1. Items of personal information collected and collection method
When you sign up for membership, we collect only the minimum personal information necessary to use our services. The information collected for your use of our services includes both required and optional information. However, opting out of optional information, such as email subscription preferences, does not restrict your use of our services.
A. Items collected during treatment
- Required items: Name (Korean), Address, Contact Information
- Health Information: Personal health information, such as medical history and family history, that medical staff deem necessary for the provision of medical services.
※ According to the Medical Act, unique identification information and medical information must be retained.
(Separate consent is not required for the collection of medical information.)
B. Items collected when registering as a member on the website
- Required items: ID, password, name, email
- Optional: Contact information (phone number, mobile number)
- Sensitive Information: Medical history, surgical history, areas of surgical interest
- The following information may be automatically generated and collected without the user's consent during the process of using the service or processing service provision tasks. (Service usage records, access logs, cookies, access IP information)
- Identity Verification (Mobile Phone Verification/i-PIN Verification): Name, identity verification value, i-PIN number for i-PIN members, date of birth, gender, ID, password, contact information (email address, mobile phone number), legal guardian information for those under 14 years of age, registration verification information
D. Items collected when paying medical expenses
- When paying by credit card: Card company name, card number, and other card payment approval information
B. Personal information collection method
- We collect personal information in the following ways:
Website (membership registration, real-time consultation, online reservation, online consultation, etc.), written form, fax, phone, email
2. Purpose of collection and use of personal information
This institution utilizes the collected personal information for the following purposes. All information provided by the user will not be used for any purpose other than those necessary for the purposes listed below, and prior consent will be obtained if the purpose of use changes.
- Medical consultations/examinations/appointment inquiries and identity verification procedures for medical treatment - Services for diagnosis and treatment
- Administrative services such as billing, payment, and refunds
- Sending medical bills, statements, and certificates, as well as sending medications/supplies and results
- Provision of medical information to other medical institutions that received referrals and transfers
- Securing communication channels to facilitate the delivery of notices, handling of complaints/grievances, etc.
- Materials for processing online consultation responses
- Provides information on new services and events
- Quality management of medical care, legal and administrative responses and measures for the operation of the hospital
- Minimum analytical data required for education and research
- Guide to Medical Information, Academic Information, and Hospital Information
- Use of reference materials for the provision of smooth services during consultation and treatment
- Collection of information for consumers pursuant to Article 52 of the Framework Act on Consumers
3. Provision and sharing of personal information
Except where your consent has been obtained or as required by relevant laws and regulations, this institution will not, under any circumstances, use your personal information beyond the scope notified in the "Purpose of Collection and Use of Personal Information" or provide it to other individuals, companies, or organizations.
However, the following cases are exceptions.
- Cases where users have consented to disclosure in advance
- In accordance with the provisions of laws and regulations, or when there is a request from the investigation agency in accordance with the procedures and methods stipulated in the laws for the purpose of investigation
- Cases where data is processed and provided in a form that prevents the identification of specific individuals, as necessary for statistical compilation, academic research, or market surveys.
4. Retention and use period of personal information
When the purpose of collecting or providing personal information has been achieved, we will destroy your personal information without delay.
a. In the case of membership registration information: When a member withdraws or is expelled, or when one year has elapsed since the last login date (Article 29 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. and Article 16 of the Enforcement Decree of the same Act)
B. In cases where collection was made for the purpose of surveys, events, etc.: When such surveys, events, etc. have concluded
C. In cases where collected for the purpose of medical treatment: Retained in accordance with the period specified in Article 15 of the Enforcement Rules of the Medical Service Act, "Preservation of Records Related to Medical Treatment" (Patient Register: 5 years, Medical Record: 10 years), (Items to be retained: Name, Address, Medical Information)
D. Records regarding consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)
E. Records regarding the collection, processing, and use, etc. of credit information: 3 years (Credit Information Use and Protection Act)
F. Records regarding identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.)
G. Records regarding visits: 3 months (Communications Secret Protection Act)
※ However, even if the purpose of collection or the purpose for which the information was received has been achieved, we may retain your personal information if there is a need to preserve it in accordance with the provisions of laws and regulations, such as the Commercial Act.
5. Procedure and method for destroying personal information
This center destroys personal information immediately after the purpose of collection and use has been achieved. The destruction procedures and methods are as follows.
A. Destruction Procedure
Information entered by users for purposes such as membership registration will be immediately destroyed by the destruction method described below once the purpose has been achieved.
B. Destruction period
If the retention period for personal information has expired, the user's personal information is destroyed within 5 days from the end of the retention period; if the personal information becomes unnecessary due to the achievement of the purpose of processing the personal information, the discontinuation of the relevant service, or the termination of the business, the personal information is destroyed within 5 days from the date it is recognized that the processing of the personal information is unnecessary.
C. Method of destruction
Personal information stored in electronic files is deleted using technical methods that render the records unrecoverable. Personal information printed on paper is destroyed by shredding or incineration.
6. Rights of users and legal representatives and methods of exercising them
This institution faithfully responds to and processes customer requests for access to, correction of, or deletion of personal information without delay. To protect personal information, we do not provide procedures for accessing, correcting, or deleting personal information via methods other than in-person visits, such as telephone, mail, or fax.
A. Access to Personal Information
Customers may visit our clinic to request access to their personal information, and we will respond promptly.
B. Correction/Deletion of Personal Information
- If a customer requests the correction or deletion of personal information, or if it is determined that such correction or deletion is necessary—such as when errors are found in the personal information—the Institute will correct or delete the information without delay. The Institute may request supporting documents necessary to verify the facts regarding the correction or deletion. The Institute will not use or provide the relevant personal information until the correction is completed. Furthermore, if incorrect personal information has already been provided to a third party, the Institute will notify the third party of the correction results without delay to ensure that the correction is made.
- When a customer requests access to, correction of, or deletion of their personal information, we verify their identity by requiring them to present identification documents such as a resident registration card, passport, or driver's license.
- If a customer's representative visits to request access, correction, or deletion, we verify whether they are a legitimate representative by checking the customer's power of attorney and consent form, as well as the representative's identification documents.
- If there is a legitimate reason to refuse access, correction, or deletion of all or part of personal information, the Company will notify the customer and explain the reason.
- Cases where access to and correction of personal information may be restricted
- Cases where there is a significant risk of harm to the life, body, property, or rights and interests of the person themselves or a third party
- Cases where there is a risk of causing significant disruption to the business of the service provider concerned
- Cases of violation of laws, etc.
Membership registration for children under the age of 14 (hereinafter referred to as "children") is conducted through a separate form, and the consent of a legal representative is strictly obtained when collecting personal information.
- In order to obtain the consent of a legal representative, this institution collects minimal information from children, such as the legal representative's name and contact information, and obtains such consent in accordance with the methods stipulated in the Privacy Policy.
Users and their legal representatives may exercise their rights regarding personal information by contacting the Hospital via the Internet, telephone, written correspondence, etc., and the Hospital will take necessary measures without delay.
※ Personal information that is required to be retained by law cannot be modified or deleted within the retention period, even upon request.
7. How to Withdraw Consent • How to Withdraw Membership
You may withdraw your consent to the collection, use, and provision of personal information at any time. To withdraw your consent (withdraw membership), you can either click on "Withdraw Consent (Withdraw Membership)" on the website, complete the identity verification process, and withdraw your consent directly, or contact the Personal Information Manager. We will take necessary measures, such as destroying your personal information, without delay.
8. Matters concerning the installation/operation of automatic personal information collection devices and their refusal
This institution uses 'cookies' to store and frequently retrieve user information in order to provide specialized, customized services to users. Cookies are small pieces of information that a website sends to a user's computer web browser, and they may also be stored on the PC's hard disk.
A. Purpose of using cookies
Cookies identify the user's computer but do not identify individual users. The Institute uses these cookies to analyze visit and usage patterns, user scale, and other factors for each service visited by users, enabling the creation of more convenient services.
Users can choose whether or not to use cookies by adjusting their web browser options. That is, they can accept all cookies, be notified when a cookie is installed, or reject all cookies.
However, users must allow cookies to use the service after accessing this institution and logging in.
B. Cookie installation/operation and rejection
Users have the option to control cookie installation. Therefore, users can configure their web browser options to allow all cookies, be prompted for confirmation whenever a cookie is saved, or refuse the storage of all cookies.
- To refuse cookie settings, users can select options in their web browser to allow all cookies, be prompted for confirmation whenever a cookie is saved, or refuse the storage of all cookies.
- Example of setup method
• For Internet Explorer: Tools menu at the top of the web browser > Internet Options > Privacy > Settings
• For Chrome: Settings menu on the right side of the web browser > Show advanced settings at the bottom of the screen > Content settings button under Privacy > Cookies
However, if you refuse to store cookies, you may experience difficulties using some of our services that require a login.
9. Matters concerning measures to ensure the security of personal information
This institution is taking the following technical and administrative measures to ensure the safety of customers' personal information and prevent its loss, theft, leakage, alteration, or damage.
[Minimization and Training of Employees Handling Personal Information]
We are minimizing the designation of personal information handlers and providing regular training.
[Conduct regular internal inspections]
To ensure the security of personal information handling, we conduct regular internal inspections at least once a year.
[Establishment and Implementation of Internal Management Plan]
We have established and implemented an internal management plan for safe handling of personal information.
[Encryption of Personal Information]
Among the user's personal information, passwords are stored and managed in an encrypted form so that only the user can access them. For important data, separate security features such as file and transmission data encryption are used.
[Technical measures against hacking, etc.]
To prevent the leakage and damage of personal information caused by hacking or computer viruses, we install security programs, perform periodic updates and checks, install systems in areas where external access is controlled, and monitor and block access technically and physically.
[Restriction on Access to Personal Information]
We are taking necessary measures to control access to personal information by granting, changing, and deleting access rights to the database system that processes personal information, and we are controlling unauthorized access from outside by using an intrusion prevention system.
[Access Control for Unauthorized Personnel]
We have established and are operating access control procedures for the physical storage location of the personal information system that stores personal information.
10. Matters concerning the operation/management of video information processing equipment
This institution operates and manages image information processing devices as follows.
[Basis for Installation and Purpose of Installation]
Patient and facility safety, fire and crime prevention
[Number of units installed, installation location, and shooting range]
Installation location and shooting range: Lobby, hallway, etc.
[Manager]
Manager: Shin Dong-jin
[Video Information Recording Time, Processing Method]
Shooting time: 24 hours
Processing Method: We record and manage matters regarding requests for the use of personal video information for purposes other than its intended use, provision to third parties, destruction, and viewing, and upon the expiration of the retention period, permanently delete the data using a method that makes restoration impossible (in the case of printed materials, shredding or incineration).
[Measures regarding data subjects' requests for access to video information, etc.]
You may request access to or confirmation of the existence of your personal video information from the operator of the video information processing device at any time. However, this is limited to personal video information in which you are filmed and personal video information that is clearly necessary for the urgent benefit of the data subject's life, body, or property.
Notwithstanding a data subject's request for access, etc., the request for access to personal video information may be refused in the following cases.
- Cases where personal video information is destroyed after the retention period has expired
- Cases where there are other legitimate grounds to refuse the data subject's request for access, etc.
[Technical, administrative, and physical measures for the protection of video information]
The video information processed by this institution is securely managed through measures such as encryption. Furthermore, as an administrative measure for the protection of personal video information, this institution grants differentiated access rights. To prevent falsification or alteration of personal video information, we record and manage the creation date and time of the information, as well as the purpose of viewing, the viewer, and the date and time of viewing upon access. In addition, we have installed locking devices for the safe physical storage of personal video information.
11. Personal Information Management Officer
To protect your personal information and handle complaints related to personal information, we have appointed a personal information manager as follows.
[Personal Information Manager]
Manager: Shin Dong-jin
Person in Charge: Shin Dong-jin
Affiliation: SC301 Member
Position: Chief Director
Phone number: 1666-1301
You may report all complaints related to personal information protection arising from your use of our services to the Chief Privacy Officer.
This institution will provide prompt and sufficient responses to user reports.
If you need to report or consult about other personal information infringements, please contact the organizations below.
Personal Dispute Mediation Committee (http://www.1336.or.kr / 1336)
Supreme Prosecutors' Office Cybercrime Investigation Division (http://www.spo.go.kr / (02) 3480-3573)
National Police Agency Cyber Terrorism Response Center (http://www.ctrc.go.kr / (02) 392-0330)
12. Obligation to notify of policy changes
This Privacy Policy was enacted on August 31, 2015. In the event of any additions, deletions, or modifications to the content due to changes in laws, policies, or security technologies, we will announce the reasons for the changes and the details on the hospital's website at least 7 days prior to the implementation of the revised Privacy Policy.
13. Entrustment of handling of personal information
To improve services, members' personal information is collected and analyzed by entrusted companies, and in accordance with relevant laws and regulations, we stipulate necessary provisions in consignment contracts to ensure that personal information is safely managed.
- Matters regarding the trustee, scope of trusteeship, scope of shared information, etc., will be posted via email, telephone, or the website.
- In the case of consignment contracts, provisions regarding the service provider's compliance with instructions related to personal information protection, confidentiality of personal information, and prohibition of provision to third parties are stipulated, and the contract contents are stored electronically.
The Hospital entrusts personal information as follows to fulfill its services, and in accordance with relevant laws and regulations, stipulates necessary provisions in entrustment contracts to ensure the safe management of personal information. The Hospital's entrusted personal information processing agencies and entrusted tasks are as follows.
| Consignment company |
Consignment work |
item |
Retention and use period |
| InfoNet |
Server hosting |
Website member information, cookies, and other data |
Until the termination of the consignment contract |
The hospital stipulates compliance with personal information protection laws, confidentiality of personal information, prohibition of provision to third parties, the duration of entrustment, and the obligation to return or destroy personal information after processing is completed through entrustment agreements, etc., and manages to ensure compliance with these.
Announcement date: March 2020, 08
Effective date: March 2020, 08
