Privacy Policy

1. Purpose of processing personal information

The Hospital processes personal information for the following purposes and does not use it for any purpose other than those listed below. If the purpose of use changes, necessary measures, such as obtaining separate consent, will be taken in accordance with Article 18 of the Personal Information Protection Act.
– Medical Appointments and Online Consultations: Confirmation, modification, and cancellation of appointments received through external booking platforms such as Naver Booking and Kakao Booking; confirmation of reservation holders and guidance on medical services; and reception and response to online consultation requests.
– Complaint Handling: Verification of complainant's identity, confirmation of complaint details, notification of processing results
– Website Operation & Management: Prevention of fraudulent use, statistical analysis for service improvement
– Facility Safety Management: Prevention of safety accidents and fires within hospital facilities through video surveillance (CCTV), and ensuring the safety of patients and staff.

The hospital processes health and medical information (sensitive information) for the purpose of medical treatment in accordance with the Medical Service Act. This processing is based on relevant laws and falls under cases where it can be processed without the separate consent of the data subject. However, if the processing of sensitive information is necessary for purposes other than medical treatment, separate consent is obtained in advance.

2. Processing and retention period of personal information

The Hospital processes and retains personal information within the retention and usage period stipulated by relevant laws or within the retention and usage period agreed upon by the data subject at the time of collection. The detailed retention periods are as follows.
– Private online consultation records on the website: 3 years after completion of processing
– Medical records: 10 years (Article 22 of the Medical Service Act · Article 15 of the Enforcement Rule of the same Act)
– Prescription: 2 years
– Surgical record: 10 years
– Examination findings record: 5 years
– Radiographs and reports: 5 years
– Nursing Record: 5 years
– Duplicate copy of medical certificate, etc.: 3 years
– Automatically generated/collected information: IP address, connection date and time, connection logs, etc.
   Retention period: Automatically deleted after 3 months
– Video Information (CCTV): 30 days from the date of recording

Notwithstanding the retention period mentioned above, if a dispute or investigation arising from a violation of relevant laws is in progress, the information will be retained until the cause for such action is terminated.

3. Items of personal information processed

– Online Consultation (Mandatory): Name, gender, mobile phone number, consultation details, and health information (sensitive information) such as symptoms may be naturally included during the consultation process.
– Upon login: Social media provider identification, unique social media identifier (Resident Registration Number is not collected.)
– Automatically collected items: Connection IP, cookies, connection logs, service usage history, date and time of visit, browser information
– Video Information (CCTV): Recorded video (image information), date and time of recording

4. Provision of personal information to third parties

The Hospital processes the personal information of data subjects only within the scope specified in Paragraph 1 (Purpose of Processing) above, and does not provide personal information to third parties except in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the data subject or special provisions of the law. However, if there is a request from public institutions, such as investigative agencies, in accordance with relevant laws (Medical Services Act, Infectious Disease Prevention Act, etc.), it may be provided to the minimum extent necessary.

5. Entrustment of personal information processing

The Hospital entrusts personal information processing tasks as follows to ensure smooth business operations, and when concluding entrustment contracts, it stipulates necessary matters to ensure that personal information is safely managed in accordance with Article 26 of the Personal Information Protection Act.
– Bit Computer: Computerized management of medical records, sending appointment and treatment notification texts (SMS/KakaoTalk).
– Cafe24 Inc.: Website hosting and system operation

In the event of a change in the consignee, we will disclose it without delay through this policy.

6. Overseas transfer of personal information

In principle, the Hospital does not transfer personal information overseas. In the event of future overseas transfers, we will provide prior notice of the items to be transferred, the country, the timing, the method, and the information of the recipient, and obtain consent in accordance with Article 28-8 of the Personal Information Protection Act.

7. Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise

– Data subjects may request access to, correction/deletion of, or suspension of processing of their personal information from the hospital at any time, and may claim compensation for damages caused by the processing of their personal information.
– You may exercise your rights in writing, via email, fax, etc., and the hospital will take action without delay.
– If a request for correction or deletion is made, the hospital will not use or provide the relevant personal information until the request is completed.
– You may also exercise your rights through the data subject's legal representative or an authorized agent.
– The rights regarding personal information of children under the age of 14 may be exercised by a legal representative, not the child themselves.

8. Destruction of personal information

The Hospital destroys personal information without delay when it becomes unnecessary, such as upon the expiration of the retention period or the achievement of the purpose of processing. However, in cases where preservation is required under other laws (see Paragraph 2), the information is destroyed after the relevant period has passed. Personal information recorded and stored in the form of electronic files is deleted using technical methods that prevent the records from being reproduced, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.

9. Measures to ensure the security of personal information

The hospital is taking the following measures to ensure the safety of personal information.
– Administrative measures: Establishment and implementation of internal management plans, minimization of employees handling personal information, and regular training
– Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation and updating of security programs, storage of access logs and prevention of falsification and alteration
– Physical measures: Access control for computer rooms, data storage rooms, etc.

10. Matters concerning the installation, operation, and rejection of cookies

The hospital uses 'cookies,' which store and frequently retrieve usage information, to provide personalized and customized services to users. Cookies are small pieces of information transmitted by the server operating the website to the user's browser, and they may also be stored on the user's computer's hard drive. Users have the option to control cookie installation and can configure settings such as allowing or blocking cookies through their web browser options (e.g., Chrome Settings > Privacy & security > Cookies and other site data).

11. Operation and Management of Image Information Processing Devices

The hospital installs and operates video information processing devices as follows for facility safety management, fire prevention, and the safety of patients and staff.
– Basis and Purpose of Installation: Article 25, Paragraph 1 of the Personal Information Protection Act, Facility Safety and Fire Prevention
– Number of installations and locations
1F (6 units)
Waiting room: 3 units
MRI Treatment Room: 1 unit
Outdoor deck: 2 vehicles

2F (17 units)
Waiting room: 5 units
Desks: 4 units
Hallway: 6 cars
MRI Treatment Room: 1 unit
Pharmacy: 1 unit

3F (16 units)
Inpatient rooms: 2
Recovery Room: 2 units
Oxygen gas chamber: 1 unit
Operating room: 1 unit
Hallway: 10 cars

Total of 39 units

significant
– 1 unit each in Operating Room 4, Rooms A and B
-> Start recording if patient requests
– Recording time: 24-hour continuous recording
– Manager: Same as the Chief Privacy Officer (see Paragraph 13)
– Outsourcing Status: ADT Caps
– Request by Data Subject for Access to Video Information, etc.: A data subject may request the Personal Information Protection Officer to access, confirm the existence of, or delete video information in which they are filmed. However, this is limited to cases where the data subject themselves is filmed or where it is clearly necessary for the urgent interests of the data subject's life, body, or property.
– Video Information Retention Period and Destruction: Automatically deleted after 30 days from the date of recording

12. Data Subjects' Rights Regarding Automated Decisions

The hospital does not make decisions regarding matters that have a significant impact on the rights or obligations of data subjects by processing personal information solely through fully automated systems (including artificial intelligence technology).

13. Personal Information Protection Manager

The Hospital assumes overall responsibility for matters concerning the processing of personal information and designates a Personal Information Protection Officer as follows to handle complaints and provide relief for damages to data subjects regarding the processing of personal information.

[Personal Information Protection Officer]
Name: Kim Geon-woo
Position: Chief Director

Email: shamadeo@naver.com

[Department for Receiving and Processing Requests for Access to Personal Information]
Department Name: Admissions Team
Person in Charge: Deputy Manager Yong Seok-un

Data subjects may contact the Chief Privacy Officer and the relevant department regarding all inquiries, complaints, and damage relief matters related to personal information protection arising from the use of the Hospital's services. The Hospital will respond to and process the data subject's inquiries without delay.

14. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, etc., to seek relief for personal information infringement. For other reports or consultations regarding personal information infringement, please contact the organizations listed below.
– Personal Information Dispute Mediation Committee: 1833-6972 (without area code) (www.kopico.go.kr)
– Personal Information Infringement Report Center: 118 (without area code) (privacy.kisa.or.kr)
– Supreme Prosecutors' Office: 1301 (without area code) (www.spo.go.kr)
– National Police Agency: 182 (without area code) (ecrm.cyber.go.kr)

A person whose rights or interests have been infringed by a disposition or inaction by the head of a public institution regarding a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), and Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

Changes to the Privacy Policy and Effective Date

This Privacy Policy applies from the effective date. In the event of any additions, deletions, or corrections to the contents pursuant to laws and policies, notice will be provided through the 'Notices' section of the website at least 7 days prior to the effective date of the changes. However, in the event of a significant change to the rights of data subjects, notice will be provided at least 30 days in advance.

Announcement date: March 2026, 8
Effective date: March 2026, 8