Privacy Policy
Last updated: [DATE]
The short version
A summary. The full policy below applies.
- We store the health information you enter, such as glucose readings and fasts, to run the app. We rely on your explicit consent for this.
- We never sell your data, and we don't use your health data for advertising.
- Emails and analytics never contain your glucose values. Analytics use a random ID, never your email.
- You can download a copy of your data or delete your account yourself, any time.
- You can withdraw your consent whenever you like, and add two-factor login for extra protection.
Who we are
Unhoney is operated by [COMPANY NAME], [ADDRESS], [COUNTRY], registered under number [CHAMBER OF COMMERCE / REGISTRATION NUMBER] ("we"). We are the controller of your personal data. Contact: [PRIVACY EMAIL ADDRESS].
What data we process
Please read- Account data: your email address and a securely stored (hashed) password.
- Health data you enter: glucose readings, fasting start and end times, and the context of each reading.
- Safety screening: we only store whether you passed the safety questions, not your individual answers.
- Subscription data: your plan, subscription status and billing dates. Card details are handled only by Stripe and never reach our servers.
- Usage events (for example "fast started" or "report downloaded"), without health values, used to run and improve the service. You can object to this by emailing [PRIVACY EMAIL ADDRESS].
- Technical data such as login cookies that are strictly necessary for the service, and a preference cookie that remembers your language.
- Your progress in the 7-day starter program.
- Notes you write (free text) on your readings and fasts. Notes are visible only to you (and to anyone you choose to share a doctor link with, if you include notes in it) and are never sent to analytics.
- Your email preferences (weekly summary, reminder hour and time zone).
- Your preferred glucose unit (mmol/L or mg/dL) and language.
- If you switch on two-factor authentication: the secret for your authenticator app, which is stored by our login provider.
- If you create a link for your doctor: the link settings (period, whether notes are included, expiry), how often it was opened, and the report the link shows. Anyone with the link can see that report until it expires or you switch it off.
Why we process it, and our legal basis
- Providing the service (tracking, charts, reports): performance of our contract with you (Art. 6(1)(b) GDPR).
- Health data: your explicit consent (Art. 9(2)(a) GDPR), given when you create your account. You can withdraw it at any time by deleting your account.
- Payments and invoices, tax records: contract and legal obligation (Art. 6(1)(b) and (c)).
- Security and fraud prevention, improving the service: our legitimate interests (Art. 6(1)(f)).
- Product analytics (without health values or your email): our legitimate interest in improving the service (Art. 6(1)(f)).
- Optional emails (weekly summary and reminders): your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.
Automated decisions
Based on your answers to the safety questions, the app automatically decides whether to turn the fasting feature on. If it is turned off, you can still use the glucose log. You can contact us to have this reviewed by a person.
How long we keep it
We keep your account and health data until you delete your account. After deletion, it is removed from our systems, and from backups within [NUMBER] days. Invoices and payment records are kept by us and Stripe for as long as tax law requires ([NUMBER] years).
Your rights
Your choicesYou have the right to access, rectify, erase and restrict the processing of your data, to data portability, to object, and to withdraw consent at any time. In the app you can download your data ("Your data" section of the dashboard) and delete your account yourself. For anything else, email [PRIVACY EMAIL ADDRESS]. You also have the right to complain to your data protection authority ([SUPERVISORY AUTHORITY, e.g. Autoriteit Persoonsgegevens in the Netherlands]).
Age
Unhoney is for adults aged 18 and over.
Security
Data is encrypted in transit, stored in the EU, and protected by access rules that only allow you to see your own data. If a data breach affecting you occurs, we will inform you and the authorities as required by law.
Changes
We will tell you about important changes to this policy by email or in the app.