Privacy Policy

Article 1 (Purposes of processing personal information)

1. The Clinic processes personal information for the following purposes.
2. Provision of medical services: consultations, examinations, appointments and appointment confirmation, and all services needed for diagnosis and treatment
3. Billing: payment for treatment, settlement, and health-insurance benefit claims
4. Patient care: identity verification, delivery of notices, handling of complaints, and service-satisfaction surveys
5. Legal obligations: issuing and retaining supporting documents under the Medical Service Act, tax legislation and other laws
6. Advertising information: sending advertising information such as events and treatment information (only to those who have agreed to receive it)
7. Personal information being processed is not used for any purpose other than those above; if the purpose of use changes, the Clinic takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Article 2 (Processing and retention periods)

1. The Clinic processes and retains personal information within the retention and use period prescribed by law, or the period consented to by the data subject at the time of collection. Medical records and related documents are kept for the following periods under Article 22 (2) of the Medical Service Act and Article 15 (1) of its Enforcement Rule.
   1. Medical records: 10 years
   2. Examination details and findings records: 5 years
   3. Prescriptions: 2 years
   4. Patient register: 5 years
   5. Surgical records: 10 years
   6. Radiographs (including imaging media) and their reports: 5 years
   7. Nursing records: 5 years
   8. Duplicates of medical certificates and similar documents: 3 years
2. Patient care and marketing (where consented): retained until the end of service use or the withdrawal of consent; however, where an investigation or inquiry into a violation of the relevant laws is under way, retained until that investigation or inquiry ends.

Article 3 (Items of personal information processed)

1. The Clinic collects only the minimum personal information needed to provide its services. The personal information processed without the data subject’s consent as permitted by law, and the personal information processed with the data subject’s consent, are as follows.
   1. Items processed without consent as permitted by law: name, resident registration number, address, telephone number, medical information (including medical history) (legal basis: Article 22 (1) of the Medical Service Act and Article 14 (1) of its Enforcement Rule; Article 42-2, subparagraph 3-6 of the Enforcement Decree of the Medical Service Act; Article 15 (1) 2, Article 23 (1) 2 and Article 24-2 (1) 1 of the Personal Information Protection Act)
   2. Items processed with the data subject’s consent (optional): email address, consent to marketing use (legal basis: Article 15 (1) 1 of the Personal Information Protection Act)
   3. How it is collected: the registration form completed at the clinic, website bookings, telephone consultations, etc.
2. The Clinic’s website may use cookies, which store and retrieve usage information; in this process, information such as your IP address, the date and time of your visits and usage records may be generated and collected automatically.
   1. How to refuse: you can refuse the storage of cookies in your web browser settings (Settings > Privacy > Block cookies); in that case, the use of some services may be restricted.

Article 4 (Provision to third parties)

1. In principle, the Clinic processes personal information within the scope set out in Article 1, and does not process it beyond that scope or provide it to third parties without the data subject’s prior consent, except in the following cases.
   1. Where separate consent has been obtained from the data subject
   2. Where a specific legal provision applies, or it is unavoidable in order to comply with a legal obligation
   3. Where it is clearly deemed necessary for the urgent protection of the life, body or property of the data subject or a third party
2. The Clinic provides personal information to third parties as follows.

Article 5 (Outsourcing of processing)

For smooth operations, the Clinic outsources personal-information processing tasks as follows.

Article 6 (Rights of data subjects and legal representatives, and how to exercise them)

1. Data subjects may at any time exercise their rights against the Clinic, such as requesting access to, correction or deletion of, or suspension of processing of their personal information, and withdrawing consent.
2. The rights under paragraph 1 may be exercised in writing, by telephone, by email or by other means, and the Clinic acts within 10 days of receiving a request and informs you of the result. However, where there is a justifiable reason, access may be postponed after you are told the reason, and access will be granted without delay once that reason no longer applies.
3. Patients or their guardians may request access to, and copies of, medical records and related documents, which the Clinic handles in accordance with the Medical Service Act.
4. For children under 14, a legal representative may exercise these rights on their behalf.

Article 7 (Destruction of personal information)

1. When personal information is no longer needed — the retention period has passed, or the purpose of processing has been achieved — the Clinic destroys it without delay.
2. Medical records and other documents that other laws such as the Medical Service Act require to be kept, even after the period consented to by the data subject has passed, are stored securely for the required period in a separate database or storage location, apart from other personal information. The legal basis for retention and the items retained are as set out in Article 2, paragraph 1 and Article 3, paragraph 1, item 1.
3. Destruction procedure: the Clinic identifies the personal information for which a reason for destruction has arisen and destroys it with the approval of the Personal Information Protection Officer.
4. Destruction method: information in electronic files is permanently deleted in a way that cannot be restored, and paper documents and other records are shredded or incinerated.

Article 8 (Measures to secure personal information)

To keep personal information secure, the Clinic takes the following measures.

Article 9 (Personal Information Protection Officer)

The Clinic designates a Personal Information Protection Officer, as below, to take overall responsibility for the processing of personal information and to handle data subjects’ complaints and remedies for damage.

1. Personal Information Protection Officer
   • Park Young-jin / Chief Director / Obliv Clinic Seoul Origin Branch
   • Contact: 02-6956-3438, official@oblivseoul.kr
2. Personal Information Protection Manager
   • Park Young-jin / Chief Director / Obliv Clinic Seoul Origin Branch
   • Contact: 02-6956-3438, official@oblivseoul.kr

Article 10 (Reporting and remedies for infringement)

If, in exercising your rights under Article 38 of the Personal Information Protection Act, you receive a decision from the Clinic that you object to or your request is refused, or if your personal information has been infringed, you can contact the bodies below to file an objection, seek dispute mediation or get advice.

• Personal Information Infringement Report Centre (118, no area code) ｜ privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee (1833-6972, no area code) ｜ www.kopico.go.kr
• Supreme Prosecutors’ Office Cyber Investigation Division (1301, no area code) ｜ www.spo.go.kr
• National Police Agency Cyber Investigation Bureau (182, no area code) ｜ ecrm.police.go.kr

Article 11 (Changes to this privacy policy)

1. This privacy policy applies from 23 October 2026. If it is revised, notice will be given 30 days before the changes take effect, on the clinic noticeboard, the website or another accessible channel.
2. Where content is added, deleted or modified in this privacy policy because of changes in laws, policies or security technology, the Clinic will announce the reasons for and details of the changes before the revised privacy policy takes effect.
3. When this policy is revised in the future, the Clinic will make the previous versions of the privacy policy available for you to check.
4. The previous privacy policy (applied 20 April 2026 – 22 October 2026) is available on the Clinic’s website.