This policy explains how DiabetesLink processes personal and health information across the iPhone app, authorised Web companion, cloud services and optional integrations.
Last updated: 9 October 2026
Health and safety: DiabetesLink is a family information and care-coordination service. It is not a medical device, does not provide a diagnosis, and must not be the sole glucose monitor, alarm or basis for treatment decisions. Follow the patient’s clinical care plan and professional advice.
1. About DiabetesLink
DiabetesLink brings glucose information, meals, Diary entries, Care records and permission-controlled family access into one service. It includes the DiabetesLink iPhone app and, for eligible authorised members, DiabetesLink Web.
DiabetesLink is operated by Daniel Murdock trading as Link Imaginations (“DiabetesLink”, “we”, “us” or “our”). Contact details are in section 22.
2. Information we collect
Category
Examples
Account
Name, email address, Firebase user ID, email-verification and account status.
Family Access
Family membership, role, relationship, permissions, suspension/removal status, invitation state, and Always, Scheduled or Temporary access policy.
Apple product and transaction identifiers, trial/renewal/grace/refund state and the family entitlement. We do not receive full payment-card details.
3. Health and diabetes information
Health information is sensitive personal data. DiabetesLink processes it to show the patient’s current and historical information, support the family’s Diary and Care workflows, present saved guidance, reconcile clinical events and deliver permitted notifications and device surfaces.
DiabetesLink does not use health information for advertising, sell it to data brokers, or use it for cross-app tracking. A glucose value, AI estimate or notification can be incomplete, delayed or inaccurate and does not replace an approved medical device, care plan or clinician.
4. Where information comes from
Information may come from:
you, another authorised family member or carer;
a supported CGM source such as Dexcom, Libre/LibreView or a Nightscout site you configure;
Apple, including StoreKit/App Store subscription information and Apple Health permissions;
your iPhone, browser, widget, Live Activity or notification service;
server-generated events, such as glucose freshness, hypo/hyper history, treatment state, delivery/deduplication and security records;
OpenAI for food estimation, Google Gemini for packaging/label extraction, and nutrition results from local databases, Open Food Facts or FatSecret where configured.
5. How we use information
We use information to authenticate accounts; verify invitations; enforce family, profile, permission, subscription and schedule boundaries; display glucose and history; run Diary, Carbs and Care features; provide optional integrations; send permitted notifications; administer family subscriptions; prevent abuse; investigate failures; and respond to applicable legal requirements.
Optional access such as Apple Health, notifications, photos, calendars and compatible CGM connections remains subject to the controls available in DiabetesLink, the device or the relevant provider. Turning off an optional integration stops future use through that integration but does not automatically erase records already shared with the family or copied to another service.
6. Family and carer sharing
DiabetesLink is collaborative. An Owner or permitted Admin can invite a person using their email address and choose their relationship, permissions and access policy. The recipient must use their own account and, where required, verify the invited email before acceptance.
Authorised members see only the family/profile information allowed by their current membership, permissions, subscription and access window. Scheduled and Temporary access can prevent access outside the configured time. Removal, suspension or expiry ends future authorised access, but cannot guarantee deletion of information already delivered to an offline device, exported or captured by that person.
7. DiabetesLink Web
Eligible authorised members can use DiabetesLink Web. Web access uses Firebase authentication, browser App Check and protected backend requests, and follows the same family permissions and schedule model.
The browser may retain an authentication session if the user chooses remembered sign-in, plus notification subscription and security data. Protected health responses are designed not to be stored by the service worker. DiabetesLink Web is not a guaranteed critical glucose alarm, continuous background monitor or offline clinical-action system.
8. AI-assisted carbohydrate estimates
If you choose food or carbohydrate estimation, DiabetesLink sends the meal image you select, your food description and any measurements you include through its protected server-side backend to OpenAI. You can provide an image, text, or both. OpenAI returns food identities, estimated quantities and nutrition information for carbohydrate review. If you choose packaging or label extraction, the selected packaging image is sent through the protected backend to Google Gemini to extract visible product and nutrition-label information. These are separate processing paths; not all AI features use the same provider.
The provider request contains the selected image or description and instructions for that task, not your account password, CGM credentials or family glucose history. An image or description can itself contain personal information, so avoid including information that is not needed for the estimate.
AI output is an estimate, not a diagnosis or treatment instruction. Review and correct it before saving. Prefer known nutrition labels and measured quantities where available.
A temporary estimate image is removed after a failed request or after explicit post-save cleanup, with a storage lifecycle fallback for temporary objects aged one day. If you choose to save a meal photo, a separate protected copy is retained with the family’s meal record until that attachment/record or family is deleted.
DiabetesLink’s current OpenAI requests disable stored response history. This does not mean zero provider retention. OpenAI’s published API data controls state that API data is not used to train its models by default unless a customer opts in, and that abuse-monitoring logs may include prompts and responses and are retained for up to 30 days by default, or longer where required by law or reasonably necessary to protect services or others from harm. No special zero-data-retention arrangement is claimed here. See OpenAI API data controls.
The current production Gemini project uses a paid API service. Under Google’s current published terms, paid-service prompts, contextual information and responses are not used to improve Google’s products, but may be logged for up to 55 days for abuse monitoring and related security or legal purposes. DiabetesLink does not use Gemini grounding, conversation storage or the Gemini File API in this feature. See Gemini API terms and abuse-monitoring information.
9. CGM providers
Automatic glucose retrieval requires a compatible provider/account configuration. DiabetesLink may use protected credentials or tokens to retrieve readings from Dexcom, Abbott Libre/LibreView, or an optional Nightscout site on your behalf. Applicable credentials are protected in device secure storage and/or encrypted server storage.
Provider, network, credential, device and background-service availability can affect freshness or stop updates. DiabetesLink does not control these services and does not claim sponsorship by them.
10. Apple Health
On a compatible iPhone, you can choose whether DiabetesLink may access Apple Health. The current app can write blood glucose, dietary carbohydrate, weight, height and blood pressure samples when the relevant action and permission allow it. It requests read permission for blood glucose, weight, height and blood pressure, although the current inspected version does not actively query/import those records.
You control Apple Health permissions in iOS Settings. Information already written to Apple Health is managed separately by Apple Health and is not automatically removed when a DiabetesLink account is deleted. DiabetesLink does not use Apple Health data for advertising or marketing.
11. Photos and documents
Some note photos can exist only in the originating iPhone’s local Diary store. Other note/meal photos and Care/Travel documents are uploaded as protected family content so another authorised client can view them. Server-backed media uses family/profile access controls and encryption metadata; protected Web viewing does not expose a public long-lived download link.
Care/Travel documents may be cached in decrypted form on an authorised device for offline viewing. Signing out, switching account or losing access triggers scoped cleanup where implemented. Do not upload material the family is not authorised to share. Images/documents can contain information beyond their visible subject, including filenames or embedded metadata.
12. Notifications, widgets and Live Activities
With permission, DiabetesLink registers device or browser tokens for APNs, Firebase Cloud Messaging, Web Push, widgets and Live Activities. Notifications may contain health-related information, such as glucose status or a family Diary update, depending on the feature and settings.
Members can control available notification preferences and schedules. Family Access schedules are checked for applicable delivery paths. Notifications and background updates may be delayed, suppressed or missed and are not guaranteed. Lock-screen, widget and browser notifications may be visible to anyone with access to that device.
13. Family subscriptions
DiabetesLink may offer Monthly and Annual DiabetesLink Family subscriptions through Apple. Apple processes payment and card details. DiabetesLink receives verified product, transaction, trial, renewal, grace, refund/cancellation and entitlement information needed to prevent replay/fraud and provide the family’s subscription features.
One valid family entitlement may cover authorised family members. Deleting a DiabetesLink account or family does not itself cancel an Apple subscription. Subscriptions must be managed separately through Apple subscription settings.
14. Service providers and integrations
We use providers only for the relevant feature or operation:
Apple: App Store/StoreKit, App Store Server services, APNs, App Attest/DeviceCheck, HealthKit and optional device Calendar.
Google Firebase and Google Cloud: authentication, database, protected file storage, backend processing, messaging, App Check and Crashlytics. Firebase Analytics is disabled in the current inspected production configuration.
OpenAI: optional food/carbohydrate estimation from selected images and descriptions.
Google Gemini: optional packaging and nutrition-label image extraction.
Dexcom, Abbott Libre/LibreView and optional Nightscout: user-configured glucose sources.
Cloudflare: production CGM polling infrastructure.
Resend: Family Access invitation email delivery.
Open Food Facts and, where configured, FatSecret: optional food search/barcode and nutrition results.
Google Calendar: optional Care reminder events when authorised.
GitHub Pages: hosting this public policy page.
These providers process information under their own terms and privacy notices where they act independently, and under service arrangements where they process it for DiabetesLink. Where a provider processes information for DiabetesLink, its applicable service terms require it to protect that information and limit use to providing and securing the relevant service.
15. Data storage and international processing
DiabetesLink’s primary Firebase backend and Functions are principally configured in Google Cloud’s London region (europe-west2). Email delivery, Apple, Google, Cloudflare, CGM, calendar, food-search and other provider infrastructure may process information in the UK, EEA, United States or other countries where those providers operate.
DiabetesLink does not promise UK-only storage. Provider processing is governed by the provider’s applicable service terms, privacy information and configured safeguards.
16. How long we keep information
We keep account, family, health, Diary, Care and protected attachment records while needed to provide the family service, preserve authorised shared history, meet security/subscription/legal needs, or until an authorised deletion applies. A member leaving does not erase legitimate shared records they created for the family.
Temporary AI estimate images use the shorter cleanup described in section 8. Some security, deduplication and registration records have technical expiry. Processor logs, crash diagnostics and backups follow operational/provider retention settings and may take time to expire after primary deletion.
We minimise or delete information when it is no longer needed for these purposes, subject to legal claims, fraud/security, accounting and technical backup requirements. Copies in Apple Health, calendars, exports, screenshots, received emails/notifications and offline devices are controlled separately.
17. Security
Controls include authenticated accounts, verified invitations, family/profile permissions, schedule and subscription checks, protected backend actions, App Check/App Attest/DeviceCheck, encryption for applicable content and credentials, secure device credential storage, access revocation, replay/rate-limit protections and diagnostic monitoring.
No electronic service is completely secure. Users should protect their device, email account and password, and remove access promptly when a family member or carer no longer needs it.
18. Age and authorised users
DiabetesLink does not currently collect date of birth or age. The person whose diabetes information is managed may be a child or an adult. Account users may include the person with diabetes, family members, carers, school staff or other individually authorised people.
Owners and permitted Admins control membership, permissions and Scheduled or Temporary access. A person providing or sharing someone else’s information must have authority to do so and should avoid sharing more than is needed. Contact us if you believe information has been provided or accessed without proper authority.
19. Your choices and rights
Depending on applicable law and the circumstances, you may have rights to ask for access, correction, deletion, restriction, objection or portability, and to withdraw consent. Some rights can be limited where information forms part of another person’s legitimate family record, must be retained by law, or is needed for security or legal claims.
You can manage many permissions in the app or device settings, disconnect optional integrations, change notification choices, leave a family if you are not its Owner, or use in-app account deletion. For a privacy request, email linkimaginations@icloud.com. We may need to verify identity and authority before acting.
If we cannot resolve a concern, you may complain to the UK Information Commissioner’s Office. See the ICO complaint guidance.
20. Account and family deletion
A non-owner can leave the family and delete their DiabetesLink account through the app. This removes their future access, membership, account record and applicable device registrations/scoped files, but shared entries they legitimately contributed can remain in the family history.
A Family Owner can use the stronger in-app family deletion flow. It is designed to remove the family’s active Firebase records, protected Storage content, invitations, registrations and family Auth accounts. Some processor logs/backups can remain temporarily, and information outside DiabetesLink’s control is not automatically removed.
Deleting DiabetesLink does not cancel an Apple subscription. Cancel it separately in Apple subscription settings.
21. Changes to this policy
We may update this policy when DiabetesLink, its providers or legal obligations change. The date at the top identifies the current version. Material changes may also be communicated in the app or by another appropriate route.
22. Contact us
Operator and intended controller: Daniel Murdock trading as Link Imaginations