Last updated: September 2026 | Next review: September 2027
This notice applies to all users of the DigiBete mobile and tablet application (the "App").
If you are uncomfortable with how information is used as described, you should stop using the DigiBete App and remove it from your device. Questions about data usage should be directed to app@digibete.org.
This notice explains:
· what personal information is collected;
· how and why it is used;
· who receives it;
· retention duration; and
· rights under UK data protection law.
This App Privacy Policy should be read with our Website Privacy Policy and Children's Privacy Policy (where applicable).
1. Who we are
DigiBete determines how and why personal information through the App is processed.
DigiBete is the data controller for limited operational, support, security, and account-management processing. Where healthcare organisations use the App for patient care, education, care-plan workflows, or clinic engagement, DigiBete acts as a data processor under applicable data processing agreements.
When DigiBete acts as a processor for a referring clinic or NHS Trust in this way — for example, School Care Plan and clinic portal information — DigiBete uses that information only for the purposes the clinic or Trust instructs and does not include it in DigiBete's own service-improvement or research analytics.
For App users based in England, DigiBete also acts as a data processor when it submits a minimum data set to NHS England, on NHS England's instructions and under a data processing/sharing agreement, to meet reporting requirements for the National Diabetes Self-Management Digital Service — see Section 4 and Section 6.
Registered details:
DigiBete (Company No. 10371773)
Registered office: Platform, 3rd Floor Tech Hub, New Station Street, Leeds, England, LS1 4JB
Contact: app@digibete.org
Data Protection Officer (DPO):
John Hughes
Email: john@digibete.org
2. Children and young people
The DigiBete App serves children and young people living with diabetes, plus their parents, carers, and families.
The ICO Children's Code applies, prioritizing child welfare in App design and operation.
A child-friendly version of this App Privacy Policy presents key points in simple language.
3. What information we collect
A. Information you provide
Collection includes:
· your name;
· date of birth;
· email address;
· role indication (patient, parent, carer, or guardian);
· health information entered into the App (type 1, type 2, or early type 1 sections).
If you are based in England, we also collect the following information about you, so that DigiBete can meet NHS England's reporting requirements for the National Diabetes Self-Management Digital Service (see Section 4 and our Fair Processing Notice):
· a minimum data set about your use of the App to NHS England's national Data Landing Portal each month, to meet reporting, performance-monitoring, and audit requirements.
Optional data provision:
· Gender
· Length of diagnosis
· First 4 digits of postcode
· Your preferred language
Health information qualifies as special category data under UK GDPR and receives additional safeguards.
B. Information collected automatically
App usage may generate collection of:
· device and operating system information;
· app usage data (feature usage examples);
· log and error information.
Precise location data is not collected.
4. How we use your information
Personal information purposes include:
· providing App access and features;
· sharing information with your clinic;
· delivering tailored educational content from your clinic;
· notifying your clinic of content access or reading;
· operating, maintaining, and improving the App;
· responding to enquiries, complaints, or feedback;
· complying with legal and regulatory obligations;
· producing aggregated or anonymised information for service improvement, training, and research;
· supporting care-plan collaboration between clinics, families, schools, and authorised carers;
· managing invitation and approval workflows for school care plans or clinic services;
· notifying you of App changes or privacy notice updates;
· if you are based in England, DigiBete act as a data processor to submit, on NHS England's instructions, a minimum data set about your use of the App to NHS England's national Data Landing Portal each month, to meet reporting, performance-monitoring, and audit requirements under our NHS England commissioning contract for the National Diabetes Self-Management Digital Service — including, where applicable, submission of records to the National Diabetes Audit.
Your data is not used for targeted advertising.
5. Our lawful bases for processing (UK GDPR)
UK GDPR requires lawful bases for information use.
A. App provision and clinic interaction
· Article 6(1)(b) – Contract: "processing is necessary to provide the App and related services to you."
· Article 6(1)(e) – Public task (healthcare organisations using the App for healthcare services); DigiBete processes information under instruction from NHS organisations as Data Controllers for healthcare-related activities;
· For App users based in England, DigiBete submits information to NHS England as a data processor, acting on NHS England's instructions under a data processing/sharing agreement, in support of NHS England's own lawful basis — Article 6(1)(e), Public task — for the National Diabetes Self-Management Digital Service (see Section 4). This is not DigiBete's own basis for processing; it is NHS England's, as the controller of that reporting.
· Article 9(2)(h) – Health or social care (where applicable): processing necessary for health or care service management.
· The special category fields in the NHS England reporting described above (for example, diabetes type, and information derived from an NHS Number/PDS lookup) are processed in support of NHS England's reliance on Article 9(2)(h) – health or social care. For Ethnicity and Disability status specifically, NHS England additionally relies on the equality-monitoring condition in Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018.
B. Special category health data
· Article 9(2)(a) – Explicit consent, when you enter health information into the App.
C. Legal and regulatory obligations
· Article 6(1)(c) – Legal obligation, complying with law or regulator requests.
D. Service improvement and safety
· Article 6(1)(f) – Legitimate interests, operating, securing, and improving the App (balanced against your rights).
Consent withdrawal is possible anytime via the App or app@digibete.org. Withdrawal does not affect already-completed processing.
6. Sharing your information
Personal information is not sold.
Information may be shared with:
· the clinic providing App access;
· (where we act as a data processor for that clinic or NHS Trust — see Section 1 — we use School Care Plan and clinic portal information only for the purposes the clinic or Trust instructs, and not for our own purposes);
· trusted suppliers supporting hosting, analytics, messaging, and security (as data processors);
· regulators or public bodies when required by law (ICO, NHS bodies, safeguarding authorities).
· carers or care-plan participants where required and permission granted to support NHS-managed approved care-plan workflows.
· if you are based in England, NHS England, via the NHS Digital Data Landing Portal. For this specific reporting, DigiBete acts as a data processor for NHS England — see Section 1 and Section 5 — submitting only the fields NHS England has specified, under a data processing/sharing agreement.
Supplier access is strictly limited, monitored, and subject to confidentiality and security obligations.
7. Analytics and notifications
Google Firebase Analytics tracks App usage to improve performance and reliability.
Analytics data is aggregated or pseudonymised and not used for identification.
Firebase Cloud Messaging sends service-related notifications (clinic messages or important updates).
8. International transfers
Some suppliers (for example, Google) may process data outside the UK.
Appropriate safeguards apply, such as UK adequacy regulations or approved contractual protections.
The minimum data set we submit to NHS England (see Section 4) is transferred to, and stored by, NHS England within the UK.
9. How long we keep your information
Personal information retention covers:
· active App account duration;
· legal, regulatory, or clinical record retention requirements;
· security and audit purposes.
· for the monthly data set submitted to NHS England, we retain the extract only until the submission is confirmed as received; NHS England's own retention rules then apply to the data it holds.
10. How we keep your information safe
Appropriate technical and organisational measures include:
· encryption of data in transit (HTTPS);
· secure storage on devices (iOS Keychain / Android encrypted storage);
· access controls and monitoring;
· regular security testing.
· a secure, access-controlled upload process for any monthly data set submitted to NHS England's Data Landing Portal.
11. Your rights
UK GDPR provides rights including:
· accessing your personal data;
· correcting inaccurate data;
· requesting deletion (where applicable);
· restricting or objecting to processing;
· data portability (where applicable);
· withdrawing consent anytime;
· complaining to the Information Commissioner's Office (ICO).
Rights requests receive responses within one month.
12. Automated decision-making
Automated decision-making or profiling producing legal or similarly significant effects is not used.
13. Complaints
Data usage concerns should be directed to app@digibete.org.
Complaint rights extend to the Information Commissioner's Office (ICO):
Website: https://www.ico.org.uk
Telephone: 0303 123 1113
14. Changes to this policy
Privacy notice updates may occur periodically. The latest version appears within the App.
DigiBete, September 2026