Privacy Policy

Yeonhap Dental Clinic (hereinafter 'the Clinic') protects the personal information of its patients and complies with the Personal Information Protection Act, the Medical Service Act, and other applicable laws. This Privacy Policy is established to inform data subjects of what personal information the Clinic processes, for what purposes and by what means, and how that information is protected and managed. If there is any discrepancy between this translation and the Korean version, the Korean version prevails.

1. ❑Article 01Purposes of Processing Personal Information

   • Receiving and confirming consultation appointment requests
   • Notifying appointment schedules and any changes
   • Post-treatment follow-up and patient satisfaction confirmation
   • Creating and retaining medical records as required by the Medical Service Act and related laws
   • Administrative tasks such as treatment fee settlement, patient identity verification, and health insurance benefit claims
   • Identity verification for complaint handling and dispute resolution
   • Membership registration, login, Kakao login, and member account management
   • Website operation, statistical analysis, and service quality improvement

2. ❑Article 02Personal Information Items Processed

   • Required—Full name, mobile phone number
   • Optional—Email address, treatment category, consultation content, additional notes
   • Member account—Email address, password hash, Kakao account identifier, and login session information
   • Sensitive (health) information—Medical records, prescriptions, imaging and test data, and other health and medical information generated during treatment (processed under Article 23 of the Personal Information Protection Act and Article 21 of the Medical Service Act)
   • Payment information—Cash receipt information, partial card payment information, and receipt issuance records generated during treatment fee settlement
   • Guardian information—Name, contact number, and relationship of the legal guardian for minor patients or where guardian accompaniment is required
   • Automatically collected—Service usage records, access logs, cookies, IP address, browser and device information
   • Collection methods—Website consultation form, phone inquiry, in-person written form, and external channels such as Naver Booking and Naver Talk-Talk

3. ❑Article 03Retention and Processing Period of Personal Information

   • Default—Personal information is destroyed without delay once the purpose of collection and use has been fulfilled.
   • Under Article 15 of the Enforcement Rules of the Medical Service Act—Medical record book: 10 years; patient register: 5 years; prescriptions: 2 years; surgical records: 10 years; test results and findings: 5 years; radiographs and reports: 5 years; nursing records: 5 years; midwifery records: 5 years.
   • Under the Act on Consumer Protection in Electronic Commerce—Records on labeling and advertising: 6 months; records on consumer complaints or dispute resolution: 3 years.
   • Consultation request information—1 year after the consultation is completed (for follow-up consultation purposes).
   • Member account information—Destroyed without delay upon withdrawal or account deletion request, except where retention is required by law.
   • Access log records under the Protection of Communications Secrets Act—3 months.

4. ❑Article 04Processing of Sensitive (Health) Information

   • Yeonhap Dental Clinic processes patients' health information (medical records, prescriptions, imaging, test results, etc.) only for treatment purposes, in accordance with Article 23 of the Personal Information Protection Act and Article 21 of the Medical Service Act.
   • Sensitive information is not used for purposes other than the purposes of processing and is not provided to third parties unless required by law.
   • Sensitive information is stored in environments with locking devices or access-control measures and is accessible only to authorized medical staff and designated employees.

5. ❑Article 05Procedures and Methods for Destruction of Personal Information

   • Procedure—Personal information whose retention period has expired or whose processing purpose has been achieved is moved to a separate storage area, subject to internal review, and destroyed without delay.
   • Electronic files—Destroyed using methods that prevent recovery or reproduction (complete deletion, degaussing, or physical destruction).
   • Paper documents—Destroyed by shredding or incineration.
   • Information legally required to be retained is destroyed in the same manner upon expiration of the retention period.

6. ❑Article 06Third-Party Provision of Personal Information

   • Yeonhap Dental Clinic does not, in principle, provide personal information to third parties.
   • Provision occurs only when—the data subject has given separate consent; provision is specifically permitted by law (Articles 17 and 18 of the Personal Information Protection Act, etc.); or mandatory reporting under the Medical Service Act or other statutes is required.
   • Examples of legally mandated provision—National Health Insurance Service (claims for insurer-borne payments), Health Insurance Review and Assessment Service (review of medical benefit claims), infectious-disease control authorities (mandatory legal reports), and investigative agencies (data submission requests based on warrants or statutory authority).
   • When personal information is provided, the recipient, purpose, items, and retention period are disclosed in advance. Data subjects may refuse consent; however, refusal may limit appointment scheduling or treatment.

7. ❑Article 07Outsourcing of Personal Information Processing

   • Yeonhap Dental Clinic may outsource certain tasks for the smooth provision of appointment guidance and system operation.
   • When outsourcing, in accordance with Article 26 of the Personal Information Protection Act, the Clinic discloses the trustee, the scope of outsourced work, and the retention/use period in advance, and supervises the trustee.
   • Member authentication processor—Supabase, Inc.; purpose: email and Kakao login, session management, and account deletion; retention: until membership withdrawal or authentication session expiry.
   • Consultation notification email processor—Resend, Inc.; purpose: sending a notification email to clinic staff when an online consultation request is submitted (including name, phone number, and treatment category); retention: until the end of the send-log retention period (up to 30 days).
   • If any outsourcing arrangement is currently in effect, it is disclosed in this Privacy Policy immediately.

8. ❑Article 08Membership and the Right to Refuse Collection and Use

   • The Clinic's website operates a membership service using email and Kakao accounts. Registration creates a login session after email verification or Kakao OAuth authentication.
   • Data subjects may refuse consent to collection and use for membership registration. In that case, member-only features are unavailable, while non-member consultation and appointment guidance remain available.
   • A signed-in member may request withdrawal from the withdrawal page. Account and login information are deleted without delay.
   • The creation and retention of medical records for treatment purposes are carried out without a separate consent procedure, as mandated by Article 21 of the Medical Service Act.

9. ❑Article 09Processing the Personal Information of Children Under 14

   • When collecting personal information from children under 14, the Clinic obtains consent from the legal guardian in accordance with Article 22-2 of the Personal Information Protection Act.
   • Verification of legal guardians—The Clinic verifies the guardian's name and contact information and confirms consent directly (by phone, in writing, or via signed forms during visits).
   • Legal guardians may request access, correction, deletion, or suspension of processing of the child's personal information. The Clinic acts without delay after verifying the identity and guardian relationship.

10. ❑Article 10Rights and Obligations of Data Subjects and How to Exercise Them

    • Data subjects may at any time request access, correction, deletion, suspension of processing, or withdrawal of consent regarding their personal information (Articles 35–37 of the Personal Information Protection Act).
    • Methods—By phone (031-293-2207), in writing during a visit, or by email/post to the Privacy Officer.
    • Identity verification—A copy of an identification document is required. For agents, a power of attorney along with identification of both the agent and the data subject must be submitted.
    • Processing—Requests are acted upon within 10 days, and the result is notified to the data subject. Deletion may be restricted for information subject to legal retention obligations.
    • Data subjects are obligated to provide accurate personal information. Any disadvantage arising from inaccurate information is the responsibility of the data subject.

11. ❑Article 11Measures to Ensure the Security of Personal Information

    • Administrative—Internal management plans established and implemented, regular staff training, access control procedures.
    • Technical—Differentiated access privileges for the personal information processing system, retention and review of access logs, antivirus software, encrypted communications (HTTPS).
    • Physical—Access control to medical record storage areas, locking devices, management of external visitors.

12. ❑Article 12Installation and Operation of Automatic Collection Devices (Cookies) and Refusal

    • The Clinic's website may use cookies and similar technologies to improve user convenience and for statistical analysis.
    • Users may refuse or delete cookies through browser settings (e.g., Chrome → Settings → Privacy and Security → Cookies).
    • Refusal of cookies may limit use of some services.

13. ❑Article 13Operation of Video Information Processing Devices (CCTV)

    • The Clinic may install and operate video information processing devices in common areas for facility safety and prevention of theft or fire.
    • Filming scope—Entrances and waiting areas (treatment and consultation rooms, where patient privacy may be compromised, are not filmed).
    • Retention period—30 days (or the period required by applicable law).
    • Requests for viewing or deletion may be submitted to the Privacy Officer. Access is provided after identity verification and where there is justifiable cause.

14. ❑Article 14Privacy Officer

    • Name—Ahn Seong-jin (Chief Director)
    • Affiliation—Yeonhap Dental Clinic
    • Address—5F, Cham Clinic Building, 230 Geumho-ro, Gwonseon-gu, Suwon-si, Gyeonggi-do, Korea
    • Phone—031-293-2207
    • Data subjects may submit inquiries, complaints, or remedy requests regarding the processing of personal information to the Privacy Officer. The Clinic will respond and act without delay.

15. ❑Article 15Remedies for Infringement of Rights

    • Data subjects may seek the following agencies for damage relief and counseling regarding personal information infringement.
    • Personal Information Dispute Mediation Committee—(no area code) 1833-6972 / www.kopico.go.kr
    • Korea Internet & Security Agency (KISA) Privacy Infringement Report Center—(no area code) 118 / privacy.kisa.or.kr
    • Supreme Prosecutors' Office Cyber Investigation Division—(no area code) 1301 / www.spo.go.kr
    • National Police Agency Cyber Bureau—(no area code) 182 / ecrm.police.go.kr
    • If rights or interests are infringed by a disposition or omission relating to requests under Articles 35 (access), 36 (correction/deletion), or 37 (suspension of processing) of the Personal Information Protection Act, an administrative appeal may be filed with the Central Administrative Appeals Commission (www.simpan.go.kr).

16. ❑Article 16Scope of This Privacy Policy

    • This Privacy Policy applies only to the official website operated directly by Yeonhap Dental Clinic.
    • Personal information processing that occurs after navigating from the Clinic's website to external services (Naver Booking, Naver Talk-Talk, KakaoTalk, YouTube, etc.) is governed by the privacy policies of those service operators. The Clinic bears no responsibility for such processing.
    • This Privacy Policy is interpreted on the basis of its Korean text. English and other foreign-language versions are provided for reference only.

17. ❑Article 17Amendments to This Privacy Policy

    This Privacy Policy may be revised in accordance with changes in applicable laws or internal policy. When revised, the effective date and content of changes will be announced in advance on our website. For material changes, notice is provided at least 7 days in advance (and at least 30 days in advance for changes unfavorable to user rights).