Privacy Policy

We collect information in three ways: what you give us, what you generate by using the platform, and a small amount collected automatically.

• Account information: name, email, password (hashed), and shipping or billing details.
• Device and preference profile: diabetes type, device brands and models (like pump or CGM), skin sensitivities, and product preferences you choose to add — all optional, used to power compatibility filtering and recommendations.
• Orders and transactions: what you bought, from which vendor, order status, and payment confirmation (payment card details are handled entirely by our payment processor — we never see or store full card numbers).
• Community content: reviews, forum posts, questions, and messages you choose to post publicly or send to vendors.
• Usage and device data: pages visited, search queries, browser type, and IP address, collected automatically to keep the platform working and secure.

Our AI copilot uses your device profile, stated preferences, and the questions you ask it to search our structured product and compatibility data and generate explained recommendations. It does not have access to information beyond what's on the platform, and it does not make medical determinations.

Conversations with the copilot are processed by a third-party AI provider under a data processing agreement that prohibits them from using your data to train their own general-purpose models. We retain copilot conversation history so you can revisit past recommendations; you can delete this history at any time from your profile.

Diabetes Collective does not sell, rent, or trade your personal information to advertisers or data brokers. We share information only with the service providers described below, when required by law, or with your explicit consent.

We use essential cookies to keep you signed in and your cart working, and optional preference cookies to remember settings like your device profile across visits. We do not use third-party advertising or tracking cookies. See our Cookie Policy for the full list and how to manage your choice.

We rely on a small number of trusted service providers to run the platform:

• Payment processor: handles checkout, vendor payouts, and fraud prevention. They process card details directly; we never see full numbers.
• Email provider: sends order confirmations, account notifications, and — only with your opt-in — product updates.
• AI provider: powers the copilot's natural-language understanding under a data processing agreement described above.
• Vendors: receive the order and shipping details necessary to fulfill your purchase, and any messages you send them directly.

Each provider is contractually limited to using your data only to perform services for us.

Wherever you're located, you can:

• Access a copy of the personal information we hold about you.
• Export your data in a portable format.
• Correct inaccurate information directly from your profile.
• Delete your account and associated personal data, subject to records we're legally required to retain (like completed order history for tax purposes).
• Opt out of non-essential emails and preference cookies at any time.

Request any of these by visiting your profile settings or emailing privacy@diabetescollective.com. We'll respond within 30 days.

Diabetes Collective is not directed at children under 13, and we do not knowingly collect personal information from them. Caregivers may manage a child's diabetes supplies under their own adult account. If you believe a child has provided us personal information directly, contact us and we'll delete it.

We keep account and profile information for as long as your account is active. Order records are retained for at least the period required by tax and accounting law (typically 7 years). Copilot conversations and browsing data are retained for up to 24 months unless you delete them sooner. When you delete your account, we remove or anonymize personal data within 90 days, except where retention is legally required.

Diabetes Collective is not a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA) — we're a marketplace, not a healthcare provider, health plan, or clearinghouse. That means HIPAA does not directly govern the information you share with us. We still treat health-adjacent details like diabetes type and device data as sensitive, apply strong technical safeguards, and never sell them.

Questions about this policy or your data can go to privacy@diabetescollective.com.