Privacy Policy

1. Who We Are and Our Two Roles

GlycoMatrix Pro ("GlycoMatrix", "we", "us") is a clinical food-exchange and diet-planning tool for dietitians and other health professionals, available at glycomatrixpro.com. This policy explains what we collect, why, who processes it, how long we keep it, and your choices.

You, the professional using GlycoMatrix (the "user"): for your account data, we decide how it is used, so we are responsible for it.

Your patients or clients: when you enter a patient's details, you decide what to enter and why. You are responsible for having a lawful basis and, where required, your patient's consent (for example under India's Digital Personal Data Protection Act, 2023, where you act as the Data Fiduciary). We store and process that data only to provide the service to you, on your instructions. We do not use patient data for advertising, analytics profiling or model training, and we do not sell it.

2. What We Collect

Account Data

• Your email address, and your password stored only as a one-way PBKDF2-SHA256 hash with a per-user salt. We never store the password itself.
• If you sign in with Google: your Google account identifier and email address (see section 4). We do not receive your Google password.
• Whether you registered as a practitioner.
• Saved templates: the names and plan settings (exchange grid, macro targets, meal count, guideline, meal slots and times) of templates you save. They contain no client or patient details, and are deleted with your account. Please do not put patient details in template names.
• Security records: IP addresses are used briefly in security counters (up to about an hour) to stop password-guessing and other abuse; counters for an email address use a one-way hash of it, never the address itself. Password-reset links are valid for 1 hour and can be used only once, and we store only a one-way hash of each reset token.
• Usage counters for fair-use limits, such as how many PDFs your account exported this hour and today.
• Feedback you send with the feedback card: your rating (Bad, Fine or Good), any comment you write, what opened the card (an export, a print, an occasional prompt or the footer link), the page and language you were using, the app version, the time, and your account ID if you are signed in. We do not store your IP address or any patient data with feedback; please do not put patient details in comments. To limit abuse, feedback is counted per network for one day with a one-way code made from a random value that is deleted after two days.

Patient (Client) Data You Enter

You may enter the following about your patients. This is health data, so please enter only what you need for care.

• Identity: name, date of birth, gender, preferred handout language.
• Health information: weight, height, activity level, fasting blood glucose, HbA1c, conditions you tick (such as diabetes, chronic kidney disease including dialysis status, hypertension, gout), and dietary filters (such as gluten-free or lactose-free).
• Plans: calorie and macronutrient targets, food-exchange grids, meal names and times, and the meal-plan (prescription) text, including any text you write yourself.
• Visit history: each time you save a profile, a dated copy of these details and the plan is kept so you can reload past visits.

Data Kept in Your Browser

• A copy of your client list and the plan you are working on, kept in your browser's local storage so the app works smoothly. Signing out removes it from that browser, and so does another account signing in on the same browser. If your session expires before unsaved changes reach our servers, those changes stay hidden on that browser until you sign in again with the same account (they are then saved), or are deleted if a different account signs in.
• Values passed from the calorie calculator to the dashboard; these are removed after use and are not sent to us.
• Preferences: theme, ruleset, PDF layout (sections and clinic name), whether you finished the tour, when the feedback card was last shown, and your cookie choice. Signing out keeps these.

Technical data: our hosting provider (Cloudflare) processes standard web-server data such as IP address, browser type and request times to deliver and protect the site. Our own logs record outcomes and errors; they are not used to record passwords or patient details.

3. Cookies, Analytics and Services Loaded on Every Page

• Essential cookies: a session cookie that keeps you signed in (for 7 days, or until you sign out), a companion cookie that tells the page you are signed in, and two short-lived cookies used only during Google sign-in. Your cookie choice and other preferences are kept in your browser's local storage, not in cookies.
• Google Analytics 4, only with your consent: it measures how the site is used, such as pages visited, device type and approximate location. It is not loaded and sets no cookies until you choose "Accept" in our cookie banner; if you choose "Decline", it is not loaded. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. Page addresses are sent without their query strings, Google Analytics never loads on the password-reset page, and we do not send patient data or plan content to it. Google processes analytics data under its own terms.
• Google Fonts, on every page: the site's fonts are loaded from Google's font service, so Google receives your IP address and browser details when a page loads. This does not depend on your cookie choice.
• Cloudflare Turnstile, on every page: an essential security check against bots, loaded from Cloudflare and used on the sign-in, registration and password forms. When you submit one of those forms, Cloudflare receives the check result and your IP address. Turnstile may store its own security data in your browser.
• Tutorial video: only if you open it, the video plays in YouTube's privacy-enhanced (youtube-nocookie.com) player.
• You can also block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in from working.

4. Sign in with Google

When you choose Sign in with Google, Google shares your Google account ID, email address, name and profile picture with us.

We store only your Google account ID and email address, to sign you in. We don't store your name or picture, and we don't access your contacts, files or any other Google data.

If your Google email matches an existing GlycoMatrix Pro account, the two are linked; for your security, password sign-in for that account is turned off and other devices are signed out. You can set a new password with Forgot password.

We don't sell or share this data, and use it only to provide sign-in. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

We keep this data while your account exists. To remove the link or delete your account, email support@glycomatrixpro.com.

5. How We Use Data

We use the data described above only:

• To provide the service: accounts, saving patients and plans, generating plans, printing and PDF export.
• To keep it secure: preventing abuse, password-guessing and spam.
• To send service emails: password-reset links and confirmations. We do not send marketing email without your consent.
• To improve the site using aggregated analytics, only if you accepted it (section 3).
• To meet legal obligations.

6. Sharing, Sending Plans and Service Providers

Print and PDF: when you download a PDF, the plan page is sent to Cloudflare's browser-rendering service to create the file. We do not store the page or the PDF; our logs keep only its size, and we keep a daily count of exports.

WhatsApp and Copy text: the plain-text plan is built in your browser. If you choose "Send on WhatsApp", your device opens WhatsApp with the text; we do not send it, store it, or see who you send it to. The app does not add your patient's name to the text; anything you typed into the plan is included as you wrote it. WhatsApp's own terms apply once you send it.

We never sell personal data. We share it only with the service providers below, or when required by law.

Our database is hosted by Cloudflare in the Asia-Pacific region (primary copy in Singapore). Our providers may also process data outside India, including in the United States and other countries where they operate.

Service providers (processors):

• Cloudflare, Inc.: hosting, database (D1), sessions (KV), security (Turnstile) and PDF rendering. Data involved: all data stored by the service.
• Resend: sending account emails. Data involved: your email address and the email content.
• Google LLC: Google sign-in (if you use it), Google Analytics (only with your consent) and Google Fonts. Data involved: your Google account identifier and email; analytics data (section 3); the IP address and browser details of font requests.

7. How Long We Keep Data

• Patient data and visit history: until you delete the patient. Deleting a patient deletes all of their saved visits.
• Account data: while your account exists. There is no self-service account deletion: to delete your account and all of its patients, email support@glycomatrixpro.com, and we will confirm deletion within 30 days.
• Sessions: 7 days, or until you sign out. Security counters: IP addresses are kept in them for up to about an hour.
• Password-reset links: valid for 1 hour and single-use; old reset records are deleted automatically later.
• Feedback: until it is no longer needed to improve the service, or sooner if you ask us to delete feedback linked to your account.
• Analytics, only if you accepted it: Google Analytics keeps event-level data for no longer than 14 months, the longest setting it offers; aggregated reports may be kept longer.
• Backups held by our hosting provider may keep data for up to 30 days after deletion.

8. Security

We use HTTPS everywhere, one-way hashing for passwords and reset tokens, ownership checks so each account can reach only its own patients, rate limits, and bot protection. No system is perfectly secure; please use a strong, unique password and sign out on shared devices.

9. Your Rights

Depending on where you live, you may have the right to access, correct, or delete your personal data, to withdraw consent, and to nominate someone to act for you. You can correct or delete patient data yourself at any time in the app, and change your cookie choice with "Cookie settings". For anything else, contact us at support@glycomatrixpro.com.

Patients who want to access or correct their data should contact their dietitian first, because the dietitian controls that record; we will help the dietitian respond.

10. Children

GlycoMatrix is for professionals and is not intended for children to use. Professionals may enter data about patients who are minors; they are responsible for obtaining consent from a parent or guardian where the law requires it.

11. Contact and Grievances

Questions, requests or complaints: GlycoMatrix Pro, support@glycomatrixpro.com. We aim to reply within 7 days and to resolve requests within 30 days.

If you are in India and are not satisfied with our response, you may approach the Data Protection Board of India.

12. Changes to This Policy

We will update this page when our practices change and change the "Last updated" date. If a change materially affects how patient data is handled, we will notify signed-in users in the app or by email.