Privacy Policy
The short version. INDX works without an account and keeps your history on your phone. Cloud backup is off until you switch it on, and when you do, your health data is encrypted on your device with a key we never receive. We do not sell your data, we do not use it for advertising, and we do not train models on your readings.
1. Who we are and what this covers
INDX is a continuous glucose monitoring (CGM) companion app for iPhone, operated by INDX Biotechnology Company Limited, Unit 301, 8 Jordan Road, Jordan, Hong Kong ("INDX", "we", "us"). This policy describes how we handle personal data in the app and on this website.
Health data collected by the Apple Health app is governed by Apple's own terms as well as this policy. This policy does not cover third-party services that you choose to connect, such as your CGM sensor manufacturer's app.
2. Information the app handles
Health and fitness data you connect
With your permission, INDX reads data from Apple Health, including heart rate, sleep, workouts, activity, and glucose readings that a compatible CGM app or sensor has written there. If you connect a supported CGM sensor directly over Bluetooth, INDX also receives that sensor's glucose readings, signal and battery state, and serial number.
What you log in the app
Meals (text, photo, barcode, or a voice note), exercise sessions, habits such as sleep, activity, meditation and water, and the goals and challenges you set.
Photos and microphone
The camera is used to photograph meals and share cards. The microphone is used to dictate meal entries; the recording is converted to text and is not saved.
Account information
Signing in is optional. If you create an account, we hold your email address and sign-in method (Apple, Google, or a one-time email code). There is no advertising identifier and we do not build a marketing profile of you.
Technical information
When the app contacts our servers, our infrastructure records routine request data such as timestamps, IP address, and installation identifiers, as any internet service does. We use this to operate and secure the service.
Launch waitlist
If you join the launch waitlist, we collect your email address and the date you signed up so we can send you launch and early-access updates. The address is stored using Cloudflare D1 and is not used for advertising or sold. We keep it until you unsubscribe or ask us to delete it. You can leave the list at any time by emailing [email protected].
Cloudflare may process routine request information, such as your IP address and request time, to deliver and secure the website and waitlist. We do not save your IP address in the waitlist record.
3. Where your data is stored
On your device, by default
Your readings and logs are stored in the app's local database on your iPhone, protected by iOS file protection. The health data directory is excluded from iCloud backups. Your local CGM history is kept for about 400 days. Health samples imported from Apple Health do not currently have an automatic expiry and remain until you remove them or delete the app. Simulated data used for demonstrations and development is never written to your history.
Cloud backup is optional and off by default
Backup only starts after you sign in and switch it on in Settings. It exists so that you can restore your history to a new phone. This is what is and is not included:
| Included in backup | Not included |
|---|---|
| Raw glucose and CGM readings, heart rate, sleep, meals, exercise and habits | Meal photos and photo file paths, assistant chat history, cached content, device pairing records and app preferences |
If you turn backup off, uploading stops, but the encrypted copy already stored remains until you delete your account. Deleting your account removes it.
How backup is protected
Your data is encrypted on your device, before it is sent, using AES-256-GCM. The encryption key is generated on your device and stored in the iOS Keychain. It is never transmitted to us, stored on our servers, or written to logs, so we cannot decrypt your health data — and neither can anyone who obtains a copy of our database.
Each encrypted record is bound to your account, the record, and its category, so ciphertext cannot be moved between records or accounts without detection.
What our servers can still see
We want to be precise about the limits of the design above. Our servers, and anyone who compromises them, can see:
- that an account exists, the email address on it, and when it was created;
- how many encrypted records you have, when each was written, and its broad category (for example glucose, health, or meal);
- a fingerprint that tells us whether an encrypted record's contents changed, without revealing the contents;
- connection metadata such as request volume and device and installation identifiers.
They cannot see your glucose values, heart rate, sleep, meals, or habits. Reducing the metadata above is work we intend to continue.
4. Apple Health (HealthKit)
INDX reads data from Apple Health only to provide the app's features to you. We do not use HealthKit data for advertising or marketing, we do not sell it, and we do not share it with third parties for their own purposes. We do not disclose it to anyone without your consent except where the law requires it. You can revoke INDX's access in the Apple Health app or in iOS Settings at any time.
5. The AI assistant
When you use the assistant, the message you send and the readings needed to answer it are sent to our backend and on to the third-party AI model provider that generates the reply. Some messages are deliberately not sent to a model — for example acute symptoms, medication and dosage questions, pregnancy, eating disorders and self-harm — and are answered by fixed safety guidance instead, directing you to a clinician or a support service.
Assistant conversations are not part of your cloud backup and are not used to train models. The assistant's quota is tracked against your account so usage limits can be enforced.
6. What we do not do
- We do not sell your personal data.
- We do not use your health data for advertising or share it with advertising networks.
- We do not train models on your readings. We do not currently collect aggregate usage analytics or use your data for research. If that changes, it will be opt-in, separate from backup consent, and described here first.
- We do not inspect your readings for support. Because values are encrypted end to end, no one at INDX — including our support team — can read them, even to debug a report.
7. Sharing with service providers
We use a small number of processors to run the service: Supabase for authentication and cloud storage, Cloudflare for website hosting and waitlist storage, and hosting and AI model providers for the assistant. They act on our instructions and receive only what is needed for their part of the service, which for health data means ciphertext they cannot read. We do not share your data with anyone else unless you ask us to or the law requires it.
8. Retention and deletion
- On your device: CGM history about 400 days; other data until you remove it or delete the app.
- Cloud backup: until you turn backup off and delete your account.
- Account: until you delete it. Deleting your account removes your cloud backup and clears that account's local data and caches on your device.
- Waitlist: until you unsubscribe or ask us to delete your email address.
9. Your choices and rights
- Access and export: your data is visible in the app, and you can export your health data from Settings.
- Correct: you can edit or delete entries you have logged.
- Delete: you can delete your account and its cloud data from Settings.
- Withdraw consent: you can turn backup off, or revoke Apple Health and Bluetooth permissions in iOS Settings without deleting the app.
- Waitlist: email us to unsubscribe or request deletion of your waitlist entry.
Where local law gives you additional rights — for example access, correction, or erasure under the Hong Kong Personal Data (Privacy) Ordinance, or equivalent rights elsewhere — you can exercise them by contacting us. We will respond within the period the applicable law requires.
10. Security
Data in transit is protected with TLS. Sign-in credentials and your encryption key are held in the iOS Keychain and are usable only on your device after first unlock. On our side, access controls limit who and what can reach stored data, and — as described above — health values are stored only as ciphertext.
No system is perfectly secure. If you lose your encryption key (for example by losing the device without a key backup), the encrypted cloud copy cannot be recovered by us, because we cannot read it.
11. Children
INDX is intended for adults managing their own metabolic health and is not directed at children. We do not knowingly collect data from children.
12. International transfers
Our service providers may process data in countries other than yours. Where data is health data, it is transferred in encrypted form that the recipient cannot read. We choose providers and regions with appropriate safeguards and, where required, put contractual protections in place. Contact us if you would like to know the region used for your account.
13. Changes to this policy
If we change how we handle your data, we will update this page and revise the effective date above. Material changes that affect what we collect or how we use it will be communicated in the app before they take effect.
14. Contact
Questions about this policy or your data: [email protected].