Privacy Policy

Purpose of Personal Information Processing

Our clinic processes the minimum amount of personal information for the following purposes.

The personal information we process will not be used for any purpose other than those listed below. Should the purpose of use change, we will take necessary measures, such as obtaining separate prior consent in accordance with Article 18 of the Personal Information Protection Act.

• Used for identity verification procedures related to medical/screening appointments, appointment inquiries, and membership services • Guidance on using the clinic and information on new services and events • Medical appointments. Appointments. Mobile notifications regarding upcoming hospitalizations and scheduled tests • Sending medical bills, statements, and certificates, as well as dispensing medications, screening supplies, and test results • Providing services for diagnosis and treatment (including the sharing of personal and medical information necessary for consultative care) and administrative services such as medical billing, payment collection, and reimbursement • Minimum analytical data required for education, research, and medical services • Basic data for online/offline consignment, external testing, and clinical trial reviews • Establishing communication channels for handling public inquiries and grievances • Providing information in accordance with relevant laws and regulations, such as the Medical Service Act and the Criminal Code • Providing information related to pre- and post-screening services following the completion of health screenings

※ To ensure the smooth handling of the matters described above, we may outsource personal information processing to an external specialized company; details regarding this will be disclosed in our Privacy Policy.

Collection of Personal Information and Methods

The personal information collected by our clinic is listed below. The information collected is divided into required and optional fields; even if you do not enter the optional information, there will be no restrictions on using our services, such as signing up for membership or receiving medical treatment.

* We will provide a separate notice when collecting personal information on a short-term basis for specific purposes other than those mentioned above. This includes not only the information provided at the time of registration but also any information updated through subsequent modifications.

Matters Concerning the Provision of Personal Information to Third Parties

As a general rule, our clinic processes users’ personal information only within the scope specified for the purpose of processing and does not disclose users’ personal information to third parties. However, the following cases are exceptions to this rule.

• When separate consent has been obtained from the data subject
• Where there are specific legal provisions
• In cases where the data subject or their legal representative is unable to express their will, or where prior consent cannot be obtained due to an unknown address or other reasons, and where it is deemed clearly necessary to protect the urgent interests of the data subject or a third party regarding life, physical safety, or property
• When personal information is provided in a form that does not allow for the identification of specific individuals, as required for purposes such as statistical analysis and academic research.

Except for the cases listed above, if we provide personal information to third parties, we will notify you through our Privacy Policy.

Outsourcing of Personal Information Processing (Handling)

To ensure the smooth processing of personal information, our clinic has outsourced the following tasks.

When entering into an outsourcing contract, our clinic specifies in the contract and other documents matters related to liability—including the prohibition on processing personal information for purposes other than those specified in the contract, technical and administrative protective measures, restrictions on re-outsourcing, management and supervision of the contractor, and compensation for damages—in accordance with Article 26 of the Personal Information Protection Act. We also supervise the contractor to ensure that personal information is processed securely.

If there are any changes to the scope of the commissioned work or the contractor, we will disclose such changes without delay through this Privacy Policy.

Processing and Retention Period of Personal Information

Our clinic processes and retains personal information within the retention and usage periods established by consent or by law when collecting such information.

The processing and retention periods for each type of personal information are as follows. Personal information is retained and used for the aforementioned purposes from the date of consent to its collection and use until the purpose is fulfilled.

Procedures and Methods for the Destruction of Personal Information

We destroy personal information immediately after the “Purpose of Collection and Use of Personal Information” has been fulfilled. The destruction procedures and methods are as follows.

A. Disposal Procedure

Information entered by users for purposes such as registration will be immediately destroyed in accordance with the following destruction procedures once the intended purpose has been fulfilled.

B. Expiration Date

Personal information will be destroyed within 5 days of the expiration of the retention period, or within 5 days of the date on which the processing of such information is deemed unnecessary—such as when the purpose of processing has been achieved, the relevant service has been discontinued, or the business has been terminated.

C. Disposal Method

Personal information stored in electronic files is deleted using technical methods that make it impossible to recover the data.

Personal information printed on paper is destroyed by shredding or incineration.

Matters Concerning the Rights and Obligations of Data Subjects and How to Exercise Them

If a customer requests to access, correct, or delete their personal information, we will respond to the request in good faith and process it without delay. To protect personal information, we do not provide procedures for accessing, correcting, or deleting personal information via methods other than in-person visits, such as by phone, mail, or fax.

A. Access to Personal Information

Customers may visit this clinic to request access to or verification of their personal information. To ensure the most thorough protection of the personal information provided by customers, we do not provide access to or verification of such information through methods other than in-person visits, such as by phone, mail, or fax.

B. Correction/Deletion of Personal Information

• If a customer requests the correction or deletion of their personal information, this clinic will verify their identity and take the necessary measures without delay.
• If a customer requests to view or verify their personal information, we will verify their identity by asking them to present identification documents such as a resident registration card, passport, or driver’s license (new model).
• If a representative of a customer visits to review or verify information, we will verify their identity as an authorized representative by requesting proof of the agency relationship, such as a power of attorney, the customer’s seal registration certificate, and the representative’s identification.
• Even if a customer has consented to the disclosure of their personal information to a third party, if we receive a request to correct an error, we will suspend the disclosure of such personal information until the error is corrected. If incorrect personal information has already been disclosed to a third party, we will notify both the third party and the customer of this fact and take the necessary measures.
• If this clinic has a legitimate reason to refuse a customer’s request to access, verify, or correct all or part of their personal information, it will notify the customer and explain the reason.
• Customers may request to withdraw their consent (sign up or cancel) regarding the collection, use, or disclosure of their personal information as described below, and this clinic will take the necessary measures without delay.

C. Customers may withdraw their consent to the collection, use, or disclosure of their personal information.

d. A legal representative may withdraw consent for the collection, use, or disclosure of a child’s personal information if the child is under 14 years of age, and may request access to or correction of any errors in the personal information provided by the child.

Protection of Children’s Personal Information

• This clinic takes protective measures to ensure that children under the age of 14 (hereinafter referred to as “children”) and their legal guardians do not suffer any adverse consequences due to the personal information provided by the children.
• This clinic requires the consent of a child’s legal guardian in the following cases involving the child’s personal information.

A. If the company intends to collect personal information for a child’s service registration, or to use or provide the child’s personal information to a third party beyond the scope disclosed at the time of service registration or as specified in the Terms of Service

B. If a recipient of a child’s personal information uses that information for purposes other than those for which it was provided or discloses it to a third party

• This clinic may request the minimum necessary information, such as the legal guardian’s name and phone number, in order to obtain the legal guardian’s consent. In such cases, the clinic will notify the child in plain language that is easy for them to understand, explaining the purpose of collecting, using, or providing personal information and the fact that the legal guardian’s consent is required.
• We will not use or provide to third parties the personal information of a legal guardian collected for the purpose of obtaining that guardian’s consent for any purpose other than verifying whether consent has been given.

Withdraw Consent • How to Cancel Membership

You may withdraw your consent to the collection, use, and disclosure of your personal information at any time.

To withdraw your consent (cancel your membership), click “Cancel Membership” on the website, complete the identity verification process, and proceed with the withdrawal yourself. Alternatively, you may contact our Privacy Officer, and we will take the necessary measures—including the immediate destruction of your personal information—without delay.

Matters Concerning the Installation and Operation of Automatic Personal Information Collection Devices and How to Opt Out

To provide users with specialized, personalized services, we use “cookies,” which store and periodically retrieve user information. Cookies are small pieces of information that a website sends to a user’s web browser and are sometimes stored on the user’s computer’s hard drive.

A. What are cookies?

• A cookie is a very small text file sent by the server used to operate a website to the user’s browser and stored on the user’s computer’s hard drive. When the user subsequently visits the website, the website server reads the contents of the cookie stored on the user’s hard drive to maintain the user’s settings and provide personalized services.
• Cookies do not automatically or actively collect personally identifiable information, and users may refuse to allow these cookies to be stored or delete them at any time.

B. The Company’s Purpose for Using Cookies

• We use this information to analyze how users visit and use each service and website of this clinic, including their usage patterns, whether they use a secure connection, and the size of the user base, in order to provide users with optimized, personalized information, including advertisements.

C. Opting Out of Cookie Installation and Use

• Users have the option to choose whether to accept cookies. Therefore, users can set their web browser options to accept all cookies, be prompted each time a cookie is stored, or reject the storage of all cookies.
• However, if you decline to accept cookies, we may have difficulty providing the service.
• Here’s how to specify whether to allow key installation (for Internet Explorer):

[Web browser > "Tools" > Internet Options > Privacy > Set Privacy Level]

Matters Concerning Measures to Ensure the Security of Personal Information

A. Minimizing the number of employees handling personal information and providing training

We minimize the number of designated data handlers and conduct regular training.

B. Conduct regular self-inspections

To ensure the security of personal information handling, we conduct regular internal audits at least once a year.

c. Development and Implementation of an Internal Management Plan

We have established and are implementing an internal management plan to ensure the secure handling of personal information.

d. Encryption of Personal Information

Passwords, which are part of users’ personal information, are stored and managed in encrypted form so that only the user knows them, and we use additional security measures—such as encrypting files and transmitted data—to protect important data.

E. Technical measures to prevent hacking and other security threats

To prevent the leakage or damage of personal information caused by hacking or computer viruses, we install security software and perform regular updates and inspections. We also install our systems in areas with restricted external access and implement technical and physical monitoring and blocking measures.

B. Restrictions on Access to Personal Information

We take necessary measures to control access to personal information by granting, modifying, and revoking access rights to the database system that processes such information, and we use an intrusion prevention system to prevent unauthorized access from outside the organization.

D. Access Control for Unauthorized Persons

We maintain a separate physical storage location for the personal information system that stores personal information, and we have established and operate access control procedures for this location.

Matters Concerning the Operation and Management of Video Surveillance Equipment

Through our Video Information Processing Device Operation and Management Policy, we inform you of the purposes and methods by which the video information processed by our clinic is used and managed.

A. Legal Basis and Purpose for the Installation of Video Surveillance Equipment

In accordance with Article 25, Paragraph 1 of the Personal Information Protection Act, this clinic installs and operates video surveillance equipment for the following purposes.

• Facility Safety and Fire Prevention
• Crime Prevention for Customer Safety

B. Number of installations, installation locations, and coverage area

The number of video surveillance devices installed, their locations, and their coverage areas are as follows.

c. Data Controller and Authorized Users

To protect the video information of data subjects and handle complaints related to personal video information, we have appointed a Personal Video Information Protection Officer as described below.

d. Recording time and retention period for video data

e. Information regarding how and where to access personal video information

• How to verify: Please contact the person in charge of video information management in advance, and you can verify this during your visit to our clinic.
• Location: Hospital server room

B. Measures Regarding Requests from Data Subjects to Access Their Video Information, etc.

Data subjects may request the operator of video surveillance equipment at any time to view, confirm the existence of, or delete their personal video information. However, this is limited to personal video information in which you are captured and personal video information that is clearly necessary to protect the data subject’s life, physical safety, or property in an emergency.

If you request access to, confirmation of the existence of, or deletion of your personal video information, this clinic will take the necessary measures without delay.

Despite a data subject’s request to access personal video information, such requests may be denied in the following cases; in such instances, the data subject will be notified in writing or by other means within 10 days of the reasons for the denial and the procedures for appealing the decision.

• In cases where personal video information has been destroyed after the retention period has expired
• If there are legitimate grounds to deny a data subject’s request for access, etc.

D. Measures to Ensure the Security of Video Information

The video data processed by this clinic is securely managed through measures such as encryption. Additionally, as an administrative measure to protect personal video data, this clinic grants differential access rights to personal information and maintains records of the creation date and time of personal video data, the purpose of access, the person accessing it, and the date and time of access to prevent falsification or alteration. In addition, we have installed locking devices to ensure the secure physical storage of personal video information.

Data Protection Officer and Designated Representative

To protect our customers’ personal information and handle complaints related to personal information, our clinic has appointed a Data Protection Officer.

If you have any questions regarding your personal information, please contact the Data Protection Officer listed below. We will respond to your inquiry promptly and in good faith.

A. Data Protection Officer

Remedies for Violations of Data Subjects’ Rights

You may report any privacy-related complaints arising from your use of our services to the Data Protection Officer.

We will respond promptly and thoroughly to any reports submitted by users.

If you need to report or seek advice regarding other personal information breaches, please contact the agencies listed below.

http://www.1336.or.kr (http://www.1336.or.kr / 1336)

Cybercrime Investigation Unit, Supreme Prosecutors’ Office (http://www.spo.go.kr / (02) 3480-3573)

National Police Agency Cyber Terrorism Response Center (http://www.ctrc.go.kr / (02) 392-0330)

Obligation to Notify of Policy Changes

This Privacy Policy was established on March 24, 2021. In the event that content is added, deleted, or modified due to changes in laws, regulations, policies, or security technologies, we will announce the reasons for and details of the changes on our website at least 7 days prior to the implementation of the revised Privacy Policy.

Posting Date: March 24, 2021

Implementation Date: March 24, 2021