<Privacy Policy>
U&U Plastic Surgery Clinic (hereinafter 'the Clinic') places great importance on protecting your personal information and complies with the Personal Information Protection Act.
Through this privacy policy, we inform you of how and for what purposes the personal information you provide is used, and what measures are taken to protect it.
The Privacy Policy is organized as follows.
1. Items of Personal Information Collected and Collection Methods
2. Purposes of Collection and Use of Personal Information
3. Retention and Use Period of Personal Information
4. Procedures and Methods for Destroying Personal Information
5. Provision and Sharing of Personal Information
6. Outsourcing of Collected Personal Information
7. Rights of Users and Legal Representatives and How to Exercise Them
8. Withdrawal of Consent / How to Cancel Membership
9. Installation/Operation of Automatic Personal Information Collection Devices and How to Refuse Them
10. Personal Information Protection Officer
11. Measures to Ensure the Security of Personal Information
12. Duty to Give Notice of Policy Changes
1. Items of Personal Information Collected and Collection Methods
At sign-up, we collect only the minimum personal information needed to use the service.
To use our services, sign-up includes both required and optional fields; even if you do not fill in optional items such as email opt-in, your use of the service is not restricted.
A. [Medical records] - Items collected: name, date of birth, address, contact information, medical records
※ Unique identification information and medical records must be retained under the Medical Service Act (no separate consent required)
B. [Items collected at website membership registration]
- Required items: name, ID, password, address, contact information (phone number, mobile number), email address
- Optional items: birthday, SMS opt-in, email opt-in, areas of interest
- The following information may be automatically generated and collected in the course of Service use or Service operations: service usage records, access logs, cookies, and access IP information
C. [Collection methods] - Personal information is collected in the following ways.
･ Website, written forms, fax, telephone, consultation board, email
2. Purposes of Collection and Use of Personal Information
We use the collected personal information for the following purposes.
All information provided by users will not be used for any purpose other than those stated below, and prior consent will be sought if the purpose of use changes.
A. [Medical records] - Provision of medical services for diagnosis and treatment, and administrative services such as billing, payment, and refunds
B. [Website member information]
- Required information: appointment booking via the website, appointment lookup and member services, and posting on online boards (1:1 consultations/private consultations/post-surgery consultations/reviews, etc.)
- Optional information: clinic news and health information via email, surveys, troubleshooting, personalized services for individual members, statistics on Service usage, and notices of new services and information. However, sensitive personal information that could infringe on users' fundamental human rights is not collected.
Within the scope above, we collect additional information voluntarily provided by users in order to offer richer services.
3. Retention and Use Period of Personal Information
We destroy your personal information without delay once the purpose of its collection or provision has been achieved.
A. [Medical records] - Retained in accordance with the medical record retention standards set forth in the Medical Service Act
B. [Website member information]
- Upon membership withdrawal or expulsion. However, even after the purpose of collection or provision has been fulfilled, your personal information may be retained where required under the Commercial Act or other applicable laws.
- Records of consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)
- Records of the collection/processing and use of credit information: 3 years (Credit Information Use and Protection Act)
– Identity verification records: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection)
– Visit records: 3 months (Protection of Communications Secrets Act)
4. Procedures and Methods for Destroying Personal Information
We destroy personal information immediately once the 'Purpose of Collection and Use of Personal Information' has been achieved. The destruction procedure and methods are as follows.
A. [Destruction procedure] Information entered by users for membership registration and similar purposes is destroyed immediately, using the destruction methods below, once its purpose has been fulfilled.
B. [Destruction method] Personal information stored in electronic file form is deleted using technical methods that make the records unrecoverable.
Personal information printed on paper is destroyed by shredding or incineration.
5. Provision and Sharing of Personal Information
Except with your consent or as required by applicable laws, we will under no circumstances use your personal information beyond the scope disclosed in the 'Purpose of Collection and Use of Personal Information' or provide it to other persons, companies, or institutions.
- Submission of medical records to the Health Insurance Review and Assessment Service for reimbursement claims under the National Health Insurance Act
- Provision in a form that does not identify specific individuals, where necessary for statistical compilation or academic research
- Submission upon request by investigative agencies in accordance with procedures and methods prescribed by law, etc.
6. Outsourcing of Collected Personal Information
We outsource personal information processing as described below for service fulfillment, and in accordance with applicable laws, our outsourcing contracts stipulate what is necessary for personal information to be managed safely.
Our personal information processing contractors and the outsourced tasks are as follows.
Contractor: Yourdev
Outsourced tasks: website maintenance, access logs, administration, member management
Outsourced personal information: name, address, phone number
Retention and use period of personal information: until termination of the outsourcing contract
7. Rights of Users and Legal Representatives and How to Exercise Them
Membership registration for children under 14 (hereinafter "children") is conducted through a separate form written in plain language that children can easily understand, and we always obtain the consent of a legal guardian when collecting personal information.
To obtain a legal guardian's consent, we collect only minimal information from the child, such as the guardian's name and contact details, and we obtain the guardian's consent in the manner set out in this privacy policy.
A child's legal guardian may request to view, correct, or delete the child's personal information. To do so, click 'Edit Member Information' and complete the guardian verification process, after which the guardian may directly view, correct, or delete the child's information; alternatively, contact the Chief Privacy Officer in writing, by phone, or by fax, and we will take the necessary measures.
We do not provide or share children's information with third parties, and if a legal guardian requests correction of errors in personal information collected from a child, we prohibit the use and provision of that information until the error is corrected.
※ Personal information that must be retained by law cannot be modified or deleted during the retention period, even upon request.
8. Withdrawal of Consent / How to Cancel Membership
You may withdraw your consent to the collection, use, and provision of your personal information at any time. To cancel your membership, click 'Membership Withdrawal' on the My Page section of our website; the Chief Privacy Officer will confirm your request, and withdrawal will be completed within 10 days of the request date. Alternatively, contact the Chief Privacy Officer in writing, by phone, or by fax, and we will take the necessary measures, such as destroying your personal information without delay.
9. Installation/Operation of Automatic Personal Information Collection Devices and How to Refuse Them
We operate 'cookies' that store and retrieve your information from time to time. A cookie is a very small text file that the server operating our website sends to your browser; it is stored on your computer's hard disk. We use cookies for the following purposes.
You have the right to choose whether to accept cookies. By setting options in your web browser, you may allow all cookies, require confirmation each time a cookie is saved, or refuse all cookies.
If you refuse the installation of cookies, some services may be difficult to provide.
10. Personal Information Protection Officer
To protect your personal information and handle privacy-related complaints, we have designated a Chief Privacy Officer as follows.
Name: Kikap Kim
Position: Head Director
Affiliation: U&U Plastic Surgery Clinic
Phone: 02-544-6996
You may report any privacy-related complaints arising from your use of our services to our Chief Privacy Officer.
We will respond promptly and fully to user reports.
If you need to report or seek advice on other privacy infringements, please contact the organizations below.
･ Personal Information Dispute Mediation Committee (http://www.1336.or.kr / 1336)
･ ePrivacy Mark Certification Committee (http://www.eprivacy.or.kr / (02) 580-0533~4)
･ Supreme Prosecutors' Office Cybercrime Investigation Unit (http://www.spo.go.kr / (02) 3480-3573)
･ National Police Agency Cyber Terror Response Center ( http://www.ctrc.go.kr / (02) 392-0330)
11. Measures to Ensure the Security of Personal Information
In handling users' personal information, we implement the following technical and administrative measures to ensure it is not lost, stolen, leaked, altered, or damaged.
A. [Password encryption] The password you set when joining the site is stored and managed in encrypted form, known only to you, and personal information can be viewed or changed only by the person who knows the password. However, if a member has difficulty using the site and requests a change directly from the Personal Information Protection Officer, the information can be changed after identity verification in writing or by phone, fax, or email.
B. [Countermeasures against hacking] The Clinic does its utmost to prevent members' personal information from being leaked or damaged by hacking, computer viruses, and the like.
We back up data regularly to guard against damage to personal information, use up-to-date antivirus software to prevent users' personal information and data from being leaked or damaged, store important personal information (such as resident registration numbers) in encrypted form, and use encrypted communications to transmit personal information safely over the network. We also control unauthorized outside access with an intrusion prevention system, and strive to put in place every possible technical safeguard to secure our systems.
C. [Minimization and training of personal information handlers] The Clinic limits the handling of personal information to designated staff, assigns them separate passwords that are updated regularly, and provides both regular and ad hoc training for those staff.
However, we assume no responsibility for problems caused by the leakage of personal information such as phone numbers, passwords, or resident registration numbers due to the user's own negligence or issues on the Internet.
12. Duty to Give Notice of Policy Changes
This privacy policy was amended on the date specified below. If content is added, deleted, or amended due to changes in laws, policies, or security technology, we will announce the reasons for and details of the changes on the Clinic's website at least 7 days before the revised privacy policy takes effect.
･ Effective date: June 15, 2020
