Simcheong (심청이) Privacy Policy

1. Why we process personal information

We process personal information only for the purposes below, and we will tell you and obtain any required consent before using it for a new purpose.

• Identifying you and managing your account: sign-in, verification, abuse prevention, account deletion
• Managing institution participation: join requests, approvals and invitation-code checks
• Providing AI voice calls and chat: speech recognition, AI replies, speech synthesis, and check-in calls scheduled by your institution
• Conversation history, summaries and memory, so later conversations can build on earlier ones
• Health and daily-life features: mood records, medication schedules and dose logs, medicine photo guidance, the mind-health report, and step display
• Keeping call recordings: only for users who agree, for their institution's care review and call-quality checks
• Provision to your institution: supporting your institution's care, with your separate consent (section 7)
• Family connections: sharing with connected family members to the extent you allow
• Keeping the Service reliable: diagnosing and fixing errors and crashes
• Answering enquiries and handling requests to exercise your rights

2. What we process

Account information (required)

Email address, sign-in identifier, and sign-in records (time, IP address, device and browser details). You can sign in with an emailed code, a Google account or, on iPhone only, an Apple account; if you sign in with Google or Apple, the account identifier that service provides and the information you agreed to share (for example, name and email address).

Institution participation (required)

Your institution, the status of your join request or approval, and invitation-code checks (invitation codes and recipient emails are stored as hashes).

Voice calls (required)

Your voice during a call (processed in real time), transcripts, AI-generated call summaries and conversation-tone assessments, moods the AI inferred from the conversation, call records such as date, time and length, and call schedules.

Call recordings (optional)

Created only if you agree to "Call voice recording and storage" (section 4).

AI chat

Chat messages, audio when you dictate a message, and attached photos, PDFs and text files. Attachments are used only for the AI's analysis; the files themselves are not stored. Chat text is stored only if you turn on "Keep conversation summaries".

Memory

Facts about you that the AI noted from conversations (for example, things you like, family stories, health-related remarks). You can review and delete them under My space › "What Simcheong remembers".

Health-related information (when you use these features)

Mood records; medicine names, directions and schedules; dose logs; medicine details read from a pharmacy bag or medicine photo (the photo itself is not stored); and questionnaire answers you enter to create a mind-health report (used only to generate the report, not stored separately on our servers).

Family connections (when you use this feature)

Family invitation links, connected family accounts and family-sharing settings.

Generated automatically

Push notification tokens (Android FCM, iOS VoIP), a random device identifier created by the app, app error and crash information (device model, operating system, app version, where the error occurred), consent records, and service usage records.

Kept only on your device

Gratitude and reflection entries, sleep entries, your family map, and step counts. Steps are only read, with your permission, from Apple Health or Health Connect. None of this is sent to our servers, and it is removed when you delete the app.

We do not collect advertising identifiers, and we do not create voiceprints that identify you by your voice.

3. Sensitive (health) information

Health information such as medication details, mood records, mind-health questionnaire answers and health or emotional conditions you mention in conversation is sensitive information under Article 23 of PIPA. We ask for your separate consent in the app's consent step, apart from other personal information, and process it only for the purposes in section 1.

You have the right to refuse this consent. However, because health matters can come up in any AI conversation, you cannot use Simcheong without it.

The Service's analyses and guidance are for reference only; we do not use them for medical diagnosis or treatment.

4. Call recording

Simcheong records a call only if you agree to the optional consent item "Call voice recording and storage". If you do not agree, calls and every feature work exactly the same.

Recordings are used for your institution's care review and for call-quality checks. You can change your choice at any time by turning "Store voice recordings" on or off under My space › Sharing & consent. When you turn it off, calls that start afterwards are not recorded and recordings already stored are deleted without delay.

Recordings are kept in the cloud storage of our calling provider, Daily (United States). Our database stores only the information needed to find a recording (recording ID, call date and time, and similar). Institution staff may play recordings back under the consent to provision in section 7; each playback uses a time-limited link and is logged.

Recordings are deleted automatically 90 days after the call. If you withdraw your recording consent by turning off "Store voice recordings", or delete your account, we start deleting the recordings stored until then without delay. You can also ask us to delete them at support@intunelabs.ai or +82-42-823-5557 and we will delete them without delay. Deletion is carried out by the calling provider on our request and may take some time to complete; the information used to find a recording is deleted once the provider confirms the recording is gone.

5. How long we keep information

We destroy personal information without delay once you delete your account or the purpose of processing has been achieved, except for the following, which we keep for the periods shown.

Information stored on our servers (account, conversations, health records and so on)

Until you delete your account. The Account Deletion page explains what is deleted and what remains.

AI chat text

If "Keep conversation summaries" is on, deleted automatically 30 days after it is saved (up to 365 days, depending on institution settings).

Call recordings

90 days from the call. Deletion starts without delay when you turn off "Store voice recordings", delete your account or ask us to delete them (section 4).

Information provided to your institution

As set out in section 7.

App error and crash information

According to the retention policy of the service provider (Sentry).

Information kept under law

Information that a law requires us to keep is stored separately for the period that law sets.

6. How we destroy information

• We destroy personal information without delay once its retention period ends or its purpose has been achieved.
• Information we must keep by law is stored separately from other information and destroyed when that period ends.
• Electronic files are deleted so they cannot be recovered; printed information is shredded or incinerated.

7. Provision to third parties

We do not provide personal information to third parties except with your consent or where the law specifically allows it. With your consent under Article 17 of PIPA, we provide personal information as follows.

Your institution (required consent)

Recipient: the institution (welfare centre or similar) that approved your participation Purpose: supporting your care (check-ins and linking you to help in a crisis) and running check-in call schedules Information: name (or preferred name), email and other participant details, participation status, call schedules and call records (date, length, outcome), transcripts and call summaries, mood and medication records, crisis alerts (crisis-related expressions found in a conversation and the relevant passage), and call recording playback (only if you agreed to "Call voice recording and storage") Retention: until your participation ends or you withdraw consent. Information the institution keeps in its own care records follows the institution's retention period. Right to refuse: you have the right to refuse this consent. However, Simcheong is provided together with your institution, so if you refuse you cannot use the institution-linked service.

Connected family members (optional)

Only if you invite and connect family members and turn on "Share with family" can connected family see the information you share, such as call summaries. "Share with family" stays off until you turn it on, and you can turn it off at any time.

Consent to provision to your institution is asked separately from other consents in the app's consent step. Health information among these items is provided within the sensitive-information consent in section 3.

8. Processors and transfers outside Korea

We entrust the processing of personal information to the companies below to provide the Service. All of them process personal information outside the Republic of Korea (in the United States). Information is sent over encrypted connections (such as HTTPS) whenever you use the Service.

AI replies in voice calls and picture-generation requests pass through a relay server that the Company operates (hosted by Hostinger) and are sent to Google (Gemini) and OpenAI (ChatGPT) under the Company's subscription accounts; if a reply is delayed, the paid Gemini API handles it. Requests made through the subscription accounts are also subject to Google's and OpenAI's terms and privacy policies for those services.

Under Article 28-8 of PIPA, we transfer personal information outside Korea after disclosing in this policy the recipient, country, items and purpose, retention period, timing and method of transfer, and how to refuse. Sensitive information is processed only with the separate consent described in section 3.

Clerk (United States)

Recipient: Clerk, Inc. (privacy@clerk.dev) Service: sign-in and account authentication Information: account information and sign-in records Retention: until you delete your account

Convex (United States)

Recipient: Convex Systems, Inc. (privacy@convex.dev) Service: the Service's database and file storage (US East) Information: everything stored on our servers (account, institution participation, conversations, health records and so on) Retention: the periods in section 5

Vercel (United States)

Recipient: Vercel Inc. (privacy@vercel.com) Service: running the app's server (API) Information: requests the app sends to the server (chat, attachments, medicine photos, report questionnaires and so on) and IP address Retention: while the request is processed (operational logs follow Vercel's policy)

Daily (United States)

Recipient: Daily, Co. (help@daily.co) Service: voice call connections, running the AI voice-conversation server (Pipecat Cloud), storing call recordings Information: call audio, transcripts and AI replies, call recordings (if you agreed to recording) Retention: call audio is processed in real time during the call; recordings for the period in section 4

Inworld AI (United States)

Recipient: Theai, Inc. (Inworld AI, privacy@inworld.ai) Service: speech recognition (speech to text) and speech synthesis (AI replies to voice) Information: call audio, dictated chat audio, AI reply text Retention: while the request is processed

Google — Gemini API and push notifications (United States)

Recipient: Google LLC (https://support.google.com/policies?p=privpol_privts) Service: AI chat replies, analysing chat attachments and medicine photos, call summaries, writing mind-health reports, backup processing of voice-call AI replies and picture generation, Android push notifications (FCM) Information: conversation content, chat messages and attachments, medicine photos, report questionnaire answers and related records, push tokens Retention: while the request is processed (operational logs follow Google's policy)

Google — subscription-account route (United States)

Recipient: Google LLC (https://support.google.com/policies?p=privpol_privts) Service: generating voice-call AI replies (primary route) and pictures, sent through the Company's relay server Information: conversation content (including the memory, mood and medication details the conversation needs), picture-generation requests Retention: while the request is processed. Records of requests made through the subscription account may be kept under Google's terms and policies.

OpenAI — subscription-account route (United States)

Recipient: OpenAI OpCo, LLC (privacy.openai.com, dsar@openai.com) Service: generating voice-call AI replies (backup route when a Google reply is delayed), sent through the Company's relay server Information: conversation content (including the memory, mood and medication details the conversation needs) Retention: while the request is processed. Records of requests made through the subscription account may be kept under OpenAI's terms and policies.

Hostinger (United States)

Recipient: Hostinger (gdpr@hostinger.com) Service: hosting the AI request relay server that the Company operates Information: voice-call AI requests, picture-generation requests Retention: until the purpose of the entrustment is fulfilled

Apple (United States)

Recipient: Apple Inc. (https://www.apple.com/legal/privacy/contact/) Service: delivering iOS call notifications (VoIP push) Information: push tokens Retention: until you sign out or delete your account

Sentry (United States)

Recipient: Functional Software, Inc. (Sentry, compliance@sentry.io) Service: diagnosing app errors and crashes Information: app error and crash information (configured not to send conversation content or account IDs) Retention: the period in section 5

If you do not want your information transferred outside Korea, you can delete your account or ask us to stop processing by emailing support@intunelabs.ai. Because the companies above are needed to provide the Service, refusing the transfer means you cannot use the Service. If these companies change or are added to (for example, to send crisis alerts by email or text message), we will update this policy before the change takes effect.

9. AI processing and automated decisions

• Simcheong's conversation partner is an AI, not a person. The AI's replies, summaries, memory and mood records may contain errors.
• Based on your calls, the AI creates call summaries and conversation-tone assessments, and records moods it infers and facts about you.
• If your institution uses crisis alerts, expressions related to a crisis such as self-harm found in a conversation are flagged for institution staff to review. These alerts are for people to check; staff do not watch every conversation in real time.
• We do not make decisions that significantly affect your rights or obligations by fully automated means alone.
• We do not use your conversations or call recordings to train the Company's AI models. If that ever changes, we will tell you in advance and ask for your separate consent.

10. Your rights and how to exercise them

You may at any time ask to access, correct or delete your personal information, to stop its processing, or to withdraw your consent.

• In the app: under My space › Sharing & consent you can change the recording, conversation-history and family-sharing settings; under "What Simcheong remembers" you can delete memories; and "Delete account" at the bottom of My space deletes your account.
• By email or phone: contact support@intunelabs.ai or +82-42-823-5557. After verifying your identity we will act on your request and tell you the result within 10 days.
• You may also make a request through a legal representative or someone you have authorised, who must provide documents showing that authority.
• A request may be limited where the law requires us to keep information or where it could infringe someone else's rights; we will tell you why.

11. How we keep information secure

• Connections between the app and our servers, and between our servers and our processors, are encrypted (HTTPS and similar).
• For every request, our servers check that you are the signed-in user, or a member of institution staff responsible for you, before showing any information.
• Recording playback uses time-limited links and is logged.
• App error reports are configured to strip conversation content and account information before they are sent.
• Access to personal information is limited to the people and scope that their work requires.

12. Automatic collection tools

The Simcheong app does not use cookies or tracking tools for advertising or targeted advertising.

Optional usage analytics to improve the app (analytics tool PostHog) are currently switched off in the app. If we switch them on, we will add the recipient and country to this policy first, and they will apply only to users who agree.

13. Age

Simcheong is a service for adults aged 18 and over. We do not collect personal information from children under 14; if we learn that we have, we will destroy it without delay.

14. Privacy officer and contact

For questions, complaints or remedies about how we process personal information, please contact our privacy officer below. We will respond and act without delay.

Privacy officer

Joowon Lee (CEO) Email: support@intunelabs.ai Phone: +82-42-823-5557

Company

IntuneLabs (주식회사 인튠랩스) · Business registration no. 644-88-03732 903, 99 Daehak-ro, Yuseong-gu, Daejeon, Republic of Korea

15. Remedies

If you need to report or discuss a privacy infringement, you can also contact the following Korean bodies.

• Personal Information Dispute Mediation Committee: 1833-6972 (in Korea), www.kopico.go.kr
• Privacy Infringement Report Center (KISA): 118 (in Korea), privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 (in Korea), www.spo.go.kr
• Korean National Police Agency: 182 (in Korea), ecrm.police.go.kr

16. Changes to this policy

This policy applies from the effective date above. We will announce changes in the app or on this website at least 7 days before they take effect, or at least 30 days before for changes that materially affect your rights.