Sachi Health ("we," "our," or "us") provides a mobile application designed to help individuals living with Polycystic Ovary Syndrome (PCOS) explore research-informed lifestyle approaches through wellness tracking, research-inspired wellness programs, and daily goal tracking.
This Privacy Policy explains what data we collect, how we use it, who has access, and how you can control your information.
This policy applies to all users of the Sachi Health mobile application, website at sachi-health.com, and related services.
Sachi Health is currently in early beta testing. Features may change, and we cannot guarantee uninterrupted availability. We are a small team committed to protecting your data.
With your explicit permission, we read the following data types from Apple Health:
Weight data may be written back to Apple Health. HealthKit data is never shared with advertising networks, data brokers, or any third party for marketing purposes. HealthKit data is used solely to support your wellness tracking.
During the beta testing period, Apple's TestFlight service may collect additional data including crash logs, usage statistics, and device information under Apple's own privacy policy.
We process your health data based on the explicit consent you provide during account setup and program enrollment. You may withdraw this consent at any time through the app settings.
Marketing website (www.sachi-health.com): When you submit your email address (and optionally a first name) on the beta waitlist (/beta) or newsletter (/newsletter) page, we use that information to add you to the corresponding mailing list (Mailchimp for the beta waitlist, Beehiiv for the newsletter), send you the communications you signed up for, and reach out about Sachi Health updates. We also collect anonymized page-view and CTA-click metrics to understand which messaging resonates with visitors. You may unsubscribe from emails at any time using the link in any newsletter, or request full deletion of your record by emailing security@sachi-health.com.
Call recordings: One-on-one onboarding or support calls may be recorded with your verbal consent for product improvement. Fireflies.ai transcribes these calls. You may decline recording at any time. Recordings and transcripts are deleted after a short retention period or immediately upon request to security@sachi-health.com.
| Provider | Purpose | Data Received | Health Data? |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: Cognito, API Gateway, Lambda, RDS PostgreSQL | All account and health data (encrypted in transit and at rest) | Yes |
| Mixpanel | Product analytics (mobile app) | Category-level screen names, session timing, device info, IP address, device identifier, user account ID | No* |
| Vercel | Website hosting and privacy-first web analytics (www.sachi-health.com) | Page URLs, referrer, country (derived from IP, IP not stored), anonymized session counts, CTA click events; cookieless | No |
| Microsoft Clarity | Website session recordings and heatmaps (www.sachi-health.com) | Page interactions, mouse movements, scroll depth, click events; form inputs (including email) are masked by default | No |
| Google Fonts | Web fonts loaded on www.sachi-health.com (DM Sans, Instrument Serif, Geist Mono) | IP address and User-Agent are sent to Google when your browser fetches the font files; no other personal data is shared | No |
| Mailchimp | Email communications; beta waitlist signups (www.sachi-health.com/beta); product feedback surveys | Email address, name, product feedback survey responses | No |
| Beehiiv | Newsletter subscriptions (www.sachi-health.com/newsletter) | Email address (and any other fields submitted through the Beehiiv subscription form) | No |
| Apple | App distribution (TestFlight/App Store), HealthKit access | Standard App Store data; HealthKit data stays on device | No |
| Google (Forms) | Survey collection | Anonymous survey responses (potentially including PCOS diagnosis, symptom preferences) | Yes** |
| Calendly | Meeting scheduling | Name, email address, scheduling availability | No |
| Fireflies.ai | Call transcription (optional, verbal consent only) | Voice recordings of onboarding/support calls | Potentially*** |
*Mixpanel: Mixpanel receives category-level screen names (e.g., "checkin" or "insights") that indicate which sections of the app you visit. These labels do not contain the content of your health entries, symptom scores, medication names, or any specific health measurements.
**Google Forms: Anonymous Google Forms surveys for customer research may ask about PCOS diagnosis or symptom tracking habits. Responses are anonymous unless email is voluntarily provided.
***Fireflies.ai: Recordings only with verbal consent. Health context may be discussed. Deleted after short retention or immediately upon request.
Law Enforcement: We will disclose personal information only in response to valid legal process such as a court order or subpoena.
Reproductive and Menstrual Health Data: We understand the sensitivity of menstrual cycle data. Your menstrual data is encrypted in transit and at rest. We do not share menstrual data with any third party in identifiable form. We will disclose menstrual or reproductive health data only in response to valid legal process such as a court order or subpoena.
Your health data is stored both on your device and on our encrypted servers. We use encryption to protect your data in transit and at rest. Our servers are hosted on Amazon Web Services (AWS) in the United States.
Check-ins and entries are saved locally first and synced when a network connection is available. If a sync fails, data is retained locally and retried on the next app opening.
If you are located outside the United States, please be aware that your data is processed and stored in the United States.
| Event | When It Fires | What's Sent |
|---|---|---|
| Registration | When account created | Event name only (no personal details) |
| Screen Viewed | Each navigation to new screen | Category-level screen label (e.g., "checkin," "insights"); no health data content |
| Session Start | When app opens | Event name only |
| Session End | When app goes to background | Session duration in seconds |
Your analytics events are linked to your account identifier. We use this to diagnose issues and understand feature adoption, not for advertising or profiling.
Mixpanel automatically collects device model, OS version, app version, screen size, carrier, language, IP address (for city-level geolocation), and vendor device identifier (IDFV). All analytics processing occurs in the United States.
The Sachi Health marketing website (www.sachi-health.com) uses two analytics tools that are separate from the in-app Mixpanel analytics described above:
Neither tool receives any health, symptom, or PCOS-related information from the marketing site, since the website only collects an email address and (optionally) a first name for the waitlist or newsletter.
HealthKit data is accessed only with your explicit permission, which you can revoke at any time in your device's Settings > Health > Data Access.
HealthKit data is:
Regardless of where you live, you have the right to:
We will not discriminate against you for exercising any of these rights. To exercise your rights, use the in-app options or email security@sachi-health.com. We will respond within 30 days.
CCPA/CPRA rights. We do not sell personal information. Health data is sensitive personal information under CPRA.
My Health My Data Act rights regarding consumer health data, including access, delete, and withdraw consent. Right to know specific third parties (listed in Section 3). We do not sell consumer health data.
CTDPA rights to access, correct, delete, and obtain a copy of personal data including consumer health data.
You may request deletion via "Delete Account" in app or email security@sachi-health.com.
If Sachi Health ceases operations, we will make reasonable efforts to notify you at least 30 days in advance.
Sachi Health is intended for users 18 years of age and older. We do not knowingly collect personal information from individuals under 18. If we become aware, we will delete that information promptly.
In the event of a data breach affecting your personal health information, we will:
If 500+ people are affected, we will also notify prominent media outlets as required by law.
We may update this Privacy Policy from time to time. We will notify you of material changes by email before they take effect and by posting the updated policy on our website and in the app.
Sachi Health
Email: security@sachi-health.com
Website: sachi-health.com
Privacy-related requests receive responses within 30 days.