Privacy Policy

Effective: 2026-06-11 · Version v0.1 (beta preparation) · 한국어

JYLAB ("the Company", Business Reg. No. 365-53-01159, South Korea) complies with the Personal Information Protection Act of Korea (PIPA) and other applicable laws, and publishes this policy to explain how user data is handled.

1. Data We Collect

Category	Items	How collected
Account	Name (nickname), messenger profile, email	At sign-up / channel connection
Health data (sensitive)	Activity records (distance, duration, heart rate), sleep, steps, weight and body composition (skeletal muscle, body-fat %), meal photos and estimated nutrition	Wearable accounts the user explicitly connects (Garmin Connect, Samsung Health / Health Connect); photos the user submits
Service usage	Conversation logs, access timestamps	Generated during service use

Health data is treated as sensitive information under PIPA Article 23 and is collected only after separate, explicit consent.

2. Purpose of Use

Generating AI-based wellness coaching content (daily briefs, weekly reports)
Integrated analysis and trends across activity, sleep, body composition and diet
Service improvement and error analysis (statistical purposes, pseudonymized/anonymized)

The service provides general wellness information only and is not a medical device or medical service for diagnosis or treatment.

3. Processing Delegation & Cross-Border Transfer

The Company delegates AI processing as below. Some processors are located overseas; users provide separate consent to cross-border transfer at sign-up.

Processor	Delegated work	Country	Retention
Google LLC (Gemini API)	AI analysis of health data, coaching text generation	USA	Discarded immediately after processing (no-training setting)
Anthropic PBC (Claude API)	AI analysis of health data, coaching text generation	USA	Discarded immediately after processing (no-training setting)
(TBD) Cloud infrastructure provider	Data storage	Updated when confirmed	Deleted upon account closure

4. Retention Period

Data is deleted without delay upon service withdrawal (account disconnection), and completely erased within 30 days at the latest.
Where retention is required by law (e.g., 5 years for e-commerce contract/payment records), data is kept only for the legally mandated period.

5. User Rights

Users may request access, correction, deletion, or suspension of processing of their data at any time.
Wearable account connections can be revoked at any time; new collection stops immediately upon revocation.
Contact: jaeyoon1725@gmail.com (handled within 7 business days)

6. Security Measures

Sensitive data including health data is encrypted at rest and in transit.
Access is restricted to minimum personnel and access logs are retained.
External integration tokens are stored encrypted; plaintext passwords are never retained.

7. Data Protection Officer

Jaeyun Shim (CEO) · jaeyoon1725@gmail.com

Reporting/consultation: KISA Privacy Center (privacy.kisa.or.kr / 118), Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)

8. Notice of Changes

Changes to this policy will be announced on the website at least 7 days before taking effect.

This document is a draft (v0.1) for the beta preparation stage. It will be updated after legal review before official launch and any paid service. The Korean version (개인정보처리방침) prevails in case of discrepancy.