By: Brooke Struyk
Abstract
Type 1 diabetes is an autoimmune disease that prevents the pancreas from making insulin. A common medical device used to deliver insulin is an insulin pump. Insulin pumps allow users to personalize their device and its data uploading. The most personalized version of these devices can be modified by an open-source software resource named LoopKit. LoopKit was created by a software Apple developer, and its GitHub page walks users how to download, use, and customize the software to make it best for them. With all this nuance, fear of the unknown might start to rise, especially regarding the cybersecurity of your health device. This blog post is an introduction to how LoopKit brings together device customization and personal information safety and why open-source devices are an investment worth making.
Introduction
Type 1 diabetes is an autoimmune disease that prevents the pancreas from making insulin, a hormone that regulates blood glucose levels [1]. When insulin levels are low, it can lead to high blood sugar (hyperglycemia) which causes issues like diabetic ketoacidosis. This is when the body breaks down fat instead of sugar and is life-threatening [1]. A more serious concern is hypoglycemia, when a diabetic’s blood glucose levels drop too low. Hypoglycemia can result in death and has often has a faster onset than hyperglycemia. In 2025, there was an estimated 9.5 million people in the world living with diabetes [2]. In the United States alone there are 1.5 million cases, and since 2021 there has been a 13% increase in cases [2]. Researchers still have not been able to fully understand what causes type 1 diabetes, though it is theorized that it is due to a mixture of genetic and environmental factors.
One of the methods used to help type 1 patients manage their blood sugar is an insulin pump. With this system a diabetic can monitor their basal and bolus rates. The basal rate works in small increments over a 24-hour period, changing the amount of insulin based on the time of day [3]. The basal rate can be changed by time and with routine. By contrast the bolus rate works by giving larger amounts of insulin when eating or to correct high blood glucose levels. The pump system (both the pump and an application on a mobile device) calculates the relationship between the amount of carbohydrates consumed, existing insulin on board, the sensitivity, of a diabetic to insulin, the type of insulin, and the decay rate of carbohydrate by type within the bloodstream to determine how much bolus insulin is needed [3].
Different insulin pumps allow patients varying levels of personalized control. A closed-loop system automatically adjusts insulin levels depending on the amount of glucose in the body at the time using a second device called a continuous glucose monitor [4]. Closed loop systems require users to input the amount of carbohydrates after meals but beyond that manage the fluctuations in blood glucose [4]. Finally, there are DIY closed-loop systems that use open-source software to connect to a smartphone application and analyses glucose data remotely [4]. This type of system allows for complete personalization of the device and keeps it at a low-cost.
Introduction to LoopKit
LoopKit is an open-source software that can be downloaded. It uses Bluetooth to connect devices a pump and a CGM. It was created in 2015 by Nate Racklyeft, an Apple developer, inspired by his own Type 1 diabetes experience [5]. The software itself had been co can be found on GitHub, a coding storage platform. The platform also holds well organized detailed instructions, and it includes a questions and comments tab that is semi-active. LoopKit combines preexisting open-source resources, took all their advantages, and created a resource that is easy to understand and further customize. As of 2022, more than 9,000 people are using LoopKit software to help manage their Type 1 diabetes [6].
Once the software has been downloaded it can be run in simulation modes on various iOS devices or installed on a phone. When operating in the simulator the app acts as a real phone and takes you through its customization feature set-up process. Here the user can add their insulin pump and CGM. The user will then be asked for more specific settings to further set up the application based on the devices they personally use.
The user interface of LoopKit itself is very easy and straightforward to understand. There are also other applications that can be connected to LoopKit like Nightscout to create an even more personalized experience. Nightscout can also store and graph treatment data, so a user can further optimize their inputs based on their body’s responses [7]. LoopKit can also be connected to Apple’s HealthKit database [8]. This is Apple’s Health app that can provide information on what data is being output by the insulin delivery device.
Highlights of the code behind LoopKit
The first thing that can be noted about LoopKit is that it’s coded in Swift. Swift is a coding language developed by Apple that is compatible with the programming language C [9]. Using an easy-to-follow coding language helps the user understand the software, how data is being used to make calculations, to create the application home page visuals, and how the application connects to the user’s insulin delivery device. The code itself is separated into well organized and named folders, so the user can easily go through, read, and change the code if needed.
Throughout the platform, developers have written detailed comments on what specific lines mean and how it adds to the platform. An example of this is in the DoseMath folder, the user can see the math that is being used to calculate their insulin intake after they personalize their inputs. This section, along with the comments, is meant to help users who are new to the software and/or new to Type 1 diabetes. It helps them understand what exactly their inputs will be changing and why it matters. An equation like the total amount of insulin needed to correct glucose differentiation or the recommended doses for automatic enactment that use either bolus or basal for high or low correction can be hard to understand when initially starting to use this type of software, LoopKit does a great job of helping users understand how this works.
On the non-technical side, it is also interesting to see how certain sections of the code were made later to its release in 2016. It is clear it has been updated to keep up with the new additions of technology, and more intricate code is added by the authors. Due to other authors being brought into the code over the years you can also start to see the code become more heavily commented. An example of this is the 2021 addition of allowing compatible Bluetooth devices to connect to the application. This part of the code has comments that explain each output if Bluetooth isn’t connecting correctly or other potential issues the user may have regarding Bluetooth.
Cybersecurity and LoopKit
Cybersecurity and protection of personal health information have been an increasingly talked about topic. With new technology in medical devices, it is important to understand where your data is being collected, how, and if there are ways to prevent yourself from being put in danger. According to an online survey conducted in March 2026 by RunSafe Security, 24% of health care professions across the US, UK, and Germany reported cyberattacks on medical devices [10]. 80% of those attacks resulted in a disruption of patient care. In 2025 there were two big Class I cybersecurity recalls. One involved Baxter with 4,881 ventilator and compressor units that had software-based cybersecurity vulnerabilities and had removed from use and returned [11]. The other was an Abiomed heart pump controller that allowed potential unauthorized users into its network interface [12]. Most notably in March 2026, Stryker, one of the leading medical device manufacturers, experienced cybersecurity attack that was connected to an Iran-backed hacker group.
When promoting open-source software for medical devices, cybersecurity exposure and personal health information data being leaked can be a concerning factor for some and prevent them from looking into open-source software. LoopKit, being built as an Apple app and with Apple software, includes all of Apple’s information protections. Apple has a Consumer Health Protection Privacy Policy [14]. This includes security protection and on-device processing. Apple uses end-to-end encryption which requires two-factor authentication and a password, so when data is synced to iCloud, Apple can’t read it. On-device processing uses the device itself to process information rather than sending it to a server. This minimizes the amount of data being collected, and Apple only maintains what is collected for a maximum of seven days. It’s also important to note that while setting up LoopKit, a user can choose exactly what data is being collected, shared, and looked at. This allows users to have more say in where their information is going and how it is being processed. Overall, LoopKit works with Apple to keep its user’s information from being vulnerable to cyber-attacks.
User experience: Case study article
In a case study article by Diabetes Technology & Therapeutics, they tested the user experience with LoopKit [6]. They were able to find that most people in the study preferred their new tracking system. It forced them to learn more about how their insulin pump works, why specific data needs to be uploaded and tracked, and how much control they were able to have over their device. Most users said they felt empowered to be able to use Loop as a customized helping tool [6]. The main challenge that was faced was setting up the application. The article highlights that the set-up process may seem daunting to a normal person and learning to figure out how the application works may prevent them from using it all together. Once set up however, users were excited to use the device and reported it was easier for glycemic control, especially at night.
Conclusion
As technology is growing and changing with cybersecurity fears growing and more people using AI to get information, it’s important to know where your data is going. With a surge of running and fitness devices like the Garmin and Oura Ring that collect health data, now is the time to promote new ways of looking at their medical devices. LoopKit’s features allow users to change their input information and personalize their insulin levels to fit their needs. Information shared within the software and transmitted to the insulin delivery device is also protected from cyber-attacks. Open-source software like this promotes new ways to track your insulin levels and create something better fit for your needs and body.
Work Cited
[1] Cleveland Clinic, “Insulin,” Cleveland Clinic, Jan. 17, 2024. Available: https://my.clevelandclinic.org/health/body/22601-insulin. [Accessed: Nov. 30, 2025]
[2] G. D. Ogle et al., “Global type 1 diabetes prevalence, incidence, and mortality estimates 2025: Results from the International diabetes Federation Atlas, 11th Edition, and the T1D Index Version 3.0,” Diabetes Research and Clinical Practice, vol. 225, no. 112277, pp. 112277–112277, May 2025, doi: https://doi.org/10.1016/j.diabres.2025.112277. Available: https://www.sciencedirect.com/science/article/pii/S0168822725002918. [Accessed: Dec. 01, 2025]
[3] Cleveland Clinic, “Insulin Pumps,” Cleveland Clinic, Dec. 11, 2023. Available: https://my.clevelandclinic.org/health/articles/insulin-pumps. [Accessed: Dec. 01, 2025]
[4] S. Templer, “Closed-Loop Insulin Delivery Systems: Past, Present, and Future Directions,” Frontiers in Endocrinology, vol. 13, no. 1, Jun. 2022, doi: https://doi.org/10.3389/fendo.2022.919942. Available: https://pmc.ncbi.nlm.nih.gov/articles/PMC9207329/. [Accessed: Dec. 01, 2025]
[5] Nate Racklyeft, “The History of Loop and LoopKit,” Medium, Oct. 02, 2016. Available: https://medium.com/@loudnate/the-history-of-loop-and-loopkit-59b3caf13805. [Accessed: Dec. 01, 2025]
[6] S. C. Suttiratana et al., “Qualitative Study of User Experiences with Loop, an Open-Source Automated Insulin Delivery System,” Diabetes Technology & Therapeutics, vol. 24, no. 6, pp. 416–423, Jun. 2022, doi: https://doi.org/10.1089/dia.2021.0485. Available: https://pubmed.ncbi.nlm.nih.gov/35099278/. [Accessed: Oct. 04, 2022]
[7] “What is Nightscout? – Nightscout,” nightscout.github.io. Available: https://nightscout.github.io/. [Accessed: Dec. 01, 2025]
[8] “LoopDocs,” loopkit.github.io. Accessed: Sep. 22, 2026. [Online]. Available: https://loopkit.github.io/loopdocs/
[9] A. Inc, “Swift.org,” Swift.org, 2024. Available: https://www.swift.org/about/. [Accessed: Jan. 27, 2026]
[10] A. Arnett, “Hospitals Reject More Medical Devices Over Cybersecurity, Index Finds,” 24×7 | Leading Resource for Healthcare Technology Management Professionals. Accessed: Sep. 22, 2026. [Online]. Available: https://24x7mag.com/standards/safety/cybersecurity/hospitals-reject-more-medical-devices-cybersecurity-index-finds/
[11] A. Arnett, “Baxter’s Life2000 Cyber Recall Draws Attention to FDA’s Focus on Software Safety Risks,” 24×7 | Leading Resource for Healthcare Technology Management Professionals. Accessed: Sep. 22, 2026. [Online]. Available: https://24x7mag.com/standards/safety/cybersecurity/baxters-life2000-cyber-recall-draws-attention-to-fdas-focus-on-software-safety-risks/
[12] KBA Attorneys, “KBA Attorneys (Ketterer, Browne & Associates, LLC),” KBD Attorneys. Accessed: Sep. 22, 2026. [Online]. Available: https://kbaattorneys.com/cybersecurity-risk-with-the-impella-controller/
[13] Ionut Ilascu, “Stryker Attack Wiped Tens of Thousands of Devices, No Malware Needed,” BleepingComputer. Accessed: Sep. 22, 2026. [Online]. Available: https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/
[14] Apple, “Legal – Consumer Health Personal Data Privacy Policy – Apple,” Apple Legal. Accessed: Sep. 22, 2026. [Online]. Available: https://www.apple.com/legal/privacy/consumer-health-personal-data/en-ww/