Privacy notice

1. Who we are

MealCurve is an independent UK digital health software project operated by Carl Lindsay. For UK data protection law, MealCurve is the controller of the personal information described in this notice.

Privacy questions and requests can be sent to privacy@mealcurve.co.uk.

2. Scope and eligibility

This notice covers the MealCurve mobile application and the MealCurve website. MealCurve is currently intended for adults aged 18 and over and is not knowingly offered to children.

MealCurve is an informational, retrospective service. It is not a medical device, emergency service or substitute for your official CGM application, receiver or clinical care.

3. Information we use

Account information

Your email address, account identifier and authentication information needed to create and secure your account. MealCurve uses passwordless email codes and does not receive your email account password.

Meal information

Meals you log, including names, restaurants, carbohydrate values, timestamps and any optional active-insulin value you enter.

Dexcom information

If you connect Dexcom, MealCurve processes the authorisation credentials needed to access your account and glucose readings supplied through Dexcom’s API. Glucose information is health data and receives additional protection under data protection law.

Optional cycle information

If you enable cycle tracking, MealCurve processes the dates and settings you enter to provide cycle-related context. This feature is optional and the information is health data.

Optional activity and sleep information

If you choose to enable activity or sleep insights, MealCurve reads workout sessions and/or sleep-analysis records from Apple HealthKit on iOS or Health Connect on Android. It uses workout start and end times and sleep intervals to calculate sleep duration. This is health data, and access is optional and read-only.

Device and local information

Meal and preference information may be cached on your device so that supported parts of the app remain usable offline. Removing the application or using its deletion controls may affect this local copy.

Website and security information

Hosting and infrastructure providers may process limited technical information, such as IP address, browser details, request time and security logs, to deliver and protect the website and services. The website does not currently use advertising or analytics cookies.

4. How and why we use information

You may withdraw consent for optional health-data processing. Withdrawal does not affect processing that was lawful before consent was withdrawn.

5. Your Dexcom connection

Connecting Dexcom is optional and uses Dexcom’s authorisation process. MealCurve stores access and refresh credentials securely on its server so it can make authorised, read-only requests on your behalf. These credentials are not displayed to other users.

MealCurve retrieves glucose readings on demand to create retrospective meal summaries and patterns. It does not currently retain raw Dexcom glucose readings as a separate long-term cloud dataset. Meal records and calculated information shown or saved by the app may remain until you delete them.

You can disconnect Dexcom from your account controls. This removes MealCurve’s stored Dexcom connection but does not delete information held by Dexcom.

6. Optional activity and sleep insights

This feature is optional. You can choose workouts, sleep, or both. MealCurve requests read access only to the types you select; it does not request permission to add, change or delete health records. It does not request workout routes, steps, heart rate or calories.

When you open or refresh Activity & sleep, MealCurve reads the selected records on your device and compares them with completed glucose responses for your logged meals. Workout timing is used to group responses around recorded workouts and periods with no workout recorded. Sleep intervals are used to estimate the duration of the main sleep session before a meal and compare responses with your usual sleep duration. These comparisons describe associations in your records; they do not establish cause and effect and are not medical advice.

The underlying workout and sleep records, and the resulting activity and sleep comparisons, are processed on your device and are not uploaded to MealCurve’s servers. They are held temporarily while the insight screen is in use and cleared when you leave it or sign out. Your choices to enable these optional insights are saved locally for your account; the health records themselves are not saved in MealCurve’s cloud database.

You can turn off the feature in MealCurve and review or revoke device access from Settings → Health data access. On iPhone, open the Health app, tap your profile picture, then Apps and Services → MealCurve, and turn off Workouts or Sleep. On Android, open Health Connect, choose App permissions → MealCurve, and turn off Exercise or Sleep. iOS does not allow MealCurve to revoke HealthKit access for you.

7. Who receives information

We use carefully selected service providers where necessary to operate MealCurve:

• Supabase provides account authentication, database and server infrastructure.
• Dexcom operates the CGM service and API you choose to connect. Dexcom processes information under its own privacy terms.
• Website, DNS and email infrastructure providers deliver and secure the website and route service communications.

Providers may only receive information needed for their role. We do not sell personal information, use health information for advertising or share it with employers, insurers or data brokers.

We may disclose information where legally required or where necessary to establish, exercise or defend legal claims.

8. Storage, security and international transfers

MealCurve’s primary database is hosted in London, United Kingdom. Service providers and their subprocessors may process limited information in other countries. Where UK personal information is transferred internationally, we rely on an applicable adequacy decision or appropriate contractual and organisational safeguards.

We use measures appropriate to the nature of the information, including authenticated access, user-specific records, protected server credentials and encrypted network connections. No online service can guarantee absolute security.

9. How long we keep information

• Account, meal and optional cycle information is generally retained while your account is active or until you delete it.
• Dexcom credentials are retained while the connection remains active and are removed when you disconnect it or delete your data.
• Temporary authorisation records are kept only as needed to complete and protect the connection process.
• Operational and security logs are retained for limited periods according to the relevant provider’s schedule.

Deletion removes information from active systems. Limited encrypted backup copies may remain until they expire through normal backup schedules and will not be used except for recovery and security purposes.

10. Your rights

Depending on the circumstances, UK data protection law gives you rights to:

• receive a copy of your personal information;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• receive eligible information in a portable format; and
• withdraw consent at any time.

You can use the account controls to disconnect Dexcom, delete your MealCurve data while retaining your account, or permanently delete your account. You may also contact us. We may need to verify your identity before completing a request.

11. Changes to this notice

We may update this notice as MealCurve develops, providers change or legal requirements evolve. Material changes will be highlighted in the app or through another appropriate channel. The current version and update date will remain available on this page.