EDIV CLINIC (the “Clinic”) complies with applicable laws of the Republic of Korea, including the Personal Information Protection Act and the Medical Service Act, to protect the freedoms and rights of data subjects, and processes personal information lawfully and manages it securely.
In accordance with Article 30 of the Personal Information Protection Act, the Clinic establishes and publishes this Privacy Policy to explain the procedures and standards for processing and protecting personal information and to address related inquiries and complaints promptly and efficiently.
Article 1. Purposes of Processing Personal Information
The Clinic processes personal information for the following purposes.
Personal information is not used for purposes other than those listed below. If a purpose changes, the Clinic takes necessary measures, including obtaining separate consent, in accordance with the Personal Information Protection Act and other applicable laws.
1. Provision of Medical Services
Personal information is processed to provide and manage medical services, including appointments and registration, identity verification, diagnosis and treatment, examinations and prescriptions, medical record management, and billing, payment collection and refunds.
2. Website Consultation and Appointment Requests
Personal information is processed to receive consultation and appointment requests through the website, confirm their details, provide consultation and appointment guidance, and respond to inquiries.
3. Customer Inquiries and Complaints
Personal information is processed to facilitate communication, including confirming inquiries and complaints, verifying facts and notifying individuals of the outcome.
4. Website Usage Analysis and Service Improvement
The Clinic may process service usage information to analyze website usage, referral sources and service usage statistics, and to improve the website and service quality.
5. Marketing and Advertising
When using personal information to provide event information, Clinic news or advertising, the Clinic obtains separate, optional consent from the data subject.
Article 2. Categories of Personal Information Processed
The Clinic processes only the minimum personal information necessary to provide its services.
1. Personal Information Processed under Applicable Laws
The Clinic processes personal information specified by the Medical Service Act and other applicable laws to provide medical services and manage medical records.
- Full name
- Address
- Contact details
- Personal particulars, including resident registration number
- Medical information, including primary symptoms, diagnosis and treatment details
- Other health information necessary for medical care
Sensitive information such as health information, and unique identification information such as resident registration numbers, processed during medical care are handled only to the extent permitted by applicable laws.
2. Personal Information Collected for Website Consultation and Appointment Requests
With the data subject’s consent, the Clinic processes the following personal information for consultation and appointment requests through the website.
Required information
- Name
- Contact details
Depending on the consultation or appointment service, additional information entered by the user, such as consultation details and preferred appointment date and time, may be processed. When additional personal information is collected, the relevant screen explains the information collected and its purposes.
3. Personal Information Used for Marketing and Advertising
The Clinic may process the following personal information only if the data subject has separately consented to receive marketing information.
Optional information
- Name
- Contact details
Consent to receive marketing information does not affect access to medical care, consultation or appointment services, and may be withdrawn at any time.
4. Information That May Be Automatically Generated or Processed during Service Use
The following information may be automatically generated or processed when the website is used.
- Access logs
- IP address
- Cookies or similar online identifiers
- Browser and device information
- Date and time of visit
- Referral sources
- Website usage and click event information
The specific information processed may vary depending on the settings of the web analytics and website operation tools actually used by the Clinic.
Article 3. Personal Information of Children under 14
If the Clinic must process a child’s personal information on the basis of consent and the child is under 14, it obtains consent from the child’s legal representative in accordance with the Personal Information Protection Act and other applicable laws.
The legal representative may exercise rights including access, correction, deletion and suspension of processing in relation to the child’s personal information.
Article 4. Processing and Retention Periods
The Clinic processes and retains personal information for the period prescribed by applicable laws or the period disclosed to and agreed to by the data subject when the information is collected.
1. Personal Information Related to Medical Care
Medical records are retained as follows under the Medical Service Act and other applicable laws.
| Record type | Retention period |
|---|---|
| Patient register | 5 years |
| Medical records | 10 years |
| Prescriptions | 2 years |
| Surgical records | 10 years |
| Examination details and findings | 5 years |
| Radiographic images (including other imaging) and reports | 5 years |
| Nursing records | 5 years |
| Copies of medical certificates and similar documents | 3 years |
Where necessary for continuing medical care, the retention period may be extended to the extent permitted by applicable laws.
2. Website Consultation and Appointment Request Information
- Retention and use period: 3 years from the date of collection
If the data subject requests deletion or withdraws consent, the information is destroyed without delay, unless retention is required under applicable laws.
If consultation or an appointment leads to medical care and the information becomes part of medical records, retention periods prescribed by the Medical Service Act and other applicable laws may apply.
3. Customer Inquiry and Complaint Information
- Retention and use period: until the purpose of handling the inquiry or complaint is fulfilled
Where applicable laws require retention for a specified period, the information is retained for that period.
4. Personal Information for Marketing and Advertising
- Retention and use period: until the end of the period disclosed when marketing consent is obtained, or until the data subject withdraws consent
Article 5. Outsourcing of Personal Information Processing
To provide services smoothly, the Clinic outsources personal information processing to the following specialist provider.
| Service provider | Outsourced services |
|---|---|
| Mevops Co., Ltd. (Mevops) | Website consultation and appointment intake, and operation of the customer management system (Experdy) |
When entering an outsourcing agreement, the Clinic specifies in writing, in accordance with the Personal Information Protection Act, matters including the prohibition of processing beyond the outsourced purpose, security measures, sub-outsourcing, and the management, supervision and responsibilities of the service provider.
The Clinic also manages and supervises the service provider’s secure processing of personal information.
Changes to the outsourced services or service provider are disclosed through this Privacy Policy.
Article 6. Disclosure of Personal Information to Third Parties
The Clinic processes personal information within the purposes specified in Article 1 and, in principle, does not disclose it to third parties.
However, the Clinic may disclose personal information to third parties in cases permitted by applicable laws, including the following.
- Separate consent has been obtained from the data subject
- Specific legal provisions apply, or disclosure is necessary to comply with a legal obligation
- Legal requirements are met, such as those for treating an emergency patient
- Other cases permitted by the Personal Information Protection Act or other applicable laws
If the Clinic discloses personal information to a third party based on consent in the future, it will inform the data subject of the following and obtain the required consent.
- Recipient of the personal information
- Recipient’s purposes of use
- Categories of personal information disclosed
- Recipient’s retention and use period
- Right to refuse consent and any disadvantages resulting from refusal
Article 7. Overseas Transfers of Personal Information
When transferring personal information overseas, the Clinic complies with the Personal Information Protection Act and other applicable laws, and discloses the following through this Privacy Policy or other means, or obtains the necessary consent as required by law.
- Categories of personal information transferred overseas
- Destination country
- Timing and method of transfer
- Name and contact details of the recipient
- Recipient’s purposes of use
- Retention and use period
- Legal basis for the overseas transfer
- Methods and procedures for refusing the transfer, and the effects of refusal
For overseas transfers, the Clinic implements the security and protection measures required by applicable laws to protect personal information.
Article 8. Procedures and Methods for Destroying Personal Information
The Clinic destroys personal information without delay when it is no longer needed, including when the retention period expires or the processing purpose is fulfilled.
If applicable laws require continued retention even after the agreed retention period expires or the purpose is fulfilled, the information is stored separately from other personal information.
1. Destruction Procedures
The Clinic identifies personal information requiring destruction and destroys it in accordance with internal procedures.
2. Destruction Methods
- Personal information recorded or stored in electronic files is deleted using methods that prevent recovery or reproduction.
- Personal information recorded or stored on paper is destroyed by shredding, incineration or similar methods.
Article 9. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
Data subjects may request access, correction, deletion, suspension of processing or withdrawal of consent at any time.
Some rights may be restricted for reasons prescribed by applicable laws, including where another law requires retention of the information.
Rights may be exercised in writing, by email or by telephone. The Clinic takes the necessary measures without delay in accordance with applicable laws.
Data subjects may exercise rights through a legal representative or an authorized agent. The Clinic may verify the identity of the data subject or the authority of the representative.
Contact for Access and Other Personal Information Requests
- Contact person: Kim Sangwoo
- Telephone: 010-8217-0253
- Email: kim.r.sangwoo@gmail.com
Article 10. Personal Information Security Measures
The Clinic takes the measures required by applicable laws to prevent loss, theft, disclosure, forgery, alteration or damage and to ensure the security of personal information.
1. Administrative Measures
- Establishment and implementation of an internal personal information management plan
- Designation of personnel handling personal information and management of their permissions
- Employee training on personal information protection
2. Technical Measures
- Management of access permissions for personal information processing systems
- Access controls and other personal information safeguards
- Safeguards for secure storage and transmission of personal information
- Installation and management of security software
3. Physical Measures
- Access controls for locations where personal information and processing systems are kept
- Secure storage of documents and storage media
Article 11. Installation, Operation and Rejection of Automatic Data Collection Technologies
The Clinic may use automatic collection technologies such as cookies to analyze website usage and improve services.
Cookies are small pieces of information that a website server can send to and store in a user’s browser. They may be used to analyze website visits and service usage.
The Clinic may use cookies and similar technologies for the following purposes.
- Analysis of website visits and usage
- Analysis of referral sources and usage patterns
- Improvement of website functions and services
Users can allow or block cookie storage through their web browser settings.
Basic website use remains available when cookies are blocked, but some functions or services may be restricted.
The Clinic may use web analytics tools such as Google Analytics to analyze website usage.
When web analytics tools are used, this Privacy Policy reflects the services actually applied, how personal information is processed, and whether overseas transfers occur, as required by applicable laws.
Article 12. Installation and Operation of Fixed Video Surveillance Equipment
The Clinic installs and operates fixed video surveillance equipment (CCTV) as described below for patient and visitor safety, crime prevention, and the safety and management of its facilities.
1. Legal Basis and Purposes of Installation
Legal basis
- Article 25 of the Personal Information Protection Act and other applicable laws
Purposes of installation
- Crime prevention
- Patient and visitor safety
- Safety and management of Clinic facilities
2. Number of Cameras, Locations and Coverage
- Number of cameras: 22 in total
- Locations and coverage: Key areas in the Clinic where CCTV is installed, including the lobby, corridors, consultation rooms, treatment rooms and recovery rooms
3. Responsible Manager, Department and Authorized Personnel
- Responsible manager: Kim Sangwoo
- Department: EDIV CLINIC operations management
- Authorized person for video information access: Kim Sangwoo
Access to video information is restricted to the responsible manager and the minimum personnel necessary for their duties.
4. Recording Hours, Retention Period, Storage Location and Processing Methods
- Recording hours: 24 hours a day
- Retention period: Within 30 days of recording
- Storage location: Records storage room
- Processing methods: Video information is automatically or permanently deleted in a manner that prevents recovery when its retention period expires. Access, use beyond the original purpose, disclosure to third parties and destruction of video information are recorded and managed when they occur.
5. How and Where to Check Personal Video Information
- How to check: Contact the responsible manager in advance and follow the procedures for requesting access or confirmation of whether the information exists.
- Where to check: Records storage room
6. Handling Requests for Access to Personal Video Information
Data subjects may request access to, or confirmation of the existence of, video information in which they appear.
The Clinic verifies the requester’s identity and the legitimacy of the request and takes the necessary measures in accordance with applicable laws.
Where another person’s personal information or privacy may be affected, the Clinic may take safeguards such as making that person unidentifiable.
Access or confirmation may be restricted or refused for reasons permitted by applicable laws. In such cases, the Clinic informs the data subject of the reason.
7. Security Measures for Personal Video Information
The Clinic implements the following administrative, technical and physical safeguards for secure processing of personal video information.
- Restricting access to personal video information to the minimum necessary personnel
- Managing access permissions and passwords for CCTV systems and video information
- Keeping records of access to and use of personal video information
- Preventing use beyond the original purpose and unauthorized access
- Controlling entry and access to locations where video storage devices are installed
- Securely destroying video information after its retention period expires
The Clinic does not arbitrarily change camera coverage or use video information for purposes other than the installation purposes, and does not use CCTV audio recording functions.
Article 13. Personal Information Protection Officer
The Clinic appoints the following personal information protection officer to oversee personal information processing and to handle inquiries, complaints and remedies relating to such processing.
Personal Information Protection Officer
- Name: Kim Sangwoo
- Telephone: 010-8217-0253
- Email: kim.r.sangwoo@gmail.com
Data subjects may contact the personal information protection officer about any personal information protection inquiries, complaints or remedies arising from their use of the Clinic’s services.
The Clinic endeavors to respond to and handle inquiries promptly in accordance with applicable laws.
Article 14. Remedies for Infringement of Rights
Data subjects who need remedies or advice regarding personal information infringement may contact the following organizations.
Personal Information Infringement Report Center (Korea)
- Telephone: 118 (no area code within Korea)
- Website: privacy.kisa.or.kr
Personal Information Dispute Mediation Committee (Korea)
- Telephone: 1833-6972
- Website: www.kopico.go.kr
Supreme Prosecutors’ Office (Korea)
- Telephone: 1301 (no area code within Korea)
- Website: www.spo.go.kr
National Police Agency (Korea)
- Telephone: 182 (no area code within Korea)
- Website: ecrm.police.go.kr
These organizations are independent of the Clinic. Inquiries and complaints about the Clinic’s processing of personal information may be directed to its personal information protection officer.
Article 15. Changes to this Privacy Policy
This Privacy Policy takes effect on October 2, 2026.
Changes to this Privacy Policy are disclosed on the website in accordance with applicable laws.
- Publication date: October 2, 2026
- Effective date: October 2, 2026
