1. Scope and status
This notice covers the Sodam mobile app and website. We process personal information in accordance with Korea’s Personal Information Protection Act (PIPA) and other applicable law.
2. Information we process
We process account details (mobile number and authentication identifier), profile settings, symptoms, notes, questions, visit and calendar information, audio recordings, transcripts, summaries, attachments, device and error logs, and support messages. We separately obtain consent to process sensitive health information such as symptoms, diagnoses, and prescriptions. A third party’s voice and statements captured in a recording, including a clinician’s, are processed under PIPA Article 15(1)(6) for the legitimate interest of creating that user’s visit record.
3. Why we process it
We use information to operate accounts, store and sync records, provide recording, transcription and summaries, enable selective sharing, support users, secure and troubleshoot the service, and meet legal duties. Automated output is not used for medical judgment.
4. Device permissions
Microphone access supports recording; calendar access imports events the user selects. Other permissions, such as notifications, are requested when enabled. Permissions can be revoked in device settings, which may limit features.
5. Processors
Sodam outsources processing only as needed to provide the service. Processor contracts require purpose limitation, safeguards, restrictions on subprocessors, and oversight.
| OpenAI, L.L.C. | Audio transcription, visit summaries, and user-requested AI answers |
|---|---|
| Supabase, Inc. | User authentication, database operation, and private file storage |
6. International transfer
OpenAI transcription and summarization are overseas outsourced processing. You may object in Privacy & security in the app or by contacting privacy@sodam.care. If you object, recording summaries, attachment conversion, and chat features will be unavailable.
| Personal information transferred | Visit audio and transcripts (including patient and clinician voices and statements), note attachments, and chat questions |
|---|---|
| Country, timing, and method | United States · sent through an encrypted API when a recording or other material is uploaded |
| Recipient and contact | OpenAI, L.L.C. · privacy@openai.com |
| Purpose and retention | Audio transcription, summaries, and answers · retained by OpenAI for abuse monitoring for up to 30 days, then deleted |
| How to object and effect | Use Privacy & security in the app or contact privacy@sodam.care · AI features will be unavailable |
7. Retention and deletion
Raw visit audio is deleted within 24 hours after successful transcription. Transcripts and summaries are retained until the user deletes the record or closes the account. On account deletion, we delete the profile, records, notes, and attachments unless retention is required by law. Removal from backups may take a limited period.
8. Safeguards
We use encryption in transit, authentication, Supabase row-level security (RLS), private storage, least-privilege access, and log review. No system is absolutely secure, and this does not represent a security certification.
9. Your rights
Subject to applicable law, users may request access, correction, deletion, suspension, consent withdrawal, or portability. We will verify identity, respond within legal timeframes, and explain any lawful limitation.
10. Children and emergencies
Minimum age and guardian-consent procedures will be finalized before launch. Sodam is not an emergency service; contact 119 or local emergency services for urgent medical needs.
11. Contact and changes
Contact privacy@sodam.care. We will give appropriate advance notice of material changes.