Privacy Policy

Neevo Care Ltd is the controller responsible for personal data processed through the Services for our own purposes.

If you have any questions about this Privacy Notice or wish to exercise your privacy rights, please contact us using the details above.

This Privacy Notice applies to individuals who use or interact with the Services, including parents and guardians, invited family members, trusted carers and eligible child or teen users.

A parent or guardian may provide personal data about a child or another person when creating and managing a family account. Users must only provide information about another person where they are authorised or otherwise entitled to do so.

The personal data we collect depends on how you use the Services and may include:

• Identity and account data, such as your name, email address, account role, profile information and authentication-related information.
• Family and relationship data, including information about children or other family members associated with an account and the roles of authorised users.
• Health and care-related data voluntarily entered or uploaded by users, including information relating to Type 1 diabetes, care plans, device or sensor/pump site records, supplies, notes, tasks, appointments and other care-related information.
• Documents and records uploaded by users, which may include care plans, school documents, appointment information, results, insurance or benefit-related documents, receipts and other records selected by the family.
• Usage and activity data, including actions taken within a shared family account and information identifying which authorised user recorded, acknowledged or updated information.
• Communications data, including information you provide when you contact us for support or otherwise communicate with us.

Neevo is designed to help parents and guardians organise and coordinate the practical aspects of caring for a child with Type 1 diabetes. As a result, Neevo processes health information about children as a core part of providing the Services. Health information is considered sensitive personal data and is subject to additional protections under applicable privacy and data protection laws.

The health information stored within Neevo is primarily provided by parents, guardians and other authorised users and may include information relating to a child's Type 1 diabetes care, care plans, diabetes devices and device sites, supplies, appointments, care-related tasks and notes, and health information contained within documents or records that users choose to upload to the Services.

Neevo processes this information for the purpose of providing the organisational and care-coordination functionality requested by families. Neevo does not provide medical diagnosis, determine or recommend treatment, calculate insulin or medication doses, provide clinical decision-making, or act as an emergency or glucose-monitoring service.

Access to a child's health information is controlled according to the roles and permissions available within the Services. Parents and guardians control who they authorise to access the family account and may provide access to trusted individuals, including family members and carers, in accordance with the permissions assigned to them. Access can be removed when it is no longer required.

We recognise that children's health information is particularly sensitive and requires a high level of protection. We apply appropriate technical and organisational measures designed to protect this information against unauthorised access, loss, misuse, alteration or disclosure. These measures include authenticated user access, role- and permission-based controls within family accounts, restrictions on access to personal data within our organisation, and appropriate safeguards for service providers that process personal data on our behalf.

We seek to limit the collection, use and disclosure of children's health information to what is necessary for the provision, security and operation of the Services and to provide privacy-protective settings appropriate to the nature of the information being processed.

We process health information only where permitted by applicable privacy and data protection laws and in accordance with any additional requirements that apply to sensitive or specially protected personal data.

Neevo collects personal data from you and about you depending on how you interact with our Services. We may use personal data to:

• create, maintain and administer user and family accounts;
• provide, operate and maintain the Services and the features available under your subscription;
• administer subscriptions, purchases, renewals and account status;
• enable authorised users within a family account to organise and coordinate information;
• display records, documents, notes, tasks, appointments, reminders and supplies information selected by users;
• maintain records of actions taken within shared accounts where attribution is necessary for the operation of the Services;
• communicate with you about your account, subscription or the Services, including important service, security and administrative notices;
• respond to enquiries, customer support requests and other communications from you;
• maintain the security, integrity and reliability of the Services;
• investigate technical problems and improve the performance, functionality and user experience of the Services;
• where permitted by law and, where required, with your consent, send you marketing communications about Neevo, including news, promotions, events, products or services that may be of interest to you. You can opt out of marketing communications at any time;
• comply with our legal and regulatory obligations;
• establish, exercise or defend legal rights and protect the security and safety of the Services and their users.

Neevo does not use information entered by families to diagnose medical conditions, calculate medication or insulin doses, or make clinical treatment decisions.

Neevo does not display third-party advertising within the Services and does not sell personal data to advertisers. We do not use children's personal data or health information for advertising, behavioural advertising or advertising profiling.

We process personal data only where permitted under applicable privacy and data protection laws. The legal basis or justification for processing may depend on where you live, the nature of the personal data and the purpose for which it is processed.

Where applicable, the legal bases we rely on may include:

• Performance of a contract: where processing is necessary to provide the Services you have requested, administer your account and subscription, provide customer support, and deliver the functionality available through Neevo.
• Legitimate interests: where processing is necessary for our legitimate business interests or those of another person, provided those interests are not overridden by your rights and interests. This may include maintaining and improving the Services, ensuring their security and reliability, preventing misuse, understanding how the Services are used, and establishing, exercising or defending legal rights.
• Legal obligation: where processing is necessary for us to comply with a legal or regulatory obligation.
• Consent: where we ask you to provide consent for a particular processing activity, for example certain marketing communications or the use of non-essential cookies or similar technologies where consent is required. Where we rely on consent, you may withdraw it at any time, although this will not affect the lawfulness of processing carried out before consent was withdrawn.

Where we process health information or other sensitive personal data, we will also comply with any additional requirements that apply to the processing of that information under applicable privacy and data protection laws.

Further information about our processing of children's health information is provided in the section “Health information and other special category data” above.

Neevo is designed to support families caring for children with Type 1 diabetes and, as a result, we recognise that children's personal data requires particular protection and take this into account in the way we design and operate the Services.

A parent or guardian establishes and manages the family account on behalf of a child and may provide personal data about that child to Neevo. Parents and guardians are responsible for ensuring that they have the appropriate authority to provide information about a child and to manage access to that child's information through Neevo.

Parents and guardians may invite other trusted individuals, such as another parent or guardian, family members or carers, to access relevant information about a child in accordance with the roles and permissions available within the Services. Parents and guardians are responsible for managing this access and should remove access when it is no longer required.

Where available, eligible older children or teenagers may be provided with their own access to certain Neevo functionality. The information and functionality available to a child or teen user will depend on their age, account type and the permissions applicable to their account.

We seek to collect and process only the personal data reasonably necessary to provide, secure and operate the Services and to apply privacy-protective settings appropriate to children. Where privacy information or choices are presented directly to a child, we aim to provide them in clear, accessible and age-appropriate language.

Information about our processing and protection of children's health information is provided in the “Health information and other special category data” section of this Privacy Notice.

Neevo is designed to enable controlled sharing of information between people authorised to participate in a family account. Personal data relating to a child, including health and care-related information, may therefore be accessible to authorised users of that child's family account in accordance with their assigned role and permissions.

Parents and guardians may invite trusted individuals, such as another parent or guardian, family members or carers, to access relevant information through Neevo. The information and functionality available to each user may differ depending on their role and the permissions associated with their access.

Parents and guardians are responsible for deciding whom they authorise to access a family account and should only provide access to individuals who require it for an appropriate purpose. Access should be removed when it is no longer required.

Neevo facilitates the sharing of information between authorised users within a family account but does not independently select the individuals with whom a family chooses to share information.

Certain actions within Neevo may be recorded and attributed to the user who performed them. This allows authorised users to understand, where relevant, who added, updated, acknowledged or recorded particular information or activity within the family account.

Where a user's access to a family account ends or their individual account is deleted, certain shared family records and activity history may remain available to other authorised users where those records form part of the continuing family account. Further information about deletion and retention is provided in the “Account deletion and shared family information” section of this Privacy Notice.

We may engage trusted third-party service providers to support the operation of the Services. Where those providers process personal data on our behalf, we require them to process it in accordance with applicable data protection requirements and appropriate contractual safeguards.

The categories of third parties we use may include hosting and cloud infrastructure providers, authentication providers, communications providers, subscription/payment providers, analytics providers and technical monitoring or error-reporting providers.

We may also disclose personal data where required by law, where necessary to protect our legal rights or the rights and safety of others, or in connection with a merger, acquisition, reorganisation or sale of all or part of our business, subject to appropriate safeguards.

Neevo is based in the United Kingdom, and the service providers we use to operate and support the Services may store, access or otherwise process personal data in countries other than the country in which you are located.

Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer is made in accordance with applicable privacy and data protection laws and that appropriate safeguards are in place where required.

For transfers of personal data from the United Kingdom, where the recipient is not covered by UK adequacy regulations, we will use an appropriate transfer mechanism where required, which may include the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional protections required in the circumstances.

Where we use service providers that process personal data internationally, we take appropriate steps to ensure that such providers are subject to contractual and data protection obligations designed to protect personal data.

Where applicable, further information about the safeguards used for international transfers may be requested by contacting us using the details provided in the “Contact us” section of this Privacy Notice.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide and operate the Services, maintain the security and integrity of the Services, and comply with applicable legal, accounting, regulatory and dispute-resolution requirements.

Where an individual user account is deleted, personal data relating specifically to that user will generally be retained for a 14-day recovery period, after which it will be deleted or anonymised, unless we are required or permitted by law to retain certain information for longer.

Deleting an individual user's account does not necessarily result in the deletion of information forming part of a shared family record. Shared records, documents, care information and activity history may remain available within the family account where they form part of the continuing record used by other authorised users. Further information is provided in the “Account deletion and shared family information” section below.

Retention periods may vary depending on the nature of the information, the purpose for which it is processed and any applicable legal or regulatory requirements. When determining an appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the information and whether those purposes can be achieved by other means.

Neevo family accounts contain information that may be created, contributed to and relied upon by multiple authorised users. For this reason, deleting an individual user's account does not automatically delete information that forms part of the family's shared records.

When an individual user deletes their account, personal data relating specifically to that user's account will be handled in accordance with the retention periods described in the “Data retention” section above. Shared family information, including records, documents, notes and other information forming part of the continuing family account, may remain available to other authorised users even where the departing user originally created, uploaded or entered that information.

Where the primary parent or guardian deletes their account and another eligible parent or guardian remains within the family account, responsibility for the family account will transfer to the remaining eligible parent or guardian in accordance with Neevo's account rules.

Where the primary parent or guardian is the only eligible parent or guardian associated with the family account, they will be required to add another eligible parent or guardian before their account can be deleted. This is designed to prevent deletion of the account from unintentionally removing or disrupting access to shared family information relied upon by the continuing family.

Certain records of activity within the family account may also need to be retained after an individual user's account has been deleted, for example where this is necessary to preserve the integrity and continuity of the family's shared records, maintain appropriate audit or security records, or comply with legal obligations. Where appropriate, information identifying the departing user will be deleted, anonymised or otherwise limited in accordance with our retention practices and applicable law.

We recognise the sensitive nature of the personal data processed through Neevo, particularly children's health information, and take the security of that information seriously.

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our security measures are designed to reflect the nature and sensitivity of the personal data we process and the risks associated with that processing.

Access to personal data within Neevo is controlled through authenticated user accounts and role- and permission-based access controls. Within a family account, access to information is limited according to the role and permissions assigned to each authorised user.

We also restrict access to personal data within our organisation to authorised personnel who require access for legitimate business purposes and require service providers processing personal data on our behalf to implement appropriate security and data protection measures.

While we take appropriate measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure. Users are responsible for keeping their account credentials secure, protecting access to their devices and ensuring that access to their family account is only granted to appropriate and trusted individuals.

If you become aware of or suspect unauthorised access to your Neevo account, you should contact us promptly using the details provided in the “Contact us” section of this Privacy Notice.

Depending on where you live, you may have rights in relation to your personal data under applicable privacy and data protection laws. These rights vary by jurisdiction and may include:

• Access – the right to request information about the personal data we process about you and, where applicable, receive a copy of that data.
• Correction – the right to ask us to correct inaccurate personal data or complete information that is incomplete.
• Deletion or erasure – the right to ask us to delete your personal data in certain circumstances.
• Restriction of processing – the right, where applicable, to ask us to restrict how we use your personal data.
• Objection to processing – the right, where applicable, to object to certain uses of your personal data, including certain processing based on legitimate interests and direct marketing.
• Data portability – the right, in certain circumstances, to receive personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another organisation where applicable and technically feasible.
• Withdrawal of consent – where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
• Rights relating to automated decision-making – where applicable, rights relating to certain decisions made solely by automated means that produce legal or similarly significant effects.
• Marketing preferences – the right to opt out of direct marketing communications at any time.

These rights are not absolute and may not apply in every circumstance. We may, for example, be required or permitted to retain certain information for legal, security or other legitimate purposes. Where information forms part of a shared family account or relates to more than one individual, we may also need to consider the privacy rights of other individuals when responding to a request.

To exercise your rights, please contact us using the details provided in the “Contact us” section of this Privacy Notice. We may need to request additional information to verify your identity before responding to a request. Where a request relates to a child, we may also need to verify the identity and authority of the person making the request on the child's behalf.

We will respond to valid requests within the timeframes required by applicable law. You will not normally be required to pay a fee to exercise your privacy rights, although applicable law may permit us to charge a reasonable fee or refuse a request in certain limited circumstances.

If you are in the United Kingdom, you have the right to make a complaint to the Information Commissioner's Office (ICO). If you are located elsewhere, you may have the right to make a complaint to the relevant privacy or data protection authority in your jurisdiction. We would appreciate the opportunity to address your concerns first and encourage you to contact us, although you are not required to do so.

Neevo does not use personal data to make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.

Neevo does not use children's health information to automatically diagnose a medical condition, determine or recommend treatment, calculate insulin or medication doses, predict glucose levels, assess clinical risk or make other automated clinical decisions.

Certain features of Neevo may automatically organise, display or surface information based on information entered into the Services, such as reminders, tasks, care administration items or account information. These functions are intended to assist with organisation and care coordination and do not constitute medical or clinical decision-making.

Neevo uses cookies and similar technologies on our website and, where applicable, technologies within our mobile application to operate, secure and improve the Services.

Some of these technologies are strictly necessary for the website or Services to function and cannot be disabled through our consent controls. Other technologies, such as analytics or performance technologies, will only be used where permitted by applicable law and, where required, after you have provided your consent.

Where consent is required, you can choose whether to accept non-essential cookies or similar technologies and can change or withdraw your choices at any time through the cookie or privacy settings made available to you. Withdrawing consent does not affect the lawfulness of processing that occurred before consent was withdrawn.

Our Cookie Policy provides further information about the cookies and similar technologies we use, including their providers, purposes and duration, and explains how you can manage your preferences.

The Services may contain links to, or allow users to open, websites, applications or services operated by third parties. Where you choose to access a third-party service, that service operates independently from Neevo and its own terms, privacy notice and data-processing practices will apply.

Neevo is not responsible for the privacy practices, content or operation of independent third-party services. We encourage you to review the applicable privacy information before providing personal data directly to a third party.

Access to certain Neevo features may require a paid subscription. Depending on the platform through which you subscribe, subscriptions may be purchased and managed through a third-party application marketplace or payment provider.

Where a subscription is purchased through a third-party provider, that provider is responsible for processing your payment in accordance with its own terms and privacy practices. Neevo does not receive or store your full payment card details where payment is processed directly by the relevant third-party provider.

Neevo may receive and process information relating to your subscription in order to provide and administer the Services. This may include information such as your subscription status, subscription plan, purchase or renewal information, transaction or subscription identifiers, applicable storefront or territory, and information necessary to determine your entitlement to paid features.

We use this information to activate and manage subscriptions, verify access to subscription features, process changes to subscription status, provide customer support and maintain appropriate transaction and business records.

Where you manage, cancel or request a refund for a subscription purchased through a third-party application marketplace or payment provider, the relevant provider's terms and processes may apply. Further information about subscriptions, renewals, cancellation and refunds is provided in our Terms of Service.

We may update this Privacy Notice from time to time to reflect changes to the Services, the way we process personal data, our business practices or applicable legal and regulatory requirements.

Where we make material changes, we will take appropriate steps to bring those changes to your attention. Depending on the nature of the change, this may include providing notice within the Neevo app or website, by email, or through another appropriate method.

If you have questions about this Privacy Notice, our use of personal data or your privacy rights, please contact: