Only what you enter
Profile, readings, weight, meals, medicines and questions. We never ask for your location, contacts or anything else. Nothing extra is collected.
How your data is protected
Health data is the most sensitive data there is. Here is, in plain words, how we keep it.
Encryption
Your name, surname, date of birth, email, emergency contact and all health data are encrypted in the database with AES-256-GCM. The key is not in the database — it lives in a separate protected server setting. Even a stolen database cannot be read.
HTTPS only
All traffic between your phone and the server is encrypted. The database cannot be reached directly from the internet.
Safe sign-in without passwords
The 6-digit code is valid for 10 minutes, works once and is cancelled after 5 wrong attempts. Codes are stored hashed, never in plain text. Your device is remembered for 30 days after sign-in; you can sign out at any time, including on all other devices.
Who sees what
The server checks every request: you see only your own data, a family member only the parts you allow, a doctor only the report through a time-limited link.
AI and privacy
Your name, surname, email, exact date of birth, phone and emergency contact are never sent to the AI. Only your question, the needed readings and general facts: age, sex, BMI, diabetes type, activity. Photos are not stored.
Audit log
Sign-ins, exports, deletions and granting or removing access are recorded. In settings you can see your recent sign-ins and actions.
You are in control
At any time you can download everything as JSON and PDF. If you delete your account, everything is truly removed from the database.
Server protection
The server accepts only SSH keys; password and root logins are disabled. Only ports 22, 80 and 443 are open, fail2ban blocks attacks and the system is updated regularly. The database is backed up daily, encrypted.
Laws and principles
We follow GDPR and HIPAA principles (minimisation, purpose limitation, consent, user control, access restriction, encryption, audit) and Uzbekistan’s Law “On Personal Data”. The law requires personal data of Uzbek citizens to be stored on servers inside Uzbekistan — before full launch we plan to move the server to a data centre in Uzbekistan.
Ethics
GlycoNest never presents itself as a doctor, never diagnoses and never changes treatment. The emergency section uses no AI. Your data is never sold, never used for ads and never shown to anyone without your consent.