Privacy Policy
1. Who we are
QumranHealth operates the glucose tracking service at tracker.qumranhealth.co.uk. Our contact email is qumranhealth@gmail.com.
We are not a pharmacy, prescriber, or regulated healthcare body. We do not provide medical advice or medical services.
2. What data we collect
When you create an account and use the app, we may collect the following personal data:
- Name and email address — used to create and manage your account
- Password — stored securely (hashed) via Supabase Auth; we never see your plain-text password
- Glucose readings — fasting and post-meal blood glucose values you log manually
- Body weight — if you choose to log it
- Mounjaro dose data — dose level and injection dates, if you choose to log them
- Usage data — basic analytics about how you use the app (e.g. features used, error logs)
You are never required to enter any data you are not comfortable sharing. All health data is entered voluntarily by you.
Blood glucose readings, medication doses, body weight, and any other health metrics you enter constitute special category personal data under Article 9 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We process this data exclusively on the basis of your explicit consent (Article 9(2)(a) UK GDPR), given when you create your account and agree to these terms. You may withdraw consent and request deletion of all your data at any time by emailing qumranhealth@gmail.com. ICO Registration: ZC164080 (TradeBoost AI Ltd, expires 01 Jun 2027).
3. Why we collect it
We collect your data solely to provide the QumranHealth tracking service — including:
- Storing and displaying your health logs across devices
- Generating personalised charts, trends, and estimated HbA1c calculations
- Sending you service-related emails (e.g. password reset)
- Improving the app based on aggregated, anonymised usage patterns
We do not use your data for advertising, profiling for third parties, or any purpose other than providing this service to you.
4. How your data is stored
Your data is stored using Supabase, a cloud database platform with UK/EU data residency and compliance with UK GDPR and the EU GDPR (Data Privacy Framework). Supabase applies industry-standard encryption at rest and in transit (TLS/SSL).
Access to your data is restricted to you via your authenticated account. We do not give any third party access to your personal health data.
4a. AI Patient Information Hub — separate processing notice
The AI chat tool at tracker.qumranhealth.co.uk/tools/mounjaro-advisor operates as follows:
What is sent: The text of your question and up to six prior messages in the conversation are sent to an AI system to generate a response.
What is stored: Nothing. Your messages are not stored, logged, or retained by QumranHealth after the AI response is generated. We do not retain any record of your questions or the AI's responses.
Third-party AI processor: The AI responses are generated using Anthropic's Claude (operated by Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA). Your message text is sent to Anthropic's API to generate the response. Anthropic's data handling is governed by their Privacy Policy. Anthropic does not use API inputs to train its models.
Lawful basis: This processing is conducted on the basis of your explicit consent (UK GDPR Article 9(2)(a)), given by ticking the consent checkboxes before using the tool. You may withdraw consent at any time by simply not using the tool — as no data is retained, there is nothing to delete.
Special category data: Any health information you choose to include in your questions constitutes special category data under UK GDPR Article 9. By giving consent before using the tool, you explicitly consent to this processing solely for the purpose of generating an AI response. This data is not retained beyond the response.
This tool is not a medical device and is not regulated by the MHRA or CQC. It provides general published information only and does not constitute medical advice.
5. Data sharing
We do not sell, rent, or share your personal data with third parties for commercial purposes. We do not share your health data with insurers, employers, or marketing companies.
We may share anonymised, aggregated data (which cannot identify you) for the purpose of improving the service.
We use the following sub-processors to deliver the service:
- Supabase Inc. — database and authentication (tracker app accounts)
- Vercel Inc. — web hosting and delivery
- Stripe Inc. — payment processing (subscription only; we do not store your card details)
- Anthropic PBC — AI response generation for the Patient Information Hub only. Message text is sent transiently to generate a response and is not retained. See Section 4a above.
6. Cookies
We use minimal, strictly necessary cookies and local browser storage to keep you logged in and store your app preferences. We do not use tracking cookies, advertising cookies, or third-party analytics cookies (e.g. Google Analytics).
No cookie consent banner is required because we only use essential cookies.
7. Your rights under UK GDPR
Under UK data protection law, you have the right to:
- Access your personal data — email us and we will send you a copy
- Erasure ("right to be forgotten") — email qumranhealth@gmail.com to request deletion of your account and all associated health data. We will action this within 30 days.
- Rectification — correct inaccurate data held about you
- Portability — request your data in a machine-readable format
- Restriction or objection — restrict or object to certain processing
- Withdraw consent — at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, email us at qumranhealth@gmail.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
8. Data retention
We retain your personal data for as long as your account is active. If you cancel your account or request deletion, your data will be permanently deleted within 30 days, except where we are required by law to retain certain records.
9. Children
This service is intended for adults (18+). We do not knowingly collect personal data from children under 18.
10. Changes to this policy
If we make material changes to this Privacy Policy, we will notify registered users by email. The "last updated" date at the top of this page will always reflect the most recent version.
11. Contact
For any privacy queries or to exercise your rights, contact us at: qumranhealth@gmail.com