Privacy Policy

명동리앤한의원 (the "Clinic") has established this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act in order to inform data subjects of the personal information processed on the website operated by the Clinic (the "Website") and the measures taken to protect it, and to handle the grievances of data subjects promptly and smoothly.

• Scope: This Policy applies to the Website's member services, online consultation, contact and notices, visit statistics, and security records. Medical records prepared in the course of in-person treatment and the video information processing devices (CCTV) inside the Clinic are governed separately under relevant laws, including the Medical Service Act, and the applicable notices are posted inside the Clinic. Records of online consultations on the Website are not medical records.
• Foreign-language versions of this Policy are translations provided for convenience; if there is any discrepancy, the Korean version prevails.

Article 1 (Purposes of Processing)

The Clinic processes personal information only for the following purposes. If a purpose changes, the Clinic will take the necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Member registration and management: confirming the intent to register, identifying and authenticating members, restricting registration by children under the age of 14, maintaining and managing membership, preventing fraudulent use, processing withdrawals, and giving notices and notifications
2. Online consultation: confirming receipt of consultations, providing answers and contacting the person, and providing members with their consultation history
3. Service notices (informational): contact regarding services requested by the user, such as confirmation of receipt of a consultation, notice that an answer has been posted, and appointment notices
4. Sending advertising information: sending clinic news and the like only to members who have consented to receive advertising information, and only by the methods they consented to (if the Clinic operates this function)
5. Promotional and marketing use: sending information tailored to clinic news to members who have consented (if the Clinic operates this function)
6. Service security: preventing fraudulent use and automated input, managing personal information access logs, and responding to security incidents
7. Usage statistics: visit statistics for improving the Website (Article 11)
8. Exercise of rights and handling of grievances: verifying, handling, and notifying the results of requests for access, correction, deletion, or suspension of processing, and of complaints
9. Receiving foreign-language appointment requests: confirming and responding to appointment requests submitted by foreign-language visitors through NAVER Form

Article 2 (Items of Personal Information Processed)

① Items processed without consent — information necessary for entering into and performing the membership contract (Article 15(1)4 of the Personal Information Protection Act)

② Items processed with consent

③ Information generated in the course of using the service

• Date and time a consultation was received, the Website page from which the consultation was started, and the processing status and its date and time
• Access information (IP address and browser information): processed in the course of delivering the Website and performing security checks (Articles 7 and 8, Cloudflare).
• Login records (IP address, browser information, date and time): recorded by the authentication service when members or staff log in.
• To prevent duplicate submissions and abuse, an irreversibly transformed value of the access IP address (deleted after 24 hours), and irreversibly transformed values of contact details and consultation content (deleted together when the consultation is anonymized or deleted). The original IP address is not retained in consultation records.
• Records of consent and withdrawal (item, version of the wording consented to, date and time, route), and an irreversibly transformed value of contact details used to verify opt-outs from advertising
• Message delivery results (date and time sent, whether successful)
• Login session information and visit statistics information (Article 11)

④ Information not collected: unique identification information such as resident registration numbers, date of birth, gender, occupation, address, payment information, and health-related information in member profiles. The original IP address is not retained in consultation or visit statistics records in the Clinic's database.

Article 3 (Personal Information of Children Under 14)

① The Clinic does not accept member registration from children under the age of 14. At registration, the Clinic confirms that the person is 14 or older and does not ask for a date of birth. If the Clinic learns after registration that a member is under 14, it will suspend use and destroy that personal information without delay, without applying the post-withdrawal retention period in Article 4.

② Online consultations are completed by the person themselves if 14 or older, or by a legal representative (guardian). Consultations concerning a child under the age of 14 are completed and consented to by the legal representative on the child's behalf.

Article 4 (Processing and Retention Periods of Personal Information)

The Clinic processes and retains personal information within the retention period prescribed by law or the period consented to by the data subject.

Article 5 (Procedures and Methods for Destroying Personal Information)

① Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. An automated daily job identifies information subject to destruction, deletes or anonymizes it, and records the number of items processed.

② Electronic files are deleted by methods that make recovery or reproduction impossible, and files such as attached photos are deleted from storage. Any printouts are shredded or incinerated.

③ Backup copies kept for data recovery are stored encrypted and are automatically deleted after 31 days. Accordingly, destroyed personal information disappears from backup copies no later than 31 days after destruction.

④ If personal information must be preserved under other laws, it is stored separately from other personal information for the period prescribed by those laws. Because no payments or transactions are made on the Website, there is currently no such information.

Article 6 (Provision of Personal Information to Third Parties)

The Clinic does not provide data subjects' personal information to third parties. However, exceptions apply in the cases prescribed in Articles 17 and 18 of the Personal Information Protection Act, such as where the data subject has given separate consent or where a law contains special provisions.

Article 7 (Entrustment of Personal Information Processing)

① The Clinic entrusts personal information processing tasks as follows for the smooth provision of services.

② When entering into an entrustment contract, the Clinic specifies in writing, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing for purposes other than performing the entrusted tasks, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability such as compensation for damages, and supervises whether the trustee processes personal information safely.

③ If the Clinic begins using a new provider to automatically send notices or advertising information by email, KakaoTalk AlimTalk, or similar means, it will add that trustee and the entrusted tasks to this Policy and give notice before using the provider. The same applies when a trustee or the content of entrusted tasks changes.

Article 8 (Overseas Transfer of Personal Information)

① The Clinic transfers personal information overseas (including cases where it is stored or accessed overseas) as follows. This constitutes entrustment of processing and storage necessary to provide the Website's services, and is disclosed through this Policy pursuant to Article 28-8(1)3 of the Personal Information Protection Act; it is also disclosed on the consent screen for online consultation.

② How to refuse and the effect of refusal

• Supabase and GitHub: If you do not want the transfer, you may refrain from using member registration and online consultation and consult by telephone (02-318-1575) instead. In this case, you cannot use member services or online consultation.
• Cloudflare: Because Cloudflare handles delivery of the Website, access information is transferred when you visit the Website. If you do not want this, there is no way to refuse other than not using the Website.

Article 9 (Processing of Sensitive Information)

① Health-related information contained in online consultation content and attached photos is sensitive information under Article 23 of the Personal Information Protection Act. The Clinic processes it only when separate consent has been obtained, distinct from consent to the processing of other personal information. If you do not consent, only a contact request is received, without consultation content or photos, and the consultation proceeds by telephone or other means.

② Online consultations are always processed privately, without a public bulletin board, and can be viewed only by the member who wrote them and by authorized Clinic staff. Accordingly, there is no possibility that sensitive information will be made public in the course of using the service.

③ The Clinic does not send consultation content to external artificial intelligence services for translation, summarization, or similar purposes, and new-consultation notifications sent to staff do not include names, contact details, or consultation content.

Article 10 (Processing of Pseudonymized Information)

The Clinic does not process pseudonymized information. The visit statistics in Article 11② use a method designed so that individuals cannot be identified, but the detailed records are conservatively treated and protected as personal information.

Article 11 (Installation, Operation, and Refusal of Automatic Collection Devices)

① The Clinic uses cookies as follows.

② Visit statistics (no cookies): The Clinic produces visit statistics using a method designed not to directly identify individuals. However, because detailed records may be linked to other records from the same day, they are treated and protected as personal information for 90 days. The Clinic collects the pages visited, the type of referral route, the device, browser, and operating system type, the browser language, the country and region (estimated), and the fact that a consultation button was pressed; it does not store IP addresses, cookies, or contact details, and uses only temporary values that become irreversible after one day. Detailed records are deleted after 90 days and daily totals after 25 months, after which only aggregate counts remain. For the same purpose, the Clinic uses Cloudflare's visit statistics (which do not use cookies).

③ How to refuse: You can refuse the storage of cookies in your browser settings (Chrome: Settings > Privacy and security > Third-party cookies / Edge: Settings > Cookies and site permissions / Safari: Settings > Privacy). If you turn on your browser's "Do Not Track" (DNT, GPC) signal, your visits are not recorded in the Clinic's visit statistics.

④ The Clinic does not currently use any external visit analytics tools that use cookies. If the Clinic begins using such a tool, it will, before use, amend this Policy to disclose the tool's name, the items collected, and whether overseas transfer occurs; make the tool operate only when the visitor has consented; and allow consent to be withdrawn at any time through "Cookie settings" at the bottom of the screen.

Article 12 (Collection, Use, and Refusal of Behavioral Information)

① The Clinic does not allow other businesses to collect behavioral information on the Website for the purpose of personalized advertising, and does not use visit statistics for personalized advertising.

② For the following external services connected to the Website, the respective business processes access information (IP address, browser information) in the cases below. The privacy policy of each business applies to this processing.

• Directions map — Kakao Corp. (Kakao Map): When a map is configured, the map on the Directions page, or the "Directions" map at the bottom of every page, loads automatically when it comes near the visible area of the screen.
• Website videos — Google LLC (YouTube): Some video preview images on the home screen are retrieved from YouTube image servers (no cookies), and videos are opened in a reduced-cookie YouTube player only after the visitor presses the play button.

Article 13 (Measures to Ensure the Safety of Personal Information)

The Clinic takes the following measures in accordance with Article 29 of the Personal Information Protection Act and the Standards for Measures to Ensure the Safety of Personal Information.

1. Administrative measures: establishing and implementing an internal management plan, minimizing the number of staff handling personal information, one staff account per person, granting permissions by role and keeping records of permission changes (3 years), and regular inspections
2. Access control: separate access verification and mandatory two-factor authentication for the administrator screen, automatic logout after a period of inactivity, limits on failed login attempts, and masking of contact details on staff screens
3. Retention and review of access logs: keeping records of staff viewing member and consultation information for 2 years, preventing their forgery or alteration, and reviewing them regularly
4. Encryption: encryption of all transmission segments (HTTPS), one-way encryption of passwords (authentication service), and encryption of backup copies
5. Prevention of disclosure and leakage: consultations are always private; consultation attachments are kept in private storage and viewable only by authorized staff; no function is provided for downloading files containing contact details or consultation content; and names, contact details, and consultation content are not left in records (logs)
6. Security management: automated input prevention, access rate limiting, and application of security updates
7. Breach response: if the Clinic becomes aware of a personal information leak, it will notify the data subjects and report to the Personal Information Protection Commission and others within the deadlines prescribed by law.

Article 14 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

① Data subjects may at any time request the Clinic to provide access to, correct, delete, or suspend the processing of their personal information, and may withdraw their consent.

② How to exercise rights

• Members: You may view and correct your information, change notification and receipt consents, and withdraw membership yourself in "My Account" on the Website, or make a request using the contact details in Article 16.
• Consultation writers who are not members, and others: You may make a request using the contact details in Article 16. To prevent other people's information from being disclosed, the Clinic will process the request after verifying your identity using the contact details you provided at the time of consultation.
• Opting out of advertising information: Even without logging in, you may opt out at any time free of charge through the unsubscribe link at the bottom of an email or by blocking the KakaoTalk channel.
• Requests may also be made in writing, by telephone, by email, or by other means, and the Clinic will not make the process more difficult than the method by which the personal information was collected.

③ Processing deadlines

• Access: Within 10 days of receiving the request, the Clinic will provide access or notify you of the date, place, and other details of access. If access is postponed for a legitimate reason or is restricted or refused under the law, the Clinic will notify you of the reason and how to file an objection within 10 days.
• Correction, deletion, suspension of processing: The Clinic will take action without delay and notify you of the result within 10 days of receiving the request.
• Withdrawal of consent: The Clinic will take the necessary measures without delay, such as destroying the personal information.
• Consent to, refusal of, or withdrawal of consent to receiving advertising information: The Clinic will notify you of the result within 14 days of the date you expressed your intention.

④ Deletion cannot be requested for personal information that other laws specify as subject to collection, and requests for access or suspension of processing may be restricted or refused where Article 35(4) or Article 37(2) of the Personal Information Protection Act applies. In such cases, the Clinic will notify you of the reason and how to file an objection.

⑤ Rights may also be exercised through a legal representative or a person who has been delegated authority, in which case a power of attorney must be submitted. The legal representative of a child under the age of 14 may exercise the above rights with respect to the child's personal information.

⑥ The Clinic does not charge a fee for the exercise of rights. However, if you wish to receive a copy of the accessed materials by mail, the actual postage may be charged.

⑦ Data subjects must not infringe their own or other people's personal information or privacy.

Article 15 (Other Processing Not Performed)

The Clinic does not additionally use or provide personal information collected on the Website without the data subject's consent, even within a scope reasonably related to the original purpose, and does not make decisions that significantly affect data subjects by means of fully automated systems. The Clinic does not operate mobile video information processing devices on the Website and is not subject to the requirement to designate a domestic representative.

Article 16 (Chief Privacy Officer and Handling of Grievances)

① The Clinic designates a Chief Privacy Officer as follows to take overall responsibility for personal information processing and to handle complaints and provide remedies for damages of data subjects.

② Data subjects may direct inquiries, complaints, requests for remedies for damages, and the like regarding personal information in connection with the use of the Website to the Chief Privacy Officer, and the Clinic will respond and handle them without delay.

Article 17 (Remedies for Infringement of Rights)

To obtain remedies for infringement of personal information, you may apply for dispute resolution or consultation to the following organizations.

Article 18 (External Consultation and Appointment Channels Linked from the Website)

The Website provides buttons linking to external services such as KakaoTalk Channel, NAVER Booking, WhatsApp, LINE, and WeChat. If you consult or make an appointment through these services, the privacy policy of the operator of that service also applies. The Clinic uses information received through those channels only for responding to consultations and appointments, and does not separately download or store it.

Article 19 (Changes to the Privacy Policy)

① This Privacy Policy applies from the effective date stated at the top of this screen. This is the first version of the privacy policy for the Clinic's Website, and it replaces the document previously posted on the former website.

② When the Clinic changes this Policy, it will give notice on the Website from 7 days before the effective date; for changes that are important to the rights of data subjects, such as changes to the items collected, purposes of use, provision to third parties, or overseas transfer, it will give notice from 30 days before the effective date and also notify members by email.

③ Previous versions of the Privacy Policy can be viewed under "Previous versions" at the bottom of this screen.