Article 1 (Purpose of Processing Personal Information)

The Clinic processes personal information for the following purposes. The personal information being processed will not be used for purposes other than those listed below, and prior consent will be obtained from the data subject in accordance with Article 18 of the Personal Information Protection Act if the purpose of use is changed.

• Provision of medical care and services: patient identification, appointment scheduling, examinations, prescriptions, tests, surgeries, procedures, treatment, payment and settlement of medical fees, preparation and retention of medical records, and consultations regarding medical services
• Administrative tasks related to medical care: claims for national health insurance and medical benefits, issuance of medical certificates and other documents, referrals and transfers between medical institutions, and processing of medical fee claims by insurance companies
• Website operation and grievance handling: identity verification of online consultation and appointment requesters, confirmation of intent, communication for fact-finding, and notification of processing results
• Marketing and advertising: provision of information on new services, events, and participation opportunities (only when separate consent has been obtained)

Article 2 (Items of Personal Information Collected and Methods of Collection)

① The Clinic collects personal information as follows.

1. Provision of medical care and services

• Required items: name, resident registration number, address, contact information (mobile phone number, telephone number), medical records (medical history, treatment records, test results, prescription records, surgical and procedural records, and other health and medical information)
• Optional items: email, occupation, guardian information (name, contact, relationship)
  ※ Resident registration numbers are collected and used in accordance with Articles 22 and 23 of the Medical Service Act, Article 96 of the National Health Insurance Act, and other relevant laws.

2. Online consultation and appointments through the website

• Required items: name, contact information, consultation content (including health and medical information voluntarily entered by the user for consultation)
• Optional items: email, date of birth, gender

3. Information automatically generated and collected during the use of internet services

• IP address, cookies, service usage records, access logs, visit dates and times, device information, and browser type

② Methods of collecting personal information

• Online consultation and appointments through the website, telephone, fax, email, written documents (medical questionnaires, consent forms, etc.), and direct entry during visits to the Clinic
• Provision from related institutions such as the Health Insurance Review and Assessment Service, the National Health Insurance Service, and other medical institutions through referrals and transfers
• Collection through automatic collection devices such as cookies

Article 3 (Retention and Use Period of Personal Information)

The Clinic processes and retains personal information within the retention and use period prescribed by laws or agreed upon with the data subject at the time of collection.
The processing and retention periods for each category of personal information are as follows.

1. Medical records and related documents (Article 15 of the Enforcement Rule of the Medical Service Act)

• Patient register: 5 years
• Medical records: 10 years
• Prescriptions: 2 years
• Surgical records: 10 years
• Test results and findings: 5 years
• Radiological images (including video) and findings: 5 years
• Nursing records: 5 years
• Midwifery records: 5 years
• Duplicates of medical certificates (medical certificates, death certificates, postmortem certificates, etc., to be kept separately): 3 years

2. Records related to medical fee claims (National Health Insurance Act, etc.)

• Documents on claims for medical care benefits: 5 years

3. Retention under the Act on Consumer Protection in Electronic Commerce

• Records on labeling and advertising: 6 months
• Records on contracts or withdrawal of subscriptions: 5 years
• Records on payment and supply of goods: 5 years
• Records on consumer complaints or dispute resolution: 3 years

4. Retention under the Protection of Communications Secrets Act

• Website visit records (logs, IP, etc.): 3 months

5. Online consultation and appointment information

• 1 year after completion of consultation/appointment processing (if treatment was provided, the retention period for medical records under Section 1 above shall apply)

Article 4 (Provision of Personal Information to Third Parties)

• ① The Clinic processes the personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides personal information to third parties only with the consent of the data subject, under specific provisions of law, or in cases falling under Articles 17 and 18 of the Personal Information Protection Act.
• ② The Clinic may provide personal information to third parties as follows.
  • National Health Insurance Service and Health Insurance Review and Assessment Service: claims, review, and payment of medical care benefits, and tasks related to health insurance (National Health Insurance Act) • Korea Disease Control and Prevention Agency, public health centers, and other health authorities: reporting of statutory infectious diseases (Infectious Disease Control and Prevention Act) • Insurance companies: provision of medical records necessary for insurance claims and review with the consent of the data subject • Medical institutions: provision of medical records upon consent of the data subject or in accordance with referrals and transfers under the Medical Service Act • Investigative agencies: when requested in accordance with the procedures and methods prescribed by law

Article 5 (Outsourcing of Personal Information Processing)

• ① The Clinic may outsource personal information processing tasks for smooth processing of personal information as follows.
  • Website operation, maintenance, and web hosting: outsourcing company (system management and server operation) • Sending text messages and notifications: outsourcing company (sending appointment confirmations and treatment notifications) • Payment processing: PG companies (approval and processing of credit card payments for medical fees)
• ② When entering into outsourcing contracts, the Clinic specifies in writing, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing personal information for purposes other than the outsourced work, technical and managerial protective measures, restrictions on subcontracting, supervision of the outsourced party, and liability for damages, and supervises whether the outsourced party processes personal information safely.
• ③ If the content of the outsourced work or the outsourced party changes, this Privacy Policy will be updated and disclosed without delay.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

• ① Data subjects may exercise the following rights related to personal information protection at any time.
  • Right to request access to personal information • Right to request correction in case of errors • Right to request deletion • Right to request suspension of processing
• ② The exercise of rights under Paragraph (1) may be made to the Clinic in writing, by email, or by fax, in accordance with Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the Clinic will take action without delay.
• ③ If a data subject requests the correction or deletion of an error in personal information, the Clinic will not use or provide such personal information until the correction or deletion is completed.
• ④ The exercise of rights under Paragraph (1) may be conducted through a legal representative or an authorized agent of the data subject. In this case, a power of attorney in accordance with Form No. 11 attached to the "Notice on Methods of Personal Information Processing" must be submitted.
• ⑤ The right to request access and the right to request suspension of processing may be restricted under Articles 35 (4) and 37 (2) of the Personal Information Protection Act. In particular, requests for deletion of information that is required by law to be retained, such as medical records under the Medical Service Act, may be restricted.
• ⑥ Requests for correction or deletion of personal information may not be made if the personal information is specified as a subject of collection in other laws.
• ⑦ When responding to requests for access, correction or deletion, or suspension of processing, the Clinic verifies whether the requester is the data subject in person or a legitimate representative.

Article 7 (Procedures and Methods for Destroying Personal Information)

• ① When personal information is no longer necessary due to the expiration of the retention period or achievement of the purpose of processing, the Clinic destroys it without delay.
• ② If personal information must continue to be retained under other laws despite the expiration of the agreed retention period or the achievement of the purpose of processing, the personal information is moved to a separate database or stored in a separate location
• ③ The procedures and methods for destroying personal information are as follows.
  • Destruction procedure: The Clinic identifies personal information for which a destruction reason has arisen and destroys it with the approval of the Clinic's Personal Information Protection Officer. • Destruction method: Personal information stored in electronic file format is deleted using technical methods that prevent the records from being reproduced. Personal information printed on paper is destroyed by shredding or incineration.

Article 8 (Measures for Ensuring the Security of Personal Information)

The Clinic takes the following measures to ensure the security of personal information.

• Administrative measures: establishment and implementation of an internal management plan, minimization of personnel handling personal information, and regular training
• Technical measures: management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, and installation of security programs
• Physical measures: access control to computer rooms, document storage rooms, etc.

Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

• ① The Clinic uses "cookies" that store and retrieve usage information from time to time to provide individualized customized services to users.
• ② Cookies are small pieces of information that the server (HTTP) used to operate the website sends to the user's computer browser, and they may be stored on the hard disk of the user's computer.
  • Purpose of using cookies: cookies are used to identify visit and usage patterns, popular search terms, and secure connection status of each service and website visited by the user, and to provide optimized information to the user. • Installation, operation, and refusal of cookies: users can refuse to store cookies by setting options in the Tools > Internet Options > Privacy menu at the top of the web browser. • If the user refuses to store cookies, there may be difficulties in using customized services.

Article 10 (Personal Information Protection Officer)

• ① The Clinic designates the following Personal Information Protection Officer to take overall responsibility for personal information processing and to handle complaints and remedies related to personal information processing.

Personal Information Protection Officer

• Name: Jeong Il-bong
• Position: Director (Daepyowonjang)
• Contact: 010-3569-1082
• Email: 5for5clinic@gmail.com

Personal Information Protection Department

• Department: Administration Team

• ② Data subjects may direct any inquiries, complaints, or remedy requests regarding personal information protection arising from the use of the Clinic's services to the Personal Information Protection Officer or the responsible department. The Clinic will respond to and process such inquiries without delay.

Article 11 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency Personal Information Infringement Report Center, etc., to seek remedies for personal information infringement. For other reports or counseling on personal information infringement, please contact the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
• National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)

Any person whose rights or interests have been infringed by a disposition or omission made by the head of a public agency in response to a request under Articles 35 (Access to Personal Information), 36 (Correction or Deletion of Personal Information), or 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

• Central Administrative Appeals Commission: 110 (no area code) (www.simpan.go.kr)

Article 12 (Changes to the Privacy Policy)

• ① This Privacy Policy shall apply from the effective date. Any additions, deletions, or amendments due to changes in laws or policies will be announced through the notice section of the Clinic's website at least 7 days prior to the effective date of such changes.
• ② This Policy shall take effect from June 1, 2026.