Consumer Health Data Privacy Policy

1. Who this policy covers

Sato Health LLC provides this separate notice for consumer health data, including rights under Washington’s My Health My Data Act and Nevada’s consumer health data law where applicable. Read it with our Privacy Policy. Consumer health data can include information that identifies your past, present, or future physical or mental health, as well as related inferences.

2. Health data we use

Medication and treatment

Medication, dose, route, dates/timing, injection sites, titration, supply, concentration, expiration, and beyond-use details. Used for records, reminders, supply calculations, and estimated medication curves.

Measurements and wellbeing

Weight, goals, profile details, symptoms, appetite, food noise, hydration, nutrition, exercise, and notes. Used for tracking, trends, reports, projections, and requested features.

Health-related media and messages

Progress, food, label, and unrecognized-barcode photos; label text; iPhone/Watch recordings and transcripts; and health details sent to support. Import assistance sends headings and format summaries, which may reveal health information, but no individual cell values. Used to store photos, draft entries, estimate nutrition, read labels, map imports, and answer messages. Progress photos can sync through private iCloud; cloud photo analysis is separate. Plus Watch recordings reach the AI provider through your iPhone.

Derived information

Estimated medication levels, nutrition and weight projections, summaries, and patterns. Reports are calculated on-device. With Plus, OpenAI consent, and the weekly-note switch on, Sato automatically sends the week’s record when it closes for an AI-written note. This may include weight, steps, workouts, and nutrients from Apple Health. Otherwise, the note is written on-device. Outputs are estimates, not clinical measurements or diagnoses.

Identifiers linked to use

Installation/service identifiers, connection information including IP addresses, and support contact details can become health data when linked to health requests. Used to operate, secure, and support Sato. We do not request precise GPS location, use health-facility geofencing, or collect identifying biometric templates. Audio and photos can contain identifying details.

3. Where it comes from

• You: information you enter, speak, photograph, import, or submit to support.
• Apple Health: records from your authorized data types, including data originally recorded by other apps or devices.
• Your Apple iCloud database and files you select: synced records and imports.
• Food services and calculations: database results from fatsecret, and estimates or inferences produced by Sato or its AI provider.

4. Who receives it

The features you use determine what is shared:

Railway & OpenAI · online features

Railway hosts Sato’s backend. OpenAI receives voice/Watch audio and transcripts, selected food photos and on-device labels, nutrition-label text/images, weekly-note records, and import headings/format summaries. Weekly records include weights, doses, symptoms, appetite, food, activity, and profile details. See the full input list and temporary processing and provider retention rules. OpenAI does not train on API data by default. Sato no longer includes Ask Sato chat or clinical research.

Apple · sync & Health

Apple processes private iCloud sync and the Health data types you authorize. Imported Health values join your Sato records and sync when iCloud sync is on. This is separate from Sato’s backend.

fatsecret & Open Food Facts · food lookup

fatsecret receives searches, recognized food names, and food/barcode identifiers through Sato’s service. With online lookup on, Open Food Facts receives barcode digits and connection metadata directly from your device. Queries can reveal health interests; lookups do not require your full medical or food history.

Netlify, ImprovMX & Gmail · communications

Process forms, email, and attachments, including health details you submit. Please avoid health information in website forms.

Apple & RevenueCat · purchases

Process subscription/tip identifiers, access status, and related metadata. We do not send health logs to RevenueCat, though app use may allow health-related inferences.

Your recipients & legal disclosures

Export recipients receive what you share. Other disclosures may occur when required by law or permitted by applicable health-data law.

No corporate affiliates receive consumer health data. We do not sell it or share it for targeted advertising. Provider privacy and contact links appear in Services we use.

5. Consent & controls

We collect and use health data to provide requested services or with your consent, as applicable law requires. Where separate sharing consent is required, we obtain it separately. Accepting the Terms does not replace that consent.

Nothing goes to OpenAI until you choose “Agree and continue” on “A few features use OpenAI.” “Not now” sends nothing. In Settings → Cloud features, four switches start on:

• Spoken check-ins.
• Meal-photo estimates, including cloud label readings.
• Online food lookup, including searches and direct Open Food Facts barcode requests.
• The weekly note.

Import assistance runs only after “Read the names” and the same OpenAI agreement, with a payload preview. Apple’s microphone and photo permissions do not, by themselves, consent to health-data sharing.

Withdraw consent in settings or email privacy@sato-app.com. Withdrawal applies going forward and may limit related features. Audio and photos are processed before draft review; declining a draft does not undo that processing. Recordings, images, and weekly records may contain identifying or health details that Sato does not fully remove.

6. Your rights & deletion

Where applicable, you can ask whether we collect, share, or sell your health data; access it; withdraw consent; or request deletion. You can also request a list of third parties and affiliates that received it, with contact details required by law. We do not sell this data.

Email privacy@sato-app.com. We verify requests proportionately, explain when records cannot be located, and meet applicable deadlines:

• Washington: within 45 days of receiving a covered request.
• Nevada: generally within 45 days of authentication; deletion within 30 days, subject to the backup exception.
• Extensions: up to 45 additional days where permitted, with timely notice and an explanation.

Required deletion includes notifying applicable processors and recipients. Deferred backup deletion must occur within six months of authentication under Washington law. Nevada allows necessary backup-restoration delays up to two years. Where multiple laws apply, we follow the shorter applicable deadline and explain any exception.

Deleting the app alone may leave iCloud, Apple Health, backups, and exports. “Delete all Sato data” removes the iCloud copy only with sync on. Use the relevant Sato and Apple controls for other copies. Correct logs in the app, or email us to correct information we hold.

Responses are free as required by law. You will not be penalized for exercising a privacy right, though features may need data to work.

7. Appeals & complaints

If we deny a request, reply to the decision or email privacy@sato-app.com with “Privacy appeal” and explain why you believe the decision should change. We will review your appeal and send a written decision with our reasons within 45 days of receiving it.

If your appeal is denied, you may contact your state attorney general. Washington complaint options and Nevada complaint options are available online. Other rights or remedies under applicable law remain available.

8. Retention, updates & contact

App records remain in your chosen storage until deleted. Cloud processing, technical logs, support, and earlier reports follow the separate rules in Retention & deletion.

We give notice before material changes to collection, use, or sharing where required and obtain new consent when required by law. Contact Sato Health LLC, Wisconsin, United States: privacy@sato-app.com.