Article 1 (Purposes of Processing Personal Information)

The Clinic processes personal information for the purposes below. It does not use personal information for any other purpose. If a purpose changes, the Clinic will take the necessary steps, such as obtaining separate consent under Article 18 of the PIPA.

1. Appointment booking and consultation: receiving bookings, verifying identity, sending appointment details, and handling changes and cancellations
2. Provision of medical services: examination, prescription, procedures, and the creation and management of medical records
3. Responding to inquiries: answering questions and handling complaints
4. Compliance with legal obligations: retention and reporting required under the Medical Service Act, the National Health Insurance Act, the Income Tax Act, and other relevant laws
5. Service improvement: compiling website usage statistics and improving service quality. The statistics contain no information that identifies an individual.
6. Assistance with medical records: the Clinic records the treatment process and uses the transcript of that recording to create a draft medical record. The draft helps medical staff write the medical record.

Article 2 (Personal Information Items Processed)

The Clinic processes the personal information items below.

① When you book or ask for a consultation on the website

• Required: name, mobile phone number, preferred appointment date and time
• Optional: symptom category, treatment of interest, email address, additional inquiry details
• Also collected when a first-time patient makes a provisional booking: date of birth

② When you visit and receive treatment

• resident registration number, health insurance information, medical records (symptoms, diagnosis, prescriptions, procedure history), imaging records (X-ray, ultrasound, etc.), and consent forms

③ Items collected automatically while you use the website

• access IP address, cookies, access logs, service usage records, browser type, operating system information
• SMS verification code and bot-prevention verification token

④ Marketing analytics items (collected only with your consent)

• advertising source (UTM source, medium, campaign, gclid), the first page you landed on, and a session identifier. Kept for 30 days.

⑤ Voice recordings made during treatment

The Clinic records conversations during treatment and uses the recordings to create transcripts and draft records.

• What is recorded: conversations between the patient and medical staff during nursing intake, treatment in the treatment room, and consultation in the examination room
• Transcript: the recording converted into text
• Draft record: a draft medical record created from the transcript

Whether a recording leaves the clinic depends on where it was made.

• Nursing intake and the treatment room: the original audio is sent to a transcription service outside Korea. Article 6 gives the details.
• The examination room: audio files made with the recording program on the examination-room PC are converted into text only by a transcription program inside the clinic. However, if medical staff separately upload an examination-room audio file to the portal, that file may be sent to the transcription service outside Korea.

Article 3 (Processing and Retention Periods)

The Clinic processes and keeps personal information only within the period set by law or the period you consented to when it was collected. The retention period for each item is shown below.

Content from a recording that medical staff have reviewed and entered into the medical record is kept for 10 years, the same as the medical record. The one-year period in the table applies to the original audio, the transcript, and the draft record.

Personal information is destroyed without delay once its retention period ends. Article 5 explains how.

Article 4 (Provision of Personal Information to Third Parties)

The Clinic processes personal information only within the purposes stated in Article 1. It provides personal information to a third party only in the cases covered by Articles 17 and 18 of the PIPA, such as when the data subject has consented or a law specifically provides for it.

• National Health Insurance Service: claims for insurance benefits (National Health Insurance Act)
• Medical dispute mediation bodies and agencies authorized by law: when the Korea Medical Dispute Mediation and Arbitration Agency, an investigative authority, or a similar body makes a request based on law
• With the data subject’s consent: for example, issuing documents for an insurance claim when you have consented

Article 5 (Destruction of Personal Information)

The Clinic destroys personal information without delay once its retention period ends or its processing purpose has been achieved.

Personal information that must still be kept under law or internal policy after its purpose is achieved is moved to a separate database. Paper documents are moved to separate files. This information is destroyed when its set retention period ends. Personal information that no longer needs to be kept is destroyed immediately.

Electronic files are deleted in a way that prevents recovery or playback. Paper documents are shredded or incinerated.

Article 6 (Entrustment of Personal Information Processing)

The Clinic entrusts personal information processing tasks to the outside parties below.

When the Clinic enters into an entrustment contract, it sets out the following in the contract or a similar document, as required by Article 26 of the PIPA.

• A prohibition on processing personal information beyond the purpose of the entrusted work
• Technical and managerial protective measures
• Restrictions on re-entrustment
• Management and supervision of the trustee
• Liability, including compensation for damages

The Clinic supervises whether each trustee processes personal information safely.

Cross-border transfer to OpenRouter

OpenRouter, Inc. is a service that relays requests for transcription and draft records to model providers. OpenRouter decides which model provider handles each request.

This cross-border transfer is based on Article 28-8(1)3(a) of the PIPA. Because entrusting the processing of personal information is necessary to perform the treatment contract, the matters required by Article 28-8(2) are disclosed in this policy as follows.

1. Personal information transferred: audio recorded during treatment and its transcripts
2. Country, timing, and method of transfer: the United States. When recording ends during treatment, the data is sent through an API over an encrypted connection. The United States is where OpenRouter, Inc. is located. The model provider that actually handles a request may be located outside the United States.
3. Name and contact details of the recipient: OpenRouter, Inc. / 169 Madison Avenue, New York, NY 10016, United States / support@openrouter.ai
4. The recipient’s purpose of use and retention/use period: the transferred information is used to convert audio into text and to create draft records. OpenRouter states that it does not keep audio files beyond the time needed to relay the request. OpenRouter also states that abuse detection, security, billing, and legal compliance are exceptions. Retention periods at the model providers that actually handle requests differ from provider to provider.

The original audio is sent as recorded, without identifying information removed. As a rule, transcripts are sent only after identifying information has been removed. However, if that removal fails, the original transcript may be sent as is.

Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise the following rights with the Clinic at any time.

1. Request access to personal information
2. Request correction of inaccurate personal information
3. Request deletion. Information that the Medical Service Act or another law requires to be kept, such as medical records, cannot be deleted on request. Article 3 lists the retention periods set by law.
4. Request suspension of processing

Under Article 41(1) of the Enforcement Decree of the PIPA, you may exercise these rights in writing, by telephone, by email, by fax, or by similar means. The Clinic will act on your request without delay.

If you request correction or deletion, the Clinic will not use or provide the personal information in question until the correction or deletion is complete.

The rights of a child under 14 may be exercised by the child’s legal representative, in the same way as by the data subject.

Article 8 (Measures to Ensure the Safety of Personal Information)

Under Article 29 of the PIPA, the Clinic takes the following measures to keep personal information safe.

1. Managerial measures: establishing and carrying out an internal management plan, and regular staff training
2. Technical measures: managing access rights to the personal information processing system, installing access-control systems, encrypting unique identifying information, and installing security programs
3. Physical measures: controlling entry to the computer room, the records room, and similar areas

Article 9 (Installation, Operation, and Refusal of Automatic Collection Devices)

The Clinic’s website uses cookies, which store usage information and retrieve it later.

① Purposes of using cookies

• Analyzing how often and when users visit
• Tracking the advertising source (UTM, gclid). This is used to measure marketing effectiveness and is kept for 30 days.

The booking widget does not store the result of identity verification in a cookie. It is used only while the booking screen is open and disappears when the screen is closed.

② How to refuse cookies

In your web browser settings, you can allow all cookies, confirm each time a cookie is stored, or refuse all cookies. If you refuse cookies, some services may be difficult to use.

Article 10 (Personal Information Protection Officer)

The Clinic designates the Personal Information Protection Officer below to oversee personal information processing and to handle data subjects’ complaints and remedies.

Please direct any inquiry, complaint, or request for remedy about personal information protection to the Personal Information Protection Officer. The Clinic will respond and act without delay.

Article 11 (Remedies for Infringement of Rights)

If you need a remedy or counseling for an infringement of your personal information, you may contact the agencies below.

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Privacy Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301 (no area code) / www.spo.go.kr
• National Police Agency: 182 (no area code) / ecrm.cyber.go.kr

Article 12 (Changes to the Privacy Policy)

This privacy policy applies from its effective date. If content is added, deleted, or corrected because of a change in law or policy, the Clinic will announce the change in its notices starting seven days before it takes effect.