Privacy Policy

This English text is provided for convenience only. In the event of any discrepancy in interpretation, the Korean original shall prevail.

1. Personal Data Collected and How It Is Collected

The Clinic collects the following personal data in order to provide medical and treatment services.

• Required : Name, date of birth, gender, mobile phone number
• Optional : Address, email, how you heard about us
• Sensitive data : Medical and treatment records, before-and-after photographs, skin condition, medical and medication history, history of allergies and adverse reactions
• Online booking / consultation : Name, contact number, desired treatment, desired date and time, consultation details
• With marketing consent : Mobile phone number (for SMS and messenger notifications)
• Automatically collected : IP address, visit date and time, service usage records, browser information, cookies

Data is collected through in-clinic registration and medical questionnaires, online booking and consultation on the website, telephone and messenger consultations, and consultation records created during treatment. Consent to receive marketing information is optional; declining does not restrict your access to medical services.

2. Purposes of Use

• Provision of medical services such as consultations and treatments
• Receiving, confirming and notifying changes to consultations and appointments
• Monitoring treatment progress and providing aftercare guidance
• Payment of medical fees and issuance of certificates such as medical certificates and opinions
• Receiving and handling enquiries and complaints
• Information on events and benefits (only where separate consent has been obtained)
• Fulfilment of statutory obligations and response to medical disputes

3. Retention and Use Periods

The Clinic destroys personal data without delay once the purpose of collection and use has been achieved. However, data is retained as follows for the periods prescribed by law.

• Medical records : 10 years (Article 15, Enforcement Rule of the Medical Service Act)
• Surgical records and before-and-after photographs : 10 years
• Copies of medical certificates : 3 years
• Prescriptions : 2 years
• Patient register : 5 years
• Online booking and consultation records : 1 year after processing is completed
• Marketing consent records : Until consent is withdrawn

4. Provision to Third Parties

The Clinic does not provide personal data to third parties without the data subject’s consent, except in the following cases.

• Where the data subject has consented in advance
• Where medical benefit costs are claimed from the National Health Insurance Service or the Health Insurance Review and Assessment Service
• Where required for referral or transfer to another medical institution (with the data subject’s consent)
• Where specifically provided for by law, or where an investigative authority makes a request in accordance with lawful procedure
• Where necessary to address an imminent danger to life or physical safety

5. Outsourcing of Data Processing

In order to provide services smoothly, the Clinic may outsource personal data processing as follows.

• Website operation and maintenance : Development and management of the website and booking system
• SMS and messenger notifications : Sending appointment confirmations, guidance and notices

The Clinic sets out the necessary requirements in its outsourcing contracts so that personal data is managed securely, and discloses any change to the outsourced work or the service provider through this policy.

6. Use of Sensitive Data such as Before-and-After Photographs

• As a rule, before-and-after photographs are taken and stored solely for medical purposes such as reviewing treatment progress.
• the website, printed materials and online channelspurposes other than medical care, we explain the purpose of photography, the scope of use and the retention period, and then obtainseparate written consent.
• Consent may be withdrawn at any time, and published photographs are deleted without delay upon withdrawal. However, materials that form part of medical records and are subject to a statutory retention obligation are kept for the relevant period.
• We take the necessary measures to ensure that published photographs do not contain personally identifiable information.

7. Rights of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights at any time.

• Request access to personal data
• Request correction of any errors
• Request deletion (except where a statutory retention obligation applies)
• Request suspension of processing and withdrawal of marketing consent

Rights may be exercised by written request or by telephone to the Clinic, and the Clinic will act without delay. For children under the age of 14, a legal representative may exercise these rights.

8. Destruction Procedure and Method

• Procedure— Personal data whose retention period has expired or whose purpose has been achieved is destroyed in accordance with internal policy and applicable law.
• Method— Electronic files are deleted by technical means that prevent recovery, and paper documents are shredded or incinerated.

9. Measures to Ensure Security

• Minimising the number of staff handling personal data and providing regular training
• Granting differentiated access rights and retaining access logs
• Access control and encryption for personal data processing systems
• Measures against hacking and malware, including installation of anti-virus software
• Storing documents and portable storage media, such as medical records and treatment photographs, in locked locations

10. Data Protection Officer

The Clinic has designated the following Data Protection Officer to oversee personal data processing and to handle complaints and remedies for data subjects.

Data Protection Officer: Hyunseung Seo (Medical Director)

Phone : 1899-7599

Address: 59, Seocho-daero 77-gil, Seocho-gu, Seoul

11. Remedies for Infringement of Rights

If you need advice or redress in relation to a personal data breach, you may contact the following organisations.

• Personal Information Infringement Report Centre — 118 (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors’ Office, Cyber Investigation Division — 1301 (www.spo.go.kr)
• National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)

12. Changes to This Policy

Where this policy is supplemented, deleted or amended, notice will be given on the website from seven days before the change takes effect.

This policy applies from 8 September 2026.