Privacy Policy

Privacy Policy

OWN CLINIC SAMSEONG (the operator of the “Service,” hereinafter referred to as OWN CLINIC SAMSEONG) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to handle related grievances swiftly and smoothly.

○ This Privacy Policy is effective as of June 1, 2023.

OWN CLINIC SAMSEONG (the operator of the “Service,” hereinafter referred to as OWN CLINIC SAMSEONG) processes personal information for the following purposes. The personal information being processed will not be used for any purposes other than those listed below. If the purpose of use changes, necessary measures such as obtaining separate consent will be taken in accordance with Article 18 of the Personal Information Protection Act.

1. Membership Registration and Management on the WebsitePersonal information is processed for the purposes of verifying the intent to register as a member, identifying and authenticating the individual to provide membership-based services, maintaining and managing membership status, preventing fraudulent use of services, confirming the consent of legal guardians when processing the personal information of children under 14, providing notices and notifications, and handling grievances.

2. Handling of Civil ComplaintsPersonal information is processed for the purposes of verifying the identity of the complainant, confirming the details of the complaint, contacting and notifying for fact-finding, and informing the complainant of the results.

3. Provision of Goods or ServicesPersonal information is processed for the purposes of providing services, sending contracts and invoices, delivering content, offering personalized services, verifying identity and age, and processing payments and settlements.

4. Use for Marketing and AdvertisingPersonal information is processed for the purposes of developing new services (or products), providing personalized services, offering information about events and promotional opportunities, and verifying the effectiveness of the services.

① OWN CLINIC SAMSEONG processes and retains personal information within the period permitted by relevant laws or within the period consented to by the data subject at the time of collection.

② The processing and retention period for each category of personal information is as follows:

1. <Membership Registration and Management>

   ●     Personal information related to <Membership Registration and Management> is retained and used for the above purposes from the date of consent for collection and use until 1 year thereafter.

   ●     Basis for Retention: Conversion to dormant account after 1 year of inactivity; destruction of information after retaining the dormant account for 1 year

   ●     Relevant Laws: Terms of Service

   ●     Exception: If cooperation with public authorities (e.g., administrative matters, investigations) is required

2. <Provision of Goods or Services>

   ●     Personal information related to <Provision of Goods or Services> is retained and used for the above purposes from the date of consent for collection and use until 5 years thereafter.

   ●     Basis for Retention: Handling of civil complaints based on payment and supply records

   ●     Relevant Laws:

   ○     Records on payment and supply of goods or services: 5 years

   ○     Records on contracts or withdrawal of subscription, etc.: 5 years

    

   ●     Exception: If cooperation with public authorities (e.g., administrative matters, investigations) is required

3. <Handling of Civil Complaints>

   ●     Personal information related to <Handling of Civil Complaints> is retained and used for the above purposes from the date of consent for collection and use until 3 years thereafter.

   ●     Basis for Retention: Handling of civil complaints based on complaint records

   ●     Relevant Laws:

   ○     Records on consumer complaints or dispute resolution: 3 years

    

   ●     Exception: If cooperation with public authorities (e.g., administrative matters, investigations) is required

4. <Use for Marketing and Advertising>

   ●     Personal information related to <Use for Marketing and Advertising> is retained and used for the above purposes from the date of consent for collection and use until 1 year thereafter.

   ●     Basis for Retention: Enhancing customer experience based on marketing information

   ●     Relevant Laws:

   ○     Records on labeling/advertising: 6 months

    

   ●     Exception: If cooperation with public authorities (e.g., administrative matters, investigations) is required

OWN CLINIC SAMSEONG processes the following items of personal information:

1. <Website Membership Registration and Management>

   ●     Required items: Mobile phone number, gender, date of birth, name, CI (Connecting Information), service usage history, access logs, cookies, IP address, payment records, legal guardian's name, legal guardian's home phone number, legal guardian's home address, legal guardian's mobile phone number

   ●     Optional items: Email, marital status, hobbies

2. <Provision of Goods or Services>

   ●     Optional items: Credit card information, bank account information

3. <Handling of Civil Complaints>

   ●     Required items: Mobile phone number

   ●     Optional items: Email

4. <Use for Marketing and Advertising>

   ●     Optional items: Mobile phone number, email

① When collecting personal information from children under the age of 14, OWN CLINIC SAMSEONG obtains the consent of the legal guardian and collects only the minimum personal information necessary to provide the relevant service.

●     Required items: Legal guardian’s name, relationship to the child, contact information

② In addition, if OWN CLINIC SAMSEONG collects personal information of children for promotional purposes related to its medical services, separate consent is obtained from the legal guardian.

③ When collecting personal information from children under the age of 14, OWN CLINIC SAMSEONG may request the minimum information necessary (such as the legal guardian's name and contact information), and verifies the legal guardian’s valid consent through one of the following methods:

●     Having the legal guardian indicate consent on a website displaying the consent content and notifying them via text message to their mobile phone confirming their consent

●     Having the legal guardian indicate consent on a website displaying the consent content and collecting their credit or debit card information

●     Having the legal guardian indicate consent on a website displaying the consent content and verifying their identity through mobile phone authentication

●     Delivering a document containing the consent content directly, by mail, or by fax, and requiring the legal guardian to sign and return it

●     Sending an email containing the consent content and receiving a reply email from the legal guardian expressing their consent

●     Explaining the consent content over the phone and obtaining verbal consent, or guiding them to a website where the consent content can be reviewed, then following up with another phone call to confirm consent

●     Any other method equivalent to the above that informs the legal guardian of the consent details and verifies their expression of consent

① OWN CLINIC SAMSEONG processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only when the data subject has given consent or when permitted by law, such as under Articles 17 and 18 of the Personal Information Protection Act.

② OWN CLINIC SAMSEONG provides personal information to third parties as follows:

<Boostree>

●     Recipient: Boostree Partners Co., Ltd.

●     Purpose of Use: Website member management, reservation management, and access to medical records of the data subject (individual), based on mobile phone number, gender, date of birth, name, and service usage history

●     Retention Period: Until membership withdrawal

<Boostree Mobile App>

●     Recipient: Boostree Partners Co., Ltd.

●     Purpose of Use: Mobile app member management, reservation management, and access to medical records of the data subject (individual), based on mobile phone number, gender, date of birth, name, and service usage history

●     Retention Period: Until membership withdrawal

<Vegas CRM>

●     Recipient: TNH Co., Ltd.

●     Purpose of Use: Access to medical records of the data subject (individual), based on mobile phone number, gender, date of birth, name, and service usage history

●     Retention Period: Until medical information retrieval is complete, and for 5 years after the end of the transaction relationship under the contract

<Kakao>

●     Recipient: Kakao

●     Purpose of Use: Mobile phone number and Kakao AlimTalk notifications

●     Retention Period: According to Kakao’s policy

① OWN CLINIC SAMSEONG entrusts the following personal information processing tasks to ensure smooth operations:

●     Trustee: Boostree Partners Co., Ltd.

●     Entrusted Services:

○     Website service

○     Mobile app service

② When entering into an outsourcing agreement, OWN CLINIC SAMSEONG specifies the following items in the contract or other written documents in accordance with Article 26 of the Personal Information Protection Act: prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and administrative protection measures, restrictions on re-entrustment, management and supervision of the trustee, liability for damages, etc. OWN CLINIC SAMSEONG also supervises whether the trustee processes personal information securely.

③ If there are any changes to the details of the entrusted work or the trustee, such changes will be disclosed promptly through this Privacy Policy.

① OWN CLINIC SAMSEONG will promptly destroy personal information when the retention period has expired, the purpose of processing has been achieved, or when the information is otherwise no longer necessary.

② If the retention period agreed to by the data subject has expired or the purpose of processing has been achieved, but retention is still required by other laws, the relevant personal information will be stored separately in a different database (DB) or in a different storage location.

●     Legal Basis: Terms of Service

●     Items Retained: Account information, transaction date

③ The procedures and methods for destroying personal information are as follows:

●     Destruction Procedure: OWN CLINIC SAMSEONG selects personal information for which a reason for destruction has occurred and destroys it with the approval of the hospital’s personal information protection officer.

●     Destruction Method: Information in electronic file format is destroyed using technical methods that make the records irrecoverable.

① OWN CLINIC SAMSEONG converts user accounts that have not used the service for one year into dormant accounts and stores the personal information separately. The separated personal information is retained for one year and then promptly destroyed.

② OWN CLINIC SAMSEONG notifies users scheduled for dormancy at least 30 days in advance via methods such as text message or email. The notice includes the fact that their information will be stored separately, the scheduled dormancy date, and which personal information items will be separated.

③ If you do not wish your account to become dormant, simply log in to the service before the dormancy date. Even if your account has already become dormant, logging in again with your consent will restore your account, allowing you to use the services normally.

① Data subjects may exercise the rights to access, correct, delete, and suspend the processing of their personal information at any time with respect to OWN CLINIC SAMSEONG.

② These rights may be exercised by submitting a written request, email, or similar method in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act. OWN CLINIC SAMSEONG will promptly take necessary action upon such request.

③ The above rights may also be exercised through a legal representative or a delegated agent. In such cases, a power of attorney must be submitted using the form provided in Appendix Form No. 11 of the “Notice on Personal Information Processing Methods (No. 2020-7).”

④ Requests to access or suspend processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑤ Requests to correct or delete personal information cannot be accepted if the information is required to be retained by law.

⑥ OWN CLINIC SAMSEONG verifies whether the person making a request for access, correction, deletion, or suspension is the actual data subject or an authorized representative.

To ensure the security of personal information, OWN CLINIC SAMSEONG takes the following measures:

●     Administrative Measures: Establishment and implementation of an internal management plan, regular employee training

●     Technical Measures: Management of access rights to personal information processing systems, installation of access control systems

●     Physical Measures: Access control to computer systems and facilities

① OWN CLINIC SAMSEONG uses ‘cookies’ to store and retrieve user information in order to provide personalized services.

② A cookie is a small piece of data sent by the server (HTTP) operating the website to the user's computer browser, and may be stored on the user's hard disk.

●     Purpose of Cookie Use: Cookies are used to understand how users visit and use various services and websites, track popular search terms, check secure login status, and provide optimized information to users.

●     Cookie Management and Refusal: Users can refuse the storage of cookies by adjusting their browser settings under Tools > Internet Options > Privacy menu. However, refusing to store cookies may result in difficulties in using personalized services.

① <The Personal Information Controller> collects and uses behavioral information to provide data subjects with optimized, personalized services, benefits, and online customized advertisements during service use.

② <The Personal Information Controller> collects behavioral information as follows:

③ <The Personal Information Controller> allows online personalized advertising service providers to collect and process behavioral information as outlined below:

●     Advertising service provider collecting and processing behavioral information: OWN CLINIC SAMSEONG

●     Method of collection: Automatically collected and transmitted when the user visits the website or launches the app

●     Items collected and processed: User’s web/app visit history, search history, purchase history

●     Retention and usage period: 1 year

④ <The Personal Information Controller> collects only the minimum behavioral information necessary for online personalized advertising and does not collect sensitive behavioral information that may clearly infringe on an individual's rights, interests, or privacy, such as thoughts, beliefs, family and relatives, educational or medical history, or other aspects of social activity.

⑤ <The Personal Information Controller> does not collect behavioral information for personalized advertising from children under the age of 14 or from online services mainly used by such children, and does not provide personalized advertising to users known to be under the age of 14.

⑥ <The Personal Information Controller> collects and uses advertising identifiers in mobile apps for the purpose of online personalized advertising. The data subject can block or allow personalized advertising by changing settings on their mobile device.

▶︎ Blocking/Allowing advertising identifiers on smartphones (Menu names and methods may vary depending on the mobile OS version):

●     Android: ① Settings → ② Privacy → ③ Ads → ④ Reset advertising ID or Delete advertising ID

●     iPhone: ① Settings → ② Privacy → ③ Tracking → ④ Turn off “Allow Apps to Request to Track”

⑦ The data subject can also block or allow online personalized advertising uniformly by changing cookie settings in the web browser. However, doing so may affect the availability of certain services such as automatic login.

▶︎ Blocking/Allowing personalized advertising via web browser:

●     Internet Explorer (Internet Explorer 11 for Windows 10): Click the Tools button in Internet Explorer → Internet Options → Privacy tab → Advanced → Select block or allow cookies

●     Microsoft Edge: Click the “…” in the top right corner → Click Settings In the left menu, click “Privacy, Search, and Services” → Under “Tracking Prevention,” select whether to enable tracking prevention and choose the desired level Optionally, enable “Always use Strict tracking prevention when browsing InPrivate” Under “Privacy,” choose whether to “Send Do Not Track requests”

●     Google Chrome: Click the “⋮” icon (Customize and control Chrome) in the top right corner → Click Settings Scroll to the bottom and click “Advanced” → In the “Privacy and security” section, click “Site Settings” In the “Cookies” section, check “Block third-party cookies”

⑧ For inquiries regarding behavioral information, exercising the right to refuse, or filing a complaint, data subjects may contact the following department:

▶︎ Personal Information Protection Department

●     Contact Person: Park Junyeong

●     Contact Info: 050-7873-0447

OWN CLINIC SAMSEONG may use or provide personal information additionally without the consent of the data subject in accordance with Article 15(3) and Article 17(4) of the Personal Information Protection Act, considering the matters prescribed in Article 14-2 of its Enforcement Decree. Accordingly, OWN CLINIC SAMSEONG has considered the following criteria for additional use or provision without the data subject’s consent:

●     Whether the purpose of additional use/provision is related to the original purpose of collection

●     Whether the additional use/provision was foreseeable given the circumstances of collection or customary processing practices

●     Whether the additional use/provision unfairly infringes on the interests of the data subject

●     Whether necessary safety measures such as pseudonymization or encryption have been taken

The specific standards for these considerations may be autonomously determined and disclosed by the business/operator.

OWN CLINIC SAMSEONG processes pseudonymized information for the following purpose:

●     Purpose of Processing Pseudonymized Information: To allow activity in community forums under a pseudonym instead of a real name

●     Retention Period: Until membership withdrawal

●     Pseudonymized Information Item: Nickname

●     Security Measures According to Article 28-4 of the Personal Information Protection Act: Same as general user data protection policies

① OWN CLINIC SAMSEONG designates a Personal Information Protection Officer who is responsible for overall management of personal data processing and handling inquiries, complaints, and relief requests from data subjects:

▶︎ Personal Information Protection Officer

●     Name: Park Junyeong

●     Position: Chief Medical Director

●     Contact: 050-7873-0447

② Data subjects may contact the Personal Information Protection Officer or the relevant department for all inquiries, complaints, or damage relief related to personal data that arise while using OWN CLINIC SAMSEONG’s services. OWN CLINIC SAMSEONG will respond promptly.

Data subjects may contact OWN CLINIC SAMSEONG’s designated domestic representative under Article 39-11 of the Personal Information Protection Act for handling privacy-related grievances. OWN CLINIC SAMSEONG will strive to ensure prompt handling of such matters through the Personal Information Protection Officer and relevant personnel.

Data subjects may submit requests for access to personal information pursuant to Article 35 of the Personal Information Protection Act to the following department. OWN CLINIC SAMSEONG will ensure the requests are processed promptly.

▶︎ Personal Information Protection Department

●     Contact Person: Park Junyeong

●     Contact Info: 050-7873-0447

Data subjects may seek dispute resolution or counseling due to personal information infringement through the following agencies:

●     Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

●     Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)

●     Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)

●     National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)

If a data subject’s rights or interests are violated due to a disposition or inaction by the head of a public institution in response to requests under Articles 35 (Access), 36 (Correction/Deletion), or 37 (Processing Suspension) of the Personal Information Protection Act, they may file an administrative appeal in accordance with the Administrative Appeals Act.

※ For more information on administrative appeals, please visit the website of the Central Administrative Appeals Commission (www.simpan.go.kr).

① This Privacy Policy is effective as of June 1, 2023.