Wellody Privacy Policy

Translation draft — pending legal review. Not legal advice. The Korean version is authoritative; this English text is a convenience translation. The Korean original is itself a draft before legal review (‘초안 — 법률 검토 전’).
This document is a draft based on data flows confirmed in the actual service code. Items marked 〔 〕, such as operator information and retention periods, are not yet decided.

〔Business decision: operator name (company or sole proprietor) — BD-30〕 (the “Company”) processes and protects the personal information of people who use Wellody, a health log and visit preparation app (the “Service”), in accordance with the Personal Information Protection Act (「개인정보 보호법」). This policy explains what we process, why, for how long and with whom, and how you can exercise your rights.

At a glance

Article 1 Personal information we process

1. Sign-up and sign-in (required)

When you sign in, the authentication server (Supabase Auth) keeps authentication records such as the last sign-in time and the IP address used. 〔Needs confirmation: Supabase Auth audit log items and retention period〕

2. Information you enter while using the Service

“None”, “Don’t know” and “Not logged” are stored differently. Blank fields are never turned into 0 or “normal”.

Information about sex life (sexual health records) is handled more narrowly. Only you can see it, and it can’t be added to family viewing (server permission rules block it). It doesn’t appear on Today, in widgets, notifications or on the lock screen, in daily summaries or counts, or in sample data. It goes into a visit summary only if you turn on the “Sexual health” section when making that summary, into the Madi assistant (Lody) only if you turn on “Let the assistant read these”, and into an export file only if you pick it when exporting. This area asks for separate consent at the moment you turn it on (separate consent for sensitive information about sex life, Korea PIPA Art. 23; explicit consent under GDPR Art. 9 where it applies). The consent screen lists what is stored, who can see it (only you), where it is left out by default, and how to turn it off and delete it; the area turns on only when you tap “Agree and turn on”. We keep a record of the consent text version and time, and without this consent the server doesn’t store new sexual health records. Turning the area off is recorded as withdrawal of consent, and you can either delete what you logged at the same time (you can undo for a short while, after which it is destroyed) or keep it hidden. Kept records aren’t shown anywhere until you turn the area back on or delete them; you can also delete each record or delete your account. When Log lock is on, the record type (that it is a sexual health record) is encrypted on the device along with the content, like other records.

3. Information imported from devices and health apps (optional, read-only)

We read these only if you agree to “Connect devices and health apps” and allow each item in your phone’s permission screen. Wellody does not write to health apps.

4. Information generated or collected automatically

The Company does not collect advertising identifiers, precise location, contacts, or call or text history. We do not currently use crash analysis tools or external usage analytics tools. 〔Business decision: whether to introduce analytics or crash tools — BD-12. If introduced, this Article will be updated first.〕

5. Information processed only on the device and not received by the Company

• Voice: when you log by voice, speech is converted to text on your phone by default. Recordings are not saved. If you choose “Phone voice service” in settings or use voice input in a web browser, speech recognition may be handled by the phone or browser provider (Apple, Google), subject to that provider’s policy. The Company does not receive your voice.
• Current location: when you tap “Use current location”, the location is read once at the lowest accuracy to pick the nearest city/district; the location value is not stored or sent. Only the area (city/district) name is stored.
• Interpreting speech and text: the basic interpretation that splits a log sentence into items uses on-device rules.
• “Sample tour” and “Save on this device only” modes without sign-in: logs do not leave the device (drug information, clinic search and weather lookups send only the search term or area, as in Article 4 below).

6. Processing paths by feature at a glance

You can see the same table in the app › Settings › AI & privacy › “What’s sent and current processing paths”.

Article 2 Purposes of processing

Health data is not used for advertising or marketing, personalized ads, sale of personal information, or insurance, employment or credit decisions. Users’ logs are not provided for AI training.

Article 3 Processing and retention periods

• In principle, we keep information until you leave (delete your account), and destroy it without delay when you request deletion.
• When you tap Delete account, access is blocked immediately, and the logs, original files, visit summaries, share links, family permissions, consent records and conversations on the service server, external AI usage records, rate-limit hashes, invite code and share link attempt records, and the sign-in account (email and sign-in method identifiers) are deleted. Copies stored on the device and the lock key are deleted too.
• The deletion ledger keeps only the deleted account’s identifier and the time (so data can be deleted again when restoring from backup; no content). Records of you viewing logs that another user opened to you belong to that person’s access history, so they remain on their side.

If you don’t have the app or can’t get into it, you can request deletion as described on the web guide page (/en/delete-account).

Article 4 Entrustment of processing and overseas transfer

1. Entrustment of processing

〔Business decision: concluding entrustment contracts (data processing addenda, DPAs) with each processor — BD-03, BD-06, BD-30〕

2. Overseas transfer (Article 28-8 of the Act)

External AI is off by default and works only if the user taps “Agree and turn on external AI” in settings. Turning it off stops external transfers immediately, and processing then uses on-device rules only. Refusing consent to external AI does not affect other features.

Food photo analysis results (food names, estimated amounts, estimated nutrition values) are drafts and become logs only after the user edits them on the review screen and taps “Save as is”. All nutrition values are shown as estimates based on the amount seen in the photo. Meal photo results in the sample tour without sign-in are on-device demo results and are not sent externally.

Results of AI calorie estimates for foods (food name, estimated single serving, estimated calorie range, macronutrients) are drafts and are labeled “AI estimate · check before saving”. They become a log only after the user checks or edits the calories and amount and adds the food; for foods that have a value in the MFDS food nutrition database, that value is never overwritten. To reduce cost, estimates for the same food name and amount text are kept on the service server for up to 90 days without any link to an account (keyed by a hash of the food text) and reused. Usage records do not contain the food text.

The external AI consent text (version draft-2026-10-20) lists all six features in the table above (users who agreed to draft-2026-10-19 are asked again because “AI calorie estimates for foods” was added; users who agreed to draft-2026-10-18 also see “Analyzing food photos”). When the version of the text changes, users who agreed to an earlier version are shown the changes and asked to agree again before they next use an external AI feature (other features remain available). The service server also checks for consent to the current version on every request.

〔Needs confirmation: Supabase is a US corporation but the storage region is Seoul. Whether this counts as an overseas transfer (remote access, support, etc.) needs legal review.〕

3. External lookups that send no personal information

The following lookups are designed not to send personal information. All of them go through Wellody server functions, and the user’s account and IP are not passed to the external institutions.

Drug information and disease name lookup results are temporarily stored (cached) on the server so the same search term isn’t requested again; the cache does not record who searched.

Article 5 Provision of personal information to third parties

The Company does not provide users’ personal information to third parties. The following happen only when the user requests them directly.

• Visit summary share link: when the user turns a visit summary they confirmed into a link, anyone with the link and (if chosen) the 6-digit verification code can view that one summary without signing in. The link stops opening after the set period (up to 30 days) or when the user withdraws it. The number of views and the fact of viewing are shown to the user. The user chooses whether to include their name and birthday. Med notes are included unless “Leave out of visit summary” is turned on.
• Saving and sharing as PDF or image, showing the screen in the exam room: sent to places the user chooses via the phone’s share feature. The Company cannot delete files already sent.
• Family viewing (experimental feature, hidden by default): shows only the scope the user chooses to people the user approved. It can be reduced or withdrawn at any time. When Log lock is on, new family sharing currently can’t be set up. Information about sex life (sexual health records) can’t be included in this scope.
• Where laws have special provisions, or where it is unavoidable to comply with legal obligations.

Article 6 Procedures and methods for destroying personal information

• Procedure: deletion request received → access blocked immediately → original files, logs and usage records on the service server deleted → sign-in account deleted → backup copies expire according to the retention cycle 〔Business decision: deadline — BD-05, BD-31〕. Even when restoring from backup, deleted logs are deleted again according to the deletion ledger.
• Method: electronic files are deleted in a way that cannot be recovered. No paper documents are created.
• When disconnecting a health app, choosing “Also delete imported logs” deletes the logs imported from that health app.

Article 7 Rights and obligations of data subjects and legal representatives, and how to exercise them

Users can exercise the following rights at any time.

• If it’s hard to do in the app, you can ask the privacy officer below, and the Company will respond within 〔Business decision: processing deadline, within the statutory 10 days recommended〕.
• You can also exercise these rights through a representative (power of attorney required).
• About Log lock: if you lose both the passphrase and the recovery code, not even the Company can recover the locked logs. What you can do then is delete the locked logs and start over. Don’t include your passphrase or recovery code when contacting us. The Company will never ask for them.

Children under 14

〔Business decision: policy for users under 14 — together with BD-07 (adult identity verification method). Draft proposal: “Wellody does not accept sign-ups from children under 14. If we learn that information of a child under 14 has been collected, we delete it without delay.” If a feature for family to manage a child’s logs is opened, a legal representative consent procedure (Article 22-2 of the Act) is required.〕

Article 8 Security measures

• Encryption in transit: encrypted communication (HTTPS) is used between the app/web and servers, and between servers and external institutions. 〔Needs confirmation: the Food Safety Korea lookup address is http — only search terms are exchanged, no personal information〕
• Access control: every log view or change passes a permission check. Without permission, we don’t even reveal whether a log exists. The database uses row-level access rules (RLS) so only you and the people you allow can read. File storage is not public.
• Secrets management: external AI and public data keys are kept only on the server and not built into the app.
• Minimal logging: server logs and usage records do not contain health log content, original questions, photos or precise location. Rate limiting uses only hashes of the account or IP.
• Rate limits and cost caps: external AI has daily counts and monthly cost caps. Share links and verification codes block wrong attempts after 10 per hour.
• Log lock (optional — when on, some items are encrypted on the device before saving): when on, log content and photo and document files are encrypted on the device (XChaCha20-Poly1305) before upload. The decryption key opens only with the user’s passphrase or recovery code, and the Company has no spare key. So even the Company cannot open log content stored on the server. However, the following are outside the encryption:
  Photos and sentences sent when you use external AI (while the request is being processed)
  Copies of visit summaries sent by share link (while the link is valid)
  Account, consent, subscription, inquiries and access history
  Technical information such as save times, sizes, number of logs and profile identifiers
  The web version downloads the app code from the server each time it opens, so its protection may be weaker than the app version.
• On-device storage: the app version keeps the key in the phone’s secure storage (Keychain/Keystore). Signing out deletes the key on the device.
• 〔Business decision: internal management plan, designating and training personal information handlers, access permission procedures, keeping access logs (Standards for Security Measures of Personal Information) — BD-30〕

Article 9 Installation, operation and refusal of automatic collection tools

• The mobile app does not use cookies. Sign-in state and settings are kept in device storage.
• The web version uses browser storage (localStorage, IndexedDB) to keep you signed in. No advertising or tracking cookies or external analytics tools are used. Clearing site data in your browser settings signs you out. 〔Needs confirmation: check for actual cookies on the deployed web version〕
• We do not collect behavioral information (usage records for advertising purposes).

Article 10 Additional commitments for health app data (Apple Health, Health Connect)

• We read only the items you allow, and only read. Period data is read only when turned on separately.
• We don’t currently read sexual activity items (Apple Health “Sexual Activity”, Health Connect “Sexual activity”). If we start, they’ll be read only when a user who has turned on the “Sexual health” area allows them separately.
• Imported data is used only for this app’s daily logs, look-backs and visit summaries.
• We do not use it for advertising or marketing, do not sell it, and do not pass it to ad platforms or data brokers. We do not use it for insurance, employment or credit decisions.
• We do not share it with third parties without your explicit request (share links, PDFs, etc.).
• People read it directly only when you request it (e.g. attached to an inquiry), for security purposes, or when legally required.
• Health app data is not stored in iCloud.
• With a cloud account, imported data is stored on the service server like other logs, and is encrypted too when Log lock is on. You can delete imported logs when disconnecting.

Article 11 Privacy officer

You can also contact us via “Contact / report a problem” in the app. Inquiries are read by the operators.

Article 12 Remedies for infringement of rights

If you need advice or remedies for a personal information infringement, you can contact the following institutions (Korea).

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (no area code), privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (no area code), www.spo.go.kr
• Korean National Police Agency Cyber Investigation Bureau: 182 (no area code), ecrm.police.go.kr

〔Needs confirmation: recheck each institution’s contact details just before publication〕

Article 13 Changes to this policy

When this policy changes, we announce it in the app and on this page from 7 days before it takes effect (30 days for changes that are unfavorable to users or important). Changes that add collected items or purposes require consent again.

• Announcement date: 〔Business decision〕
• Effective date: 〔Business decision〕
• Previous version: 〔None — first version〕
• Draft revision: 2026-10-21 — wording only, aligned with the app (the visit summary name); processing items, purposes, retention and sharing are unchanged