Privacy Policy

Effective date: 16 September 2026

This Privacy Policy explains how Bolus Ltd ("Bolus", "we", "us" and "our") collects, uses, shares and protects personal data when you use the Bolus app and related services in the United Kingdom.

Bolus is not a medical device and does not provide medical advice. It does not diagnose conditions, recommend or calculate insulin or medication doses, or replace your healthcare team. Glucose data supports food and planning choices; it does not direct clinical treatment. The AI coach (Emily) is designed to remain within food and lifestyle guidance and to direct clinical questions to your healthcare team.

By using Bolus, you confirm that you have read this Privacy Policy, our Terms and our medical disclaimer, and understand the limits of the service.

1. Who we are

Bolus Ltd is the data controller for the personal data described in this Privacy Policy.

If you are dissatisfied with our response, you may complain to the Information Commissioner's Office ("ICO"). See section 16.

2. Personal data we collect

2.1 Identity and account data

We may collect:

• your email address;
• Apple sign-in identifier;
• name;
• mobile number, where provided on an earlier version of the app; and
• for Sign in with Apple users, an Apple refresh token used only to ask Apple to revoke the sign-in grant when the account is deleted.

We use this information to create and operate your account.

2.2 Health-profile data

We may collect:

• diabetes type;
• sex at birth;
• date of birth;
• weight, entered by you or synced from Apple Health;
• height;
• activity level;
• target weight and, where relevant, the starting weight recorded when that goal was set;
• whether you take weight-loss medication;
• your primary goal; and
• the glucose source or device you use.

This is special-category health data. We use it to tailor meal guidance. Date of birth and activity level contribute to a server-side personal energy estimate used to shape meal guidance. The estimate is calculated when needed, is not stored and is not shown as a calorie figure. Target weight is used to show progress and a steady-pace arrival projection, which is calculated when needed and is not stored.

2.3 Glucose data

We may collect blood-glucose readings and records needed to ingest, process and analyse them. This is special-category health data. We use it to provide glucose insights.

Glucose may come from Apple Health or a FreeStyle Libre account, as described in section 7.

2.4 Workout and movement data

If you grant permission and your account is on the paid tier, we may collect:

• workout start and end times;
• workout duration;
• activity type;
• an intensity band;
• estimated energy burned;
• whether the workout came from a watch or phone; and
• one all-day step total per calendar day, together with the name of the device or application that recorded it.

We do not collect the workout heart-rate stream or store individual heart-rate values. The intensity band is derived on the device from Apple Health's average-METs metadata. We receive only the intensity band, not the METs value. If that metadata is unavailable, the intensity is recorded as "unknown". We do not collect intraday step counts.

Movement data is used to:

• show exercise on your glucose timeline;
• improve detection of eating events near exercise; and
• give the AI coach (Emily) visibility of movement for coaching.

Movement data is not used in meal planning or energy estimation. Step totals are not paired with meals or glucose because an all-day total does not show when movement occurred.

A free account may read and display this information from Apple Health on the device, but does not upload it to Bolus. Uploading begins when an account becomes paid, including any permitted historical backfill, and stops if the paid subscription lapses. Data already uploaded remains subject to the retention periods in section 11.

2.5 Wearable physiology shown only on your device

With your permission, the app may read from Apple Health:

• body weight;
• resting heart rate;
• heart-rate variability;
• estimated VO₂ max; and
• all-day active energy.

Resting heart rate, heart-rate variability, VO₂ max and active-energy values are displayed in the app but are not sent to or stored by Bolus. For paid-tier accounts, Bolus may store only the names of the signals currently displayed, such as "resting heart rate" or "HRV", so that the AI coach (Emily) can direct you to the relevant information. The list contains no measurements, is replaced when updated and is deleted with your account.

We do not collect sleep sessions, sleep respiratory rate, wrist temperature, continuous physiological streams, workout heart-rate streams or intraday step counts.

2.6 Meal plans and food preferences

We collect weekly plans, meals, shopping lists, liked meals, cooking history and onboarding preferences, including diet pattern, allergens, foods you avoid, portion size, effort and household size.

We use this information to build and operate your weekly plans.

2.7 Push notifications and Live Activities

We may collect:

• device push tokens, including tokens used for lock-screen Live Activities;
• notification-delivery records; and
• records of Live Activity runs, including the planned meal concerned, app installation, status, start time, last-update time, end time and reason for ending.

We use this information to deliver notifications and start, update and end Live Activities.

2.8 Consent and disclaimer records

We keep a record that you accepted the medical disclaimer and Terms, including the relevant versions and timestamps.

2.9 AI coach (Emily) conversations, coaching and safety logs

The AI coach (Emily) may process:

• your conversation thread, so it can be restored in the app;
• coaching agreements, including goals, action plans, if-then plans, requested settings changes, review points, summaries, status, optional follow-up dates and structured information needed to operate the feature;
• per-message safety metadata that contains no message text and is stored under a pseudonymous label; and
• flagged message text where the safety system identifies a concern.

Flagged messages may contain personal or health information.

The AI coach (Emily) is an informational assistant for food and planning questions. It does not diagnose, provide medical advice, recommend treatment, calculate medication or insulin doses, or make decisions for you. It is not a medical device or a substitute for professional care. It is designed to direct clinical questions to your healthcare team.

The AI coach (Emily) may be monitored by humans for safety, abuse prevention and service quality. User data is not used for research or to train or develop AI models.

2.10 Support data

If you submit a report through in-app support, we may collect:

• your message and any health information you include;
• app version and build;
• device model;
• operating-system version;
• the screen from which the report was sent;
• the relevant week, where the report is sent from Insights; and
• recent request identifiers used to locate relevant server logs.

We use this information to handle support requests.

2.11 Subscription and purchase data

Subscriptions are purchased through Apple In-App Purchase. We do not receive or store full payment-card details.

We may receive or retain limited subscription and receipt information, including Apple's original transaction identifier, product identifier, status and expiry, to manage entitlements, cancellations, renewals, refunds, chargebacks, support, accounting, tax, fraud prevention and legal obligations.

Apple's App Store Server Notification payloads may also be retained for webhook idempotency and audit purposes. These records are deleted through a daily process once they are more than 90 days old.

2.12 Email communications

We may process your email address, email content, attachments, delivery information and related technical information when we communicate with you by email. We currently send emails using our Google account.

Transactional and service emails

We may send essential communications, including:

• account, security and password-related messages;
• support responses;
• subscription, payment and entitlement messages;
• legal and compliance notices;
• material service updates; and
• other messages necessary to provide or administer Bolus.

These communications are necessary to operate the service and are not marketing communications.

Marketing emails

Where permitted by law, we may send marketing communications about Bolus, including product updates, educational content, offers and related services. We will send marketing emails only where we have the consent or other lawful basis required by applicable law, including regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426 ("PECR").

Every marketing email will include an unsubscribe mechanism. You may withdraw consent or opt out at any time using the unsubscribe link or by contacting [email protected]. Opting out of marketing does not prevent us from sending essential transactional or service communications.

We do not intentionally include detailed health information in email subject lines or email content unless necessary to respond to your request.

3. How we use personal data

We use personal data to:

• create and manage accounts;
• provide Bolus and its features;
• build meal plans and shopping lists;
• personalise food guidance and recommendations;
• provide glucose insights;
• display exercise on glucose timelines;
• help detect eating events near exercise;
• operate the AI coach (Emily) and coaching features;
• send push notifications and Live Activities;
• send transactional, service and marketing emails;
• manage subscriptions and paid entitlements;
• respond to support requests;
• maintain security and service integrity;
• detect and investigate errors, abuse and misuse;
• maintain consent, disclaimer and subscription records; and
• comply with legal obligations and establish, exercise or defend legal claims.

We do not sell personal data, use it for third-party advertising, use it for research, or use it to train or develop AI models.

4. Lawful bases

4.1 Performance of a contract

We rely on performance of a contract to process:

• identity and account data;
• meal plans and food preferences;
• coaching agreements;
• support data needed to provide the service;
• subscription and entitlement data;
• device and notification data needed to deliver the service; and
• email data needed for transactional and service communications.

4.2 Consent and explicit consent

We rely on consent or explicit consent, as applicable, to process:

• health-profile data;
• glucose data;
• Apple Health data;
• workout and movement data;
• special-category health information in messages to the AI coach (Emily); and
• marketing email data where consent is required.

Movement-data ingestion is gated on the recorded medical-disclaimer consent.

You may withdraw consent by deleting your account, disconnecting the relevant feature or source, or unsubscribing from marketing emails. Withdrawal does not affect the lawfulness of processing before withdrawal.

4.3 Legitimate interests

We rely on legitimate interests to process:

• push and notification data;
• Live Activity records;
• AI coach (Emily) safety logs;
• support and abuse-prevention data;
• security and service-integrity data;
• limited analytics and error-monitoring data;
• subscription administration and fraud-prevention data; and
• email records needed to administer, secure and evidence communications.

Where an AI coach (Emily) safety log contains health information, that content is processed under the explicit-consent basis described above.

4.4 Legal obligations

We may process or retain information where necessary to comply with legal obligations, demonstrate compliance, or establish, exercise or defend legal claims.

5. Special-category data

Health, glucose, movement and certain AI coach (Emily) information constitute special-category data under Article 9 of the UK GDPR.

We process special-category data only where you have given explicit consent and the processing is necessary for a feature or service you have chosen to use.

6. Apple Health and device permissions

The app may read, with your permission:

• blood glucose;
• workout sessions;
• daily step totals;
• body weight;
• resting heart rate;
• heart-rate variability;
• estimated VO₂ max; and
• active energy.

The app does not read sleep data, respiratory rate, wrist temperature, intraday step counts or workout heart-rate streams. It never writes data to Apple Health.

The app requests Apple Health permissions and push-notification permission. iOS allows you to grant or refuse individual Apple Health permissions.

The app does not use the camera, location, contacts, photos or microphone.

A sign-in token and, where applicable, FreeStyle Libre credentials are stored in the device keychain and excluded from device backups. Recent glucose readings may be held locally and are cleared when you log out.

7. FreeStyle Libre

If you select FreeStyle Libre as your glucose source, the app collects your LibreView account email address and password and communicates directly from your device with Abbott's European LibreLinkUp service to retrieve readings.

Libre credentials are stored only in the device keychain and are not sent to or stored on Bolus's servers. The glucose readings themselves are sent to Bolus's backend in the same way as other glucose data.

8. Providers and data sharing

We use the following providers:

For the AI coach (Emily), we send a limited, purpose-built view of your plan, preferences and food context. We do not send your email address, real name or account identifier to the model. Health-profile details and glucose reflections are included only where relevant features are enabled. Your first name is added to the response by Bolus's servers.

Amazon is contractually prohibited from using data submitted through Amazon Bedrock to train or improve its foundation models.

Sentry receives only a masked user reference, with personal data, message bodies and health values removed. TelemetryDeck receives limited masked or anonymous interaction events and cannot receive health data.

On the website, TelemetryDeck may record page views, scrolling, key-link clicks and UTM campaign parameters. The website sends no visitor identifier, sets no cookies and does not link website analytics to Bolus accounts.

Cloudflare briefly handles API traffic in transit at its nearest network edge before forwarding it to our server. Cloudflare is a global provider and is not contractually restricted to UK or EU edge locations.

Google may process your email address, email content, attachments, delivery information and related technical information on our behalf. We do not intentionally include detailed health information in emails unless necessary to respond to you.

We do not use SMS providers, advertising networks or other email providers. We do not share personal data outside this list except where required by law.

9. Hosting and international transfers

Our API runs on AWS in London. Our database is hosted by Neon on AWS in Europe. The AI coach (Emily) is called from London using Amazon Bedrock's EU cross-region inference. Sentry and TelemetryDeck use EU hosting.

Cloudflare operates a global network. Although UK and EU users may ordinarily be served from UK or EU edge locations, Cloudflare may process data outside the UK or EU.

Where required, international transfers are protected by appropriate safeguards, including the EU Standard Contractual Clauses with the UK Addendum and, where applicable, the UK-US Data Bridge.

10. Security

We use technical and organisational measures designed to protect personal data, including:

• Sign in with Apple authentication;
• secure one-way password hashing where a password is used;
• seven-day signed session tokens;
• device-keychain storage for sign-in and Libre credentials;
• HTTPS, HSTS and encryption in transit;
• encryption at rest by our database provider;
• database-level access controls;
• least-privilege access;
• pseudonymisation of AI coach (Emily) safety logs;
• masked error-monitoring and analytics data;
• environment-managed secrets;
• abuse and system-integrity monitoring; and
• immediate and irreversible account deletion.

Libre credentials do not reach Bolus's servers.

No system is completely secure.

11. Retention

We retain personal data only for as long as necessary.

11.1 Account, health, glucose, movement, meal, coaching and support data

These data are retained for the life of the account and deleted when the account is deleted.

11.2 Notifications and Live Activities

Notification-delivery records are retained for 90 days. Device registrations and Live Activity records are retained for the life of the account and deleted on account deletion.

11.3 Consent and disclaimer records

The live record is retained for the life of the account and deleted on account deletion.

After deletion, we retain a limited archive for six years consisting of:

• email address;
• Terms version;
• acceptance time; and
• links to the Terms and Privacy Policy.

The archive is used only for accountability and potential legal claims, is not accessible to app features, and is restricted to authorised legal and administrative personnel. It is then automatically purged.

11.4 AI coach (Emily) safety logs

Pseudonymous safety metadata containing no message text may remain after account deletion because it cannot reasonably be linked back to you.

Flagged message text is normally deleted after approximately 30 days and is deleted immediately for you when you delete your account. Your conversation thread is deleted on account deletion.

11.5 Subscription, App Store and email records

Subscription and receipt information is retained as necessary for entitlement, support, accounting, tax, fraud prevention and legal obligations.

App Store Server Notification payloads are deleted when more than 90 days old.

We retain transactional, service and support email correspondence as long as necessary to administer the relevant account, service, enquiry, legal obligation or potential claim. Marketing preferences, consent records and unsubscribe records are retained as necessary to demonstrate compliance and prevent further marketing after opt-out.

12. Account deletion

You can delete your account in Settings > Delete account. Deletion is immediate and irreversible, with no grace period.

Deletion removes your account data, including flagged AI coach (Emily) message text, subject to the limited consent archive and other records that must temporarily be retained as described in section 11.

For Sign in with Apple users, deletion also revokes the Apple sign-in grant.

13. Your rights

Subject to applicable conditions and exemptions, you may have rights under the UK GDPR to:

• be informed about processing;
• access your personal data;
• rectify inaccurate data;
• request erasure;
• restrict processing;
• receive portable data;
• object to processing based on legitimate interests; and
• withdraw consent where processing relies on consent.

You may exercise these rights by contacting [email protected]. You may unsubscribe from marketing emails using the link in the relevant email.

We may verify your identity before responding. Certain information may be retained where required by law or necessary to establish, exercise or defend legal claims.

14. Children

Bolus is intended for adults and is not directed to children under 18. We do not knowingly collect personal data from children.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the service, our processing activities or legal requirements. If we make material changes, we will take reasonable steps to notify you.

The version posted in the app and on our website is the current version.

16. Contact and complaints

Please contact us first with any privacy complaint. We will acknowledge your complaint within 30 days and respond without undue delay.

You may also complain to: