Obliv Clinic Seoul Origin Branch

Obliv Clinic Seoul Origin (hereinafter referred to as 'the Clinic') establishes and discloses the following privacy policy in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly in accordance with the Personal Information Protection Act.

Article 1 (Purpose of Processing Personal Information)

1. The Clinic processes personal information for the following purposes.

2. Provision of medical services: providing all services necessary for treatment, testing, appointment and appointment confirmation, diagnosis and treatment, etc.

3. Billing for medical expenses: receiving payment for treatment, billing and claims for health insurance benefits, etc.

4. Customer management: identity verification, delivery of notices, handling of complaints, surveys on service satisfaction, etc.

5. Compliance with legal obligations: issuance and retention of documentary evidence pursuant to the Medical Service Act, tax-related statutes, etc.

6. The personal information being processed shall not be used for any purpose other than those stated below, and if the purpose of use changes, the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act, will be taken.

Article 2 (Period of Processing and Retention of Personal Information)

1. The Clinic processes and retains personal information within the period of retention and use prescribed by law or within the period of retention and use consented to by the data subject at the time of collection.

   1. Medical records: 10 years

   2. Test result review report: 5 years

   3. Prescription: 2 years

2. Customer management and marketing (with consent): retained until the date of service termination or withdrawal of consent; however, if investigations or inquiries for violations of relevant laws are in progress, it will be retained until such investigations or inquiries are concluded.

Article 3 (Items of Personal Information Processed)

1. The Clinic collects the minimum necessary personal information required to provide services.

   1. Required items: name, resident registration number, address, telephone number, medical information (medical history, etc.)

   2. Optional items: email, whether to consent to marketing use

   3. Collection methods: registration form completed when visiting the clinic, website booking, telephone consultation, etc.

2. The Clinic does not currently operate an online automatic collection device, and if it is operated via a website, app, etc., the following items will be collected and specified.

   1. Cookie definition, items collected (IP, date and time of visit, usage history, etc.), purpose of collection, and method of refusal (browser settings)

Article 4 (Provision of Personal Information to Third Parties)

1. In principle, the Clinic processes the personal information of data subjects within the scope specified in Article 1 and does not process it beyond the original scope or provide it to third parties without prior consent from the data subject. However, exceptions apply in the following cases.

   1. Where separate consent has been obtained from the data subject

   2. Where there is a special provision in law or it is unavoidable to comply with legal obligations under relevant statutes

   3. In emergency situations, namely where the data subject or their legal representative is unable to express their intention or prior consent cannot be obtained due to an unknown address, and it is clearly recognised as necessary to protect the urgent life, body or property interests of the data subject or a third party

2. The Clinic provides personal information processing tasks as follows in order to ensure smooth business operations.

Article 6 (Rights, obligations, and exercise methods of the data subject and their legal representative)

1. Data subjects may at any time exercise rights such as requests to access, correct, delete, or suspend the processing of personal data held by our hospital.

2. The rights under paragraph 1 may be exercised in writing, by email, etc., and we will take action within 10 days (if unavoidable, an additional 10-day extension may be possible in accordance with relevant laws and regulations).

3. The patient or their guardian may request access to and copies of medical records, and our hospital will process such requests in accordance with the Medical Service Act.

4. In the case of children under the age of 14, the legal representative may exercise the rights on their behalf.

Article 7 (Destruction of personal data)

1. When personal data is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved, our hospital will destroy the relevant personal data without delay.

2. Even after the consent period agreed by the data subject has passed, medical records, etc. that must be retained under other laws, including the Medical Service Act, are safely managed in a separate database or storage location for the relevant period.

Article 8 (Measures to ensure the security of personal data)

Our hospital is taking the following measures to ensure the security of personal data.

Article 9 (Personal Information Manager)

This clinic is responsible for overseeing all matters concerning the processing of personal information, and has designated a person in charge of personal information protection as follows to handle complaints from data subjects and provide remedies for damage, etc.

1. Personal Information Protection Officer

   • Moon Ji-eun / Chief Director / Obliv Clinic Seoul Origin Branch

   • Contact: 02-6956-3438, official@oblivseoul.kr

2. Personal Information Protection Manager

   • Moon Ji-eun / Chief Director / Obliv Clinic Seoul Origin Branch

   • Contact: 02-6956-3438, official@oblivseoul.kr

Article 10 (Reporting and Remedy for Personal Information Infringement)

If a data subject receives a disputed processing result from this clinic regarding the exercise of rights under Article 38 of the Personal Information Protection Act, or is refused the exercise of those rights, or if their personal information has been infringed, they may contact the following organisations for lodging objections, dispute mediation or advice.

• Personal Information Protection Commission (without area code 182) ｜ www.pipc.go.kr

• Personal Information Infringement Report Centre (without area code 118) ｜ privacy.kisa.or.kr

• Personal Information Dispute Mediation Committee (1833-6972) ｜ www.kopico.go.kr

• Supreme Prosecutors' Office Cyber Investigation Division (without area code 1301) ｜ www.spo.go.kr

• National Police Agency Cyber Investigation Bureau (without area code 182) ｜ ecrm.cyber.go.kr

Article 11 (Changes to the Personal Information Processing Policy)

1. This personal information processing policy will apply from 20 April 2026, and if revised, prior notice will be given 30 days in advance through any space where notice can be posted, such as the clinic notice board or website, before implementation.

2. If there are additions, deletions or amendments to the contents of this policy in accordance with changes to laws, policies or security technology, we will announce the reason for and details of the change before implementing the revised personal information processing policy.

3. If a revision is made thereafter, we will ensure that the previous personal information processing policy can also be checked.