Privacy Policy
Last updated October 10, 2026
This Privacy Notice for Ask My Glucose LLC ("we," "us," or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://askmyglucose.com or any website of ours that links to this Privacy Notice.
- Use Ask My Glucose: a subscription service that connects a user's continuous glucose monitor sharing account (FreeStyle Libre via LibreLinkUp, or Dexcom via Dexcom Share/Follow) to a personal web dashboard and to voice access through Amazon Alexa and Apple Siri, so users can see and hear their own glucose readings and those of people they care for. Ask My Glucose is an informational convenience only and is not a medical device.
- Engage with us in other related ways, such as contacting support.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at support@askmyglucose.com.
Summary of key points
What personal information do we process? Account details you give us, the login for your glucose-sharing account, your glucose readings, and basic usage information. Learn more.
Do we process sensitive personal information? Yes: health data (glucose readings), only with your explicit consent. Learn more.
Do we collect information from third parties? Only your glucose readings from Abbott (LibreLinkUp) or Dexcom, at your direction, and your spoken requests as text from Amazon Alexa or Apple Siri. We do not buy data or use data brokers.
How do we process your information? To provide, secure, and improve the Services, to communicate with you, and to comply with law. Learn more.
With whom do we share personal information? Only with the service providers that run the Services for us, and with voice platforms at your direction. We do not sell personal information or use it for advertising. Learn more.
How do we keep your information safe? With organizational and technical safeguards, including encryption of stored sensor logins. No system is 100% secure. Learn more.
What are your rights? Depending on where you live, you may have rights to access, correct, export, or delete your data and to withdraw consent. Learn more.
How do you exercise your rights? Visit your dashboard or email us. We will act on any request in accordance with applicable data protection laws.
Table of contents
- What information do we collect?
- How do we process your information?
- When and with whom do we share your personal information?
- Do we use cookies and other tracking technologies?
- How do we handle social logins?
- How long do we keep your information?
- How do we keep your information safe?
- Do we collect information from minors?
- What are your privacy rights?
- Controls for Do-Not-Track features
- Do United States residents have specific privacy rights?
- Do we make updates to this notice?
- How can you contact us about this notice?
- How can you review, update, or delete the data we collect from you?
- Additional information for users in the EU, EEA and UK
1. What information do we collect?
Personal information you disclose to us
In short: we collect personal information that you provide to us.
We collect personal information that you provide when you register for the Services, link a sensor, add someone you care for, or contact us. This may include:
- names (including the names you give household members so Alexa can say them)
- email addresses
- usernames, passwords, and other sign-in data for your Ask My Glucose account (handled by our sign-in provider)
- CGM sharing-account credentials (your LibreLinkUp or Dexcom Share login), which we store encrypted
- the contents of messages you send to support
Sensitive information. With your explicit consent, we process health data: glucose readings, their trend and time, and your sensor model. If you add a person you care for to your household, we process their glucose readings, received through your LibreLinkUp account, on your confirmation that they (or their parent or guardian) have agreed.
Payment data. If you subscribe, payment is processed by Stripe. Card numbers and billing details are collected and stored by Stripe, not by us. See Stripe's privacy notice.
Social login data. You can sign in with your Google account. If you do, we receive basic profile information such as your name and email address, as described in section 5.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.
Information automatically collected
In short: some information, such as your IP address and browser details, and a record of your voice requests, is collected automatically.
- Log and usage data: service-related, diagnostic, and performance information our servers record when you use the Services, such as your IP address, browser type and settings, and the date and time of your activity.
- Voice-request records: each time you ask for a reading through Alexa or a Siri voice link, we record which account asked, when, the type of question (for example "current level" or "how is everyone"), and the language. We use this to run, secure, and improve the Services.
Information from other sources
In short: we receive information only from the services you connect.
When you link a sensor, we receive your glucose readings from Abbott (LibreLinkUp) or Dexcom (Dexcom Share). When you use Alexa or Siri, Amazon or Apple sends us your request as text. Amazon, Apple, Abbott, and Dexcom are independent companies with their own privacy policies. We do not obtain information from data brokers, marketing partners, or social media platforms.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2. How do we process your information?
In short: we process your information to provide, improve, and administer our Services, communicate with you, keep the Services secure, and comply with law. We may also process it for other purposes with your consent.
- To create and manage your account and let you sign in.
- To deliver the Services, including fetching your readings and those of household members you add, showing them on your dashboard, and reading them aloud through Alexa and Siri.
- To respond to inquiries and offer support.
- To send administrative information, such as service and policy updates.
- To manage subscriptions and payments.
- To protect our Services, including security and fraud prevention.
- To evaluate and improve our Services, for example by understanding how often features are used.
- To comply with our legal obligations and to establish, exercise, or defend legal rights.
3. When and with whom do we share your personal information?
In short: only with the service providers that run the Services for us, and with voice platforms at your direction.
We use the following service providers ("processors"), under written contracts that require them to protect your information and use it only on our instructions:
| Provider | What they do for us | Location |
|---|---|---|
| Vultr | Hosts our servers and database | United States |
| Cloudflare | Domain name service, email routing, and sending service emails | Global network |
| Clerk | Account sign-in and authentication | United States |
| Stripe | Payments and subscriptions | United States and other locations |
| Our support mailbox | United States and other locations |
Voice platforms, at your direction. When you ask Alexa or Siri for a reading, we send the spoken answer back to Amazon or Apple so it can be read to you.
Your household. If you are a member of a family plan, the plan owner can hear your readings through "how is everyone" and see your name in their household list. If someone adds you as a person they care for, they can see and hear your readings.
Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business.
We do not sell personal information, and we do not share it for advertising.
4. Do we use cookies and other tracking technologies?
In short: we use only cookies needed to run the Services and remember your settings.
We use cookies and similar technologies to keep you signed in, protect your account, and remember preferences such as your language and glucose units. We do not use advertising cookies, and we do not allow third parties to place tracking or advertising technologies on our Services. See our Cookie Notice for details.
5. How do we handle social logins?
In short: if you sign in with Google, we receive basic profile information.
You can sign in with your Google account. When you do, we receive your name, email address, and profile picture from Google. We use this information only to create and secure your account. We do not control, and are not responsible for, other uses of your information by Google; please review Google's privacy policy.
6. How long do we keep your information?
In short: no longer than needed, and glucose readings for at most 90 days.
- Glucose readings: 90 days, then automatically deleted.
- Voice-request records: 12 months, then automatically deleted.
- Account information and sensor logins: while your account is open. Disconnecting a sensor deletes its stored login.
- Backups: encrypted database backups are kept for up to 15 days.
- Billing records: kept by Stripe and us as long as tax and accounting law requires.
When you delete your account, we delete your personal information, except records we must keep by law. Information remaining in backups is isolated from further use and deleted when the backup expires.
7. How do we keep your information safe?
In short: we protect your personal information with organizational and technical safeguards.
We use appropriate technical and organizational measures to protect the personal information we process. Sensor-sharing logins are encrypted (AES-256) and never shown again after setup; connections to our Services are encrypted in transit; access to our systems requires two-factor authentication. However, no electronic transmission over the Internet or storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never defeat our security. You should access the Services only within a secure environment.
8. Do we collect information from minors?
In short: we do not knowingly collect data from or market to children without a parent or guardian.
We do not knowingly collect data from, or market to, children under 18 years of age. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of a minor and consent to that minor's use of the Services, including adding the minor's readings to your household. In the EU, EEA and UK, a parent or guardian must give consent for users under the digital age of consent in their country (13 to 16). If you become aware of data we may have collected from a child without such consent, please contact us at support@askmyglucose.com.
9. What are your privacy rights?
In short: you may review, change, or delete your information, and withdraw consent, at any time.
Withdrawing your consent. You can withdraw your consent to our processing of your health data at any time by disconnecting your sensor on your dashboard or deleting your account, or by contacting us. Withdrawal does not affect the lawfulness of processing before it.
Account information. You can review or change your account information, or delete your account, from your dashboard, or by contacting us. When you delete your account, we delete your information from our active databases, except records we must keep by law.
Cookies. Most browsers accept cookies by default. You can set your browser to remove or reject cookies, but the Services need sign-in cookies to work.
If you have questions about your privacy rights, email us at support@askmyglucose.com.
10. Controls for Do-Not-Track features
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT signals. Because we do not track you across websites or use advertising technologies, this has no practical effect on our Services. California law requires us to tell you how we respond to DNT signals.
11. Do United States residents have specific privacy rights?
In short: if you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or Washington, you may have the right to access, correct, copy, or delete your personal information, and to withdraw consent.
Categories of personal information we collect
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, account name, IP address | YES |
| B. Personal information (California Customer Records statute) | Name and contact information | YES |
| C. Protected classification characteristics | Gender, age, race, national origin | NO |
| D. Commercial information | Subscription and payment history (held with Stripe) | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other network activity | Usage of our Services and voice-request records | YES |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory information | Recordings (we receive voice requests as text only) | NO |
| I. Professional or employment information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences | Profiles of preferences or characteristics | NO |
| L. Sensitive personal information | Account login information and health data | YES |
We collect sensitive personal information only with your consent and only to provide the Services. We do not use it to infer characteristics about you. We keep each category as described in section 6.
Sources and use. See section 1 and section 2. We have not sold or shared personal information for targeted advertising in the preceding twelve months. We disclose personal information to our service providers for business purposes, as described in section 3.
Your rights
Under applicable US state laws you may have the right to know whether we process your personal data; to access, correct, or delete it; to obtain a copy; to opt out of sale, targeted advertising, or profiling (we do none of these); to limit use of sensitive data; and not to be discriminated against for exercising your rights. Washington residents also have rights regarding consumer health data under the My Health My Data Act.
How to exercise your rights. Visit your dashboard or email support@askmyglucose.com. You may use an authorized agent; we may ask for proof of authorization.
Request verification. We will verify your identity before acting on a request, using only the information needed to do so.
Appeals. If we decline a request, you may appeal by emailing support@askmyglucose.com. We will respond in writing. If your appeal is denied, you may complain to your state attorney general.
California "Shine the Light". California residents may request, once a year and free of charge, information about personal information we disclosed to third parties for direct marketing. We do not make such disclosures.
12. Do we make updates to this notice?
In short: yes, as needed to stay accurate and compliant.
We may update this Privacy Notice from time to time. The updated version will show a new "Last updated" date. If we make material changes, we will notify you by posting a notice on the Services or by email.
13. How can you contact us about this notice?
Email support@askmyglucose.com, or write to:
Ask My Glucose LLC
7699 E Pinnacle Peak Rd, STE 115
Scottsdale, AZ 85255
United States
14. How can you review, update, or delete the data we collect from you?
Depending on where you live, you may have the right to access the personal information we hold about you, learn how we have processed it, correct it, or delete it, and to withdraw consent. To do so, visit your dashboard or email support@askmyglucose.com.
15. Additional information for users in the EU, EEA and UK
Controller. Ask My Glucose LLC, 7699 E Pinnacle Peak Rd, STE 115, Scottsdale, AZ 85255, USA, is the controller of your personal data. Contact: support@askmyglucose.com.
Representatives. We are appointing representatives in the EU and the UK under Article 27 of the GDPR and UK GDPR. Their contact details will be added here once appointed; until then, please contact us directly.
What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account data: name, email, sign-in details | Create and run your account | Contract, Art. 6(1)(b) |
| Glucose readings, trend, sensor model | Show and read out your readings | Explicit consent, Art. 9(2)(a), and contract, Art. 6(1)(b) |
| Sensor-sharing login (LibreLinkUp / Dexcom), encrypted | Fetch your readings from Abbott or Dexcom | Explicit consent, Art. 9(2)(a) |
| Household members' readings (people you follow in LibreLinkUp) | Read them aloud for the caregiver | Explicit consent given by or for that person, Art. 9(2)(a) |
| Voice-request records: time, question type, language | Run, secure, and improve the Services | Legitimate interests, Art. 6(1)(f) |
| Payment and billing records (held by Stripe) | Take payment and keep tax records | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Support emails | Answer your questions | Contract and legitimate interests, Art. 6(1)(b) and (f) |
Household members. If a caregiver adds you as a person they care for, your readings come from the caregiver's LibreLinkUp account, on their confirmation that you (or your parent or guardian) agreed. You can ask us to stop at any time by emailing support@askmyglucose.com.
Transfers outside the EU/EEA/UK. Our servers are in the United States. Transfers rely on the EU-US Data Privacy Framework and its UK Extension where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
Retention. As described in section 6: glucose readings 90 days; voice-request records 12 months; account data while your account is open; backups up to 15 days.
Your rights. You have the right to access, correct, delete, or receive a portable copy of your data; to restrict or object to processing; and to withdraw consent at any time (disconnect your sensor or delete your account), without affecting processing before withdrawal. Use your dashboard or email us; we reply within one month.
Complaints. You can complain to your local data protection authority, for example the UK Information Commissioner's Office, Ireland's Data Protection Commission, or the supervisory authority in your EU or EEA country.
Automated decisions. We make no automated decisions that produce legal or similarly significant effects. Spoken notes such as "which is low" are informational, not medical advice.
Previous version: September 6, 2026.