Privacy notice

Updated 1 October 2026

KitRoo is run by Dan Robinson, who is responsible for your information (the “controller”). Email [email protected] with any question about it. Younger users can read a short explanation.

What KitRoo stores

For the adult account: name, email address, an optional phone number, a scrambled (hashed) password, sign-in sessions, and a record of when you accepted the terms.

For each journal (you, or a child you add): name, date of birth, sensor LOT and serial numbers, start and end dates, insertion site, stock and delivery counts, the answers Dexcom asks for, fault descriptions, an optional Dexcom username, Dexcom case references, and when the adult agreed to KitRoo keeping the journal. A child’s paired phone can only open that child’s journal.

For a Dexcom report: the contact details for Dexcom (patient and reporter names, email and phone), Dexcom’s follow-up answers, and for Premium submissions, images of Dexcom’s filled form and its confirmation page.

These details show that the person wears a Dexcom G7, so they count as health information under UK data protection law. KitRoo does not connect to your CGM or read glucose readings from it, control a device or give treatment advice. If you report inaccurate readings, the fingerstick and Dexcom readings you type in for Dexcom are kept with that report. The box scanner reads the code on your phone and does not save the camera image. Box photos from older versions may still be in some records.

Why we use it, and our legal basis

• Running your account and the journals: to provide the service you asked for (contract, UK GDPR Article 6(1)(b)). For a child’s journal, the child is not party to that agreement, so we rely on legitimate interests (Article 6(1)(f)): helping the family keep accurate sensor records. We limit the child’s phone to their own journal and never use their information for advertising.
• Health information in journals: your explicit consent (Article 9(2)(a)), given when a journal is created. For a child, the adult with parental responsibility gives it. You can withdraw it at any time by deleting the journal in Settings.
• Sending a report to Dexcom through KitRoo (Premium beta): your explicit consent, given by ticking the box before each submission.
• Security and keeping KitRoo working: legitimate interests in protecting and operating the service, keeping only what is needed.

KitRoo does not make automated decisions about you, and does not show adverts or build marketing profiles.

Who receives it

• Contabo hosts the KitRoo server and its backups in the European Union (Germany). The UK treats the EU as providing adequate protection.
• Cloudflare delivers and protects the website. Traffic passes through its network, which can include servers outside the UK; Cloudflare’s data processing terms include standard safeguards for this.
• Purelymail sends account emails (invitations, email checks and password resets). These contain your name, email address and a link, never journal details. Purelymail is based in the United States.
• New Relic (EU region) receives technical performance data: page routes, counts and timings, without names, contact details, LOT or serial numbers, images or report text.
• Dexcom receives a report only when you send it yourself through Dexcom’s own form or phone line, or when you tick the box and choose Submit to Dexcom. A Premium submission sends the wearer’s name and date of birth, the contact details, the sensor’s LOT and serial number, and your answers (including any readings for an inaccuracy report), and ticks Dexcom’s consent box for you, agreeing that Dexcom can use the details to provide technical support. Dexcom then handles the report under its own privacy policy.

How long we keep it

• Account and journal records: while the account exists, or until you delete a journal.
• Images of Dexcom’s form from a Premium submission: 90 days, or longer while the report is still open. Preview images of a prepared form: 14 days. Box photos from older versions: 90 days, or while a related report is open.
• Backups: a daily copy of the database is kept on the same server for 30 days, and Contabo keeps server snapshots for four weeks. Deleted information is gone from all backups within about four weeks.
• Information already sent to Dexcom is kept under Dexcom’s own policy.

Security and your device

All connections use HTTPS. Each account and paired phone can only open its own journals. Form images are encrypted on the server. KitRoo uses one sign-in cookie so you stay signed in, and remembers the selected journal on your device. There are no advertising or tracking cookies.

Your rights

You can ask to see a copy of your information, correct it, delete it, restrict how we use it, or receive it in a portable format. You can object to uses based on legitimate interests, and withdraw consent at any time. The adult can correct records and delete a journal or the whole account in the app’s Settings, or start deletion from the account deletion page. For anything else, email [email protected]. A young person can contact us directly too.

If you are unhappy with how we handle your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office.

KitRoo is independent of Dexcom. See also our terms of use.