Effective Date. 09/22/2026
Gluva Health ("Gluva," "we," "us," or "our") respects the privacy of individuals who use our website, technology platform, applications, coaching services, and related programs (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, safeguard, and otherwise process information in connection with the Services.
Gluva provides technology-enabled health and wellness tools designed to help individuals better understand information relating to their health, wellness, lifestyle, and glucose trends. Gluva's Services may include access to data generated by continuous glucose monitoring ("CGM") devices, health and wellness information, educational resources, coaching, and other tools made available through Gluva or participating employers, health plans, benefit programs, providers, or other organizations.
Contents
1. HIPAA and Protected Health Information
2. Information We May Collect
3. How We Use Information
4. Gluva Coaching and Health Information
5. When We May Disclose Information
6. We Do Not Sell PHI
7. Cookies, Analytics, and Online Technologies
8. Data Security
9. Data Retention
10. Your Privacy Rights
11. Employer Reporting and De-Identified Information
12. Children and Minors Privacy
13. Third-Party Services
14. Changes to This Privacy Policy
15. Contact Us
1. HIPAA and Protected Health Information
The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") apply to certain health care providers, health plans, health care clearinghouses, and their business associates.
Gluva does not act as a HIPAA-covered entity or business associate for every service it provides or every type of information it receives. Whether HIPAA applies depends on how you receive Gluva's Services and who provides the information.
In certain circumstances, Gluva provides Services to or on behalf of a health plan, health care provider, or other HIPAA-covered entity. When Gluva receives, creates, maintains, or transmits Protected Health Information ("PHI") as a business associate of a HIPAA-covered entity, Gluva uses and discloses that information in accordance with HIPAA, the applicable Business Associate Agreement, and the legal obligations of the covered entity.
Where HIPAA applies, Gluva maintains administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of PHI.
If you receive Gluva Services through a health plan, health care provider, or other HIPAA-covered entity, that entity's Notice of Privacy Practices describes how your PHI may be used and disclosed and the rights available to you under HIPAA.
Health information outside HIPAA. Some information you provide directly to Gluva, or choose to share from a consumer device or app, may not be PHI under HIPAA. Gluva protects that information under this Privacy Policy and applicable law, which may include the FTC Health Breach Notification Rule and state consumer health data privacy laws.
2. Information We May Collect
Depending upon the Services you use and the program through which you access them, Gluva may collect:
Personal and Account Information. Information such as your name, email address, telephone number, mailing address, date of birth, account credentials, employer or sponsoring organization, and other information used to establish or administer your account.
Health and Wellness Information. Information you provide concerning your health, wellness goals, diet, physical activity, sleep, medications, symptoms, medical history, or other health-related information.
CGM and Device Information. Glucose measurements, glucose trends, device information, sensor information, and other data obtained from a CGM device or related platform when you authorize or otherwise permit that information to be shared with Gluva.
Coaching and Program Information. Information relating to your participation in coaching, educational, wellness, or other Gluva programs, including communications with coaches and information voluntarily provided during those interactions.
Technical and Usage Information. Information concerning your browser, device, operating system, IP address, application usage, pages viewed, access times, referring URLs, and similar technical information.
Communications. Information you provide when you contact Gluva, request support, participate in surveys, submit forms, or otherwise communicate with us.
We may also receive information from organizations through which you receive Gluva Services, device manufacturers, technology providers, health plans, benefit administrators, health care providers, or other third parties when permitted by law and applicable agreements.
3. How We Use Information
Gluva may use information to:
- provide, operate, administer, and improve the Services;
- establish and maintain user accounts;
- display glucose information, trends, insights, and other information through the Services;
- provide coaching, educational information, and wellness support;
- personalize the user experience;
- communicate with users regarding their accounts or participation in a program;
- provide customer and technical support;
- communicate with sponsoring organizations or other authorized parties as permitted by applicable law and contract;
- maintain the security and integrity of the Services;
- detect, investigate, and prevent fraud, misuse, security incidents, or other unlawful activity;
- perform analytics and improve Gluva's technology, programs, and Services;
- comply with legal, regulatory, contractual, and reporting obligations; and
- use information for other purposes disclosed to you at the time it is collected or with your authorization.
When Gluva processes PHI as a HIPAA business associate, its use and disclosure of that information is additionally restricted by HIPAA and the applicable Business Associate Agreement.
4. Gluva Coaching and Health Information
Gluva's Services are intended to support health education, wellness, lifestyle management, and informed discussions concerning health.
Unless expressly identified otherwise, Gluva's Services and coaching are not medical care and are not intended to diagnose, treat, cure, or prevent any disease or medical condition.
Gluva coaches do not replace your physician or other qualified health care professional. Information provided through Gluva should not be used as a substitute for professional medical judgment, diagnosis, treatment, or consultation.
Users should consult an appropriate health care professional regarding medical conditions, medications, treatment decisions, interpretation of health information, and other questions requiring medical judgment.
5. When We May Disclose Information
Gluva does not disclose personal information except as described in this Privacy Policy, as authorized by you, or as otherwise permitted or required by law.
Information may be disclosed to:
Service Providers. Vendors that perform services on Gluva's behalf, including hosting, cloud infrastructure, security, communications, analytics, customer support, and technology services.
Program Sponsors and Authorized Organizations. Where you participate in Gluva through an employer, health plan, provider, benefit program, or other organization, Gluva may provide information to that organization as permitted by applicable law, authorization, and contractual arrangements. Gluva does not share your individually identifiable health information with your employer, as described in Section 11.
Health Care or Wellness Professionals. When authorized by you or otherwise permitted by law, information may be shared with health care professionals, coaches, dietitians, or other persons participating in the Services.
Technology and Device Partners. Gluva may exchange information with CGM manufacturers, application providers, API providers, and other technology partners as necessary to provide functionality you request or authorize.
Legal and Safety Purposes. Gluva may disclose information when reasonably necessary to comply with applicable law, regulation, subpoena, court order, or other lawful governmental request; establish or defend legal rights; investigate fraud or security incidents; or protect the rights, property, or safety of Gluva, its users, or others.
Business Transactions. Information may be transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable legal restrictions.
Where PHI is involved, disclosure will be subject to HIPAA whenever HIPAA applies.
6. We Do Not Sell PHI
Gluva does not sell PHI in violation of HIPAA.
Gluva does not use PHI for third-party advertising or marketing in a manner prohibited by HIPAA.
Where HIPAA requires an individual's authorization before PHI may be used or disclosed for a particular purpose, Gluva will use or disclose the information only as permitted by an appropriate authorization or another applicable provision of law.
7. Cookies, Analytics, and Online Technologies
Gluva's public website may use cookies and similar technologies to operate the website, remember user preferences, measure website performance, maintain security, and understand how visitors interact with the site.
Gluva does not intend for advertising or analytics technologies deployed on its public website to receive PHI.
Authenticated areas of the Gluva platform that contain or provide access to PHI may be subject to additional restrictions regarding tracking technologies and third-party data collection.
Users may be able to manage certain cookies through browser settings or other privacy controls made available by Gluva.
8. Data Security
Gluva uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, disclosure, or destruction.
When Gluva maintains electronic PHI subject to HIPAA, Gluva applies safeguards designed to comply with applicable requirements of the HIPAA Security Rule.
No information system can be guaranteed to be completely secure. Accordingly, Gluva cannot guarantee absolute security of information transmitted to or maintained through the Services.
9. Data Retention
Gluva retains information for as long as reasonably necessary to provide the Services, fulfill the purposes for which the information was collected, satisfy contractual requirements, comply with applicable legal and regulatory obligations, resolve disputes, enforce agreements, and maintain appropriate business records.
Retention periods may vary depending upon the nature of the information and the program through which Gluva provides Services.
10. Your Privacy Rights
Depending upon where you live, the type of information involved, how you receive Gluva Services, and applicable law, you may have rights regarding your personal information.
These rights may include the ability to request access to, correction of, or deletion of certain information or to request information concerning how certain information has been used or disclosed.
Where Gluva maintains PHI as a business associate, certain HIPAA rights may need to be exercised through the health plan, provider, or other covered entity responsible for the PHI. Gluva will cooperate with applicable covered entities as required by HIPAA and the governing Business Associate Agreement.
Requests regarding information maintained directly by Gluva may be submitted using the contact information provided in Section 15 (Contact Us).
11. Employer Reporting and De-Identified Information
Information shared with your employer. Gluva does not provide your employer with individually identifiable health information. Employers and plan sponsors receive reporting only in aggregate, de-identified form, and results are not reported for groups small enough that an individual could be identified. HIPAA prohibits plan sponsors from using PHI for employment-related decisions. If your employer offers an incentive for participating, Gluva may confirm whether you enrolled or completed program requirements, but not your health information.
Where permitted by applicable law and contract, Gluva may create or use information that has been aggregated or de-identified so that it does not reasonably identify an individual.
Gluva may use appropriately de-identified or aggregated information for purposes such as analytics, service improvement, research, benchmarking, program evaluation, and development of new products or services, subject to applicable contractual and legal restrictions.
Where information is de-identified pursuant to HIPAA, Gluva will apply the standards required by HIPAA.
Research. Gluva will not use information that identifies you for research purposes without your separate, express consent.
12. Children and Minors Privacy
Unless a particular Gluva program expressly provides otherwise, the Services are not directed to individuals under the age of 18.
Gluva does not knowingly collect personal information directly from individuals under 18 through the Services without appropriate authorization or consent where required by law.
Programs involving individuals under 18 may be subject to additional parental or guardian consent, authorization, and privacy requirements under applicable law.
13. Third-Party Services
The Services may contain links to or integrate with third-party websites, applications, devices, or services.
Gluva is not responsible for the privacy practices of independent third parties. Users should review the applicable privacy policies of those organizations before providing information to them.
14. Changes to This Privacy Policy
Gluva may update this Privacy Policy periodically to reflect changes to its Services, business practices, contractual obligations, or applicable law.
When we make material changes, we will update the effective date and provide additional notice when required by applicable law.
15. Contact Us
Questions concerning this Privacy Policy, Gluva's privacy practices, or requests concerning personal information may be directed to:
Gluva Health
Attn: Privacy Officer
Email: privacy@gluvahealth.com
For information maintained by Gluva Health on behalf of a health plan, health care provider, or other HIPAA-covered entity, you may also contact the applicable covered entity using the contact information provided in its Notice of Privacy Practices.