Privacy Policy

The Clinic processes personal information for the following purposes. Personal information processed is not used for any purpose other than those below, and if a purpose changes, the Clinic will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Membership registration and management: confirming your intention to register; identifying and authenticating you to provide member services (viewing before-and-after photos and treatment reviews, checking bookings and consultations on My Page, and writing treatment reviews); maintaining and managing membership; restricting registration by children under 14; preventing misuse; sending notices and notifications; handling complaints; and processing account deletion
2. Online booking and consultation: receiving, confirming, changing and canceling appointment bookings and sending related notices; replying to consultation requests; contacting you to confirm appointment schedules; guest booking lookup; and confirming whether you visited
3. Treatment reviews and before-and-after photos: receiving, reviewing and posting treatment reviews written by members who have visited the Clinic; and showing logged-in members the before-and-after photos of people who have consented to the use of their photos
4. Marketing information (only if you have given optional consent): sending promotional information, such as events and clinic news, by whichever of text message, KakaoTalk or email you agreed to
5. Website operation and security: improving our services through visit statistics (how visitors arrive, most-viewed pages and device types); blocking abnormal access and repeated requests; responding to service failures; and keeping and reviewing records of personal information processing

The Clinic processes only the minimum personal information necessary for its services. Unique identification information, such as resident registration numbers, is not collected on the website.

In the inquiry field for bookings and consultations, please write only what is necessary for your consultation, and do not include information such as resident registration numbers or bank account numbers.

The Clinic processes and retains personal information within the retention period prescribed by law or the retention period notified to the data subject when the information was collected, and destroys it without delay when that period ends. The retention periods for each category are as follows.

If personal information must be preserved under other laws, it is kept separately from other personal information for the period prescribed by those laws.

1. Reasons and timing of destruction: When the retention period ends, or when personal information is no longer needed because the purpose of processing has been achieved, it is destroyed without delay (within 5 days from that date).
2. Destruction procedure: Personal information for which a reason for destruction has arisen is deleted by an automatic cleanup job that runs every day. If a data subject requests destruction, the information is destroyed after confirmation by the Chief Privacy Officer.
3. Preservation under other laws: If personal information must be preserved under other laws, it is moved to and kept in a storage space separate from other personal information.
4. Destruction methods: Information in electronic files is deleted in a way that makes it unrecoverable, and printed information is shredded or incinerated. Information remaining in database backups is deleted automatically when the backup retention cycle ends.

The Clinic does not process personal information beyond the scope of the purposes described in Article 1 Purposes of Processing Personal Information and does not provide it to third parties, except in the following cases:

• Where the data subject has given separate consent
• Where there are special provisions in law, or where it is unavoidable in order to comply with legal obligations
• Where it is deemed necessary for the urgent protection of the life, body or property of the data subject or another person
• Other cases permitted under Articles 17 and 18 of the Personal Information Protection Act

When you tap the KakaoTalk chat, Naver Booking or map buttons on the website, you are taken to that service; the Clinic does not pass your personal information to it. Once you move to that service, its privacy policy applies.

To operate the website smoothly, the Clinic outsources personal information processing tasks as follows.

Supabase uses Amazon Web Services data centers to store information in the Seoul region (sub-processing).

When concluding outsourcing contracts, the Clinic sets out in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing for purposes other than the outsourced tasks, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the processor, and liability, including compensation for damages; the Clinic also supervises whether the processor handles personal information securely.

If the outsourced tasks or the processors change, we will update this Policy and give notice. Because Supabase and Cloudflare are foreign companies, details of the transfer are also provided in Article 7 Overseas Transfer of Personal Information.

To store and transmit website data, the Clinic outsources the processing of personal information to, and stores it with, foreign companies as follows. This outsourcing and storage is necessary to conclude and perform contracts with data subjects, and is disclosed in this Policy in accordance with Article 28-8(1)3 of the Personal Information Protection Act.

How to refuse the overseas transfer, and the effect of refusal

If you do not want your information transferred overseas, you may choose not to use membership registration and online booking and consultation on the website; if you are already a member, you may delete your account or request suspension of processing through the contact listed in Article 13 Chief Privacy Officer and Contact. However, because this overseas transfer consists of data storage and transmission essential to operating the website, if you refuse it you will not be able to use the website's member services or online booking and consultation (simply opening the website sends access information through Cloudflare). In that case, you can book by phone (02-558-5058) or in person.

Given the nature of the website's services, health-related information (sensitive information) may be included in the following cases, so the Clinic processes it only with consent obtained separately from consent to the processing of other personal information (Article 23 of the Personal Information Protection Act).

• Online booking and consultation: desired treatment; skin condition, treatment history, medications you are taking, etc., written in your inquiry
• Treatment reviews: treatment experience, skin condition, etc., written in a review
• Before-and-after photos: before-and-after photos of the face or body and the treatment category (only where the Clinic has obtained a photo use consent form)

You may decline to consent to the processing of sensitive information. However, if you do not consent, you will not be able to use online booking and consultation or write treatment reviews; you can still book or consult by phone (02-558-5058) or in person.

Possibility of disclosure and how to keep information private

• Treatment reviews are shown to logged-in members after review by the Clinic, with the author's name partially masked. Any health information written in a review is shown along with it, so please do not include anything you do not wish to share.
• You can edit or delete a review before it is approved, and you can delete it on My Page at any time, even after approval. Deleted reviews are made private immediately.
• Before-and-after photos are shown only to logged-in members, and the person in the photos may ask the Clinic at any time to stop posting and destroy them.
• Online booking and consultation details are not made public.

• Membership registration on the website is available only to those aged 14 or older, and we confirm whether you are 14 or older when you register.
• For online booking or consultation for a child under 14, please have a legal representative (such as a parent) submit the request directly.
• Where the personal information of a child under 14 must be processed with consent, the Clinic obtains the consent of the legal representative (Article 22-2 of the Personal Information Protection Act), and if it becomes aware that information was collected without the legal representative's consent, it destroys the information without delay.

Data subjects may exercise the following rights against the Clinic at any time.

• Request access to personal information (Article 35 of the Personal Information Protection Act)
• Request correction or deletion where there are errors, etc. (Article 36)
• Request suspension of processing and withdraw consent (Article 37)
• Refuse automated decisions or request an explanation of them (Article 37-2) — the Clinic does not make automated decisions on the website

How to exercise your rights

• On My Page, you can edit your member information, change your notification settings (withdraw marketing consent), change your password and delete your account yourself.
• For other requests, contact us by phone (02-558-5058), email (naturalbeauty2431@naver.com) or in writing; after confirming your identity, we will notify you of the result within 10 days.
• You may also exercise your rights through a representative, such as a legal representative or a person you have authorized; in this case, a power of attorney must be submitted.
• Requests for access or suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act, and you may not request the deletion of personal information that other laws specify as subject to collection.
• The Clinic confirms whether the person making a request is the data subject or a legitimate representative.

Obligations of data subjects

Data subjects must keep their personal information accurate and up to date, and must not misappropriate the personal information of others or infringe on the personal information or privacy of others.

The Clinic takes the following measures necessary to ensure the security of personal information.

• Access control: Administrator accounts are divided into levels by role so that only the necessary menus are available, contact details are displayed masked, and viewing full details or downloading requires a stated reason.
• Keeping and reviewing access records: Records of administrator logins and of viewing, processing and downloading personal information are kept for 2 years and reviewed.
• Account protection: Accounts are locked after repeated failed login attempts, users are logged out automatically after a period of inactivity, and administrators can use two-factor authentication and allowed IP addresses.
• Encryption: Passwords and guest lookup codes are stored with irreversible encryption, all communications are encrypted (HTTPS), and keys for connecting to external services are stored encrypted.
• Storage protection: The database can be accessed only through an account dedicated to the website, and before-and-after photos are kept in private storage and shown to logged-in members only through addresses that work for a few minutes.
• Security response: Automated programs and repeated requests are blocked, and error and failure records are reviewed.

The Clinic uses cookies and browser storage (local storage and session storage) to store information needed to use the website and to compile visit statistics. A cookie is a small piece of information that a website sends to your browser and stores there, and browser storage is a browser feature that keeps information within the browser.

The website does not contain tracking code from external advertising or analytics companies, and does not collect behavioral information for targeted advertising or provide such information to other companies.

Visit statistics

• Visit statistics are collected directly by the Clinic. We do not use external analytics tools such as Google Analytics, and if we connect one, we will update this Policy and give notice beforehand.
• The items collected are listed in Article 2 Personal Information Processed, and the retention periods in Article 3 Processing and Retention Periods.
• On the German version, visit statistics are collected only if you consent.

How to refuse

• You can refuse the collection of visit statistics in this browser using the button below. If you refuse, the visitor and visit identifiers and the ad click marker are also deleted.
• If your browser sends a GPC (Global Privacy Control) signal, visit statistics are not collected.
• You can block or delete cookies and site data under Settings › Privacy (Privacy and security) in browsers such as Chrome, Edge and Safari. However, if you block essential cookies, you will not be able to use services that require you to log in.

External services

• The maps on the main page and the Hours & Directions page are embedded from Google Maps (Google LLC). When a map loads, Google may directly collect your IP address, browser information, cookies, etc.; the Clinic does not receive this information, and it is processed under Google's privacy policy.
• The KakaoTalk Channel chat, Naver Booking, Naver Map, Naver Blog, Kakao Map and Google Maps buttons are links to those services. No information is sent to those services before you tap them, and once you move to a service, that service's policy applies.

The Clinic has designated a Chief Privacy Officer and a responsible department, as follows, to take overall responsibility for tasks related to personal information processing and to handle complaints and provide remedies for damages of data subjects in connection with personal information processing.

You may contact us at the above for inquiries, complaints, remedies for damages, access requests and other matters concerning personal information protection that arise while using the website, and the Clinic will respond and take action without delay.

To obtain remedies for the infringement of personal information, data subjects may apply for dispute resolution, consultation and the like to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and other bodies. For other reports of, or consultation on, personal information infringement, please contact the organizations below.

This Privacy Policy applies from the date of posting.

If this Policy is revised because of changes in laws or services, the changes and the reasons for them will be announced in the website's notices or on this page from 7 days before they take effect (from 30 days before, for changes that significantly affect the rights of data subjects).