PRIVACY POLICY

Effective Date: September 9, 2026

Thank you for visiting the Glurry website located at https://glurry.app (the “Website”). This Privacy Policy explains how Rx Studio OÜ (“Rx Studio,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when you access or use the Website, the Glurry mobile application (the “Glurry App”), the Glurry Dashboard, and related services (collectively, the “Products”).

We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), HIPAA, CCPA/CPRA, and PIPEDA, where applicable. This Privacy Policy does not limit any rights you may have under mandatory applicable law.

1. INTRODUCTION

1.1 Data Controller

Rx Studio is the data controller and determines the purposes and means of processing personal data.

We may provide additional, contextual privacy information within the Products. Such information supplements, and does not override, this Privacy Policy.

This Privacy Policy is accessible at all times via the Website and within the Products. Use of the Products is also governed by our Terms and Conditions at https://glurry.app/terms.

2. SCOPE AND LEGAL BASES

The Products are intended for persons with diabetes. Use of the Products may inherently involve health-related data.

We process personal data only where a valid legal basis exists, including performance of a contract, explicit user consent, legitimate interests, and compliance with legal and regulatory obligations.

We obtain your explicit consent in the Glurry App before processing health data. Health data is special category data under the GDPR, and we process it on the basis of your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time by deleting your account in the Glurry App, through our contact form at https://glurry.app/contact-us, or by emailing privacy@glurry.app. Providing health data is voluntary, but the Products cannot work without it. Withdrawal does not affect processing carried out before it.

Where we rely on legitimate interests, these are keeping the Products secure, preventing abuse, fixing errors, and improving the Products (other than optional analytics, which relies on consent). We rely on them only where they are not overridden by your rights and freedoms, and you may object at any time (see Section 10).

3. CATEGORIES OF PERSONAL DATA

3.1 Account and Authentication Data

We process data required to create, authenticate, and manage user accounts, including your name, email address, and country, as well as system-generated user identifiers, account status, and authentication-related information.

Users may authenticate using secure authentication methods, including standard credentials, federated identity providers, or government-backed electronic identity solutions, depending on availability and user choice.

Authentication data is protected using industry-standard security mechanisms and is not stored in plain text.

3.2 Contact and Communication Data

When users interact with us through contact forms, feedback channels, or support communications, we may process contact and communication data voluntarily provided by the user, such as contact details, message content, and attachments.

3.3 Technical and Device Data

To operate, secure, and maintain the Products, we process technical data including device characteristics, operating system and application version, language, country, time zone, and technical signals necessary for functionality and security.

3.4 Health and Medical Data

Depending on user configuration, connected services, and granted permissions, we process health and medical data including, but not limited to:

• Blood glucose measurements and related timestamps
• Continuous glucose monitoring data
• Insulin and other medication data, including timing, type, and dosage
• Data from connected insulin delivery devices and smart insulin pens
• Physiological, activity, and sensor-derived health data, including physical activity, sleep, heart rate, and related metrics
• Nutrition and lifestyle data, including meals and associated media such as photos
• Optional profile information you provide, including demographic details (such as sex and date of birth), body measurements (height and weight), physical activity level, health conditions (such as diabetes type, date of diagnosis, treatment, and glucose monitoring method), and personal goals (such as nutrition targets and glucose target ranges)
• Other health-related data made available through connected devices, health platforms, or applications, as authorized by the user

Data read from Apple Health or Google Health Connect is kept on your device and is not stored on our servers. It may be sent to AI features as context to generate a response.

Data we obtain from Apple HealthKit and Google Health Connect is used only to provide user-facing health and wellness features in the Glurry App. It is not used for advertising or marketing, is not sold, is not used to assess creditworthiness or insurance eligibility, and is shared with third parties (such as AI providers) only with your consent and as needed to provide those features. Our use of information received from Health Connect adheres to the Google Play User Data Policy, including the Limited Use requirements.

3.5 Third-Party Integration and Authorization Data

To enable integrations with external devices, platforms, and services, we process authorization and access information such as tokens or credentials generated through industry-standard authorization protocols.

Such data is stored securely, used solely to provide the requested integration functionality, and is not used for unrelated purposes. If an integration requires your account credentials, the credentials you enter are stored only in your device’s secure storage and sent directly to that service. They are not sent to or stored on Rx Studio’s servers.

3.6 Analytics and Similar Technologies

Usage analytics and error reporting in the Glurry App are optional and used only with your consent, which you can change at any time in the Glurry App. Analytics events are linked to a pseudonymous user identifier, not your name or email address, and error reports may contain technical context. Analytics events and error reports are designed not to include your health data. The Website does not use advertising cookies or analytics. It stores an anonymous session identifier and uses abuse-prevention technology, which may be provided by a third party and may process your IP address and browser signals, to protect its forms.

4. PURPOSES OF PROCESSING

• Providing, operating, and maintaining the Products
• Creating and managing user accounts
• Importing, storing, and displaying health and device data at the user’s request
• Generating summaries, visualizations, and insights
• Supporting self-management and behavior-related features
• Ensuring product safety, quality, and reliability
• Providing customer support and responding to inquiries
• Complying with legal and regulatory obligations
• Conducting analysis and research using anonymized or aggregated data (or with your explicit consent) to improve the Products, where legally permitted
• Sending marketing or informational communications, where explicit consent has been provided

The legal basis for these purposes is, as applicable: performance of a contract (operating the Products, accounts, subscriptions, and support); explicit consent (health data, optional analytics, and marketing); legitimate interests (security, quality, and reliability); and legal obligation (regulatory and accounting requirements).

5. AI-BASED AND ALGORITHMIC ANALYSIS

The Products use artificial intelligence, statistical, and algorithmic methods to analyze user-provided and connected health data.

AI-based outputs are informational and supportive in nature, do not constitute medical advice, do not replace professional judgment, and are not used to make autonomous medical or therapeutic decisions.

AI features may be provided by third-party providers, to whom we send the content you submit together with relevant health and profile information in order to generate a response. These providers are not permitted to use your data to train their models. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

6. DATA SHARING AND PROCESSORS

We may share personal data with trusted service providers acting on our instructions, including providers of cloud hosting and storage (to store your data), security services, artificial intelligence services (to analyze meals and generate insights and chat responses), analytics tools (usage analytics, only with your consent), subscription management (to process Glurry Plus purchases), and customer support and email delivery (to handle your requests). We do not sell personal data.

Such providers are contractually bound to confidentiality and data protection obligations.

7. DATA STORAGE AND INTERNATIONAL TRANSFERS

Personal data is stored on secure servers located in the European Union. Some service providers, including artificial intelligence and subscription providers, may process data outside the EU/EEA. Where data is transferred outside the EU/EEA, appropriate safeguards, such as an adequacy decision or Standard Contractual Clauses, are applied in accordance with applicable law. You can request a copy of the safeguards at privacy@glurry.app.

8. DATA RETENTION

Personal data is retained only for as long as necessary to provide the Products, comply with legal obligations, or resolve disputes. When no longer required, data is securely deleted or anonymized. In particular:

• Account, health, and nutrition data, including uploaded media, are retained while your account is active. When you delete your account, your account, personal identifiers, and uploaded media are deleted immediately, and your health and nutrition records are deleted by a scheduled process within thirty (30) days. We may keep aggregated data that does not identify you.
• Authentication tokens, which verify your sign-in, and integrity tokens, which verify that requests come from the genuine Products, are short-lived and expire automatically after one (1) hour. They are renewed while you use the Products.
• Third-party integration tokens are kept until you disconnect the integration or delete your account.
• Anonymous Website sessions, such as those used for the contact form, are deleted automatically after thirty (30) days.
• Optional analytics and error reports are retained for a limited period, up to one (1) year, and no new data is collected if you opt out.
• Support communications are retained for as long as needed to handle your request and any follow-up.
• Subscription and transaction records are retained as required by accounting and tax law.
• Backups are overwritten or deleted within ninety (90) days.

9. MINORS

The Products are intended for users aged sixteen (16) or older, unless parental or guardian consent has been obtained where required by law.

10. YOUR RIGHTS

Depending on your jurisdiction, you may have rights including access, correction, deletion, restriction, objection, and data portability.

You may also withdraw any consent at any time without affecting prior processing. Requests may be submitted to privacy@glurry.app. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee) or the supervisory authority in your country of residence. If you are a California resident or are located in Canada, you may have similar rights under the CCPA/CPRA and PIPEDA, including the rights to know, access, correct, and delete your personal information, to limit the use of sensitive personal information (which includes health data), and not to be discriminated against for exercising your rights. We do not sell or share personal information for advertising.

Deleting your account. You can delete your account at any time in the Glurry App under Settings, or request deletion through our contact form at https://glurry.app/contact-us or by emailing privacy@glurry.app. Deleting your account does not cancel an active subscription, which you must cancel in your Apple App Store or Google Play account settings.

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at privacy@glurry.app.

11. HIPAA BUSINESS ASSOCIATE PROVISIONS

Where the Products are provided through a healthcare provider or insurer acting as a HIPAA Covered Entity, Rx Studio acts as a Business Associate and processes data as Protected Health Information (PHI) in accordance with HIPAA and applicable agreements.

Where no Covered Entity relationship exists, data is processed under this Privacy Policy and applicable consumer privacy laws.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Updated versions are posted on this page with a new Effective Date. Where required by law, users will be notified and additional consent obtained.

THANK YOU FOR YOUR TRUST IN RX STUDIO AND GLURRY.