Privacy

Last updated: September 2026

Trace is designed to help you understand patterns and rhythms in your glucose data. Health data should be handled carefully, transparently, and respectfully.

Who we are

Trace is operated by Dash Data Lab Ltd, a company registered in England and Wales. For privacy matters, contact support@tracebydash.app.

What Trace stores

Trace may store glucose readings, meal logs, workout data, sleep data, Daily Reviews, app preferences, notification settings, and optional display name information. Some information is stored locally on your device. Some may be securely transmitted to Trace services to support features such as AI Daily Reviews, notifications, Live Activities, and historical analysis.

How glucose data reaches Trace

Trace does not connect directly to your CGM manufacturer. Glucose readings are received from Apple Health (when you grant permission), from a relay service you have independently configured such as Nightscout or Zukka, or through a CGM connection Trace provides directly, such as Libre (LibreLinkUp). Trace reads only the data you explicitly make available through these sources.

If you connect a FreeStyle Libre sensor via LibreLinkUp, Trace uses a narrowly scoped relay service, operated by Hetzner Online GmbH (Falkenstein, Germany), to retrieve your current glucose reading from LibreView. Your LibreLinkUp sign-in credentials are sent to this relay over an encrypted connection so it can do this on Trace's behalf. The relay processes these credentials and glucose data transiently and is not designed to retain them after they are needed to provide the connection. This applies only if you use the Libre/LibreLinkUp connection option; it does not apply to Apple Health, Nightscout, or other connection types.

AI-generated reviews

If AI Daily Reviews are enabled, Trace may send glucose summaries, meal information, workout summaries, and related metabolic context to Trace services for analysis. These reviews are generated automatically and are intended for reflection and pattern awareness only. They are not medical advice.

AI analysis is powered by third-party large language model providers. Trace currently uses OpenAI (GPT-4) and/or Anthropic (Claude) to generate review content. Only anonymised metabolic summaries — not your name or contact details — are sent to these providers. Where Anthropic is used, data submitted through its API may be retained by Anthropic for up to 30 days for safety and security purposes under its standard retention settings. Their processing is governed by their respective data processing agreements.

If you use photo-based meal logging with AI Meal Photo Analysis enabled, the meal photograph itself is also sent to these third-party AI providers to estimate carbohydrates, fat and protein. AI Meal Photo Analysis is off by default and requires your explicit consent in the app, which you can withdraw at any time in Settings.

Lawful basis for processing (UK GDPR)

Trace processes your personal data on the basis of your explicit consent. You provide consent when you complete onboarding and connect your glucose data source. You may withdraw consent at any time by deleting the app and requesting data deletion as described below.

Where Trace processes special category data (health data), the lawful basis is explicit consent under Article 9(2)(a) UK GDPR.

Data retention

Glucose readings, meal logs, and Daily Reviews are retained for as long as your account is active. If you request account deletion, your data will be permanently deleted within 30 days. Device tokens (used for push notifications and Live Activities) are automatically removed when they expire or when you uninstall the app.

Notifications and Live Activities

If notifications are enabled, Trace may send push notifications relating to glucose alerts, meal analyses, Daily Reviews, and Live Activity updates. Notification tokens are securely registered with Trace services solely to deliver these notifications.

Data sharing

Trace does not sell personal data. Trace is designed as a personal insight system, not an advertising platform. Your information is not shared with third-party advertisers.

Trace uses the following third-party processors to provide its service: Cloudflare, Inc. (infrastructure and data transit); Hetzner Online GmbH (relay infrastructure for Libre/LibreLinkUp connections only, where enabled); OpenAI, Inc. (AI review generation, where enabled); Anthropic, PBC (AI review generation, where enabled). Each processor is bound by a data processing agreement and is not permitted to use your data for their own purposes.

Where your data is processed

Trace services run on Cloudflare's global network. For users who connect Libre/LibreLinkUp, glucose readings and LibreLinkUp credentials are also processed in Germany by Hetzner Online GmbH, under an Article 28 UK/EU GDPR data processing agreement. AI review generation may involve processing in the United States via OpenAI or Anthropic. Where data is transferred outside the UK, appropriate safeguards are in place in accordance with UK GDPR requirements, including standard contractual clauses.

Your rights

Under UK GDPR you have the right to access, correct, or delete your personal data; to restrict or object to processing; and to data portability. To exercise any of these rights, contact support@tracebydash.app. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Data deletion

You can request deletion of your data at any time by contacting support@tracebydash.app. Deletion requests are processed within 30 days.

Data processing and Apple Health

Health data is processed only with explicit user permission. Trace requests access to Apple Health only when you choose to connect it, and only reads the data types needed to provide the features you enable.

Medical disclaimer

Trace does not provide medical advice. Always consult qualified healthcare professionals regarding medical decisions, treatment adjustments, or health concerns. Features, analysis, and notifications may change over time. Although care is taken to improve reliability and stability, Trace should not be relied upon for medical decision-making.

Contact

For privacy questions or feedback, contact support@tracebydash.app.