BAROKO Clinic (hereinafter "the Clinic") operates in the Republic of Korea. The Clinic places great importance on protecting your personal information and complies with the Personal Information Protection Act of Korea and related legislation. Your personal information is processed and stored in the Republic of Korea. Through this Privacy Policy, the Clinic informs you of the purposes and methods by which the personal information you provide is used, and the measures taken to protect it. This Privacy Policy is organised as follows: 1. Items of Personal Information Collected and Collection Methods 2. Purposes of Collection and Use of Personal Information 3. Retention and Use Period of Personal Information 4. Disposal Procedures and Methods for Personal Information 5. Provision and Sharing of Personal Information 6. Entrustment of Collected Personal Information 7. Rights of Users and Legal Representatives and How to Exercise Them 8. How to Withdraw Consent / Withdraw Membership 9. Installation/Operation of Automatic Personal Information Collection Devices and the Right to Refuse 10. Personal Information Protection Officer 11. Measures to Ensure the Security of Personal Information 12. Obligation to Notify Upon Policy Changes 1. Items of Personal Information Collected and Collection Methods The Clinic collects only the minimum personal information necessary for service use during consultations. To use the Clinic's services, certain fields may be requested during consultation; however, services remain accessible even if email address or contact number are not provided. [Medical Information] - Items collected: name, resident registration number, address, contact number, medical records ※ Unique identification information and medical records must be retained under the Medical Service Act (no separate consent required) [Items Collected During Website Consultation] - Required: name, ID, password, email, contact number (phone number, mobile number) - Optional: email subscription preference - The following information may be automatically generated and collected during the course of service use: service usage records, access logs, cookies, access IP information [Personal Information Collection Methods] - Personal information is collected through the following methods: Website, written forms, fax, telephone, consultation board, email 2. Purposes of Collection and Use of Personal Information The Clinic uses the collected personal information for the following purposes. All information provided by users will not be used for any purpose other than those listed below; prior consent will be sought if the purpose of use changes. [Medical Information] - Provision of medical services for diagnosis and treatment, and administrative services including billing, payment, and reimbursement [Website Consultation Information] - Provision of consultation services, notification of clinic news and health information via email, and surveys 3. Retention and Use Period of Personal Information The Clinic will destroy your personal information without delay once the purpose of collection or the purpose for which it was received has been achieved. [Medical Information] - Retained in accordance with the medical record retention standards specified in the Medical Service Act [Website Consultation Information] - Even after the purpose of collection or provision has been achieved, personal information may be retained where required by law, such as the Commercial Act: - Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce) - Records on collection/processing and use of credit information: 3 years (Credit Information Use and Protection Act) - Records on identity verification: 6 months (Act on Promotion of Information and Communications Network Utilisation and Information Protection) - Records on visits: 3 months (Protection of Communications Secrets Act) 4. Disposal Procedures and Methods for Personal Information The Clinic will destroy personal information without delay once the 'Purposes of Collection and Use of Personal Information' have been achieved. Disposal procedures and methods are as follows: [Disposal Procedure] Information entered by users for membership registration etc. will be destroyed immediately by the disposal method once the purpose has been achieved. [Disposal Method] Personal information stored in electronic file format is deleted using technical methods that make the records irrecoverable. Personal information printed on paper is shredded or incinerated. 5. Provision and Sharing of Personal Information Except where the user has given consent or as required by applicable law, the Clinic will not use your personal information beyond the scope notified in 'Purposes of Collection and Use of Personal Information', nor provide it to any other person, company, or institution. - Submission of medical records to HIRA (Health Insurance Review & Assessment Service) for medical benefit cost claims under the National Health Insurance Act - Provision in anonymised form for statistical compilation or academic research where individuals cannot be identified - Submission upon request from investigative authorities pursuant to procedures and methods prescribed by law, etc. 6. Entrustment of Collected Personal Information The Clinic entrusts personal information as described below for service delivery, and has stipulated the necessary provisions in entrustment contracts in accordance with applicable law to ensure that personal information is managed securely. The Clinic's personal information processing entrusted organisations and the scope of entrusted work are as follows: - Data processor: Naw Design - Scope of entrusted work: Website management, operation, and maintenance - Personal information items entrusted: Customer personal information on the website - Retention and use period: Until the end of the entrustment contract 7. Rights of Users and Legal Representatives and How to Exercise Them Membership registration for children under the age of 14 (hereinafter "children") is carried out through a separate form written in plain language that children can understand, and consent from a legal representative is obtained whenever personal information is collected. To obtain the legal representative's consent, the Clinic collects minimum information including the legal representative's name and contact number from the child, and obtains consent in accordance with the methods set out in this Privacy Policy. A child's legal representative may request access to, correction of, or deletion of the child's personal information. To access, correct, or delete a child's personal information, the legal representative may click 'Edit Member Information', complete the legal representative verification process, and directly access/correct/delete the child's personal information, or contact the Personal Information Protection Officer in writing, by telephone, or by fax, and the necessary measures will be taken. The Clinic will not provide or share information about children to third parties, and if a legal representative requests correction of errors in personal information collected from a child, the Clinic will prohibit the use or provision of the relevant personal information until the error is corrected. ※ Personal information that is legally required to be retained cannot be modified or deleted within the retention period even upon request. 8. How to Withdraw Consent / Withdraw Membership You may withdraw your consent to the collection, use, and provision of personal information given at the time of membership registration at any time. To withdraw membership, click 'Withdraw Membership' in My Page on the Clinic's website, complete the identity verification process, and withdraw directly, or contact the Personal Information Protection Officer in writing, by telephone, or by fax, and the Clinic will promptly take necessary measures such as destroying your personal information. 9. Installation/Operation of Automatic Personal Information Collection Devices and the Right to Refuse The Clinic operates 'cookies' to store and retrieve your information on an ongoing basis. Cookies are very small text files sent by the server operating the Clinic's website to your browser and stored on your computer's hard drive. The Clinic uses cookies for the following purposes. You have the right to choose whether to accept cookies. You may therefore allow all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies by adjusting your web browser settings. If you refuse the installation of cookies, some services may be difficult to provide. 10. Personal Information Protection Officer To protect your personal information and handle complaints related to personal information, the Clinic has designated the following Personal Information Protection Officer: [Personal Information Protection Officer] Name: Jun Kim Position: Director Affiliation: BAROKO Clinic Telephone: 02-595-8599 Email: master@baroko.co.kr You may report all personal information protection-related complaints arising from your use of the Clinic's services to the Personal Information Protection Officer. The Clinic will respond promptly and thoroughly to users' reports. For other reports or consultations regarding personal information infringement, please contact the following organisations: Personal Information Dispute Mediation Committee (http://www.1336.or.kr / 1336) Supreme Prosecutors' Office Cyber Crime Investigation Division (http://www.spo.go.kr / (02) 3480-3573) National Police Agency Cyber Terror Response Centre (http://www.ctrc.go.kr / (02) 392-0330) 11. Measures to Ensure the Security of Personal Information The Clinic has put in place various security devices as technical measures to protect users' personal information. All information you send is securely stored and managed in a security system protected by a firewall. In addition, as an administrative measure for protecting users' personal information, the Clinic has established procedures necessary for access to and management of users' personal information, limits the number of staff handling users' personal information to a minimum, and conducts ongoing security training. The Clinic also designates users of systems that process personal information, assigns user passwords, and updates them regularly. 12. Obligation to Notify Upon Policy Changes This Privacy Policy was established on 17 August 2015. Where content is added, deleted, or amended due to changes in laws, policies, or security technologies, notice of the reason for and content of the change will be given through the Clinic's website at least 7 days before the amended Privacy Policy takes effect. Notice date: 17 August 2015 Effective date: 24 August 2015