Privacy Policy

1. Who we are

Remira LLC (“Remira,” “we,” “us”) is a Delaware limited liability company. We make an iOS app for people managing Type 1 Diabetes and for the family members and caregivers who support them.

This policy covers the Remira mobile app and remira-ai.com.

Questions, requests, or complaints: support@remira-ai.com

For UK and EEA users, Remira LLC is the data controller.

2. What we collect

2a. Account information

Email address (or, if you use Sign in with Apple with Hide My Email, a relay address)
Your name, as you enter it during setup
Your role — whether you are the person with diabetes or a caregiver
Which family you belong to
Your date of birth. This one stays on your phone. We use it to determine whether you are 16 or older, which decides how the account gets set up. It is not sent to our servers.

We do not use passwords. You sign in with Apple or with a one-time code sent to your email.

People under 16 do not create their own account. Remira is installed on the young person’s phone, because that is where the CGM data arrives and where the alerts need to land. Setup begins on that phone. When the date of birth entered shows the person is under 16, the app stops and asks for a parent or legal guardian, who takes over on that same phone and creates the account using their own email. There is no pairing code and no separate parent-side setup. See section 7.

2b. Glucose and CGM data

From Apple Health, with your permission: blood glucose readings, and where you enable it, sleep, activity, and nutrition data.

From Dexcom Share, if you connect it: your recent glucose readings, delivered in near real time. To connect it we ask for your Dexcom account username and password, which we store encrypted so we can keep the connection alive.

From FreeStyle LibreLinkUp, if you connect it: your recent glucose readings, delivered in near real time. To connect it we ask for your LibreLinkUp email and password. We store your password encrypted, along with the access token and the connection details — your region, account identifier, and the identifier of the sensor connection you selected.

See section 6 for more on both.

These readings are transmitted to and stored on our servers. We use them to compute forecasts, detect patterns, and send notifications. This is necessary for the app to work — the analysis runs on our servers, not on your phone.

2c. Diabetes management settings

Insulin sensitivity, carb ratio, target ranges, high and low thresholds, and similar values you enter during setup. Your care team sets these; we use them to interpret your data.

2d. Insulin, carbohydrate, and exercise you log

When you log a dose, a meal, or a workout, that entry is sent to and stored on our servers. Each entry carries:

The time of the event
Its type — insulin, carbohydrate, or exercise
The amount — units, grams, or minutes
The descriptors you select, such as carbohydrate type, exercise type, and intensity

We are explicit about this because it is insulin dosing history, and it leaves your phone.

The server needs it. Forecasts are computed on our servers, and the engine cannot account for insulin already working, or carbohydrates already eaten, unless it can see them. A dose we do not know about looks to the model like an unexplained fall.

Caregivers cannot see logged events. Our servers refuse caregiver requests for them. See section 5.

The free-text label or tag you attach to an entry is a separate thing, and it stays on your phone. See section 2g.

2e. Device and technical information

A device identifier we generate (not Apple’s advertising identifier)
Push notification tokens, so we can send alerts
App version, iOS version, device model
Time zone
Crash reports and performance diagnostics

2f. Usage analytics

Which screens you open, which features you use, how often you open the app. We use Amplitude for this.

Our analytics events carry properties, not only names. Sent alongside them:

Your role — patient or caregiver — on every event
Which CGM service you have connected, and its region
Which step of onboarding you reached
The confidence score attached to your first forecast
When we detect a gap in your data: how long since the last Apple Health sample, what we believe caused it, and how serious it is
That you logged an event, and its type — insulin, carbohydrate, or exercise. Never the amount.
Your glucose display unit, whether notifications are enabled, whether you are in preview mode, whether you have real data yet

We do not send Amplitude any glucose reading, any forecast curve, any estimated A1C or time-in-range figure, or the amount of any dose, carbohydrate, or exercise entry.

We also switch off the collection Amplitude performs by default on IP address, city, region, DMA, and carrier.

2g. What stays on your device and never reaches us

Your journal and reflections
Free-text notes
The labels and tags you write on a logged event — the event itself is sent to us, the words you attach to it are not (section 2d)
Day-type descriptions
Streaks, points, and badges
Your date of birth (section 2a)
Whether you experience menstrual cycles
Whether you drink alcohol

The last two are asked during setup and can be changed at any time in Settings. They are sensitive — reproductive health and alcohol use — which is why they never leave the phone.

All of this is stored in the app on your phone. We do not receive it, we cannot see it, and it is not visible to caregivers. If you delete the app, it is gone.

2h. What we do not collect

We do not access your contacts, camera, microphone, or precise location.
We do not use tracking technologies for advertising, and we do not collect Apple’s advertising identifier.
We do not receive your card number or any other payment details. Subscriptions are bought through Apple’s App Store. Apple processes the payment, and Apple’s own privacy policy governs your payment data. From Apple we receive only transaction IDs, which product you bought, purchase and renewal dates, and subscription status.

3. Where your data lives

Remira runs on infrastructure operated by third parties who process data on our behalf under contract:

Provider	What they hold
Cloudflare	Glucose readings, logged insulin/carbohydrate/exercise events, forecasts, encrypted CGM service credentials, account and family records
Supabase	Email address and sign-in identity
Amplitude	Usage events and the properties described in section 2f. No glucose readings or forecasts
Resend	Delivery of sign-in and account emails
Apple	Push notification delivery. Subscription billing and payment data, under Apple’s own privacy policy; we receive only transaction IDs, the product, purchase and renewal dates, and subscription status. A single “free trial used” flag for your device, through Apple DeviceCheck (section 9)

These providers may process data outside your country, including in the United States. See section 12.

4. How we use your data

To run the app. Generate forecasts, detect patterns, compute time-in-range and estimated A1C, send notifications, and show your data to the caregivers you have approved.

Estimated A1C is exactly that — an estimate, calculated from your glucose data. It is not a laboratory HbA1c test, it is not a substitute for one, and the two figures will differ.

To improve Remira. We use glucose data and logged events across our users to build and improve the models that produce forecasts and pattern detection. A model trained on more people produces better forecasts for everyone. Where we do this, we work with data that has been stripped of your name, email, and account identifiers.

To support you. A small number of authorized Remira personnel may access account and glucose data to answer support requests and diagnose problems. Access is limited to what the task requires.

To keep the service safe. Detect abuse, prevent fraud, and enforce our Terms.

To meet legal obligations. Respond to lawful requests and comply with applicable law.

What we do not do

We do not sell your data.
We do not use your health data for advertising or marketing, to you or to anyone else.
We do not share your data with data brokers.
We do not use Apple Health data for anything other than providing and improving Remira’s health features, consistent with Apple’s HealthKit requirements.

If we ever want to share data with a research partner or receive value in exchange for data, we will ask you first and you will have to say yes. Not a settings default. Not continued use of the app. An explicit choice, which you can withdraw.

5. Family accounts and what caregivers see

Remira lets one person with diabetes share their data with family members and caregivers.

A caregiver can see:

Current and recent glucose readings
Forecasts and predicted patterns
Time in range, average glucose, estimated A1C (an estimate from glucose data, not a lab result)
Alerts and notifications
Whether the patient’s device has recently checked in

A caregiver cannot see:

Insulin, carbohydrate, or exercise entries the patient logs
Journal entries, reflections, or notes
Event labels or tags
Anything the patient types

The rule we follow: a caregiver sees information calculated from glucose numbers and time. They never see anything the patient wrote, tapped, or logged. This is enforced on our servers, not just hidden in the app.

Every member of a family can see who else is in it. Caregivers can be removed at any time by the account owner, and removal takes effect immediately.

6. Your CGM connection

Connecting a live CGM service is optional. Remira works using Apple Health alone. Connecting one adds near-real-time readings, live notifications, and the lock screen and widget displays.

Dexcom Share

We store your Dexcom username and password encrypted, and use them to sign in on your behalf and retrieve your readings. We store them because the session must be re-established periodically.

FreeStyle LibreLinkUp

We use your LibreLinkUp email and password to sign in and obtain an access token. We store your password encrypted, along with the token and the details of the sensor connection you chose. We keep the password because the token expires and the session has to be re-established periodically without asking you to sign in again.

Both services

We store the password you give us, encrypted at rest, because both services require us to re-authenticate periodically to keep your readings flowing. We never display it, never share it, and delete it when you disconnect or delete your account.

Be clear about what that encryption does and does not do. Remira can decrypt your password. It has to. Signing in on your behalf requires the password in the clear at the moment of the request, and a scheduled job on our servers does exactly that to keep your session alive. The encryption protects the password from anyone who obtains our stored data. It does not put it beyond our own reach.

So: use a dedicated follower account rather than your primary CGM login, wherever the service supports it. We recommend it for this reason. A password you hand to us is recoverable, not sealed.

Remira is not affiliated with, endorsed by, or partnered with Dexcom or Abbott. We use the sharing services those companies make available to followers.
Either company may change or discontinue these services at any time, which would stop the feature working. Your data in Apple Health is unaffected.
Your use of Dexcom or FreeStyle Libre is governed by that company’s own terms and privacy policy.
You can disconnect at any time in Remira’s settings, which deletes the stored credentials and tokens.

7. Children’s privacy

Remira is not directed to children under 13, and no one under 16 creates their own Remira account.

How under-16 patients use Remira

The app goes on the young person’s phone. That is where the CGM writes its readings and where the alerts have to arrive, so that is where the account has to live.

Setup begins on that phone. The app asks for a name and a date of birth. When the date of birth shows the person is under 16, setup stops and hands off: the app asks for a parent or legal guardian, who takes over on that same device, reads and agrees to the Terms, and creates the account with their own email address.

There is no pairing code. A parent does not create an account elsewhere and then link a child’s phone to it. Every Remira account originates on the phone of the person with diabetes.

What we collect about a young person

The name entered during setup
Glucose readings, and the device and technical information in section 2e
Diabetes management settings, and any insulin, carbohydrate, or exercise events logged (section 2d)

We do not collect an email address, phone number, or other contact information from a person under 16. The contact details on the account are the parent’s or guardian’s. Date of birth stays on the device.

Parental consent

The parent or guardian gives consent on the young person’s device, during setup. They enter their name and email address and tick a box confirming that they are the child’s parent or legal guardian and that they consent to Remira collecting and using the child’s information as described in this policy. The account is then created with the parent’s or guardian’s email address.

Rights of parents and guardians

You may at any time:

Review the personal information we hold about your child
Ask us to delete it
Refuse to permit further collection, by deleting the account

Contact support@remira-ai.com. We will verify your identity before acting.

What we never do with children’s data

No behavioral advertising, ever
No sale or sharing for advertising or marketing
No collection beyond what the service requires
No retention longer than necessary

Outside the United States

In the UK, children aged 13 and over may consent to processing of their own data. In the EEA, the age is between 13 and 16 depending on the country. Because Remira requires account holders to be 16 or older, a parent or guardian must set up and manage any account for a person below these ages.

8. When we share data

We do not sell your personal information. We share it only:

With service providers listed in section 3, under contract, and only as needed to run Remira.

With people you choose. Caregivers you invite, subject to the limits in section 5.

When the law requires it. In response to a valid subpoena, court order, or lawful government request. We will notify you unless prohibited.

To protect people. If we believe disclosure is necessary to prevent imminent physical harm.

In a business transfer. If Remira is acquired or merged, data may transfer as part of the transaction. We will notify you beforehand and you may delete your account first.

With your explicit consent, for anything else.

9. How long we keep data, and how to delete it

While your account is active

We keep your data as long as your account exists.

When you delete your account

Delete your account in the app, or email support@remira-ai.com. We will:

Delete your email address, sign-in identity, and account records
Delete your name
Delete your encrypted CGM service passwords and tokens
Delete your push tokens and device records
Delete your family and caregiver relationships

This happens within 30 days.

Glucose readings and logged treatment events are handled differently. By default we retain them with all identifying information removed, and use them to improve Remira’s models. They are no longer linked to you, your email, or your account.

If you want that history erased as well, say so and we will erase it. Email support@remira-ai.com and ask for full erasure.

If you are in the UK or EEA, we perform full erasure by default, including glucose and event history, unless you tell us otherwise.

Free-trial records

Each person gets one free trial. To enforce that, we keep a small record of trials that have been used. It contains one-way hashes of your email address, your Sign in with Apple identifier, your CGM account, and your device identifier. We also set a single “free trial used” flag for your device through Apple’s DeviceCheck service; Apple stores that flag, and it holds no personal information.

A one-way hash cannot be reversed to reveal the original email address or identifier. We can only check whether a new sign-up matches one that has already had a trial. We keep this record after you delete your account, only to prevent repeat free trials, and we use it for nothing else.

Data on your device

Your journal, reflections, labels, date of birth, and the setup answers listed in section 2g live only on your phone. Deleting the app deletes them. We cannot delete them for you, because we never had them.

Legal holds

We may retain limited records where law requires, or where we need them to resolve a dispute or enforce our agreements.

10. Your rights

Everyone

Access — request a copy of what we hold about you
Correct — fix inaccurate information
Delete — as described in section 9
Withdraw permissions — revoke Apple Health access in iOS Settings, disconnect your CGM service in the app, turn off notifications at any time

Email support@remira-ai.com. We respond within 30 days.

UK and EEA (UK GDPR / GDPR)

Health data is special category data. Our lawful basis for processing it is your explicit consent, which you give when you connect Apple Health, Dexcom Share, or LibreLinkUp, and which you can withdraw at any time by disconnecting or deleting your account. For account records and security we rely on contractual necessity and legitimate interests.

You additionally have the right to data portability, to restrict processing, to object to processing based on legitimate interests, and to lodge a complaint with your supervisory authority — the ICO in the UK, or your national authority in the EEA.

California (CCPA/CPRA)

You have the right to know what we collect and why, to delete, to correct, to opt out of sale or sharing, and to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined under California law , and we do not use sensitive personal information for purposes requiring a right to limit.

We will not discriminate against you for exercising these rights.

Washington, Nevada, and other state health privacy laws

If you are a Washington resident, the My Health My Data Act gives you rights over your consumer health data, including the right to withdraw consent and to have it deleted. We do not sell consumer health data. If that ever changes, we will obtain your separate written authorization first, as the law requires.

11. Security and breach notification

We protect your data with encryption in transit and at rest, encrypted storage of CGM service credentials, authenticated access to every server endpoint, and access controls limiting which personnel can view user data.

No system is completely secure. If we discover a breach affecting your identifiable health information, we will notify you and the Federal Trade Commission as required by the FTC Health Breach Notification Rule, and any other authority required by applicable law.

If you believe your account has been accessed without your permission, email support@remira-ai.com immediately.

12. International transfers

Remira is based in the United States and our infrastructure processes data in the United States and other countries. If you use Remira from outside the US, your data will be transferred to the US, where privacy laws differ from your own. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

13. Changes to this policy

We will update the date at the top and, for material changes, notify you in the app or by email before they take effect. If a change would allow a materially different use of your health data, we will ask for your consent rather than assume it.

14. Contact

Remira LLC support@remira-ai.com

We aim to answer within 5 business days, and formal data rights requests within 30 days.