Privacy Policy

1. Introduction

Welcome to Steady1 ("Steady1," "we," "us," or "our"). Steady1 is owned and operated by Steady Connect Technologies Limited, a company incorporated in Malta.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you:

• Visit the Steady1 website at steady1.app (the "Website");
• Use the Steady1 mobile application available on the Apple App Store and Google Play Store (the "App"); or
• Participate in any surveys or research activities hosted on the Website (the "Survey").

Together, the Website, App, and Survey are referred to as the "Services."

In this Privacy Policy, "personal data" means information relating to you as an identified or identifiable person that we collect through the Services. We collect only the personal data that is essential for the Services to function, together with any information you choose to give us (for example, Survey answers). All of it is listed in Section 4. We do not sell personal data to third parties.

The Services are available in the European Union ("EU"), the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, the United States, Canada, Australia, New Zealand and India. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and the ePrivacy Directive (Directive 2002/58/EC) as implemented in relevant member states, and with the privacy laws that apply where you live, including the Swiss Federal Act on Data Protection, US state privacy and consumer health data laws, Canada's PIPEDA and Quebec's Law 25, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020 and India's Digital Personal Data Protection Act 2023. Section 14 describes the rights you have in your country.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Important Disclaimer

Steady1 is a personal diabetes management companion and diary application. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Use of the App does not create a doctor–patient relationship. Always consult your healthcare provider for decisions about your diabetes care.

Steady1 is not an alarm or real-time monitoring system. Data and notifications, including those sent to carers, can be delayed by several hours depending on how your continuous glucose monitor (CGM) syncs with Apple Health or Health Connect. Always rely on your CGM's own alerts and alarms.

3. Data Controller

For the purposes of the GDPR, the data controller is:

Steady Connect Technologies Limited
A company incorporated in Malta
Email: hello@steady1.app

4. Personal Data We Collect

This section lists all the personal data (as defined in Section 1) that we collect.

4.1 Account and Profile Information

• Email address (provided during sign-up via email OTP, Apple Sign In, or Google Sign In);
• Name (first and last, provided during onboarding or from your Apple/Google account);
• Country of residence;
• Diabetes type, CGM device, insulin pump, and insulin brands;
• Body measurements (height, weight);
• Nutrition targets (carbohydrate, protein, fat goals);
• Preferred glucose unit (mmol/L or mg/dL) and language preference.

Country of residence and diabetes type are stored on our servers. Diabetes type is used, with the consent you give during onboarding, to produce anonymous, aggregated statistics (see Section 6.7).

4.2 Health Data

With your explicit permission, the App reads and writes health data through Apple HealthKit (iOS) or Health Connect (Android), including:

• Blood glucose readings;
• Exercise and workout data;
• Nutrition data (carbohydrates, protein, fat, calories);
• Workout distance (iOS only).

Health data constitutes "special category data" under Article 9 of the GDPR. We process this data only with your explicit consent and solely for the purpose of providing the App's health tracking and management features.

Health summary on our servers: so that carers you invite can see your data as soon as they join, the App keeps a copy of your latest health summary on our servers: today's glucose readings, nutrition, activity, medicine stock, upcoming trips and appointments, and monthly markers. Each update is also kept in a history that is deleted automatically after 90 days. Carers only see the data allowed by the sharing level you choose. Your full HealthKit or Health Connect history stays on your device.

4.3 Carer and Circle Data

If you use the My Circle feature, we process:

• Carer invite codes and email addresses;
• The sharing level you choose for each carer (glucose, activity, nutrition, appointments or all data);
• Notifications sent to carers (for example, new data alerts and "I'm handling it" messages) and their history;
• Push notification tokens for the devices that receive these notifications.

Relevant contacts: the names and phone numbers you add as relevant contacts are stored only on your device. When you notify them, the App opens a text message in your phone's messaging app, which you send yourself. Please make sure your contacts agree to being added.

4.4 Subscription and Payment Data

Subscription purchases are processed entirely by Apple (App Store) or Google (Google Play). We do not collect or store your payment card details, bank account information, or billing address.

We receive and store:

• Purchase tokens and product identifiers (to verify your subscription status);
• Subscription status (active, expired, cancelled) and expiry dates;
• Subscription lifecycle events (new subscription or renewal) to monitor growth and retention;
• The date your free month started (to calculate when it ends).

4.5 Appointment, Supply, and Travel Data

• Appointment records (type, date, time, notes) that you create within the App;
• Medicine and supply stock records (names, quantities, expiry dates);
• Travel trip details (destination, dates, supplies needed).

This data is stored on your device. Medicine stock and upcoming trips and appointments are also included in the health summary kept on our servers (see Section 4.2). Other details are only sent when you share them, for example in a PDF report.

4.6 In-App Usage Analytics

We collect anonymised, aggregated counts of which App sections are used each week. No user identifier is associated with these counts.

4.7 Survey Data

• Demographic information (e.g., age range, gender, country);
• Health-related information about diabetes, treatment experiences, and lifestyle;
• Any additional information you voluntarily provide in free-text responses.

4.8 Automatically Collected Information

• IP address;
• Browser type and version;
• Device type and operating system;
• Referring URLs;
• Pages viewed and time spent on the Website;
• Date and time of access;
• Cookie identifiers and similar tracking data (Website only).

4.9 Authentication Tokens

We store authentication tokens (access tokens and refresh tokens) securely on your device using the iOS Keychain or Android secure storage. These tokens are used to maintain your signed-in session and are not shared with third parties.

4.10 Location (Travel Features)

When you tap "Find nearby", the App uses your device's location, or an address you type, to find the nearest emergency department, pharmacy and grocery store. Your coordinates are sent through our server to a location search provider to perform the search. Addresses you type are looked up with an open map data service. We do not store your location on our servers, and we do not use geofencing around health care facilities.

5. How We Collect Personal Data

• Directly from you when you create an account, complete onboarding, log health data, create appointments, manage supplies, or complete the Survey;
• From Apple HealthKit or Health Connect with your explicit permission, to read and display your health data within the App;
• From Apple or Google during sign-in (name and email from Apple Sign In or Google Sign In);
• From Apple App Store or Google Play (subscription purchase verification data);
• Automatically within the App, through anonymised usage counters;
• Automatically through cookies and analytics tools on the Website.

6. Purposes of Processing and Legal Bases

6.1 To Provide the App's Core Features

Purpose: To display your health data, track supplies, manage appointments, generate reports, facilitate carer sharing, and provide travel planning features.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR) — providing you with the service you signed up for.

6.2 To Process Health Data (Special Category)

Purpose: To read, display, and manage your health data (blood glucose, nutrition, exercise) within the App.

Legal Basis: Your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the consent box during onboarding and by approving health data permissions in Apple HealthKit or Health Connect. Users in India: this processing is based on your consent under the Digital Personal Data Protection Act 2023.

You may withdraw your consent at any time. Revoking the App's access to Apple HealthKit or Health Connect in your device settings stops the App from reading new data, but does not delete data already on our servers. To have that data deleted, delete your account (Account > Delete Account) or email hello@steady1.app. Withdrawal will not affect the lawfulness of processing prior to withdrawal.

6.3 To Manage Your Account and Authentication

Purpose: To create and maintain your account, verify your identity via email OTP, Apple Sign In, or Google Sign In, and manage two-factor authentication.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).

6.4 To Process Subscriptions

Purpose: To verify your subscription status and grant access to the App's features.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).

6.5 To Send Transactional Communications

Purpose: To send OTP verification emails, carer invitation emails, and carer notification emails related to the My Circle feature.

Legal Basis: Performance of a contract (Article 6(1)(b) GDPR).

6.6 To Administer and Analyse the Survey

Purpose: To collect, review, and analyse survey responses relating to diabetes and related health experiences.

Legal Basis: Your consent (Article 6(1)(a) GDPR). For health-related survey data: your explicit consent (Article 9(2)(a) GDPR).

6.7 To Understand App Usage and Improve the Services

Purpose: To monitor which App features are used, track subscription growth and retention, and produce anonymous, aggregated statistics about our users (for example, by country and diabetes type).

Legal Basis: Legitimate interests (Article 6(1)(f) GDPR) for anonymous usage counts and subscription statistics. For statistics based on your diabetes type: your explicit consent (Article 9(2)(a) GDPR), given during onboarding.

6.8 To Operate, Secure, and Improve the Services

Purpose: To maintain functionality, monitor usage, detect and prevent fraud, and ensure security.

Legal Basis: Legitimate interests (Article 6(1)(f) GDPR), specifically our interest in operating secure and effective services.

6.9 To Comply with Legal Obligations

Legal Basis: Compliance with a legal obligation (Article 6(1)(c) GDPR), where applicable.

7. Data Sharing and Processors

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

We do not use health data accessed through Apple HealthKit or Health Connect for advertising, marketing, or data mining purposes.

7.1 Service Providers and Third Parties

We use the following service providers (processors) to operate the Services:

• Cloud hosting, database and infrastructure providers — to host and operate our backend and store account information, subscription information, and data used to provide the Services;
• Email delivery provider — to send transactional emails such as OTP codes, invitations, reports and service-related notifications;
• Push notification services — to deliver notifications to carers' devices;
• Website hosting and e-commerce platform — to host the Website;
• Survey and data-storage providers — to collect and store survey responses submitted through the Website.

These providers process personal data on our behalf under contractual terms that include data protection obligations consistent with Article 28 GDPR.

Some features of the App can only work through third-party services, in particular those provided by Apple and Google. When you use these features, the data needed for them to work is processed by these providers under their own terms and conditions and privacy policies:

• App stores — to process and verify subscriptions and in-app purchases;
• Sign-in providers — if you choose Apple Sign In or Google Sign In;
• A location search provider and an open map data service — to find places near you and look up addresses for the Travel feature (see Section 4.10).

7.2 Carer Data Sharing

If you use the My Circle feature, you choose to share specific health data with the carers you invite. You control what data is shared through the sharing level setting (glucose, activity, nutrition, appointments or all data). Carers can only see the data you have chosen to share.

7.3 PDF Reports

When you generate a health report, the PDF is created on your device. If you choose to email the report to your healthcare team, the email is sent via our backend using our email delivery provider. The report content is not stored on our servers after delivery.

7.4 Legal Requirements

We may disclose personal data if required to do so by law or in response to lawful requests by public authorities.

8. International Data Transfers

Our servers are located in Europe. If you use the Services from outside the EU, the personal data needed for the Services to function (see Sections 1 and 4) is transferred to and stored in the EU.

Some service providers and third parties process data in the United States. Where data leaves the EU/EEA, we rely on adequacy decisions (including the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework for data from Switzerland, where the recipient is certified) or the European Commission's Standard Contractual Clauses.

Data protection laws in these countries may differ from those in your country, but we protect your data as described in this Privacy Policy wherever it is processed.

9. Apple HealthKit and Health Connect

The App integrates with Apple HealthKit (iOS) and Health Connect (Android) to read and write health data. The following rules apply:

• Health data is accessed only with your explicit permission, granted through the operating system's standard permission dialogs;
• Health data is used solely to provide the App's health tracking and display features;
• Health data is not used for advertising, marketing, data brokerage, or sold to third parties;
• Health data is not shared with third parties except as described in Section 7 (carer sharing you initiate, or PDF reports you choose to send);
• Your full health history stays on your device. A health summary is kept on our servers to provide the carer features, as described in Section 4.2;
• You can revoke the App's access to health data at any time through your device settings (iOS: Settings > Health > Data Access; Android: Settings > Health Connect > App permissions).

10. Cookies and Similar Technologies

On the Website, we may use cookies and similar technologies that are:

• Strictly necessary for the operation and security of the Website; and
• Used for basic analytics, where applicable.

Where required under EU, EEA, or UK law, we will obtain your consent before placing non-essential cookies on your device.

The App does not use cookies. The App stores preferences and cached data locally on your device using SharedPreferences and secure storage.

You can manage cookies through your browser settings.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy:

• Account data — retained for the duration of your account. Deleted upon account deletion request;
• Authentication tokens — refresh tokens expire after 60 days of inactivity;
• Subscription records — retained for the duration of the subscription plus any legally required retention period;
• Health summary (see Section 4.2) — the latest summary is retained while your account exists; the history of summaries is deleted automatically after 90 days. Both are deleted when you delete your account;
• OTP codes — automatically expire and are deleted after 10 minutes;
• Consent records (disclaimer acceptance, GDPR consent) — retained as required for legal compliance;
• Analytics data (aggregated usage counters and subscription lifecycle events) — retained for business analysis purposes;
• Survey data — retained for research and analysis purposes, or until you request deletion;
• Locally stored data (appointments, supplies, travel, preferences) — stored on your device only. Deleted when you uninstall the App or clear App data.

12. Data Security

We implement appropriate technical and organisational measures designed to protect your personal data against unauthorised access, alteration, disclosure, loss, destruction, or other unlawful or unauthorised processing.

Depending on the nature and risks of the processing, these measures include encryption of data in transit, secure storage of authentication credentials and tokens, access controls, authentication and authorisation mechanisms, and measures designed to maintain the confidentiality, integrity, availability, and resilience of our systems.

13. Data Breaches

If a security breach affects your personal data, we will notify you and the relevant authorities where required by law, including under the GDPR and the US Federal Trade Commission's Health Breach Notification Rule.

14. Your Privacy Rights

Depending on where you live, the law gives you some or all of the following rights. Where a right applies to you, we will honour it.

• Access — to know whether we hold your personal data and to receive a copy or summary of it, including, where applicable, the third parties it was shared with;
• Correction — to correct, complete or update inaccurate or incomplete data;
• Deletion — to have your personal data erased. You can delete your account directly in the App (Account > Delete Account);
• Portability — to receive your data in a structured, commonly used format;
• Restriction and objection — to restrict our processing, or to object to processing based on legitimate interests (EU, EEA, UK and Switzerland);
• Withdraw consent — at any time, where processing is based on consent (see Section 6.2). This does not affect processing carried out before you withdrew;
• Opt out of the sale of personal data, targeted advertising and profiling with legal or similarly significant effects. We do none of these;
• Nominate another person to exercise your rights if you die or become incapacitated (India).

Residents of Washington, Nevada and other US states with consumer health data laws should also read our Consumer Health Data Notice.

14.1 How to Exercise Your Rights

Email hello@steady1.app. We will respond within 30 days and may ask for information to verify your identity before doing so. Where the law allows, an authorised agent may make a request on your behalf, with proof of your authorisation. We will not discriminate against you for exercising your rights.

14.2 Appeals and Complaints

If you are not satisfied with our answer, reply to it with the subject "Privacy appeal" and we will review your request again. You can also complain to the data protection authority where you live:

• EU / EEA: your local supervisory authority (listed at edpb.europa.eu). Our lead authority is the Information and Data Protection Commissioner of Malta (idpc.org.mt);
• United Kingdom: Information Commissioner's Office (ico.org.uk);
• Switzerland: Federal Data Protection and Information Commissioner (edoeb.admin.ch);
• United States: the Attorney General of your state;
• Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca);
• Australia: Office of the Australian Information Commissioner (oaic.gov.au);
• New Zealand: Office of the Privacy Commissioner (privacy.org.nz);
• India: the Data Protection Board of India, after you have used our grievance process above.

15. Account Deletion

You can request deletion of your account and associated data at any time through the App (Account > Delete Account) or by emailing hello@steady1.app.

Upon deletion:

• Your account data, health summary and history, authentication tokens, and carer links are permanently deleted from our servers within 30 days of your request;
• Subscription records may be retained as required by Apple or Google's terms and applicable law;
• Locally stored data on your device is cleared;
• Health data in Apple HealthKit or Health Connect is not affected (managed by your device's operating system).

16. Children's Privacy

The Services are not intended for unsupervised use by minors under 18 years of age. Minors may only use the Services under the supervision of a parent, legal guardian, or authorised carer who accepts this Privacy Policy on their behalf.

If you believe that a minor has provided us with personal data without appropriate consent, please contact hello@steady1.app.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above.

Material changes will be communicated by updating this page and, where appropriate, through in-app notification. Where the law requires it, for example if we want to use your health data for a new purpose, we will ask for your consent again.

18. Contact Information

By using the Services, you acknowledge that you have read and understood this Privacy Policy.