Privacy Policy

GLPTrackr Privacy Policy

Last updated: June 2026

Effective date: June 2026

⚠ This app is not a medical device and does not diagnose, treat, cure, or prevent any disease or condition. GLPTrackr is a wellness tracking tool for informational purposes only. Always consult your prescribing doctor, pharmacist, or qualified healthcare professional before making changes to your medication, diet, or treatment plan.

1. Who we are

GLPTrackr is a mobile application that helps adults track their GLP-1 weight loss medication, meals, side effects, weight, mood, food noise, and other wellness data. GLPTrackr is operated by GLPTrackr ("we", "us", "our").

For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller of your personal data.

General enquiries: hello@glptrackr.com

Privacy and data protection enquiries: privacy@glptrackr.com

Postal address: 109 Coleman Road, Leicester, LE5 4LE, United Kingdom

If your enquiry concerns the exercise of your data subject rights, please contact us at privacy@glptrackr.com and we will respond within 30 days.

2. What data we collect

We collect the following categories of personal data when you create an account and use GLPTrackr.

2.1 Account data

Full name.

Email address.

Password (stored only as a salted hash; we never store plain text passwords).

Date of birth (used to confirm you are 18 or over).

Gender (optional, used for personalised calculations).

Authentication identifiers if you sign in with Google (your Google account email and unique Google ID).

2.2 Health and wellness data (special category data under UK GDPR Article 9)

Weight, height, and body measurements.

Medication name, brand, dosage, injection schedule, and injection history.

Injection site locations and rotation history.

Side effects reported.

Food and nutrition logs entered manually, via barcode scan, or via photo (camera).

Water intake.

Exercise activity and step counts.

Sleep duration and quality.

Mood, energy, and food noise ratings.

Morning check-in responses.

Progress photos (taken with the device camera, with your permission, and uploaded to encrypted storage).

2.3 Device permissions

GLPTrackr requests the following device permissions on iOS and Android. You can deny or revoke any of these at any time via your device settings; some app features will not work without them.

Camera — to take progress photos and scan food items or barcodes.

Photo library — to let you upload existing progress or meal photos.

Notifications — to send medication reminders, hydration nudges, and morning check-in prompts.

Motion and fitness (iOS) / Activity recognition (Android) — to count steps and log exercise activity, if you grant access.

App Tracking Transparency (iOS) / Advertising ID (Android) — if you grant permission, we and our advertising partners use your device's advertising identifier to measure the effectiveness of our marketing campaigns (see Section 6.1 and Section 14). You can decline this without affecting any other app functionality.

2.4 Usage and technical data

App usage patterns and feature interactions.

Device type, operating system version, and app version.

Crash reports and performance diagnostics.

Approximate region (derived from your IP address, not precise location).

Advertising and attribution identifiers (such as your device's advertising ID), and limited app event data (for example, that you installed the app, completed onboarding, viewed our subscription screen, or made a purchase), where you have consented to tracking. See Section 6.1 and Section 14.

2.5 Subscription and payment data

All payment processing is handled by the Apple App Store or Google Play Store. We do not collect or store your payment card details. We receive only your subscription status (active, expired, in trial, cancelled) and the product purchased.

3. How we use your data

3.1 To provide the GLPTrackr service

Tracking your medication, meals, weight, side effects, and wellness data.

Generating personalised AI meal plans, recipes, and shopping lists.

Providing AI-powered insights including the Daily Brief, Golden Dose Finder, Food Noise Index, and predictive side effect analysis.

Displaying your Medication Clock and injection cycle data.

Generating progress analytics, transformation cards, and Doctor PDF exports.

Legal basis: Performance of a contract (UK GDPR Article 6(1)(b)). For health data: your explicit consent (UK GDPR Article 9(2)(a)).

3.2 To improve the service

Analysing aggregated and anonymised usage data to improve features and performance.

Diagnosing and fixing bugs and technical issues.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)).

3.3 To communicate with you

Service-related notifications (dose reminders, hydration nudges, morning check-ins).

Responding to support enquiries.

Product updates and new feature announcements (only with your consent, which you can withdraw at any time).

Legal basis: Performance of a contract (Article 6(1)(b)) and/or consent (Article 6(1)(a)) UK GDPR.

3.4 To manage your subscription

Processing your subscription through Apple App Store or Google Play Store.

Managing free trials, Founding Member pricing, and referral rewards.

Legal basis: Performance of a contract (UK GDPR Article 6(1)(b)).

3.5 To measure and improve our advertising

To understand whether our marketing campaigns are effective, we measure actions such as installing the app, completing onboarding, viewing our subscription screen, and subscribing, and we attribute these actions to the advertising campaigns that led you to GLPTrackr. This is done using advertising and analytics partners (see Section 6.1).

We only carry out this advertising measurement where you have given us permission to do so — on iOS, through the App Tracking Transparency prompt; on Android, in line with your advertising-ID settings and the consent you provide. We never share your health or wellness data (Section 2.2) for advertising or measurement purposes.

Legal basis: Consent (UK GDPR Article 6(1)(a)). You can withdraw this consent at any time (see Section 14).

4. Health data — special category data

GLPTrackr processes health-related data as defined under Article 9 of the UK GDPR. This includes your medication details, side effects, weight, body measurements, food logs, mood, energy, sleep, and progress photos.

We process this data only with your explicit consent, which you provide when you create your account and tick the consent box agreeing to this Privacy Policy. You can withdraw your consent at any time by deleting your account (see Section 11).

We do not use your health or wellness data for advertising, profiling for advertising, or marketing, and we never share your health or wellness data with advertising or analytics partners. Your health data is used solely to provide and improve the GLPTrackr service to you. The advertising measurement described in Section 3.5 and Section 6.1 uses only advertising identifiers and basic app-event data (such as install, onboarding completion, subscription-screen view, and purchase) — it does not include any of the health or wellness data listed in Section 2.2.

5. AI processing

GLPTrackr uses artificial intelligence to power several features including AI meal plans, food photo scanning, the Daily Brief, Golden Dose Finder, predictive side effects, and the What If simulator. These features are powered by our proprietary AI system, GLPIQ 3.0, which uses underlying large language model and vision model providers.

When you use AI-powered features:

Your relevant data (for example, a food photo, your calorie target, or your dose history) is sent to our AI processing services to generate personalised results.

AI processing is performed by third-party providers (named in Section 6) under strict data processing agreements that prohibit them from training their models on your data.

No personal identifiers such as your name or email are sent to AI providers.

AI-generated outputs (meal plans, predictions, insights) are for informational purposes only and do not constitute medical advice.

You are not subject to solely automated decision-making that has legal or similarly significant effects on you. All AI features are tools to support your journey — they do not make medical decisions on your behalf, and a human (you) is always in the loop.

6. Who we share your data with

We do not sell your personal data, and we never share your health or wellness data with advertising partners. We share data only with the following named service providers, all of whom are bound by data processing agreements:

Cloud infrastructure — Supabase Inc.

Hosts our database, authentication system, file storage (including progress photos), and backend functions. Data is stored in EU/UK data centres where available. Encrypted at rest (AES-256) and in transit (TLS 1.2+).

Subscription management — RevenueCat, Inc.

Manages your subscription status, entitlements, and billing events. RevenueCat receives an anonymous user identifier and subscription product information, but not your name, email, or any health data.

Payment processing — Apple App Store / Google Play

All payments are processed by Apple Inc. (for iOS users) and Google LLC (for Android users) under their respective terms and privacy policies. We do not see or store your payment card details. Apple's privacy policy is at apple.com/legal/privacy and Google's is at policies.google.com/privacy.

AI processing — OpenAI, L.L.C. and Anthropic, PBC

These providers power our AI features (meal generation, food photo recognition, insights, predictive analysis). They receive only the minimum data necessary to perform their function. No personal identifiers are sent. Under our agreements with these providers, your data is not used to train their models.

Push notifications — Expo, Apple Push Notification Service, and Firebase Cloud Messaging

Used to deliver dose reminders, hydration nudges, and morning check-in prompts. The notification body may include your local time and reminder text, but never sensitive health details.

Error monitoring and analytics — Sentry, Expo, and Google Firebase

Used to detect crashes, performance issues, and aggregated, anonymised usage patterns. We do not send health data to these providers.

Email and customer communication

We use a transactional email provider to send account confirmation, password reset, and support replies. They receive your email address and the message content only. [Insert your email provider name here before launch, e.g. Resend, Postmark, or AWS SES.]

Marketing and email/SMS engagement — Klaviyo, Inc.

We use Klaviyo to manage marketing and lifecycle communications (such as onboarding emails, product updates, and, where you have consented, SMS messages). Klaviyo receives your email address, phone number (if provided), and basic profile and engagement information so we can send you relevant communications and measure their effectiveness. Klaviyo does not receive the health or wellness data listed in Section 2.2 for advertising purposes. You can unsubscribe from marketing communications at any time using the link in any email or by replying STOP to an SMS.

6.1 Advertising and attribution partners — Meta Platforms, Inc. (Facebook) and TikTok

To measure the performance of our advertising campaigns and understand which campaigns bring new users to GLPTrackr, we use the advertising and measurement tools (software development kits, or "SDKs") provided by Meta Platforms, Inc. (Facebook/Instagram) and TikTok.

Where you have given permission (see Section 14), these partners receive:

Your device's advertising identifier (for example, Apple's IDFA or Google's Advertising ID), where available and permitted.

Basic app event data — for example, that you installed the app, completed onboarding, viewed our subscription screen, or made a purchase, including the purchase value and currency.

These partners do not receive any of your health or wellness data (Section 2.2), your medication details, your weight, your food logs, your progress photos, or any other special-category data. Only the advertising identifier and the basic app events listed above are shared, and only for advertising attribution and measurement.

Meta and TikTok may use this information to measure and optimise advertising, including showing you or similar users relevant advertising on their own and partner platforms. For more information, see Meta's Privacy Policy at facebook.com/privacy/policy and TikTok's Privacy Policy at tiktok.com/legal/privacy-policy.

This advertising measurement only takes place if you consent to tracking. If you decline the App Tracking Transparency prompt on iOS, or opt out of advertising-ID tracking on Android, these partners will not receive your advertising identifier for tracking purposes, and all other app features continue to work normally. You can change your choice at any time (see Section 14).

All third-party providers are either UK or EU based, or operate under appropriate safeguards for international data transfers (see Section 8).

7. Data retention

We retain your personal data for as long as you maintain an active GLPTrackr account.

If you delete your account (see Section 11):

Your personal data and health data will be deleted from our active systems within 30 days.

Anonymised and aggregated data that cannot identify you may be retained for analytics and service improvement purposes.

Encrypted backup copies may persist for up to 90 days before being permanently deleted from backup storage.

We may retain a minimal record (your user ID, deletion date, and reason if provided) for up to 6 years to comply with legal, regulatory, and fraud prevention obligations.

If your subscription lapses but you do not delete your account, we retain your data for 12 months so you can return and access your history. After 12 months of inactivity, we will notify you by email before deleting your data.

8. International data transfers

Your data is primarily stored on servers within the European Economic Area (EEA) and the United Kingdom. Where data is transferred to providers outside the UK or EEA (for example, AI processing services, advertising partners, or analytics providers based in the United States), we ensure appropriate safeguards are in place, including:

The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

Standard Contractual Clauses (SCCs) approved by the European Commission and recognised by the ICO.

Data processing agreements that require equivalent protection to UK GDPR.

For US transfers, reliance on providers certified under the UK Extension to the EU–US Data Privacy Framework where applicable.

9. Data security

We take the security of your data seriously. Our measures include:

All data encrypted in transit using TLS 1.2 or higher.

All data encrypted at rest using AES-256.

Passwords hashed and salted using industry-standard algorithms — we never store plain text passwords.

Row-level security policies on our database, ensuring users can only access their own data.

Access to personal data restricted to authorised personnel on a need-to-know basis, protected by strong authentication.

Regular security reviews of our infrastructure and third-party dependencies.

Progress photos stored in encrypted, access-controlled object storage with signed-URL access only.

AI providers receive only the minimum data necessary, with no personal identifiers attached.

No system is 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify affected users without undue delay, in accordance with UK GDPR.

10. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access — you can request a copy of all personal data we hold about you.

Right to rectification — you can correct any inaccurate or incomplete data.

Right to erasure (right to be forgotten) — you can request that we delete your data. You can also delete your account directly within the app (see Section 11).

Right to restrict processing — you can ask us to limit how we use your data.

Right to data portability — you can request your data in a machine-readable format (JSON or CSV). GLPTrackr also includes a Doctor PDF export feature within the app that provides a formatted summary of your health data.

Right to object — you can object to processing based on legitimate interests, and you can object to the use of your data for direct marketing and advertising measurement at any time.

Right to withdraw consent — you can withdraw consent for health data processing at any time by deleting your account, and you can withdraw consent for advertising measurement at any time (see Section 14).

To exercise any of these rights, contact us at privacy@glptrackr.com. We will respond within 30 days, in line with UK GDPR.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

Website: ico.org.uk

Phone: 0303 123 1113

11. How to delete your account

You can delete your account and all associated personal data using either of the following methods:

In-app deletion

Open GLPTrackr, go to Profile → Settings → Delete Account, and confirm. Your account and all associated personal data will be deleted from our active systems within 30 days, as described in Section 7.

Web-based deletion request

If you no longer have access to the app, send an email to privacy@glptrackr.com from the email address registered to your account, with the subject line "Account Deletion Request." We will verify your identity and delete your account within 30 days.

A web-accessible deletion request page is also available at glptrackr.com/delete-account.

12. Subscription terms and auto-renewal

GLPTrackr offers paid subscriptions with the following terms:

Subscriptions are billed monthly or annually at the rate displayed at the point of purchase (currently £9.99 per month for GLPTrackr Premium and £19.99 per month for GLPTrackr Pro).

Payment is charged to your Apple ID or Google Play account at confirmation of purchase.

Subscriptions automatically renew at the end of each billing period unless you cancel at least 24 hours before the end of the current period.

You can manage your subscription and turn off auto-renewal at any time in your Apple ID Subscription Settings or Google Play Subscriptions page.

Any unused portion of a free trial period will be forfeited when you purchase a subscription, where applicable.

Subscription billing and refunds are handled entirely by Apple or Google under their terms. We do not have visibility into or control over individual payment events.

13. Children

GLPTrackr is strictly intended for use by adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete that data immediately and close the account.

If you are a parent or guardian and believe a person under 18 has provided us with personal data, please contact privacy@glptrackr.com.

14. Tracking, advertising identifiers, and your choices

The GLPTrackr mobile app does not use browser cookies. It uses device-local storage (such as AsyncStorage and secure keychain storage) to maintain your session and cache user preferences.

Advertising measurement. As described in Section 3.5 and Section 6.1, we work with advertising partners (Meta and TikTok) to measure the effectiveness of our marketing campaigns. This involves the use of your device's advertising identifier and basic app-event data, but never your health or wellness data.

Your choices on iOS. When you first use the app, you will see Apple's App Tracking Transparency prompt asking whether GLPTrackr may track your activity. If you choose "Ask App Not to Track," we and our advertising partners will not use your device's advertising identifier for tracking. You can change this at any time in Settings → Privacy & Security → Tracking on your device.

Your choices on Android. You can limit ad tracking or reset your advertising ID at any time in Settings → Google → Ads (or your device's equivalent privacy settings). You can also opt out of personalised advertising there.

Withdrawing consent. Declining or withdrawing tracking consent does not affect any other functionality of the app — all features continue to work. If you withdraw consent, our advertising partners will stop receiving your advertising identifier for tracking purposes going forward.

Our website at glptrackr.com uses cookies for essential functionality and anonymised analytics. For full details, see our Cookie Policy on the website.

15. Community feature

GLPTrackr may include an in-app community where users can share posts, comments, and experiences. Any content you post in the community is visible to other GLPTrackr users.

Do not share sensitive personal information in community posts — for example, your full name, postal address, phone number, NHS number, or any information that could identify you off-platform.

We moderate community content in accordance with our Acceptable Use Policy. We reserve the right to remove any content that violates our guidelines, and to suspend or terminate accounts for repeated violations.

16. Third-party services and links

GLPTrackr may contain links to third-party websites or services (for example, links to nutrition databases, medication information, or healthcare resources). These are provided for convenience only. We are not responsible for the privacy practices of these third parties. Please review their privacy policies before sharing any personal information with them.

17. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the app or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent version.

By continuing to use GLPTrackr after the effective date of an updated Privacy Policy, you confirm that you have read and agree to the updated terms.

18. Medical disclaimer

⚠ GLPTrackr is not a medical device. It does not diagnose, treat, cure, or prevent any disease or condition. AI-generated insights, meal plans, predictions, and any other content provided by GLPTrackr are for informational and educational purposes only and do not constitute medical advice. Always consult your prescribing doctor, pharmacist, or qualified healthcare professional before making any changes to your medication, diet, exercise routine, or treatment plan. In an emergency, call 999 (UK) or your local emergency number immediately.

19. Contact us

If you have any questions about this Privacy Policy, your personal data, or how we handle your information, you can contact us at: