1. Scope and status
This draft covers the Sodam mobile app and website. We are considering Korea’s Personal Information Protection Act (PIPA) and other applicable law. Required controller and privacy-officer details will be finalized before launch.
2. Information we process
We may process account details, profile settings, symptoms, notes, questions, visit and calendar information, consented audio recordings, transcripts, summaries, attachments, device and error logs, and support messages. Health-related content may be sensitive information requiring additional consent.
3. Why we process it
We use information to operate accounts, store and sync records, provide recording, transcription and summaries, enable selective sharing, support users, secure and troubleshoot the service, and meet legal duties. Automated output is not used for medical judgment.
4. Device permissions
Microphone access supports consented recording; calendar access imports events the user selects. Other permissions, such as notifications, are requested when enabled. Permissions can be revoked in device settings, which may limit features.
5. Processors and international transfers
We may use Supabase for authentication, databases and private file storage; OpenAI for AI-assisted organization; and Twilio for communications or processing. Before launch we will specify transfer locations, data, timing, method, retention, and refusal options based on final contracts and configuration, and obtain required consent.
6. Retention and deletion
Information is kept as needed for the stated purposes. Users may request record or account deletion. Removal from backups may take a limited period, and some information may be retained for legal duties or disputes. Specific periods will be finalized before launch.
7. Safeguards
We aim to use encryption in transit, authentication, Supabase row-level security (RLS), private storage, least-privilege access, and log review. No system is absolutely secure, and this does not represent a security certification.
8. Your rights
Subject to applicable law, users may request access, correction, deletion, suspension, consent withdrawal, or portability. We will verify identity, respond within legal timeframes, and explain any lawful limitation.
9. Children and emergencies
Minimum age and guardian-consent procedures will be finalized before launch. Sodam is not an emergency service; contact 119 or local emergency services for urgent medical needs.
10. Contact and changes
Contact privacy@sodam.care. We will give appropriate advance notice of material changes. This draft requires legal review and validation against final data flows before launch.