Glyvon Health AI Data Usage Policy

1. Introduction

1.1 Purpose of This Policy

This AI Data Usage Policy ("Policy") provides a comprehensive, transparent explanation of how Glyvon Health uses artificial intelligence technologies within its Service, what data is processed by AI systems, how that data is handled, and what rights and controls you have over AI processing of your personal data. This Policy supplements our Terms of Service and Privacy Policy, and is incorporated into both by reference.

1.2 Why a Separate AI Policy

We maintain this as a separate document because the processing of personal health data by AI systems raises distinct privacy, transparency, and ethical considerations that warrant focused attention. This Policy is designed to fulfill our transparency obligations under the General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).

1.3 Consent Requirement

AI-powered features in Glyvon Health require separate, explicit, granular consent that is distinct from the general consent you provide for the Terms of Service and Privacy Policy. This is because AI processing involves the transfer of health data (a special category under GDPR Article 9) to a third-party AI provider, the processing of that data by automated systems, and the generation of outputs that may influence your understanding of your health.

You will be asked to provide this consent at the first point of use for an AI feature, before any AI request is sent to our third-party AI processing provider. You may also review or withdraw this consent at any time in the application through Settings > AI Data Processing. You may use the Service without consenting to AI data processing; in that case, AI features will simply not be available to you. The Service functions fully without AI features enabled, and you are never penalized, disadvantaged, or restricted in any non-AI functionality for declining AI consent. This approach ensures that consent is freely given, as required by GDPR Article 7 and Recital 42.

2. AI Features in Glyvon Health

2.1 AI-Powered Food Analysis

What it does: When you take a photograph of a meal within the application, you can submit that photograph for AI-powered nutritional analysis. The AI examines the visual content of the image and returns estimated nutritional information, including approximate carbohydrate content in grams, estimated calorie count, approximate protein content in grams, approximate fat content in grams, a glycemic index classification (low, medium, or high), a general description of the identified food items, and portion size observations.

How it works technically: The meal photograph is captured through the application's camera interface or selected from the device photo library. The image, together with limited instructions needed to analyze the meal, is transmitted through our backend to a third-party AI processing provider over encrypted channels. The provider returns nutritional estimates, which are validated and displayed to you. If you confirm the analysis, the nutritional data is saved with your meal record in our systems.

What data is sent to the AI provider: The meal photograph, limited analysis instructions, and the preferred language for the response. No personally identifiable information such as your name, email address, user ID, health profile, glucose readings, or medication information is included in food analysis requests.

Availability: This feature is available exclusively to Premium subscribers (monthly or annual plan).

Limitations: AI-generated nutritional estimates are approximations based on visual analysis. They may not accurately reflect actual nutritional content due to factors such as hidden ingredients not visible in the photograph, specific preparation methods and cooking oils, challenges in estimating portion sizes from two-dimensional images, regional food variations and local recipes, image quality and lighting conditions, mixed dishes where individual components are not visible, and processed or packaged foods with specific formulations. These estimates should always be verified with a healthcare professional or registered dietitian, particularly when used in the context of insulin dosing calculations or other medical decisions.

2.2 AI Chat Assistant

What it does: The AI chat assistant allows you to have a text-based conversation about diabetes management, nutrition, and general health information. The assistant has access to your recent health data (with your consent) and can provide contextualized informational responses. Specifically, the assistant can answer general questions about diabetes management and nutrition, discuss your recent glucose trends based on your recorded readings, provide informational context about your meals and their potential impact on blood glucose, offer general wellness and lifestyle information relevant to diabetes management, and suggest questions you might want to discuss with your healthcare provider.

How it works technically: When you send a message, the application routes the request through our backend. Our backend verifies that you have active AI consent, checks your applicable usage allowance, applies abuse-prevention controls, compiles a limited health context summary from your recent data (described in Section 2.2.1 below), and forwards the minimum necessary context to our third-party AI processing provider. The returned response is validated, stored securely in our systems, and displayed in the application.

2.2.1 Health Context Data: The health context that is shared with the AI (when you have opted in) includes your diabetes type and target glucose range (but not your name, email, or user ID), a summary of your recent glucose readings from the past seven (7) days including statistical averages, the number of readings in each range (very low, low, normal, high, very high), and trend direction, your recent meals from the past three (3) days including meal type, nutritional data, and glycemic index, your current active medications including drug names and dosages (but not your pharmacy, prescriber, or insurance information), and general profile context such as age range (not exact date of birth). This data is compiled into an anonymized summary format on our servers before transmission. The AI provider never has access to your full underlying health records, your account credentials, or any direct identifiers.

Availability: Free users receive up to three (3) AI chat messages per day. Premium subscribers receive up to fifty (50) messages per day. Usage limits are tracked per calendar day.

2.3 What the AI Cannot and Does Not Do

The AI does not provide medical diagnoses, treatment plans, or therapeutic recommendations. The AI does not have access to your full medical history, lab results, or current physiological state beyond what you record in the application. The AI does not make decisions about your care, medication dosages, insulin adjustments, or treatment protocols. The AI does not replace the role of your physician, endocrinologist, diabetes educator, or any healthcare professional. The AI does not store, learn from, or remember your data between separate sessions; each conversation context is assembled fresh from your current data. The AI does not operate autonomously or take actions within the application on your behalf. The AI does not have the ability to contact your healthcare providers, pharmacies, emergency services, or any external services. The AI does not profile you, score you, or classify you based on your health data. The AI does not influence your access to the Service, its features, or any aspect of your user experience.

3. AI Service Provider

3.1 Provider Identity

Our AI features are powered by a contracted third-party AI processing provider. AI processing currently takes place in the United States.

3.2 Data Processing Agreement

We maintain a Data Processing Agreement (DPA) with our AI processing provider in accordance with GDPR Article 28. Under this agreement, the provider is contractually obligated to: process data only according to our documented instructions; implement appropriate technical and organizational security measures; assist us in responding to data subject rights requests (GDPR Articles 15-22); notify us without undue delay upon becoming aware of a personal data breach; delete or return all personal data upon termination of the agreement; make available all information necessary to demonstrate compliance with GDPR Article 28 obligations; and not engage sub-processors without appropriate contractual protections.

3.3 Data Retention by the AI Provider

Our AI processing provider retains submitted inputs (such as messages, images, and health context) and outputs (AI responses) for up to thirty (30) days for the sole purpose of abuse and misuse monitoring. After this thirty (30) day period, submitted data is permanently deleted from the provider's systems. The provider does not use submitted API data to train or improve public models.

3.4 Provider Security Commitments

We require our AI processing provider to maintain appropriate technical and organizational safeguards for data processed on our behalf, including encryption, access controls, auditability, and incident response procedures consistent with contractual and legal obligations.

3.5 Provider Change Management

If we materially change the AI processing provider or materially expand the categories of data sent for AI processing, we will update this Policy and, where required by law, request renewed consent before the change takes effect.

4. Data Flow and Technical Architecture

4.1 Food Analysis Data Flow

The following describes the high-level data flow when you use the AI food analysis feature:

Step 1: You capture a meal photograph using the camera or select an existing image from your device photo library, then submit it for analysis in the application.

Step 2: Our backend verifies your eligibility to use the feature, confirms your AI consent status, and performs basic request validation.

Step 3: Only the minimum necessary image data and analysis instructions are sent to our third-party AI processing provider over encrypted channels.

Step 4: The provider returns nutritional estimates, which we validate before displaying to you.

Step 5: If you accept the analysis, the nutritional data is saved with your meal record in our systems. Limited usage metrics may also be recorded for feature operations and quota management.

4.2 AI Chat Data Flow

Step 1: You type a message in the AI chat interface within the application.

Step 2: Our backend verifies your AI consent, checks your applicable daily usage allowance, applies abuse-prevention controls, and compiles a limited health context summary.

Step 3: The minimum necessary context for your request is sent to our third-party AI processing provider over encrypted channels. No direct identifiers are included in the request.

Step 4: The provider returns an AI-generated response, which is validated before display.

Step 5: Your message, the AI response, and limited usage metrics are stored securely in our systems for continuity, support of the feature, and quota management.

4.3 Network Security

All data transmitted between the application, our backend, and our third-party AI processing provider is sent through encrypted channels. Credentials used to access AI services are stored securely and are not exposed to the client application, returned in client-accessible responses, or intentionally included in application error messages.

5. Data Minimization in AI Processing

5.1 Principle

In accordance with the data minimization principle established by GDPR Article 5(1)(c), we send only the minimum data necessary to the AI provider for each specific request. We have deliberately designed our system architecture to avoid transmitting unnecessary personal data.

5.2 What Is Not Sent to the AI Provider

The following categories of data are never included in any request to the AI provider: your name, email address, or any account identifier; your user ID, session ID, device ID, or IP address; your exact date of birth (only an age range may be included in health context); your physical location, GPS coordinates, or geographic data; your payment details, subscription plan, or financial information; your consent records or consent timestamps; your authentication credentials; data belonging to any other user; your full medication history (only current active medications are included in health context); your full glucose history (only a statistical summary of recent readings is included); and any data that could directly identify you to the AI provider.

5.3 Anonymization Measures

When health context data is included in AI chat requests, it is anonymized through the following measures: all direct identifiers (name, email, user ID, account number) are excluded entirely before any data leaves our servers; dates are presented as relative references (such as "3 days ago" or "this morning") rather than absolute dates that could be used for identification; glucose readings are presented as statistical summaries (averages, standard deviations, ranges, Time in Range percentages) rather than complete timestamped records where possible; medication information includes only drug names and dosages for contextual relevance, without prescriber information, pharmacy details, or start dates; and all context compilation occurs exclusively on our servers, meaning the AI provider never has access to your raw database records or the ability to query additional information about you.

6. Your Rights and Controls

6.1 Granular Consent

AI data processing consent is separate from and independent of your general Service consent. You can accept the Terms of Service and Privacy Policy and use all non-AI features of the Service without consenting to AI data processing. This granular consent model complies with GDPR Recital 43, which states that consent should not be regarded as freely given if the data subject has no genuine or free choice, and with the European Data Protection Board (EDPB) guidelines which require that consent be specific and granular for distinct processing operations.

6.2 Right to Withdraw AI Consent

You may withdraw your consent for AI data processing at any time through the application by navigating to Settings > AI Data Processing and revoking your AI Data Usage consent. When you withdraw consent: all AI features are immediately disabled and become unavailable; no further data of any kind is sent to the AI provider; your existing AI chat history remains stored in our systems under our normal retention and security controls until you explicitly request its deletion or delete your account; the withdrawal does not affect the lawfulness of AI processing carried out before the withdrawal, in accordance with GDPR Article 7(3); data already transmitted to the AI provider during the current thirty (30) day retention window will be automatically deleted by the provider at the end of that period; and you may re-consent at any time to restore access to AI features.

6.3 Right to Delete AI Data

You can request deletion of your AI chat history and all AI-processed data at any time by contacting us at support@glyvon.app or by deleting individual chat sessions through the application interface. Upon receiving a verified deletion request, we will permanently delete all AI chat messages and AI-generated responses from our systems within thirty (30) days, delete all associated metadata including usage counts, usage timestamps, and processing metrics within thirty (30) days, delete AI-generated nutritional analysis data if specifically requested, and confirm the completion of deletion to you in writing. Data that has already been transmitted to the AI provider and is within the provider's thirty (30) day abuse monitoring retention window cannot be individually targeted for early deletion from the provider's systems. However, all such data will be automatically and permanently deleted by the provider at the end of that period.

6.4 Right to Access AI Data

Under GDPR Article 15, you have the right to request a complete copy of all data that has been processed by AI features on your behalf. This includes every AI chat message you have sent and every AI response you have received, the health context summaries that were compiled and transmitted to the AI for each request, all food analysis requests including the images submitted and the nutritional results returned, and all usage tracking data including message counts, token usage statistics, and timestamps. To request this data, contact support@glyvon.app. We will provide the data within thirty (30) days in a structured, commonly used, and machine-readable format (JSON or CSV), in accordance with GDPR Article 20.

6.5 Right to Human Intervention

If any AI-generated output concerns you, you have the right to: request human review of the output by contacting support@glyvon.app; express your point of view about the AI-generated content; contest any AI-generated result that you believe is inaccurate, misleading, or inappropriate; and receive a meaningful explanation of the basis for any AI output. This right is provided in accordance with GDPR Article 22(3) safeguards, even though we do not believe our AI features constitute automated decision-making within the meaning of Article 22(1), as our AI features are strictly informational and do not produce decisions with legal or similarly significant effects.

6.6 Right to Explanation

You have the right to understand how AI features process your data and generate their outputs. The technical descriptions in Sections 2 and 4 of this Policy are intended to fulfill this right. If you require additional explanation about any aspect of AI processing, including the logic involved in generating a specific AI output, you may contact us at support@glyvon.app and we will provide a clear, understandable explanation within thirty (30) days.

7. EU AI Act Compliance

7.1 Risk Classification

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), which entered into force on August 1, 2024, establishes a risk-based regulatory framework for AI systems operating within the European Union. Under this framework, Glyvon Health's AI features are classified as limited-risk AI systems. This classification is based on the following analysis:

Under Article 6(1) of the AI Act, an AI system is classified as high-risk if it is a safety component of a product covered by EU harmonisation legislation (such as the Medical Devices Regulation) and requires third-party conformity assessment. Glyvon Health is not a medical device and has not been certified under the EU Medical Devices Regulation (MDR 2017/745) or the In Vitro Diagnostic Medical Devices Regulation (IVDR 2017/746). The AI features do not perform medical diagnosis, clinical decision support, treatment recommendation, or any function that would qualify as a safety component of a medical device.

Under Article 6(2), AI systems performing functions listed in Annex III are considered high-risk. Glyvon Health's AI features do not perform biometric identification, critical infrastructure management, education assessment, employment evaluation, law enforcement, immigration processing, justice administration, or any other Annex III function.

Furthermore, under Article 6(3), even Annex III systems may be exempt from high-risk classification if they do not pose a significant risk of harm. Glyvon Health's AI features are informational and advisory only, do not produce outputs with legal or similarly significant effects on users, and are designed as decision-support tools where the user retains full autonomy over all health-related decisions.

7.2 Transparency Obligations (Article 50)

As a provider deploying a limited-risk AI system, Glyvon Health is subject to the transparency obligations set forth in Article 50 of the AI Act. In compliance with these obligations: users are clearly informed within the application interface, through visual indicators and text labels, that they are interacting with an AI system and not a human; all AI-generated content (nutritional analyses, chat responses, health insights) is clearly labeled and visually distinguished from non-AI content within the application; information about the general capabilities, limitations, intended purpose, and potential risks of the AI features is readily accessible within the application and through this Policy; and AI-generated text content is not presented in a manner that could be mistaken for human-authored content.

7.3 If Classification Changes

We actively monitor regulatory developments related to the EU AI Act, including implementing acts, delegated acts, guidance documents published by the European AI Office, and enforcement decisions by national authorities. If future regulatory developments result in Glyvon Health's AI features being reclassified as high-risk under the AI Act, we will promptly: conduct a comprehensive conformity assessment as required by Article 43; implement the full suite of high-risk AI system obligations, including a risk management system (Article 9), data quality and governance measures (Article 10), comprehensive technical documentation (Article 11), automatic logging and record-keeping capabilities (Article 12), enhanced transparency for deployers (Article 13), human oversight mechanisms (Article 14), and accuracy, robustness, and cybersecurity requirements (Article 15); register the AI system in the EU database for high-risk AI systems as required by Article 49; appoint an authorized representative in the EU if required; and notify all users of the reclassification, the implications for data processing, and any changes to this Policy.

7.4 Compliance Timeline

The EU AI Act compliance milestones relevant to Glyvon Health are as follows: August 2, 2025 marks the date from which transparency obligations for limited-risk AI systems (Article 50) become enforceable. August 2, 2026 marks the date from which the full obligations for high-risk AI systems become applicable. Glyvon Health is in full compliance with the transparency obligations applicable as of the date of this Policy.

8. Automated Decision-Making and GDPR Article 22

8.1 Position Statement

Glyvon Health does not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you, as described in GDPR Article 22(1). All AI features within the Service are strictly advisory and informational in nature.

8.2 Why Our AI Features Are Not Article 22 Decisions

GDPR Article 22 applies to decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects. Glyvon Health's AI features do not meet this threshold because: AI food analysis provides nutritional estimates that you review, may modify, and choose whether to accept; AI chat provides informational responses that do not determine any outcome regarding your use of the Service or your legal rights; no AI output restricts, limits, enables, or modifies your access to the Service, its features, or any entitlement; all health-related decisions (including medication dosing, dietary choices, and treatment adjustments) are made by you in consultation with your healthcare provider, not by the AI; and you maintain full control over whether to act on, ignore, modify, or discard any AI-generated information.

8.3 Safeguards Provided Regardless

Even though we do not believe Article 22 is triggered, we voluntarily implement the safeguards described in Article 22(3) as a best practice. These include the right to obtain human intervention (Section 6.5), the right to express your point of view about AI outputs, the right to contest any AI-generated result, transparency about the logic and functioning of AI features (this Policy), and the ability to use the Service without AI features entirely.

9. Ethical Principles

9.1 Our AI Ethics Framework

We adhere to the following ethical principles in our use of AI within a health context:

Human Autonomy: AI features are designed to inform and support, never to replace human judgment or the physician-patient relationship. Users retain full control over all health-related decisions. AI outputs are always presented as informational suggestions, never as directives or commands.

Non-Maleficence: We take active steps to prevent harm from AI outputs. Our internal AI instructions and safeguards prohibit the AI from providing medical advice, prescribing treatments, or recommending medication changes. All AI-generated content includes clear disclaimers. Usage controls help reduce over-reliance on AI. Medical emergency scenarios are handled with immediate redirection to emergency services.

Transparency: We are committed to being open and honest about how AI is used within the Service. This Policy, the in-app disclosures, the clear labeling of AI content, and our responsiveness to individual inquiries all reflect this commitment.

Fairness: We strive to ensure that our AI features perform equitably across diverse populations, food cultures, dietary practices, languages, and diabetes management approaches. We recognize that AI models may exhibit biases and we actively monitor for inequitable outcomes.

Privacy: We apply the principle of data minimization to all AI processing, ensure that health data shared with AI providers is anonymized to the greatest extent possible while maintaining functional utility, and provide granular consent mechanisms that give you meaningful control over your data.

Accountability: We maintain oversight of our AI systems and take responsibility for their outputs. If an AI feature produces harmful, misleading, or inaccurate information, we investigate the cause, implement corrective measures, and communicate transparently with affected users.

9.2 Ongoing Monitoring

We continuously monitor the performance, accuracy, and safety of our AI features through periodic quality audits of AI response accuracy and appropriateness, systematic review of user feedback and reported issues, analysis of AI usage patterns to detect anomalies or emerging risks, tracking provider-side changes that may affect accuracy, safety, or data processing practices, and annual review of this Policy and our AI ethics framework to ensure continued alignment with regulatory developments and industry best practices.

10. Changes to This Policy

We may update this Policy from time to time to reflect changes in our AI features, our data processing practices, our AI provider arrangements, or applicable laws and regulations. Material changes that affect how your health data is processed by AI systems, that involve a change of AI processing provider, or that alter the scope of data shared with the AI provider will require renewed explicit consent before the changes take effect. We will provide notice of material changes through the application interface at least thirty (30) days before they take effect. Minor changes such as clarifications, grammatical corrections, formatting improvements, or updates to contact information will be reflected in the "Last Updated" date at the top of this document without requiring renewed consent.

Version 2.3 (April 2026): Reduced public exposure of vendor, model, infrastructure, and backend implementation details while preserving disclosure of AI processing categories, retention periods, and user rights.

Version 2.2 (March 2026): Clarified first-use AI consent flow, in-app consent controls, public document URL, and third-party AI processing disclosures presented before AI requests are sent.

Version 2.0 (February 2026): Comprehensive rewrite with full technical architecture description, detailed data flow documentation, EU AI Act compliance section, GDPR Article 22 analysis, expanded ethical framework, provider security documentation, and enhanced rights descriptions.

Version 1.0 (November 2024): Initial release.

11. Contact Information

For questions, concerns, or requests regarding AI data processing:

Email: support@glyvon.app Phone: +1 (307) 670-7149 (SMS only)

Mailing Address: Glyvon Health (MevaTech Software LLC) 30 N Gould St Ste R Sheridan, WY 82801 USA