[Privacy Policy]

DA-EAT Korean Medicine Clinic (hereinafter referred to as the "Clinic") values the personal information of its customers and will handle it lawfully and appropriately to protect the rights and interests of data subjects.
We comply with relevant laws such as the Framework Act on Telecommunications, the Telecommunications Business Act, and the Personal Information Protection Act and its Enforcement Decree.
The "Clinic" informs you of the purposes and methods for which your provided personal information is used and what measures are being taken to protect your personal information.

■ Personal Information Items Collected
1. The "Clinic" collects the following personal information for membership registration, smooth customer consultation, and the provision of various services.
- Individual members: Name, date of birth, gender, address, age, contact information, mobile phone information, email address
- Individual members under 14: Legal representative information (resident registration number or i-PIN number, mobile phone information)
- When participating in events: Name, age, contact information, email, address, gender, reservation information, medical treatment information, consultation history

2. Methods of Personal Information Collection
- Website, written forms, fax, phone, bulletin board, email, event participation

3. The following information may be automatically generated and collected during the service usage process.
- IP Address, cookies, visit date and time, service usage records, improper usage records

■ Purpose of Collection and Use of Personal Information
The "Clinic" does not use personal information for purposes other than the following, and will obtain consent if the purpose of use changes.
1. Service Provision
- Medical information: Provision of medical services for diagnosis and treatment, and administrative services such as billing, payment, and refunds
- Reservation information: Use for identity verification procedures when using medical reservations, reservation inquiries, and other services
- Consultation information: Customer medical consultation and guidance using phone, text messages, or KakaoTalk
- Other information: Ensuring smooth communication channels for hospital news, disease information, surveys, and complaint handling via text messages and SNS

2. Membership Management
Identity verification for service use, personal identification, prevention of unauthorized use by bad actors, confirmation of legal representative consent when collecting personal information of children under 14,
future legal representative identity verification, record retention for dispute resolution, complaint handling, notification delivery, provision of various information for member management, news delivery, and surveys

3. New Service Development and Marketing, AdvertisingUtilization
- Development of new services and provision of customized services, provision of event and advertising information, and provision of participation opportunities
- If you participate in event promotions or use optional services, the following information may be collected with the member's separate consent.
• Name, age, contact information, email, address, gender, reservation information, medical treatment information, consultation history
• Third-party mobile phone numbers stored in the member's mobile phone address book (limited to services equipped with social community functions; in this case, the third party's mobile phone number is not stored)
• Credit card number, mobile phone number, ID and password of gift card payment partners (limited to members using paid payment services)

4. When participating in events
- Used for customer consultation at DA-EAT Korean Medicine Clinic (phone, text)

■ Processing and Retention Period of Personal Information
The "Clinic" processes and retains personal information within the retention/use period stipulated by law or the period agreed upon when collecting personal information from the data subject. However,
even if the purpose of collection or provision has been achieved, your personal information may be retained if it is necessary to preserve it under the provisions of laws such as the Commercial Act.
The processing and retention period for each type of personal information is as follows.

1) Website membership registration and management: Until withdrawal from the website
However, in the following cases, until the reason ends (View details)
• If an investigation or inquiry is in progress due to a violation of relevant laws, until the investigation or inquiry ends

- Website visit records
• Reason for retention: Protection of Communications Secrets Act
• Retention period: 3 months
- Records of identity verification
• Reason for retention: Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.
• Retention period: 6 months
- Records of consumer complaints or dispute resolution
• Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
• Retention period: 3 years
- Records of collection/processing and use of credit information
• Reason for retention: Use and Protection of Credit Information Act
• Retention period: 3 years

2) Medical services: Retained in accordance with Article 15 of the Enforcement Rules of the "Medical Service Act" regarding "Preservation of Medical Records" (View details)
• Patient register: 5 years
• Medical records: 10 years
• Prescriptions: 2 years
• Surgical records: 10 years
• Test results and findings records: 5 years
• Radiographic images (including video) and their findings: 5 years

3) Civil complaint handling: 3 years after the completion of complaint handling
During the service usage process, IP address, cookies, service usage records, and device information may be generated and collected.
- Information collected in this way may or may not be considered personal information depending on whether it is linked to personal information.

■ Matters Concerning Third-Party Provision and Entrustment of Personal Information Processing
The "Clinic" entrusts some of the tasks necessary for service provision to external companies and manages/supervises them to ensure that the entrusted companies handle personal information safely in accordance with the Personal Information Protection Act.
If the content of the entrusted work or the trustee changes, we will disclose it through this Privacy Policy without delay.

The Clinic's personal information processing entrustment agencies and details of entrusted work
• Personal information retention period: Until the end of the entrustment contract

Entrusted Company	Details of Entrusted Work	Entrusted Personal Information	Retention Period
CareLabs Co., Ltd.	Customer management system operation	Hospital registration number, medical information, name, resident registration number, address, phone number, email, etc.	Until the end of the entrustment contract
MetaS&C Co., Ltd.	Customer management system operation, call system operation, IT system management	Hospital registration number, medical information, name, resident registration number, address, phone number, email, etc.	Until the end of the entrustment contract
SJ Softtech Co., Ltd.	Customer management	Name, phone number, address, email	Until the end of the entrustment contract
TechLabs Co., Ltd.	TM customer management, marketing, IT system management	Name, phone number, address, email, medical information, reservation consultation information, etc.	Until the end of the entrustment contract

※ Website operation and management, delivery of advertising information such as events, IT management entrustment services, etc.: DA-EAT Lab Co., Ltd., DA-EAT Lab Bupyeong, DA-EAT Lab Suwon, DA-EAT Lab Ilsan, DA-EAT Lab Busan, DA-EAT Lab Daegu, DA-EAT Lab Changwon, DA-EAT Korean Medicine Clinic (Seoul Branch, Bupyeong Branch, Suwon Branch, Ilsan Branch, Busan Branch, Daegu Branch, Changwon Branch)

■ Rights and Obligations of Data Subjects and Methods of Exercise
1. Request for access to personal information: You may request access to personal information files held by the "Clinic" in accordance with Article 35 (Access to Personal Information) of the Personal Information Protection Act.
However, the request for access to personal information may be restricted as follows in accordance with Article 35, Paragraph 5 of the Personal Information Protection Act:
- When access is prohibited or restricted by law
- When there is a risk of harming the life or body of others, or unfairly infringing on the property and other interests of others

2. Request for correction/deletion of personal information: Regarding personal information files held by the "Clinic," you may request the "Clinic" to correct or
delete personal information in accordance with Article 36 (Correction and Deletion of Personal Information) of the Personal Information Protection Act.
However, if the personal information is specified as a collection target in other laws, you cannot request its deletion.

3. Request for suspension of personal information processing: Regarding personal information files held by the "Clinic," you may request the Clinic to suspend the processing of personal information in accordance with Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act. In addition, the legal representative of a child under 14 may request the Clinic to access, correct, delete, or suspend the processing of that child's personal information.
However, a request for suspension of processing may be refused in accordance with Article 37, Paragraph 2 of the "Personal Information Protection Act" when:
- There are special provisions in the law or it is inevitable to comply with legal obligations
- There is a risk of harming the life or body of others, or unfairly infringing on the property and other interests of others
- It is difficult to perform a contract, such as being unable to provide the agreed-upon service to the data subject without processing the personal information, and the data subject has not clearly expressed their intention to terminate the contract

■ Procedures and Methods for Destruction of Personal Information
In principle, the "Clinic" destroys the relevant personal information without delay when the retention period of personal information has elapsed or the purpose of processing has been achieved. However, this does not apply if it must be preserved according to other laws. The procedures, deadlines, and methods of destruction are as follows.

1. Destruction Procedure
Information entered by the user is destroyed according to internal policies and relevant laws after the retention period has elapsed or the purpose of processing has been achieved. (Refer to Personal Information Processing and Retention Period)
2. Destruction Deadline
The user's personal information is destroyed within 5 days from the end of the retention period if the retention period has elapsed, or within 5 days from the date it is recognized that the processing of personal information is unnecessary, such as when the purpose of processing has been achieved.
3. Destruction Method
When the "Clinic" destroys personal information being processed, it does so using the following methods.
1. Establishment and implementation of internal management plans The "Clinic" establishes and implements internal management plans in accordance with Article 29 of the (Personal Information Protection Act).
2. Minimization and training of personal information handlers
We minimize the designation of personal information handlers and conduct regular training in accordance with internal management plans.
3. Administrative measures
- We prevent information leakage by individuals in advance through security pledges from all employees upon joining, and have established internal procedures to audit the implementation of personal information protection policies and employee compliance.
- Handover of duties for personal information processors is carried out thoroughly while maintaining security, and responsibility for personal information accidents after joining and leaving the company is clarified.
4. Access restriction to personal information
We control access to personal information by granting, changing, and revoking access rights to the database system that processes personal information, and control unauthorized access from the outside using intrusion prevention and detection systems. We record the history of granting, changing, or revoking rights and keep the records for at least 3 years.
5. Storage of access logs and prevention of forgery/alteration
We store and manage records of access to the personal information processing system (web logs, summary information, etc.) for at least 6 months, and manage them to prevent forgery, alteration, theft, or loss.
6. Encryption of personal information
Users' personal information is encrypted, stored, and managed. In addition, we use separate security functions such as encrypting important data during storage and transmission.
7. Technical measures against hacking, etc.
The Clinic installs security programs to prevent leakage and damage of personal information due to hacking or computer viruses, performs periodic updates and inspections, installs systems in areas where access from the outside is controlled, and monitors and blocks them technically and physically.
8. Access control for unauthorized persons
We have a separate physical storage location for the personal information system that stores personal information and have established and operated access control procedures for it.

■ Personal Information Protection Officer

The "Clinic" designates a Personal Information Protection Officer as follows to protect personal information and handle matters related to personal information.

- Name: Bang Min-woo
- Affiliation: DA-EAT Korean Medicine Clinic Seoul Branch
- Email: bmwdoctor@da-eat.co.kr

- Name: Shin Soo-yong
- Affiliation: DA-EAT Korean Medicine Clinic Bupyeong Branch
- Email: sypride081@daeat-bp.com

- Name: Kim Jeong-sang
- Affiliation: DA-EAT Korean Medicine Clinic Suwon Branch
- Email: sportplayer1@daeat-sw.com

- Name: Kang Min-hwi
- Affiliation: DA-EAT Korean Medicine Clinic Ilsan Branch
- Email: kmh@daeat-is.co.kr

- Name: Lee Dong-hoon
- Affiliation: DA-EAT Korean Medicine Clinic Busan Branch
- Email: dh.lee@daeat-bs.co.kr

- Name: Kim Jun-ho
- Affiliation: DA-EAT Korean Medicine Clinic Daegu Branch
- Email: dgdaeat@daeat-dg.co.kr

- Name: Kim Chung-hee
- Affiliation: DA-EAT Korean Medicine Clinic Changwon Branch
- Email: megachung1@daeat-cw.co.kr

- Name: Son Ji-young
- Affiliation: DA-EAT Korean Medicine Clinic Cheonan Branch
- Email: sjy0425@daeat-ca.co.kr

- Name: Jeon Seonghyeon
- Affiliation: DA-EAT Korean Medicine Clinic Daejeon Branch
- Email: rastgeleo@daeat-dn.co.kr

■ Changes to the Privacy Policy

This Privacy Policy applies from the effective date, and if there are additions, deletions, or corrections to the contents according to laws and policies, we will notify you through announcements at least 7 days before the changes take effect.
- Date of change: April 8, 2024
- Effective date: April 15, 2024

■ Remedies for Infringement of Rights and Interests
Customers can apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center, etc., to receive relief from personal information infringement. For other reports and consultations regarding personal information infringement, please contact the following organizations.
- Personal Information Infringement Report Center / privacy.kisa.or.kr / 118 (no area code)
- Supreme Prosecutors' Office Cyber Investigation Division / www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency Cyber Bureau / police.go.kr / 182 (no area code)

■ Go to check the previous Privacy Policy content