
Your doctor's access is granted and withdrawn automatically, according to the email you have saved.
One session per account: if you sign in from another phone, the session on the previous one is closed.
Rooted or modified phones: the app doesn't work on them, to protect your data.

If you disagree with any of these things, write to us and a person will review it.

12. What the app uses on your phone

The app only uses what is essential on your phone for what you ask it to do. That's why we don't ask you for a separate permission for it (art. 22.2 of the Spanish Information Society Services Act, LSSI), except for those Android itself asks for:

Camera, when you use it: to scan barcodes (they are analysed on your phone) and to take photos for Glucy (only with the Glucy permission). Android asks you for it the first time.
Photos: we use the system photo picker, so the app only sees the photo you choose, not your gallery.
Microphone, when you dictate a message (section 4). Android asks you for it the first time.
Notifications and exact alarms, so that reminders arrive on time. Without the exact alarms permission, they arrive with some leeway.
Screen lock or fingerprint, to confirm sensitive changes, such as your doctor's email. The check is done by Android: we don't receive your fingerprint.
A phone identifier, its manufacturer and its model, so that your account has only one open session.
App Check and Play Integrity, to check that the app and the phone are genuine.
App storage: your session, your encrypted data, a temporary copy of what you sync with the cloud and your subscription status, so that the app also works offline.

The app doesn't make backups to Android's cloud or transfer your data to another phone: when you change phone, you sign in with your account and your data is recovered from the cloud.

13. How we protect your data

Encrypted connections: all the app's connections are encrypted (HTTPS); the app doesn't allow unencrypted connections. With our Glucy server and with the food database download, it also only accepts certificates from the authority Google uses.
On your phone: your profile and your personal data are stored encrypted (AES-256, with the key in Android's secure keystore) and your diary, in an encrypted database. There are two exceptions: the temporary copy of what you sync with the cloud and the photos you send to Glucy are stored in the app's private space, without their own encryption. The photos are deleted when you start a new conversation or sign out, and the temporary copy, when you sign out or delete your account.
Your account: a second step by SMS, only one open session at a time and confirmation of your identity to delete the account or change your doctor's email.
Our servers: the Glucy server only serves the genuine app and people who are signed in, and doesn't let anyone see someone else's conversation. Google encrypts the data it stores with its default encryption. Your data is not end-to-end encrypted: our systems can read it to provide you with the service.
People: only those who need it have access, with a duty of confidentiality.
If something goes wrong: if we suffer a security breach, we will notify the Spanish Data Protection Agency within 72 hours and, if it puts you at risk, you too.

No system is infallible, but we review these measures according to the risk of processing health data.

14. If you were already using LifeSugar before this version

Before its launch, LifeSugar was tested with test versions (1.0.6 and earlier) that didn't ask for all the permissions in this policy. When we released this version, we deleted all the data from those tests, including the conversations, the photos and what Glucy remembered. If you sign in again, you start from scratch and we ask you for the permissions in this policy.

Before, the LifeSugar project was run by its founders. Today the controller of your data is Lifesugar Care, S.L., the company they set up.

15. Changes to this policy

If we change anything important — who the controller is, what we use your data for, who we share it with or how long we keep it — we will let you know in the app before it applies and, if necessary, we will ask for your permission again. The version and the date it comes into force are at the top, and you can ask us for previous versions.

This policy is available in Spanish, Catalan, Basque, Galician, English, French and German.

Version	In force from	What changes
1.0	October 2026	First app policy. It replaces the text that was in Settings › Help.