The Clinic processes personal information for the following purposes. Personal information processed by the Clinic will not be used for purposes other than those stated below. If the purpose of use changes, the Clinic will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Where there are special provisions in law or processing is unavoidable in order to comply with legal obligations

a. Medical Service Act and its Enforcement Rules: Medical application forms, medical records, midwifery records, nursing records, patient lists, prescriptions, and other records, as well as inspection of and provision of copies of patient medical records

b. National Health Insurance Act: Requests for medical care benefits

c. Volunteer information

d. Electronic Financial Transactions Act: Collection of medical expenses

e. Infectious Disease Control and Prevention Act: Reporting patients with infectious diseases, suspected patients, or pathogen carriers

f. Emergency Medical Service Act: Transfer of emergency patients

g. Prevention of Acquired Immunodeficiency Syndrome Act: Reporting diagnoses or examinations of infected persons

h. Blood Management Act: Reporting specified adverse transfusion reactions

i. Organ Transplant Act: Reporting persons presumed to be brain-dead

j. Framework Act on Health and Medical Services: Reporting or notifying the discovery of persons with, or suspected of having, diseases

2. Provision of services such as medical appointments

The Clinic processes personal information to provide medical-related services, including diagnosis, treatment and hospitalization; medical and examination appointments; appointment inquiries and schedule notifications; provision of information for collaborative care; issuance of medical bills, detailed statements and certificates; and administrative services such as billing, payment and refunds related to diagnosis and treatment.

3. Handling civil complaints

The Clinic processes personal information to establish a smooth communication channel when handling complaints related to medical services, including verifying the complainant's identity, confirming complaint details, contacting the complainant for fact-finding, and notifying the complainant of the results.

4. Website membership registration

The Clinic processes personal information to confirm a user's intention to register, identify and authenticate users for membership services, maintain and manage membership status, verify identity under the limited identity verification system, prevent unauthorized use of services, confirm consent of a legal representative when collecting personal information from children under the age of 14, provide notices and notifications, handle complaints, preserve records for dispute resolution, and collect statistics on service use.

5. Installation and operation of video information processing devices

The Clinic installs and operates video information processing devices in consultation rooms, procedure rooms, payment areas, counseling rooms, and other areas, and processes personal information for purposes such as confirming medical care and resolving disputes.

1. The Clinic collects the following personal information in order to comply with legal obligations.

a. Where there are special provisions in law or processing is unavoidable in order to comply with legal obligations

- Name, resident registration number, department of care, telephone number, address, medical and family history, chief complaints, diagnostic results or diagnosis, progress notes, treatment details, date and time of care, etc.

b. Provision of services such as medical appointments

- Name, resident registration number, telephone number, passport number, etc. (for appointments by foreign patients), payment authorization information (card issuer, card number, etc.)

c. Handling civil complaints

- Name, telephone number, email address, complaint details and inquiries

d. Website membership registration

- Name, email address, password, nickname, and legal representative information for children under the age of 14

- During the use and provision of services, information such as service usage records, access logs, cookies, and access IP information may be automatically generated and collected.

e. Installation and operation of video information processing devices

- Video information from consultation rooms, procedure rooms, payment areas, and counseling rooms

2. In order to comply with legal obligations related to medical care and other matters, the Clinic may collect and use resident registration numbers, unique identification information, and sensitive information, including personal information, without the consent of the data subject where permitted by law.

1. When consent is required to process the personal information of a child under the age of 14, the Clinic obtains consent from the child's legal representative.

2. When obtaining consent from a legal representative regarding the processing of personal information of a child under the age of 14, the Clinic may request only the minimum information necessary, such as the legal representative's name and mobile phone number. The Clinic may verify consent by having the legal representative indicate consent on the website where the consent details are posted and then notifying the legal representative by text message that the indication of consent has been confirmed.

1. The Clinic processes and retains personal information within the retention and use period prescribed by law or within the retention and use period agreed to by the data subject at the time the personal information is collected.

2. The processing and retention periods for each category of personal information are as follows.

a. Where there are special provisions in law or processing is unavoidable in order to comply with legal obligations. However, where necessary for continuous medical care, records may be retained for an additional period equal to the applicable period for each item.

- Patient register: 5 years

- Medical records: 10 years

- Prescriptions: 2 years

- Surgical records: 10 years

- Test details and test findings: 5 years

- Radiographic images (including other medical images) and related reports: 5 years

- Nursing records: 5 years

- Midwifery records: 5 years

- Copies of medical certificates, etc.: 3 years

b. Provision of services such as medical appointments

- Retained in accordance with Article 15, “Retention of Medical Records,” of the Enforcement Rules of the Medical Service Act.

c. Handling civil complaints

- Retained for 10 years after completion of complaint handling.

d. Website membership registration

- Retained until membership withdrawal.

3. Notwithstanding the above, personal information will be retained until the relevant reason ceases to exist in any of the following cases.

a. Where an investigation or inquiry is ongoing due to a violation of applicable laws: until the investigation or inquiry is completed

b. Where a creditor-debtor relationship arising from website use remains outstanding: until the relevant relationship is settled

1. The Clinic destroys personal information without delay when it is no longer necessary, such as upon expiration of the retention period or achievement of the processing purpose.

2. If personal information must continue to be retained under other laws even after the consented retention period has expired or the processing purpose has been achieved, the Clinic will move the information to a separate database or store it in a separate location.

3. The procedures and methods for destroying personal information are as follows.

a. Destruction procedure: The Clinic selects personal information for which a reason for destruction has arisen and destroys it with the approval of the Clinic's Chief Privacy Officer.

b. Destruction method: Personal information recorded and stored in electronic file format is destroyed in a manner that makes the records unrecoverable, and paper documents are destroyed by shredding or incineration.

Except with the consent of the data subject or as permitted by applicable laws and regulations, the Clinic does not use or provide personal information beyond the scope disclosed in Article 1. However, personal information may be provided without the data subject's consent in the following cases in accordance with applicable laws and regulations.

1. Where the data subject has provided prior consent to disclosure to a third party

2. Where medical records are submitted to the Health Insurance Review & Assessment Service for claims for medical care benefit expenses pursuant to the National Health Insurance Act

3. Where information is processed into a form that does not identify a specific individual and provided for statistical compilation, academic research, etc.

4. Where an investigative authority or court requests information in accordance with procedures and methods prescribed by law

5. Where an emergency patient is transferred to another medical institution

6. Other cases where laws and regulations contain special provisions regarding the provision of information

1. The Clinic outsources personal information processing as follows to ensure smooth service provision.

2. The Clinic supervises service providers to ensure that personal information is processed securely. If the scope of outsourced services or a service provider changes, the Clinic will disclose the change without delay through this Privacy Policy.

The Clinic takes the following measures to ensure the security of personal information.

1. Administrative measures: Establishment and implementation of an internal management plan, regular employee training, and operation of a dedicated organization

2. Technical measures: Management of access privileges to personal information processing systems, installation of access control systems, encryption of personal information, and installation and updating of security software

3. Physical measures: Access control for computer rooms, records storage rooms, and other restricted areas

1. Data subjects may request access to, transmission of, correction of, deletion of, suspension of processing of personal information, or withdrawal of consent at any time.

2. To protect personal information, requests to inspect, obtain copies of, correct, delete, or suspend the processing of medical records and other records related to medical care are not accepted by telephone, mail, fax, or other methods; the data subject must visit the Clinic in person.

3. If the Clinic has legitimate grounds to refuse access to, correction of, or deletion of all or part of the personal information, the Clinic will notify the data subject and explain the reason.

4. Details regarding access to and other requests concerning a data subject's personal information are as follows.

a. Access to personal information

1) When a data subject visits the Clinic and requests access to their personal information, the Clinic verifies the person's identity using the data subject's identification document.

2) When a representative of the data subject visits the Clinic and requests access, the Clinic verifies the representative's authority by reviewing documentary evidence required by applicable laws, such as a power of attorney (or family relationship certificate), the representative's identification, and a copy of the data subject's identification.

b. Correction and deletion of personal information

1) When a data subject visits the Clinic and requests correction or deletion of personal information, and the information is found to contain an error requiring correction or deletion, the Clinic will correct or delete it without delay. The Clinic may request supporting documents necessary to verify the requested correction or deletion.

2) Personal information that is legally required to be retained cannot be corrected or deleted during the mandatory retention period even at the request of the data subject.

3) When a data subject requests correction or deletion of personal information, the Clinic verifies the person's identity and takes necessary measures in accordance with applicable laws.

4) When a representative of the data subject visits the Clinic and requests correction or deletion, the Clinic verifies the representative's authority by reviewing documentary evidence required by applicable laws, such as a power of attorney (or family relationship certificate), the representative's identification, and a copy of the data subject's identification.

c. Withdrawal of consent to the collection, use, or provision of personal information

1) When a data subject requests suspension of personal information processing, the Clinic verifies the person's identity and takes necessary measures in accordance with applicable laws.

2) When a representative of the data subject visits the Clinic and requests suspension of processing, the Clinic verifies the representative's authority by reviewing documentary evidence required by applicable laws, such as a power of attorney (or family relationship certificate), the representative's identification, and a copy of the data subject's identification.

d. Access, correction, and deletion of website membership information: After logging in to the website, users can process these requests directly under “My Page” → “Edit Personal Information.”

e. Legal representatives of children under the age of 14: A legal representative may request access to, correction or deletion of, or suspension of processing of the child's personal information. In such cases, documents proving the relationship with the child and identification documents must be submitted.

1. The Clinic designates the following Chief Privacy Officer to oversee and take responsibility for personal information processing and to handle complaints and provide remedies related to personal information processing.

▶ Chief Privacy Officer: Dongwoo Son, Administrative Director, 02-476-8965

2. Data subjects may contact the Chief Privacy Officer regarding any inquiries, complaints, or requests for remedies related to personal information protection arising from use of the Clinic's services. The Clinic will respond to and handle such inquiries without delay.

Data subjects may refuse to consent to the processing of personal information and may withdraw their consent at any time after giving it. However, the personal information collected is the minimum basic information necessary for the smooth provision of medical services and other services, and refusal to consent may limit the data subject's use of medical services or other services.

1. The Clinic uses “cookies” to store and retrieve usage information from time to time in order to provide individually tailored services to members.

2. Cookies are small pieces of information sent by the server (HTTP) operating a website to the user's web browser and may also be stored on the hard drive of the user's computer.

a. Purpose of using cookies: Cookies are used to provide optimized information to users by identifying patterns of visits and use of services and websites, popular search terms, security connection status, and similar information.

b. Installation, operation, and refusal of cookies: Users may refuse the storage of cookies through the option settings under Tools > Internet Options > Privacy in the web browser.

c. Refusing to store cookies may make it difficult to use customized services.

The Clinic installs and operates video information processing devices as follows.

1. Purpose of installation: Patient and facility safety, and prevention of fire and crime

2. Number installed, installation locations, and recording scope

a. Number installed: 17 devices at major facilities

b. Installation locations and recording scope: Consultation rooms, procedure rooms, payment areas, counseling rooms, etc.

3. Person in charge and persons authorized to access: Dongwoo Son, Administrative Director, 02-476-8965

4. Recording time, retention period, and storage location of personal video information

a. Recording time: 24 hours

b. Retention period: Within 30 days from the date of recording

c. Storage location: Server room

5. How to request confirmation of personal video information: Contact the Clinic in advance and apply in person

6. Measures regarding requests by data subjects to access personal video information

a. A data subject may request access to or confirmation of the existence of personal video information from the operator of the video information processing device at any time. Such requests are limited to personal video information in which the data subject appears or information clearly necessary to protect the data subject's urgent interests in life, body, or property.

b. Notwithstanding a request for access by a data subject, the Clinic may refuse access to personal video information if (1) the retention period has expired and the information has been destroyed, or (2) there is another legitimate reason to refuse the request.

7. Technical, administrative, and physical measures to protect video information: Video information processed by the Clinic is securely managed through encryption and other safeguards. As an administrative measure, the Clinic grants differentiated access privileges to personal video information. To prevent alteration or falsification, the Clinic records and manages the date and time of creation and, when the information is accessed, the purpose of access, the person accessing it, and the date and time of access. The Clinic also installs locking devices to ensure the secure physical storage of personal video information.

1. A data subject may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, or other relevant organizations to obtain relief for personal information infringement. For other reports or consultations regarding personal information infringement, please contact the organizations below.

a. Personal Information Dispute Mediation Committee: 1833-6972 (without area code) (www.kopico.go.kr)

b. Personal Information Infringement Report Center: 118 (without area code) (privacy.kisa.or.kr)

c. Korean National Police Agency: 182 (without area code) (ecrm.cyber.go.kr)

This Privacy Policy was established on October 1, 2025. If additions, deletions, or revisions are made due to changes in laws, policies, or security technologies, the Clinic will provide notice on its website at least 7 days before the revised Privacy Policy takes effect.

- Date of Notice: October 1, 2025

- Effective Date: October 1, 2025