← Go back

316 Zone Co., Ltd. (hereinafter referred to as the "Company") complies with relevant laws and regulations, including the Personal Information Protection Act, and establishes and discloses this Privacy Policy (hereinafter referred to as the "Policy") to safely protect users' personal information.

Article 1 (Items of Personal Information Collected and Methods of Collection)

1. Items collected during membership registration

• Required: Email address, password (or social login identifier), nickname, date of birth, gender
• Select: Residence (City/Province), Profile Image

2. Items collected during identity verification (Optional)

• Identity verification information for age confirmation (CI/DI provided through mobile phone authentication, PASS, etc., name, date of birth, gender)

3. Items collected during the use of the service

• Chat text entered by the user, uploaded images, and files
• AI-generated answers, summaries, and reports
• Consultation records when using the hospital chatbot

4. Automatically Collected Items

• Connection IP, connection date and time, service usage records, device information (OS, browser, device identifier, etc.), cookies

5. Collection method

• Information directly entered or uploaded by the user during the service registration and usage process
• Information automatically generated and collected during the use of the service (cookies, logs, etc.)
• Information provided by the identity verification agency

※ Chat records of non-member users are processed only for the minimum period necessary to provide the service and are discarded immediately after the response is completed.

Article 2 (Processing of Sensitive Information)

① The Company may process the following items among sensitive information pursuant to Article 23 of the Personal Information Protection Act and Article 18 of the Enforcement Decree of the same Act upon obtaining separate consent.

• Health-related information: Information voluntarily entered by the user during the consultation process, such as history of procedures or surgeries, medication or allergy information, and physical condition.
• Photos and videos of body parts such as the face

② Sensitive information is stored and managed separately from other information, and additional security measures, such as encryption, are applied.

③ You have the right to refuse consent to the processing of sensitive information, and if you refuse, related functions (e.g., photo-based counseling) may be restricted.

Article 3 (Purpose of Collection and Use of Personal Information)

1. Member identification and management, identity verification, and verification of age 19 or older
2. Provision of AI chatbot consultation services and hospital chatbot services
3. Responding to user inquiries, customer support, dispute resolution
4. Service operation, prevention of fraudulent use, security incident response
5. Service improvement, new feature development, statistical analysis
6. Training for AI model quality improvement (within the scope where the user has not consented or opted out)
7. Provision of marketing and event information based on the user's prior consent
8. Fulfillment of legal obligations

Article 4 (Retention and Use Period and Destruction of Personal Information)

① The Company destroys personal information without delay once the purpose of its collection and use has been achieved. However, the following information is retained for the specified period.

• Records regarding contracts or withdrawal of subscription, etc.: 5 years (Electronic Commerce Act)
• Records regarding payment settlement and supply of goods, etc.: 5 years (Electronic Commerce Act)
• Records regarding consumer complaints or dispute resolution: 3 years (Electronic Commerce Act)
• Records regarding labeling and advertising: 6 months (Electronic Commerce Act)
• Login records/access records: 1 year (Communications Secret Protection Act/Personal Information Safety Measures Standards)
• Identification information for the purpose of preventing fraudulent use: 1 year

② The retention period for chat records and uploaded files is as follows.

• Member's chat history: Until membership withdrawal or user's request for deletion (up to 12 months after upload)
• Uploaded Images/Files: Automatically and permanently deleted within [1 month] of upload.
• Non-member chat history: Deleted immediately after response is completed

③ The Company may separately store pseudonymized or anonymized data for AI model training in accordance with the user's prior consent, and prohibits the combination or re-identification of pseudonymized information. Users may opt out of the use of AI training at any time.

④ Method of destruction: Information in the form of electronic files is deleted using technical methods that make recovery and reproduction impossible, and paper documents are shredded or incinerated.

Article 5 (Provision of Personal Information to Third Parties)

① The Company processes users' personal information only within the scope of the purposes specified in this Policy and provides it to third parties only with the user's prior consent or when there is a basis in relevant laws and regulations.

② It may be provided to a third party as follows, subject to the user's consent.

• Recipient: [List of affiliated medical institutions / Notification will be made separately]
• Purpose of provision: Consultation referral and reservation support based on user requests
• Items provided: Nickname, consultation summary, procedure/symptom information entered by the user
• Retention and Usage Period: Until the purpose of processing consultations and appointments at affiliated medical institutions is achieved.
• Right to Refuse and Consequences of Refuse: Users may refuse consent, and refusal will restrict the use of services linked to the relevant affiliated medical institution.

③ In cases where information is transferred to affiliated medical institutions, the Company shall notify the user of the items and purpose of the transfer immediately prior to the transfer and obtain the user's explicit consent.

Article 6 (Outsourcing of Personal Information Processing)

① The Company may entrust personal information processing tasks as follows to ensure the smooth provision of services.

• [Cloud Infrastructure]: Amazon Web Services, etc. — Data storage and processing (Outsourcing countries: [USA, etc.])
• [Large-scale Language Model (LLM) APIs]: OpenAI, Anthropic, etc. — AI Response Generation (Entrusted Country: [USA])
• [Identity Verification]: [PASS, Kakao, NICE, etc.] — Verification of age 19 or older
• [Customer Support]: [ChannelTalk, KakaoTalk Channel, etc.] — Responding to user inquiries
• [Payment Processing]: Separate notification if applicable

② When concluding a consignment contract, the Company specifies matters concerning the protection of personal information in accordance with Article 26 of the Personal Information Protection Act and manages and supervises the trustee to ensure compliance therewith.

③ Any changes to the content of the entrusted work or the trustee will be disclosed through this policy.

Article 7 (Transfer of Personal Information Abroad)

① The Company transfers personal information overseas as follows for the purpose of calling LLM APIs and using cloud infrastructure.

• Items being transferred: Chat input text (after pseudonymization and masking), supplementary information required to generate responses
• Relocated to: [USA, etc.]
• Previous Date/Time/Method: Transmitted via encrypted communication (HTTPS/TLS) at the time the user inputs the chat.
• Recipients: OpenAI, Anthropic, Amazon Web Services, etc. (Main contact information: Publicly available on each company's website)
• Purpose of use: AI response generation, data storage, and processing
• Retention and Usage Period: Immediately after response generation or for a period determined by the trustee's own policy

② Users may refuse consent to overseas transfer, and if refused, the use of some functions may be restricted.

Article 8 (Matters concerning automated decision-making and artificial intelligence)

① The Company provides responses to users by utilizing AI models, and this may constitute an automated decision pursuant to Article 37-2 of the Personal Information Protection Act.

② Users may exercise the following rights regarding automated decisions.

• Right to request an explanation of automated decisions
• The right to reject automated decisions or request a human review (particularly in cases that significantly affect the user's rights and obligations, such as procedure recommendations or hospital matching)
• Right to request review and correction of automated decision results

③ How to exercise your rights: You can apply through the Customer Center (Email [Address] / KakaoTalk Channel [Channel Name]).

Article 9 (Rights of Users and Legal Representatives)

① Users may exercise the following rights at any time.

1. Request for access to personal information
2. Request for Correction or Deletion of Personal Information
3. Request to suspend personal information processing
4. Withdrawal of consent for the processing of personal information
5. Withdraw membership

② You may request the exercise of your rights through the Company’s Customer Center or the settings menu within the service, and the Company will take necessary measures without delay in accordance with relevant laws and regulations.

③ Users must be at least 19 years of age to use this service, so in principle, the consent procedure by a legal representative does not apply; however, if it is confirmed that a minor is using the service, the rights of a legal representative may be exercised.

Article 10 (Measures to Ensure the Safety of Personal Information)

The Company implements the following measures in accordance with Article 29 of the Personal Information Protection Act and the Notification on Standards for Measures to Ensure the Safety of Personal Information.

• Administrative measures: Establishment and implementation of internal management plans, regular personal information protection training
• Technical measures: Management of access rights to personal information processing systems, operation of access control systems, encrypted storage of unique identification information, passwords, and sensitive information, installation and updating of security programs, retention and inspection of access logs (minimum 1 year)
• Physical measures: Access control to computer rooms and archives
• Separate storage and differentiated access permissions for AI training data, masking of PII (Personally Identifiable Information) when calling LLM APIs

Article 11 (Use of Cookies)

① The Company may use cookies to provide customized services to users.

② Users may refuse the storage of cookies by changing their web browser settings, and refusal may result in restrictions on the use of some services.

③ The company obtains consent by distinguishing between essential cookies, analytics cookies, and advertising cookies.

Article 12 (Personal Information Protection Officer and Contact Information)

The Company assumes overall responsibility for the processing of personal information and designates a Personal Information Protection Officer as follows to handle user complaints and provide relief for damages related to the processing of personal information.

• Chief Privacy Officer: Ji-in Kim (CEO)
• Contact: privacy@sc301.co.kr, 1666-1301

For reports or consultations regarding other personal information infringements, you can contact the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (privacy.kisa.or.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cybercrime Investigation Division: 1301 (spo.go.kr)
• National Police Agency Cyber ​​Bureau: 182 (ecrm.cyber.go.kr)

Article 13 (Change of Policy)

① This policy applies from the effective date and may be modified in accordance with changes in laws or the company's policies.

② In the event of changes, notice will be given through announcements within the service at least 7 days prior to implementation (30 days prior in the case of changes unfavorable to users).