Privacy Policy

Last updated

Dia is an app for people living with diabetes. That means almost everything it holds is health data about you, and in the UK and EU it is special-category data — the most protected kind there is. This page says exactly what we collect, what we never collect, where it goes, and how to get rid of it. It is written to be read, not to be survived.

The short version. Your actual glucose numbers never leave your phone. We do not sell your data, we do not run ads, and we do not share anything with insurers, employers or data brokers. You can export everything or delete everything from inside the app, without asking us.

Who we are

Dia is operated by the maker of the Dia app (“Dia”, “we”, “us”), and is the data controller for the information described here. You can reach us any time at support@diaapp.co.

What never leaves your phone

This is the part that makes Dia different, so it goes first rather than in a footnote.

Your individual glucose readings — the mg/dL or mmol/L values themselves — are stored only on your device. They are not uploaded to our servers, not included in backups we hold, and not sent to the AI model that writes your insights. Not a single reading, not an average, not your GMI or your standard deviation.

What does sync is the interpretation: the state word Dia derived from a reading (“Steady”, “Rising”, “Low”), when it was, where it came from and how long it held, plus aggregate percentages such as your time in range for a day or a week. When you connect a CGM, Dia also fills in up to 30 days of that timeline, one state word per reading. A timeline of state words shows the shape of your days — when you ran high, low or steady, and for how long — but not a single number. A state word covers a band of values, not one value, so it cannot be turned back into the exact readings behind it, and a percentage reveals even less. That is where the line is drawn.

The practical consequence, stated plainly: if you delete the app or lose your phone, your reading history goes with it. We think that is the right trade, and we would rather tell you about it than discover you assumed otherwise.

What we collect

Your account

You can use Dia as a guest, in which case your account is an anonymous identifier and we hold no name or email for you at all. If you sign in with Apple, we receive your name and an email address — which is a private relay address if you chose to hide yours, and we never see the real one.

Your profile

Whatever you enter during onboarding or in settings: display name, age, height, weight, type of diabetes, diagnosis date, time zone, and your target glucose range.

Health data from Apple Health

Only with your explicit permission, and only the types Dia actually uses. It is read-only — Dia never writes to Apple Health. The full list:

You can withdraw any of these in the Health app at any time, and Dia will keep working with less to go on. Apple Health data is not readable by us in transit — it is read by the app on your device.

What you log

Meals, insulin doses, activity, mood, periods, and free-text notes. Logged insulin doses and the glucose states Dia derives are health data about a medical condition, and we are naming that explicitly rather than letting it hide inside the word “usage”.

If you photograph a meal, the photo is sent to our AI provider to identify the food and estimate its carbohydrates. The photo is not stored — by us or by them — after the answer comes back. Only the resulting text (“Chicken burrito bowl”, and the macro estimates) is saved to your log.

If you log by speaking to your Apple Watch, the watch records a short clip while you talk and sends it to your iPhone, which turns it into text using Apple’s speech recognition. The clip is deleted as soon as it has been read, and neither the audio nor the transcript ever reaches our servers — only the log you confirm on screen is saved, exactly as if you had typed it. Your watch will ask for microphone permission the first time, and you can decline and use the keyboard instead.

Where you are, roughly

With permission, Dia uses your phone’s location to get the weather and altitude where you are, because both measurably affect glucose. To get the weather, your phone rounds your coordinates to roughly 10 km, enough for a town and not a street, and sends them straight to Open-Meteo, a weather service, and nothing else about you: no name, no account or user ID, no advertising ID. Like any website, Open-Meteo can see your phone’s IP address. Dia uses the coordinates only to fetch the weather. Our servers never receive your coordinates: we store the weather and the altitude, not where you were, and we keep no location history. Deny the permission and Dia drops those factors.

Diagnostics and product analytics

Crash reports, and events about which screens get used so we can tell what is working. These carry the random identifier of your Dia account, never your name, your email or anything you logged — not what you ate, not a dose, not your diabetes type. That identifier lets us follow one person’s use of Dia across devices and reinstalls, so these events are tied to your account, though not to who you are.

There are two of these in the app. PostHog sees the events above. Google (Firebase) sees a much shorter list — that an install, a sign-up, a first log and a purchase happened, and which plan — which is how we will tell whether it is worth paying to reach people who might need Dia. Google is told, in the app’s own code, that it may not use any of it for advertising, ad personalization or building a profile of you, and it never receives anything about your health.

On this website, analytics run cookieless — nothing is written to your device, which is also why you were not asked to dismiss a cookie banner to read this page.

If you joined the waitlist

Your email address, which form on the page you used, and when. We also keep which link brought you here: the campaign tag on it, if it had one; the name of the app whose built-in browser opened the page, if it was one (such as Instagram or TikTok); or else just the name of the site that sent you (a host such as t.co, never the page or its address). If you choose an answer to the optional “How did you hear about us?” question, we keep that too. We keep only those short names and never your browser’s description of itself. Nothing else — no IP address, no browser fingerprint. Your address is never sent to our analytics. Every signup gets one confirmation email; if you haven’t tapped its link after about three days, one reminder (and never a second); and, later, one email when Dia is on the App Store. Signups from before the reminder existed were promised no further mail without a tap and are not sent it. Every one of these messages has an unsubscribe link, and using it deletes your address rather than just pausing mail; you can also write to us to have it removed.

What we never collect

Why we are allowed to hold it

If you are in the UK or EU, our lawful bases under UK GDPR / GDPR are: your explicit consent for health data (Article 9(2)(a)), which you give by granting the Health permission and can withdraw at any time in iOS Settings; performance of our contract with you for your account and your subscription; and our legitimate interests in keeping the app working for crash reporting and product analytics. Withdrawing consent does not undo processing that already happened, and it does not affect your ability to keep using the parts of Dia that do not need it.

Who else touches it

We use a small number of processors, each for one job. We do not sell data, we do not share it for advertising, and none of these are permitted to use it for their own purposes.

Supabase
Database, authentication and server functions. Hosted in the United States.
Anthropic
The AI model that writes your morning brief, night analysis and Ask Dia answers. It receives state words, aggregate percentages, the patterns Dia has found, your recent logs, sleep and weather — never a glucose value. Inputs are not used to train their models.
Apple
App Store distribution and billing, Sign in with Apple and push notifications. Apple Health data itself stays on your device.
Open-Meteo
The weather where you are. It receives your phone’s coordinates, rounded to roughly 10 km, and its IP address when Dia asks for the weather, and nothing that identifies you or anything about your health.
RevenueCat
Subscription state — whether your subscription is active. On iPhone, RevenueCat also collects an anonymous Apple Ads attribution token for every install, so we can check whether our ads worked. The token names no one, carries no advertising identifier, and needs no tracking permission. No health data.
PostHog
Product analytics for the app, tied to your account’s random identifier and never to your name, email or health data, and cookieless analytics for this website.
Google (Firebase)
Anonymous install, sign-up and purchase counts, so we can tell whether a campaign reached anyone. Advertising use is switched off in the app’s code. No health data.
Sentry
Crash and error reports.
Resend
Sends the waitlist confirmation email. Website only.

We are based in the United States and these services process data there. If you are in the UK or EU, that transfer relies on the Standard Contractual Clauses in each provider’s data-processing agreement.

We will also disclose data if the law genuinely requires it. If that ever happens and we are permitted to tell you, we will.

How long we keep it

Your logs, states and insights stay until you delete them or delete your account. Deleting your account removes your data from our database immediately and from our backups within 30 days. Crash reports and analytics events age out within 12 months.

Waitlist addresses are kept until Dia is ready for you and you have either joined or unsubscribed. If you never confirmed, we keep the row rather than deleting it — plenty of real people never click a confirmation link — but we treat unconfirmed addresses with more caution, not less.

Your rights, and how to actually use them

You have the right to see your data, correct it, export it, delete it, restrict or object to how we use it, and to withdraw consent. Two of those are buttons rather than requests, because waiting on a support queue to get your own medical history is not a real right:

Both of these stay available regardless of whether you are subscribed. For anything else, write to support@diaapp.co and we will respond within 30 days. If you are in the UK or EU you can also complain to your data protection authority; in the UK that is the ICO.

Security

Data is encrypted in transit and at rest. Every table in our database enforces row-level security, so one account cannot read another’s rows even if something else goes wrong. CGM credentials, if you connect a sensor directly, are stored in the iOS Keychain and never in our database. No system is perfect; if we ever suffer a breach affecting your data we will tell you and the relevant regulator within 72 hours of becoming aware.

Children

Dia is for adults — you must be 18 or older to use it. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

If we change something material — a new processor, a new category of data, a different use for what we already have — we will tell you in the app before it takes effect, not by quietly editing this page. The date at the top always reflects the current version.

Contact

support@diaapp.co. A person reads it.