Privacy Policy

1. Who we are

Sato Health LLC, a Wisconsin limited liability company, provides Sato and this website. “We” and “us” mean Sato Health LLC. For privacy questions or requests, email privacy@sato-app.com.

2. What this policy covers

This policy covers Sato (listed as “Sato: GLP-1 & Weight Tracker” on the App Store), its online services, and sato-app.com. Our Consumer Health Data Privacy Policy explains additional health-data rights. Apple and other providers have their own policies for services they provide directly to you.

Sato is a consumer tracking and educational app. It does not create a clinician–patient relationship or, by itself, provide a HIPAA-covered healthcare service. Your records may have different legal protections from records held by your clinician. Other privacy and consumer-protection laws may apply.

3. Records on your device & iCloud

Sato stores your profile, medication and dose history, injection sites, schedules, supply and vial details, weight and goals, symptoms, appetite, food noise, food and nutrients, hydration, exercise, and notes. It can also store photos, settings, imports, reports, trends, and estimates.

Health logs and progress photos are saved on your device and can sync through your private iCloud database. Profile images stay in a separate local store. Turn sync off in Settings → iCloud sync; new records and photos stay on that device until you turn it back on. Sync is separate from requests to Sato’s online services.

For fatsecret foods, names, serving sizes, and values stay on the device that logged them. Sync carries food and serving identifiers, amounts, and meal totals; other devices fetch the details through Sato’s service. Conversations saved in earlier versions remain until deleted.

Device backups, exports, and Apple Photos hold separate copies. The optional photo lock uses Apple’s device authentication; Sato does not receive your Face ID or Touch ID biometric template.

4. What goes online

Food lookup

With online food lookup on, Sato sends search and autocomplete text, barcode digits, food/serving identifiers, and food names from spoken or Watch check-ins to fatsecret. Barcode scans first contact Open Food Facts directly, sending the digits, IP address, and app user-agent. Turning lookup off stops these requests. Search terms can reveal health interests.

Cloud AI

Once you agree to OpenAI processing, Sato’s backend can send:

• Spoken check-in audio and transcripts, medication terms including names you added, and your local date, time, and time zone. Plus includes Watch recordings sent through your iPhone. Meals missing from food databases may be sent again with the transcript for nutrition estimates.
• Selected food photos with up to three labels recognized on-device; unrecognized barcode photos when cloud photo estimation is on; and nutrition-label text, plus the image if needed, for a requested cloud reading.
• The weekly-note record, when that feature is enabled.
• Import-column headings and format summaries: data type, decimal precision, magnitude, and filled proportion. Individual cell values and existing logs are not sent. Headings can contain private details; review the payload first.

Service operation

Random installation and request identifiers, session tokens, IP addresses, app-integrity information, retry counts, request timing and status, usage and quota counts, and diagnostics support sessions, security, and service limits. These identifiers can link requests from one installation; they do not make requests anonymous. OpenAI receives a scrambled installation identifier for abuse monitoring and checks requests with its moderation model.

Reports & support

Messages, email addresses, form fields, and attachments you send, including any health details you include. The retired Ask Sato reporting feature accepts no new reports; earlier submissions follow the retention rules below.

Purchases

Apple and RevenueCat use purchase status, transaction identifiers, and a random customer identifier for Sato Plus and optional one-time tips. Tips unlock no features. Sato keeps the customer identifier in iCloud Keychain to restore purchases after a reinstall or on another device. Apple handles payment details; Sato does not receive your full card number.

5. How information is used

• Provide the records, sync, food lookup, AI, import, export, and purchase features you use.
• Respond to support and privacy requests, investigate reports, and fix errors.
• Apply service limits, prevent abuse, protect security, and meet legal obligations.
• Send product news by email to people who signed up for it. You can withdraw that request at any time.

We do not sell personal or consumer health data, use health data for targeted advertising, or provide health logs to data brokers. We do not use your Apple Health data for advertising, marketing, or unrelated data mining. Sato does not include advertising SDKs.

6. Permissions & Apple Health

Sato requests Apple permissions for Health, microphone, camera, photos, and notifications. Manage them in Apple’s settings. Declining a permission can limit its feature; manual tracking remains available.

Apple Health access covers only the data types you authorize. Imported values join your Sato records, contribute to calculations and weekly reviews, and sync through private iCloud when sync is on. If you enable writing, confirmed values can also be saved in Apple Health.

With Plus, OpenAI consent, and the weekly-note switch on, the weekly record is sent automatically when the dose week closes. It can include weight, steps, workouts, and nutrients from Apple Health. Health permission alone does not authorize voice or photo uploads. Revoking it does not erase previously imported or written values.

7. Voice logging

Spoken check-ins temporarily record audio on your iPhone, then send it through Sato’s backend to OpenAI for transcription. Medication terms, including names you added, help recognition. The transcript becomes draft entries and may be used for nutrition estimates.

With Plus, Apple Watch sends recordings to your paired iPhone and deletes its copy after transfer. The iPhone processes them under the same OpenAI consent and spoken-check-in switch, and shows drafts for review.

You review, edit, and confirm drafts before they enter your log. Cloud processing happens before that review. Canceling a draft does not recall uploaded audio or text.

The server processes audio in memory. The app is designed to delete temporary recordings after processing or cancellation. Failed uploads remain on your iPhone until you retry or dismiss the error; interrupted cleanup can leave a temporary file. See Retention & deletion for Sato’s retry cache and OpenAI’s separate audio and transcript rules.

8. Photos, AI & weekly reviews

OpenAI powers spoken check-ins, selected photo features, the weekly note, and optional import assistance. Nothing is sent until you choose “Agree and continue” on the OpenAI page. Sato no longer includes Ask Sato chat or clinical research. Exports go to the recipients or storage services you choose.

Meal photos

With cloud photo estimation on and available, Sato sends the selected image and up to three on-device food labels to OpenAI through its backend. With it off, available on-device recognition is used. Progress and profile photos are not automatically analyzed as meals.

Nutrition labels

Label scans first read text on-device. A requested cloud second reading sends that text and, if needed, the image. Check values and serving size before saving.

Weekly note

With Plus, OpenAI consent, and the weekly-note switch on, Sato automatically sends a record when each dose week closes, usually before you open the report. OpenAI writes the note at the top. The record includes:

• Weekly weights, doses and timing, symptoms and severity, hunger, food noise, meal counts and timing, nutrients, steps, and workouts. Weight, activity, and nutrient values can come from Apple Health.
• Medication and dose, recent weekly weight averages, dose stages and adherence, and last week’s note.
• Profile details: age band, sex, BMI, starting, current, and goal weights, weekly loss target, diabetes status, and activity level.

Days are numbered, not dated. Names, food names, and free-text notes are excluded. The rest of the report is generated on-device, as is the note when this feature is off or unavailable.

Recordings can contain anything you say, including health details and identifying information. Avoid names, contact details, other people, and unrelated private content in recordings and images. Sato does not promise to remove every identifying detail.

The meal-photo switch also controls cloud label readings. Voice, food lookup, weekly notes, and requested import assistance have separate controls. Reviewing an entry before saving does not undo processing. OpenAI’s training and retention rules are explained in Retention & deletion.

9. Services we use

Apple · platform, sync, health & purchases

Provides iCloud, HealthKit, App Store payments, and app-integrity services. Depending on what you enable, Apple processes synced records, authorized health data, and transaction/device information. Apple privacy information.

Railway · backend hosting

Hosts Sato’s online food and AI services, processing request content and connection information. Railway privacy information.

OpenAI · transcription & AI

Processes the voice, photo, weekly-note, and import inputs listed in section 4, including Watch recordings and meal descriptions. Sato does not use OpenAI for chat or clinical web research. OpenAI API data controls.

fatsecret & Open Food Facts · food information

fatsecret receives searches, recognized food names, barcodes, and food/serving identifiers through Sato’s backend. Open Food Facts receives barcode digits and connection metadata directly from your device when online lookup is on. Lookups do not send your full health history. Open Food Facts privacy information · fatsecret privacy information.

RevenueCat · purchase access

Processes a random customer identifier, subscription/tip status, transactions, and SDK/device metadata to manage purchases. The identifier is not your name, email, or device identifier; it stays in iCloud Keychain after reinstalling or deleting Sato data to restore access. We do not send health logs to RevenueCat. RevenueCat privacy information.

Netlify · website & forms

Hosts this site and processes form submissions, connection information, and spam/security signals. It uses Akismet for spam filtering and keeps submissions until we delete them. Netlify privacy information.

ImprovMX & Google Gmail · email

ImprovMX forwards domain email to Gmail. Messages and form notifications include your email, name, and anything you write. ImprovMX privacy information · Google privacy information.

Providers receive information needed for their role. We may disclose information when legally required, to protect rights or safety, or in a business transfer subject to applicable notice, consent, and privacy obligations. No corporate affiliates receive your health data.

10. Website, forms & email

This site uses no advertising pixels or analytics scripts. Images, styles, and bundled fonts are hosted here; system fonts are also used. Infrastructure providers still process connection and security logs.

The contact form collects your name, email, topic, and message. Netlify processes submissions and emails notifications. Email-update signups include your email and consent. Please do not submit medical records, health-log screenshots, or urgent medical questions.

Unsubscribe through an update or email hello@sato-app.com. We may keep minimal information to avoid adding you back. Privacy requests do not enroll you in marketing.

11. Retention & deletion

App records and copies

Settings → Privacy → Delete all Sato data removes records, progress photos, cached weekly notes, your OpenAI consent choice, the installation identifier, pending Watch check-ins and recordings, temporary backups and exports, store recovery copies, and samples Sato wrote to Apple Health. It keeps the RevenueCat identifier for restoring purchases.

With iCloud sync on, deletions reach your private iCloud database when they sync. With sync off, existing cloud records remain; delete again with sync on to remove them. Deleting the app alone can leave records that return after reinstalling.

Other Apple Health entries, Apple Photos, device backups, and exports are separate copies. An in-app deletion confirmation does not prove every copy is gone.

AI processing

Sato processes AI inputs without saving them to a server database. A check-in’s transcript and results stay in server memory for up to 90 seconds to answer retries, then are discarded. Server logs contain timing, usage counts, and error codes, not recordings, transcripts, photos, or food-search content.

OpenAI does not use API inputs or outputs to train models by default; training requires the API customer to opt in. Its audio transcription endpoint lists no abuse-log or application-state retention. Sato requests that Responses API outputs not be stored as retrievable application state.

Later AI processing has different rules: transcripts, photos, weekly records, and other Responses API content may remain in abuse-monitoring logs for up to 30 days under standard settings, or longer for legal or safety reasons. Prompt caching can retain an encrypted request representation; duration depends on the model and provider settings. Images flagged by OpenAI’s child-safety scan are kept for review. Sato does not claim organization-wide zero data retention. See OpenAI’s API data controls.

Food results

fatsecret results stay in backend memory for at most 24 hours, with regular expiry sweeps and no database storage. Saved meals and exports may retain nutrition values separately. fatsecret’s license and storage restrictions still apply after you confirm an entry.

Operational, purchase and support records

We retain usage/security records to operate and protect the service; support messages and earlier reports to resolve issues; and purchase records to restore access, meet accounting needs, and comply with law. Duration depends on the purpose, provider settings, and legal obligations. Contact us to request deletion.

We delete or deidentify information no longer needed, subject to required retention and applicable rights. Valid health-data deletion requests cover processors, recipients, and backups as required by law. We cannot delete independently shared files or storage we cannot access, but can explain your controls.

12. Your choices & requests

Nothing goes to OpenAI until you choose “Agree and continue” on “A few features use OpenAI.” “Not now” sends nothing. In Settings → Cloud features, “Sending to OpenAI” lets you view or change your answer.

• Cloud switches: spoken check-ins, meal-photo estimates, online food lookup, and weekly notes. All four start on; review them before use. Photo estimates include cloud label readings; food lookup includes searches and direct Open Food Facts barcode requests. Typed check-ins remain available when voice is off.
• Import assistance: runs only after you tap “Read the names” and agree to OpenAI processing. “See what’s sent” previews the payload.
• Backups and exports: Settings → Backup & export offers backups, CSV, and clinician summaries. JSON backups exclude progress photos.

Email privacy@sato-app.com to request access, correction, a copy, deletion, withdrawal of consent, or disclosure details for data we hold. Include enough to identify your request, without a full medical history.

We may ask for proportionate verification or authority to act for someone else. Installation, purchase, or support references may help locate records; we will explain what is needed. No Sato account or new sign-up is required. Do not email passwords, tokens, card details, or a full health-data export.

Rights vary by location. We do not discriminate for exercising them or sell data or share it for cross-context behavioral advertising, including when your browser sends a Global Privacy Control signal. See the health-data rights and appeal process.

13. Children & teenagers

Sato is intended primarily for adults. A person aged 13–17 may use it only with a parent or guardian who agrees to the Terms and supervises use. Sato is not directed to children under 13, and we do not knowingly collect their personal information.

If you believe a child under 13 has supplied information to our services, contact privacy@sato-app.com so we can investigate and delete it as appropriate. Children’s information could reach us through cloud features or support even though Sato does not have a sign-in.

14. Security & international processing

We use safeguards such as encrypted network connections, access controls, provider authentication, and limits on transmitted context. No system is perfectly secure. Protect your device, Apple account, backups, and exported files.

Service providers may process information in the United States or other countries where they operate. Laws and protections can differ from those where you live. Where legally required, we use the applicable safeguards for cross-border processing.

If a security incident triggers notification duties, including under the FTC Health Breach Notification Rule or state law, we will notify affected people and authorities as required.

15. Changes & contact

We will update this page when this policy changes. Material changes will be communicated through the app or website, and we will obtain consent where a new collection, use, or disclosure requires it.

Privacy questions: Sato Health LLC · Wisconsin, United States · privacy@sato-app.com.