Privacy Policy
Kleam Clinic Hongdae (the “Clinic”) complies with the Personal Information Protection Act and other relevant laws, and establishes this Privacy Policy as follows to process the personal information of data subjects safely.
The Clinic's website does not offer membership registration or login. The website processes only the information received through the online consultation and appointment request form.
- Personal information collected and how it is collected
- Purposes of use
- Retention and use period
- Provision to third parties
- Outsourcing of processing
- Transfer of personal information overseas
- Destruction procedures and methods
- Rights of data subjects and how to exercise them
- Personal information of children under 14
- Installation, operation and refusal of automatic collection tools (cookies, etc.)
- Security measures
- Chief Privacy Officer
- Remedies for infringement of rights
- Changes to this Privacy Policy
1. Personal information collected and how it is collected
Website consultation and appointment requests
| Category | Items |
|---|---|
| Required | Name, mobile phone number |
| Optional | Preferred appointment date and time, requests (content you enter) |
| Automatically generated | Branch and language of the request, page of the request and treatment of interest, referral source (previous page address, advertising campaign information), date and time of consent to the collection and use of personal information |
We ask that you not enter sensitive information such as your health condition in the requests field. You do not need to enter information that is not required to answer your inquiry.
Information automatically generated when you visit the website
Device and browser information, date and time of visit, pages visited, and IP address. This is collected through a visitor analytics tool (Google Analytics) and server access logs, and is used for statistics in a form that does not identify individuals.
When you visit the Clinic for treatment
| Category | Items |
|---|---|
| Required | Name, date of birth, resident registration number (for foreign nationals, alien registration number or passport number), contact information |
| Optional | Address, email |
| Health information | Medical history, family history and other information the medical team deems necessary for treatment |
Unique identification information such as resident registration numbers and health information collected during treatment are processed in accordance with the Medical Service Act and other laws.
Collection methods: website consultation and appointment request form, phone and messenger consultations, registration documents at the time of visit
2. Purposes of use
- Contacting you to confirm consultation and appointment requests, answer inquiries, and confirm, change or cancel appointments
- Providing medical services, billing and collecting medical fees, and managing medical records
- Smooth communication, including handling complaints
- Improving the website through visitor statistics (in a form that does not identify individuals)
Information received through website consultation and appointment requests is not used for purposes other than those above, such as event or advertising notices. If the purpose of use changes, we will obtain separate consent in advance.
3. Retention and use period
| Category | Retention period |
|---|---|
| Consultation and appointment request information | 1 year after the consultation or appointment is processed (destroyed without delay if the data subject requests deletion) |
| Medical records | Period prescribed in Article 15 of the Enforcement Rule of the Medical Service Act (e.g., 10 years for medical charts) |
| Website access logs | 3 months (Protection of Communications Secrets Act) |
| Records of consumer complaints or dispute resolution | 3 years (Act on the Consumer Protection in Electronic Commerce) |
The website's submission server does not store request information; it forwards it directly to the Clinic's consultation management system. Only requests that fail to be delivered are stored temporarily for resending, and they are deleted immediately once delivered.
4. Provision to third parties
The Clinic processes personal information only within the scope of the purposes in Section 1 and does not provide it to third parties except in the following cases.
- When the data subject has given separate consent
- When submitting medical records to the Health Insurance Review & Assessment Service or other bodies to claim medical care benefits under the National Health Insurance Act
- When required by special provisions of law, or when requested by an investigative agency in accordance with the procedures and methods prescribed by law
5. Outsourcing of processing
The Clinic outsources personal information processing as follows for smooth operations.
| Contractor | Outsourced work |
|---|---|
| Cloudflare, Inc. | Website operation, transmission of consultation and appointment request forms |
| [To be confirmed: name of consultation management system (CRM) provider] | Storage and management of consultation and appointment request information |
| Google LLC | Website visitor analytics (Google Analytics) |
When entering into outsourcing contracts, we specify and supervise the contractor's responsibilities and obligations so that personal information is managed safely. If a contractor or outsourced task changes, we will notify you through this policy.
6. Transfer of personal information overseas
Personal information is transferred overseas as follows for website operation and visitor statistics. If you do not wish your information to be transferred, you may request a consultation by phone instead of using the website form. You can refuse the collection of visitor statistics using the methods described in Section 10.
| Recipient (contact) | Country | Items transferred | Time and method of transfer | Purpose of use | Retention period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States and other countries where Cloudflare data centers are located | Consultation and appointment request information, access logs | Transmitted over the network at the time of request or access | Website operation, transmission of request forms | Deleted once transmission is complete (failed transmissions are deleted after resending) |
| Google LLC (https://support.google.com/policies) | United States | Device and browser information, pages visited, cookie identifiers | Transmitted over the network at the time of visit | Visitor statistics analysis | 14 months from the date of collection |
7. Destruction procedures and methods
Personal information is destroyed without delay when the retention period ends or the purpose of processing has been achieved. Where retention is required by law, it is stored separately from other information.
- Electronic files: deleted using methods that prevent recovery
- Paper documents: shredded or incinerated
8. Rights of data subjects and how to exercise them
Data subjects may at any time request access to, correction, deletion or suspension of processing of their personal information, and may withdraw consent. As there are no member accounts, please submit your request to the Chief Privacy Officer below by phone, email or in writing, and we will act without delay after verifying your identity. Requests may also be made through a legal representative or an authorized person.
9. Personal information of children under 14
Children under 14 cannot submit consultation or appointment requests on the website themselves; a legal representative must submit the request on their behalf. For treatment, information is processed with the consent of the legal representative.
10. Installation, operation and refusal of automatic collection tools (cookies, etc.)
The website uses cookies and browser storage for the following purposes. No login cookies are used.
- Visitor statistics (Google Analytics): aggregating return visits and visit paths in a form that does not identify individuals
- Saving the “Don't show again today” setting for pop-ups
- Recording the referral source when you request a consultation (deleted when you close the browser window)
You can refuse or delete cookies in your browser settings. You can also opt out of Google Analytics collection with the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout). You can still submit consultation and appointment requests even if you refuse cookies.
11. Security measures
- Administrative measures: minimizing staff who handle personal information, regular training, and establishing and implementing an internal management plan
- Technical measures: encryption in transit (HTTPS), access control for management systems and retention of access logs, and operation of security programs
- Physical measures: access control to storage areas for documents and equipment containing personal information
12. Chief Privacy Officer
For inquiries, complaints or remedies regarding the processing of personal information, please contact the officer below.
| Category | Details |
|---|---|
| Chief Privacy Officer | Kim Hyun-ok (Representative Director) |
| Contact | 02-6956-5786 |
| [To be confirmed: email for privacy inquiries] |
13. Remedies for infringement of rights
For reports or consultations regarding infringement of personal information, you may contact the following organizations.
- Personal Information Dispute Mediation Committee: 1833-6972 (https://www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (https://privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (https://www.spo.go.kr)
- Korean National Police Agency: 182 (https://ecrm.police.go.kr)
14. Changes to this Privacy Policy
If this policy is changed, we will announce the changes on the website at least 7 days before they take effect. For changes that significantly affect the rights of data subjects, we will announce them at least 30 days in advance.
This policy takes effect on [To be confirmed: website launch date] and replaces the policy effective May 29, 2026.