Privacy policy and consumer health data

Last updated 24 October 2026

Who we are

Glucoray (thaliscan.glucoray.com) is run by Gheware UniGPS Solutions LLP, India ("we"). Questions or requests about your data: [email protected].

Health data and other data we collect

We collect health data only after you agree to it on the consent screen.

• Account: your email address (for sign-in codes) and the name you give us. If you use Glucoray on WhatsApp, your WhatsApp number instead of an email.
• Health profile (consumer health data): what you're managing (for example type 2 diabetes, prediabetes or gestational diabetes, or that you're a caregiver), your daily carb target and, if you add it, your HbA1c.
• Meals (consumer health data): the dishes and portions you confirm, when you ate, and the carbs, fibre, calories and ratings we calculate from our nutrition tables. We also keep a record of each scan: when it happened and the dishes we suggested.
• Meal photos: read in memory to recognise the dishes, then discarded. They are never written to disk, a database or a log, and never shared.
• Clinic sharing: which clinics you share with and when, notes your dietitian writes on your meals, and a log of every time clinic staff open your data.
• Payments: your plan, amount, currency and order numbers. Card, UPI and PayPal details go straight to the payment provider and never reach us. The phone number Cashfree asks for is passed on, not stored.
• Technical: a sign-in cookie (needed for the app to work), your timezone, and standard server logs (such as IP address and browser) used to keep the service secure and working.
• Where you came from: if you arrived through one of our own ad or post links, the campaign tags in that link (its "utm" tags: source, medium, campaign, ad name), saved once when you create your account, so we can tell which campaigns work. It stays with us and is in your data export.
• Visits to our public pages: when you open the home, sample-scan or sign-in page without being signed in, we add one to a daily count for that page and campaign. The count holds nothing about you: no IP address, browser or account.

This data comes from you, and notes come from a dietitian at a clinic you chose to share with.

How we use it

• To recognise your meals, calculate carbs, rate meals against your target and show your history and trends.
• To let a clinic you invited follow your meals and leave notes.
• To run your account: sign-in, billing, security and support.
• To tell our own team about each new sign-up and each payment by email (your email, plan, amount and the campaign you came from; never health data), and when you save your first meal (when, not what you ate), so we can thank you and ask how it's going.
• Only if you opt in: to measure our ads (see "Meta" below). Never your health data.

To recognise dishes, we send your meal photo, with its location data removed, to an AI service (see "AI services" below). We send nothing else about you: no name, email or health details. We don't keep your photos, and we don't use them to train models.

Trying a scan without an account (on our sample page): the photo is read the same way and not stored, and the result stays in your browser until you sign up and save it. We keep only a keyed hash of your internet address and the time, to limit free tries, and delete them after about two days.

Feedback and quotes: after you save a meal we may ask how it went. Feedback is optional: a star rating and, if you like, a few words. Your rating and words are emailed to our team with your email address and the campaign you came from, so we can read and reply. Your words appear on our website only if you tick the box to allow it, with the name and city you choose, and only after we approve them; we never edit them. You can withdraw a quote at any time in Settings → Feedback and your quote, by sending again with the box unticked. Deleting your account deletes your feedback.

Using Glucoray on WhatsApp (Indian +91 numbers): your messages and meal photos travel through WhatsApp, which is run by Meta. We read each photo in memory the same way and don't store it, but Meta may keep media sent through its WhatsApp Business Cloud API for up to 30 days under its terms. Your WhatsApp number is your account; we show it masked (for example +91 •••• ••215) and never write it to our logs. If you don't agree to our terms on WhatsApp, we keep only your number, for up to 7 days, and then erase it. We only ever reply to messages you send; we don't send reminders or marketing. Typed messages are never sent to an AI service. To delete your account and meals, send delete to Glucoray on WhatsApp and confirm, or use Settings → Delete my account on the web.

Who we share it with

We don't sell personal data, including health data. We share only what each service needs:

• Clinics you choose: your name and email, your condition, carb target and HbA1c, the meals you ate since you accepted (with their carbs), and your trends. Only while you share; you can stop at any time in Settings → Sharing.
• AI services: your meal photo, and the dishes on it with possible matches from our food table, go to Anthropic (USA). If Anthropic is unavailable, they go to DeepInfra (USA) instead, or to the AI model we run on our own servers in India. These companies process the photo only to answer our request. Under their terms they don't train models on it, though they may keep it for a short time, for example to check for abuse.
• An AI assistant you connect (Claude, ChatGPT): only if you choose to connect one, from its own app. It then receives your meals with their carbs and your daily carb target, and the estimates it asks us for. That company's privacy terms apply to what it receives. If you allow it, it can also save a meal after you say yes to its estimate; it can't edit or delete meals. Your photo stays with the assistant: we never receive it. We email you when an assistant is connected, and you can revoke it at any time in Settings → Connected assistants, which ends its access at once.
• Cloudflare: carries traffic between your browser and our servers.
• Meta (WhatsApp), only if you use Glucoray on WhatsApp: carries your messages, photos and our replies (see above).
• Amazon Web Services (SES): sends your sign-in code, and alerts to our own team (your email, where you came from, and any feedback you write).
• Cashfree Payments (payments in rupees): the amount, your email and your phone number. PayPal (payments in US dollars): the amount and our order number. You sign in to PayPal yourself.
• Google Fonts: serves the app's fonts, so Google sees your IP address when the page loads.
• Meta (Facebook): our public pages (home, sample scan and sign-in) tell Meta that the page was visited, to measure our ads. Inside the app, nothing is sent unless you opt in to "Help measure our ads". If you do, Meta is told when you sign up, open the upgrade page, start a checkout or buy a plan, with the price. That tells Meta you use Glucoray, but never your meals, condition, targets or any other health details. You can switch it off in Settings at any time.
• The law: if we are legally required to, for example by a court order.

Where it's stored and for how long

Your data is stored on our servers in India. If you use Glucoray from outside India, your data is transferred to India. Meal photos are processed by our AI services (see above), usually in the USA, and are not stored by us. We keep it until you delete your account. Deleting removes it from our live database at once. Nightly backups are deleted after about two weeks, so a deleted account is fully gone within 16 days. Two things stay: payment records, without your name or email, because tax law requires them; and, if you ever started a clinic trial, a one-way keyed code made from your email (not the email itself), so the free clinic trial can't be claimed twice.

Your rights and choices

• See and download all your data: Settings → Download my data.
• Correct your profile and meals in the app.
• Delete your account and data: Settings → Delete my account.
• Withdraw consent to health data: delete your account, as Glucoray can't work without it.
• Stop sharing with a clinic: Settings → Sharing.
• Turn off ad measurement: Settings → Help measure our ads.
• Ask us which third parties received your data, or anything else, at [email protected].

Residents of Washington, Nevada, Connecticut and other US states with health-data laws: you have the rights above, including to confirm whether we collect, share or sell your consumer health data, to access it, to get the list of third parties and affiliates that received it, to delete it, and to withdraw consent. We answer within 45 days. If we decline a request, you can appeal by replying to our answer and we will reply within 45 days. If you're still not satisfied, you can contact your state Attorney General. We won't treat you differently for using these rights.

Users in India: you have the rights in the Digital Personal Data Protection Act, 2023, including access, correction, erasure and nominating someone to act for you, and you can raise a grievance with us at [email protected].

Security

Traffic is encrypted. Sign-in codes and session tokens are stored only as hashes. Every query is limited to your own data, and clinic access is checked against your consent each time.

Children

Glucoray isn't intended for children under 13, and we don't knowingly collect their data.

Changes

If we change how we collect or share health data, we'll tell you in the app and ask for your consent again before the change applies to you.

Glucoray gives estimates, not medical advice. Talk to your doctor or dietitian before changing your diet or treatment.