Back to home

Privacy Policy

1. Data Controller & About the Project

The controller of your personal data is Maciej Nasiadka - the owner and creator of this app. Contact via the contact form at https://guardian.nasiadka.pl/contact.

2. What data do we process and why?

  • Email Address: Serves as account identifier and for sending account- and service-related messages (e.g., confirmations, password recovery, sync status notifications, and other important information about the app's operation).
  • App Password: Stored as a secure hash, unreadable by the administrator.
  • CareLink Tokens: We store auth tokens (Access/Refresh Token) allowing our server to fetch data on your behalf. We do NOT know or store your CareLink password.
  • Insulin Data: We fetch basal micro-boluses and automatic correction boluses to generate charts and basal profiles. This constitutes health-related data (sensitive data category).

Legal basis: your explicit consent - Art. 6(1)(a) GDPR and, for health data, Art. 9(2)(a) GDPR (you give it by ticking the box when registering and can withdraw it at any time by deleting your account); for running your account and sending service emails - necessity to perform the agreement, Art. 6(1)(b) GDPR; for the contact form and server logs - the controller's legitimate interest, Art. 6(1)(f) GDPR (answering enquiries, security and stability of the service). Providing data is voluntary but necessary to use the app.

Your data is not subject to profiling that would lead to automated decision-making.

3. Your Rights

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise these rights use the contact form; erasure is also available at any time through the "Delete account" button.

You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

4. Data Retention Period

Data is stored for as long as you use the app and until your account is deleted or consent is withdrawn; after that it is deleted. Specific periods:

  • Unverified accounts: deleted automatically after 7 days.
  • Synchronization logs (time and result of each sync): as long as your account exists, deleted together with it.
  • Contact form messages: 12 months from receipt, or earlier on your request.
  • Server logs (IP address, time, requested address, browser): kept on the administrator's own server for as long as needed for security and traffic statistics.
  • Backups: deleted data may remain in database backups (under the administrator's sole control) until they expire, for up to several years. They are used only to restore the system after a failure.

5. Data Security & Hosting

CareLink login happens locally on your computer (using the provided script). The script sends only session tokens to our server.

Connection is encrypted (HTTPS).

Only the app administrator has access to your data. The database and application are hosted on the administrator's private home server (within the EEA). Your data is not sold and is not shared for advertising.

6. Recipients of data

Besides the administrator, your data can be processed on our behalf by:

  • An email delivery service provider - sends our emails (account confirmation, password reset, notifications).
  • The provider of the administrator's mailbox (WP) - receives the replies you send to our emails (the Reply-To address).

7. Contact form

If you write to us through the contact form, we process your name, email address and message to answer you (legitimate interest, Art. 6(1)(f) GDPR). Messages are kept for up to 12 months.

8. Server logs

Like every web server, ours automatically records technical data about each request: IP address, date and time, requested address, response status and browser identifier (User-Agent). We use it to keep the service secure and stable, e.g. to detect abuse and attacks, and for traffic statistics (legitimate interest, Art. 6(1)(f) GDPR). Logs stay on the administrator's own server, are not shared with anyone and are not used to profile you.

9. Cookies

The service uses one technical cookie: auth_session. It is used solely to keep you signed in (valid for up to 90 days). We do not use tracking, advertising, or analytical cookies from third parties.