PRIVACY

Privacy Policy

This English translation is provided for convenience. If there is any difference between this translation and the Korean version, the Korean version prevails.

Miri Clinic (Gangdong Cheonho) Privacy Policy

◆ In accordance with Article 30 of the Personal Information Protection Act, Miri Clinic establishes and discloses the following privacy policy in order to protect the personal information of data subjects (customers) and to handle related grievances promptly and smoothly.

1. Purposes of Collection and Use of Personal Information

□ Purposes of collection and use: Miri Clinic uses the personal information it collects for the following purposes.

ο Performing contracts for the provision of services and providing content in connection with the services

ο Identity verification and personal identification in connection with the use of the services, prevention of fraudulent and unauthorized use by abusive members, handling of complaints and other civil petitions, and delivery of notices

ο Use for marketing and advertising: providing information on events and promotions and opportunities to participate,

providing services and placing advertisements based on demographic characteristics, and identifying access frequency or compiling statistics on the use of the services

ο Verifying the identity of persons filing complaints, confirming the details of complaints, contacting and notifying them for fact-finding, and notifying them of the results

2. Items of Personal Information to Be Collected

□ We collect the following personal information for membership registration, consultations, service applications, and similar purposes.

ο Items collected: name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, service use records

ο Optional items: branch, areas of interest, event selections, how you found us, and whether you agree to receive mailings and SMS

ο Retention period: until you separately opt out of receiving communications or request to withdraw your membership (where retention is required under the relevant laws, Section 3, Retention and Use Period of Personal Information, applies)

ο Method of collection: website (membership registration, consultation board, reservation board, simple login, etc.)

3. Retention and Use Period of Personal Information

① Miri Clinic processes and retains personal information within the retention and use period to which the data subject consented when the information was collected, or within the retention and use period prescribed by law.

② The specific processing and retention periods are as follows.

ο Customer registration and management: until the service use agreement ends or is terminated; however, where any claims or debts remain outstanding, until those claims and debts are settled

ο Records of contracts, withdrawal of offers, payments, and supply of goods in electronic commerce: 5 years

ο Information collected for diagnosis and treatment: in accordance with the standards of the Medical Service Act

ο Even after the purpose of collection or provision has been achieved, personal information may be retained where it must be preserved under the Commercial Act or other laws and regulations

4. Outsourcing of Personal Information Processing

① Miri Clinic outsources personal information processing tasks to an external party as follows for the smooth handling of personal information.

ο Outsourcee (entrusted party): BrainMedi Co., Ltd.

- Outsourced tasks: identity verification for membership services, handling of complaints and other civil petitions,

delivery of notices, development of new services (products) and provision of customized services, and provision of information on events and promotions and opportunities to participate

② When entering into an outsourcing contract, Miri Clinic, in accordance with Article 26 of the Personal Information Protection Act,

specifies in the contract or other documents matters such as the prohibition on processing personal information for purposes other than performing the outsourced tasks, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the outsourcee, and liability including compensation for damages, and supervises whether the outsourcee processes personal information safely.

5. Provision of Personal Information to Third Parties

Miri Clinic does not provide personal information to third parties except in cases falling under Article 17 of the Personal Information Protection Act, such as where the data subject has given separate consent or where a law specifically provides otherwise.

6. Rights and Obligations of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights relating to the protection of personal information against Miri Clinic at any time.

① Requests for access to personal information, ② requests for correction of any errors, ③ requests for deletion, and ④ requests for suspension of processing

may be made in writing, by email, by fax, or by other means, using Form No. 8 annexed to the Enforcement Rule of the Personal Information Protection Act, and Miri Clinic will take action on them without delay.

Where a data subject has requested correction or deletion of errors or other problems in personal information, Miri Clinic will not use or provide that personal information until the correction or deletion has been completed.

Rights may also be exercised through an agent, such as the data subject's legal representative or a person delegated by the data subject.

In this case, a power of attorney in accordance with Form No. 11 annexed to the Enforcement Rule of the Personal Information Protection Act must be submitted.

7. Items of Personal Information Processed: Miri Clinic processes the following items of personal information.

ο Items collected: name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, service use records

ο Optional items: branch, areas of interest, event selections, how you found us, and whether you agree to receive mailings and SMS

8. Destruction of Personal Information

① In principle, Miri Clinic destroys personal information without delay once the purpose of processing has been achieved. The procedure, deadlines, and methods of destruction are as follows.

When the retention period of personal information has expired, Miri Clinic destroys the personal information within 5 days from the end of the retention period. When personal information is no longer needed, for example because the purpose of processing has been achieved, the relevant service has been discontinued, or the business has closed, Miri Clinic destroys it within 5 days from the date on which its processing is deemed no longer necessary.

② Miri Clinic destroys personal information using the following methods.

ο Electronic files: deleting files, formatting disks, or using other technical methods that make records unrecoverable

ο Paper documents: shredding or incineration

9. Installation and Operation of Devices That Automatically Collect Personal Information, and Refusal of Such Devices

Miri Clinic uses "cookies" and similar technologies, which store and retrieve users' information from time to time, to provide customized services tailored to users.

οCookies are used to provide personalized services by analyzing access frequency and visit times, identifying and tracking users' preferences and areas of interest, and determining the level of participation in events and the number of visits.

οUsers can set options in their web browser to accept all cookies, to be asked for confirmation each time a cookie is stored, or to refuse the storage of all cookies.

10. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, Miri Clinic takes the following technical, administrative, and physical measures necessary to ensure security.

ο Regular internal audits

To ensure the security of personal information handling, we conduct internal audits on a regular basis (once a year).

ο Minimizing and training staff who handle personal information

We designate the staff who handle personal information and limit such handling to those persons, keeping their number to a minimum as a measure for managing personal information.

ο Establishing and implementing an internal management plan

We have established and implement an internal management plan for the safe processing of personal information.

ο Technical measures against hacking and similar threats

To prevent leakage of and damage to personal information caused by hacking, computer viruses, and the like, we install security programs and regularly update and check them, install systems in areas where access from outside is controlled, and monitor and block access by technical and physical means.

ο Encryption of personal information

Users' passwords are encrypted when stored and managed, so that only the users themselves know them, and for important data we use additional security features such as encrypting files and transmitted data or using file-locking functions.

ο Restriction of access to personal information

We take the measures necessary to control access to personal information by granting, changing, and revoking access rights to the database systems that process personal information, and we use an intrusion prevention system to control unauthorized access from outside.

11. Privacy Officer

Miri Clinic takes overall responsibility for work relating to the processing of personal information,

and has designated the following Privacy Officer to handle data subjects' complaints and provide remedies for damages relating to the processing of personal information.

ο Privacy Officer

- Name: Bak Hyeonjeong

- Contact: +82 2-470-1175

12. If You Do Not Consent

Users (data subjects) have the right to refuse consent to the collection and use of personal information. However, if you do not consent, the provision of related services will be restricted.