This policy explains how Torvmark Labs (Torvi Studio) handles information in connection with GlucoLumi.
Version scope: This page describes GlucoLumi 1.0 (173), awaiting Apple approval. The available TestFlight build may differ; check TestFlight for current beta availability. The in-app policy reference is 2026-10-01. The separate health-data consent notice is 2026-10-01.1.
GlucoLumi is designed for iPhone and a paired Apple Watch, with widgets and Live Activities. It is not offered as a Mac app. It does not create a separate Torvi Studio account.
On this page
1. Who is responsible
For the processing for which we are responsible, the controller is Torvmark Labs, a sole proprietorship with organisation number 938 284 792, Hovsveien 27D, 1769 Halden, Norway. Torvi Studio is our brand. Contact: hello@torvistudio.com.
2. Information we and our partners handle
GlucoLumi is a personal data overview for importing, storing, displaying and exporting glucose readings from LibreLinkUp or a Nightscout source you connect, and records read from a compatible insulin pen. It is not intended for dosing, diagnosis, treatment changes or emergency decisions.
Depending on the features you choose, the app handles:
- glucose values, timestamps, source trends, sensor start and estimated expiry, follower-connection details and source identifiers;
- your LibreLinkUp email, password, region and session, or Nightscout HTTPS address and optional read token;
- pen records read via NFC, including recorded units and times, pen serial number, model and part number, scan times and import status;
- pen profiles with names and insulin labels you enter, your basal/bolus selection, your choice of automatic export to Apple Health for each pen, the shared airshot threshold, automatic and manual airshot markings, and pending Health correction or export status;
- display units, history period, selected source, sync and reminder choices, saved progress for initial setup and Review setup, the demo-session return point and settings restoration copy, the version of a deferred consent-renewal prompt, and locally recorded acceptance of safety information, terms and the privacy revision; the separate health-data consent receipt includes the notice text, version, language, consent time and any withdrawal time;
- glucose and insulin records you choose to write to Apple Health, with source identifiers and sync versions for duplicate prevention and corrections;
- local sync status, technical errors and Apple-generated MetricKit crash, hang and performance reports.
If you contact support, Torvi Studio receives your email address and what you choose to include. The app does not automatically send health history, credentials or diagnostics to support.
Website visits and language/theme preferences
When you visit our website, the web server receives your IP address, requested address and browser/request information to deliver and protect the page. Our hosting provider processes this technical information for us; the basis is our legitimate interest in operating a secure, available website. Remembering a language or theme implements your requested preference. The site stores your chosen language and theme in functional cookies shared across torvistudio.com and its subdomains, with browser-local storage as a fallback. The cookies are named torvi-lang and torvi-theme and expire one year after they are set; browser-local copies remain until cleared. These preferences contain no account or advertising identifier. You can change them on any page or clear them through your browser. They are separate from in-app Analytics and advertising consent.
3. Storage, sync and connected services
CGM credentials, sessions and read tokens are stored in Apple's Keychain. Glucose history is stored locally in the app group's SwiftData database with CloudKit disabled. Pen profiles and records are stored locally, including a local recovery copy. Preferences, acknowledgement records and the latest glucose snapshot are also stored on the device.
During a demo session, the app locally keeps its return point, pre-demo settings, source and dataset identifiers, Health-sync choice and a copy of the previous glucose snapshot, which may contain real readings. These copies restore your earlier state when you exit. Recovery copies are cleared after successful exit; the return point is cleared when the return to setup or Settings has been handled. A failed exit retains recovery information for retry. This is local recovery information, not a new upload of health data.
The widget extension uses the shared app group and credentials to display the latest snapshot and, for LibreLinkUp and Nightscout, fetch a fresh reading directly when access and consent allow it. The paired Apple Watch receives snapshot data through Apple's WatchConnectivity service. GlucoLumi does not use CloudKit to sync glucose history or upload it to our own server. Sharing a snapshot does not transfer the complete history.
Device backups and separate copies
The app asks the operating system to exclude its own database, pen files, local recovery copies, settings and app-owned Watch copies from new iCloud and computer device backups. The instruction applies after the updated app or extension runs; it is not a guarantee that no system-managed copy can exist. Existing backups are not deleted. Do not rely on a device backup to restore lost GlucoLumi data. Local recovery files protect against certain file errors on the same device; they are not an off-device backup.
Apple Health, Keychain, operating-system-managed copies and files you export are handled separately. The app does not request iCloud Keychain sync for its credentials; its device-only Keychain setting restricts migration, but may allow restoration to the original device. Your Apple Health settings control Health's separate iCloud sync. A CSV saved to iCloud Drive is a copy you choose to create. See support for backup controls and their limitations.
Apple Health and pen records
Apple Health integration is optional. Active health-data consent is required for new fetching and new Health writes; Health permission is an additional, separate choice. New CGM fetching and pen reading within the app require subscription access, but not Health permission. You request Health permission through a separate action; if you decline or dismiss it, requested access or exports can be handled later from Overview. Writing already stored data, including pending queues, to Health does not require a subscription. For glucose export to Apple Health, the app requests write access only to blood-glucose data. It writes values, timestamps, stable source identifiers and sync versions so Health can merge repeated or corrected writes. Enabling Health sync can export locally stored readings as well as newly fetched readings to Apple Health. The app does not request permission to read your glucose history from Health.
Export of insulin records to Apple Health has a separate permission flow for writing insulin-delivery records, also without read access. A written record contains units, time, your selected basal/bolus category, a stable identifier and sync version. Pen display names and insulin-name labels stay local. GlucoLumi does not automatically identify the insulin or its category.
A pen record indicates an actuated dose, which may include priming; it does not confirm an injection. Airshot threshold is one shared setting for automatic marking, not a separate Health-export minimum. Its default of 0 U disables automatic marking. You must confirm your choice, including 0 U, before the first real pen export to Apple Health. The Export automatically to Apple Health switch is off for new pens and requires a separate choice for each pen.
With current health-data consent, new and retained records strictly below the threshold are automatically marked as airshots. Records equal to the threshold are not automatically marked. Airshots remain in pen history and full CSV exports, but are excluded from the insulin overview and Health exports. Changing the threshold updates automatic markings; manual markings remain. An automatic marking cannot be individually overridden while the record is below the threshold. This is a user-chosen amount rule, not verified detection of priming or an injection; it can also exclude genuine small injections.
If GlucoLumi already exported an affected record, it queues removal of its own matching Health sample. Removal is limited to its own samples with the record's exact identifier and can fail or require a retry. Lowering the threshold does not cancel pending removal: removal must finish before a later permitted export. Changing a marking does not erase the original pen record locally or immediately write it back to Health.
A pending Health correction must finish before the record can be deleted individually; a full app reset can still remove pending work. Supported corrections do not provide unrestricted editing of historical doses, times or categories. Changing a pen profile does not automatically rewrite earlier categories. Apple manages Health data and permissions. Torvi Studio cannot access your Health database. Local deletion or reset does not remove Health samples and is not a substitute for completing a targeted Health correction.
History, visibility and exports
The app version described here imports and displays source data. It does not calculate GMI, time in range, glucose variability, insulin on board or dose recommendations, and it does not generate its own glucose alerts. Reading age and technical sync errors remain visible. Local development builds may include experimental analysis and alerts; these features are unavailable in TestFlight and App Store builds.
Widgets, Live Activities, Dynamic Island and the paired Apple Watch can display glucose values outside the main app. Choose where this information is visible through the relevant Apple settings.
CSV export runs only when you request it. Glucose export covers the selected period and active dataset, not every glucose source or all history at once. Select an older CGM dataset again to view or export it. Export full pen history includes all retained records from all stored pens regardless of the date filter, including airshots, pen identifiers, timestamps, units and Health export/correction status. Deleted records are not recovered. You choose where to save or share the file. Exports contain health information; a demo export is labelled DEMO and demo data are never written to Health. CSV files cannot be imported back into GlucoLumi as a backup. Resetting the app does not delete exported copies.
Optional reminders and demo
Local reminders are off by default. If enabled, the app uses configured pen scan times to decide whether a pen reminder is needed and app activity plus the presence of a real CGM source for an app-opening reminder. Reminders pause in demo mode or without active health-data consent. Notification content contains no glucose value, dose, pen identifier or account information. These are practical reminders, not glucose alerts or insulin advice, and delivery is not guaranteed.
Demo is a separate trial session that you confirm. It needs no CGM account, subscription, physical pen or health-data consent. Use Exit demo to end it. Starting demo from setup pauses that setup; exiting returns to the same page, including after restarting the app. Demo started from Settings returns to Settings. App settings changed in demo return to their pre-demo values when exit completes.
Demo pen records use separate, temporary history that clears on exit or app restart. Synthetic glucose history uses a separate local dataset; exiting demo does not delete that dataset or files you exported. Demo records do not replace real pen history and are never written to Apple Health. Demo does not test real NFC, provider sign-in or Health writes.
Exit demo before configuring real CGM connections, changing health-data consent, purchasing or managing a subscription, setting up reminders or changing real-data permissions or deletion settings. Legal information remains readable. See support for demo and reminder instructions.
Security
The app uses Apple's Keychain for secrets, requires HTTPS for Nightscout, stores history locally without CloudKit and applies Apple's file protection to local MetricKit files. No system is completely secure. Protect your device and CGM accounts, review where values may be visible, and use a read-only Nightscout token rather than an API secret.
Intended use and safety
GlucoLumi is an informational companion for source data. Readings, pen records, trends and Apple-device displays may be delayed, incomplete, incorrect or unavailable. Background updates are controlled by Apple. Do not use the app for dosing, diagnosis, treatment changes or emergency decisions, or as an alarm source. Use the manufacturer's official solution and follow your treatment plan.
See the GlucoLumi terms and safety information for the scope of use and pen-record limitations.
4. Purchases and subscriptions
GlucoLumi uses Apple's StoreKit for a monthly auto-renewable subscription and any eligible introductory offer. Apple handles payment, purchase confirmation, renewal and refunds. GlucoLumi does not receive your card details and has no Torvi Studio billing server. The purchase flow does not send your glucose history, pen records or CGM credentials to a payment or advertising service.
To verify access, the app processes StoreKit purchase and renewal information. It keeps a local app-group cache of the product identifier, original transaction identifier, access status, expiration date, any grace-period end and verification time. A local time reference helps prevent the cached access period being extended by changing the device clock. App extensions use this verified, time-limited status for new-data access. No separate Torvi Studio account is created.
A subscription provides access to new pen scans and CGM data fetching, including fresh readings for widgets and other displays. A pen scan started with valid access may finish after the subscription expires. Already stored records and queues can still be written to Apple Health without a subscription, with active health-data consent and the required Health permission. History, supported corrections, export and deletion remain available; this does not mean every display or overview is unlocked. See support and terms for renewal and cancellation information.
5. Analytics, advertising and consent
GlucoLumi contains no advertising SDK, cross-app tracking, third-party analytics or third-party crash-reporting SDK. Torvi Studio does not sell glucose data, credentials or health information, use Health data for advertising, marketing, profiling or data brokering, or use the data for research. Your Apple Health database and local glucose history are not uploaded to Torvi Studio.
Health-data consent
A separate explicit choice is required before real pen scans, CGM fetching, new Apple Health exports and automatic airshot changes or removals. The current health-data consent notice is 2026-10-01.1 and also describes optional local reminders. The website policy reference remains 2026-10-01. Demo use does not require health-data consent. Buying a subscription, accepting terms or granting an Apple system permission does not itself provide this consent. The notice and receipt are stored locally, not in a central consent database.
First-time setup for real data requires the safety and privacy acknowledgements, separate health-data consent and a verified subscription or eligible trial. On long pages, Continue scrolls through the content before advancing; reading or scrolling alone accepts nothing. Acknowledgements require an explicit selection followed by Continue. Setup and Review setup have separate local progress records. Deferring a consent-renewal prompt records only the prompt version, not consent.
If health-data consent is missing, withdrawn or for an older notice version, new fetching, new Health exports and automatic airshot changes and removals are paused. This includes work in existing queues. Existing markings and history are retained. System operations already started may finish.
Where offered, existing users can choose View saved data after completing any required safety and privacy acknowledgements. This does not give or renew health-data consent, start demo mode or allow new fetching. Viewing retained history, CSV export, deletion subject to the existing restrictions and explicit manual corrections remain available without a subscription. A manual Try again processes only the selected record, not other queued records, and does not resume automatic processing. New Health exports still require current consent and the required Health permission.
You can review or withdraw consent under Settings → Privacy and safety → Your acknowledgements → Health data consent. Withdrawal also ends Live Activities and requests a reset of Watch snapshots; an offline Watch may update later. Credentials and pending Health correction/export records are not automatically deleted. To resume automatic processing, give the current consent explicitly; Health sync must be enabled again separately. Withdrawal does not cancel a subscription or delete information already held by Apple Health, your CGM provider or an export destination. Withdrawing consent does not affect the lawfulness of earlier consent-based processing.
TestFlight beta testing
TestFlight separately sends Apple-collected crash and usage data to Torvi Studio automatically. Feedback may include screenshots and contact details; public-link invitations do not reveal your name/email unless included in feedback. This is separate from local MetricKit reports. We use it for beta troubleshooting, not advertising. Apple controls platform retention; our downloaded copies are handled for the support/testing case as described below. Prefer demo data or redacted feedback; do not include unnecessary health information. See TestFlight & Privacy.
Diagnostics and support
Apple-generated MetricKit reports about crashes, hangs and performance are stored locally for no more than 30 days and no more than 20 reports. They are not uploaded automatically. You can preview and delete the reports in the app, and they are exported only when you manually choose to share a diagnostics file.
GlucoLumi does not add glucose values, measurement identifiers, account details, email addresses, server addresses, credentials or HealthKit samples to the diagnostics report. Apple-generated MetricKit payloads may contain technical device and app metadata and call stacks, so the app lets you inspect them before sharing.
If you send a report or support message, we use your contact details and submitted content to handle the request. Support email is handled through Webhuset. Prefer demo data and redacted screenshots, and never send passwords or access tokens. If health information is necessary, we first explain what is needed and why and obtain specific explicit consent before requesting it. Necessary health attachments are removed from the case's working copies when the case is closed. This is a manual process, not automatic erasure of provider backups or every email-client copy; those copies are handled under their actual arrangements.
6. Data sharing
Connected CGM services
For LibreLinkUp, read the service-specific privacy notice displayed in the official LibreLinkUp app for your country. Abbott’s privacy centre links to regional information; its general website notice does not replace that service-specific notice. For Nightscout, consult the operator of the exact instance you connect to; there is no single policy covering every self-hosted instance.
- LibreLinkUp: GlucoLumi sends your email and password directly to a known LibreLinkUp server to sign in and fetch follower connections and measurements. Automatic region selection starts at the EU server and follows Abbott's account-region redirect only to recognised LibreLinkUp servers. You can instead choose a starting region under Advanced; account-region redirects are still followed. This integration uses an unofficial interface that Abbott may change. Torvi Studio is not affiliated with or endorsed by Abbott.
- Nightscout: GlucoLumi connects directly to the HTTPS site you provide and sends the read token, if any, to that site.
The iPhone app and widget extension may make the current LibreLinkUp and Nightscout connections directly from your device. Each configured provider receives the requests and processes information under its own terms and privacy policy. Torvi Studio does not receive those credentials or glucose responses.
Legal basis and choices (EEA/UK)
For the app's defined processing needed to provide the agreed service, we use contract as the basis under GDPR Article 6(1)(b). For health information we additionally request explicit consent under Article 9(2)(a). Optional sharing is a separate user choice based on consent under Article 6(1)(a) and, for health information, Article 9(2)(a). These grounds concern personal-data handling, not medical treatment. They do not make us responsible for every operation of Apple, Abbott or your chosen Nightscout operator; those services have their own roles and notices.
Ordinary support needed to fulfil our agreement is handled on a contractual basis. Other enquiries, troubleshooting and service security rely on our legitimate interests where appropriate; you can object to that processing. Specific legal obligations may require particular records. A Health system permission or acceptance of terms is not a general consent for us to receive your health history. Sensitive support information requires a separate, specific assessment and consent before we request it.
For the providers’ own processing and international-transfer safeguards, see Apple’s privacy policy. Depending on the provider and service, information may be processed outside the EEA/UK. The provider’s applicable policy explains the destinations and safeguards, such as adequacy decisions or standard contractual clauses. Contact us for information about transfers involving data Torvi Studio holds.
7. Retention and deletion
Local history from real sources is kept until you delete it, reset the app or remove the app and its data. Disconnecting a CGM source removes its saved login, token or session but keeps local history and samples already written to Apple Health. Forgetting a pen removes its profile while preserving its records. You can delete individual pen records locally; a local hidden-record identifier prevents a later scan from restoring them.
Under Settings → History and export → Local storage, a completed Delete all app data and reset removes local glucose history, pen profiles and records, CGM credentials, preferences, snapshots, Live Activity, locally stored diagnostics and remaining app notifications. It does not delete Apple Health samples, revoke system permissions, remove provider data or delete exported files. Manage these copies and permissions separately. Resetting or uninstalling does not cancel an Apple subscription or delete Apple's purchase records. The local subscription cache is cleared by reset and can be recreated from verified StoreKit purchases. A technical glucose-sync version counter remains so future writes do not overwrite Health samples with older versions; it contains no glucose values.
A full reset also removes health-data consent and pending work. Complete pending Health corrections first. Earlier backups, exports and source data are not deleted. Reset is sent to the Watch, but an offline Watch can retain a snapshot until delivery succeeds. If clearing a widget request or deleting pen history fails, Settings stays available with an error so you can retry. Data already deleted are not restored: reset is not an all-or-nothing operation.
Keychain items may survive uninstalling the app. Use disconnect or reset before uninstalling; if necessary, reinstall and reset to remove retained credentials. Torvi Studio cannot remotely access or delete information stored only on your devices, in Apple Health or with your chosen provider.
8. Your rights and choices
Because app and health data normally remain on your devices or with providers you choose, Torvi Studio usually has no copy it can access, correct or delete. We can respond to requests concerning support correspondence or other information Torvi Studio actually holds. Depending on the processing and applicable law, people in the EEA may have rights of access, correction, deletion, restriction, data portability and objection. You may complain to the Norwegian Data Protection Authority or your relevant local supervisory authority.
9. Children
GlucoLumi does not create a separate user account with us. Consent to handling your own health information does not authorise handling another person's information. Before connecting another person's or a child's readings, the required authority and lawful basis must be established; a follower connection or acceptance of these terms alone is not sufficient. The app does not provide a separate guardian-verification flow. Contact us without sending health records if you need clarification.
10. Changes to this policy
Material changes are shown in the app and may require a new confirmation. The date above identifies this website revision. Accepting safety information is not consent to unrelated data use.
11. Contact
Provider: Torvmark Labs (Torvi Studio), sole proprietorship, organisation number 938 284 792, Hovsveien 27D, 1769 Halden, Norway. For support, privacy or legal questions: hello@torvistudio.com.