Da-eat Korean Medicine Clinic Privacy Policy
Welcome to our website. Privacy Policy Information
[Privacy Policy]
Da-eat Korean Medicine Clinic (hereinafter "the Clinic") values the personal information of our customers and will handle it lawfully and appropriately to protect the rights and interests of the data subjects.
We comply with relevant laws such as the Framework Act on Telecommunications, the Telecommunications Business Act, and the Personal Information Protection Act and its Enforcement Decree.
"The Clinic" informs you of the purposes and methods for which the personal information you provide is used and what measures are being taken to protect your personal information.
■ Items of Personal Information Collected
1. "The Clinic" collects the following personal information for membership registration, smooth customer consultation, and the provision of various services.
- Individual members: Name, date of birth, gender, address, age, contact information, mobile phone information, email address
- Individual members under 14: Legal representative information (resident registration number or i-PIN number, mobile phone information)
- When participating in events: Name, age, contact information, email, address, gender, reservation information, medical treatment information, consultation history
2. Methods of collecting personal information
- Website, written forms, fax, phone, bulletin board, email, event participation
3. The following information may be automatically generated and collected during the service usage process.
- IP Address, cookies, visit date and time, service usage records, improper usage records
■ Purpose of Collection and Use of Personal Information
"The Clinic" does not use personal information for any purpose other than the following, and if the purpose of use changes, we will obtain your consent before processing it.
1. Service Provision
- Medical information: Provision of medical services for diagnosis and treatment, and administrative services such as billing, payment, and refunds
- Reservation information: Use for identity verification procedures when using medical reservations, reservation inquiries, and other services
- Consultation information: Customer medical consultation and guidance using phone, text messages, or KakaoTalk
- Other information: Ensuring smooth communication channels for hospital news, disease information, surveys, and complaint handling via text and SNS
2. Membership Management
Identity verification for service use, personal identification, prevention of unauthorized use by bad actors and unauthorized access, verification of legal representative consent when collecting personal information of children under 14,
record retention for future legal representative identity verification, dispute resolution, complaint handling, delivery of notices, provision of various information for member management, news delivery, and surveys
3. New Service Development and Marketing, AdvertisingUtilization
- Development of new services and provision of customized services, provision of event and promotional information, and provision of participation opportunities
- If you participate in event promotions or use optional services, the following information may be collected with the member's separate consent.
• Name, age, contact information, email, address, gender, reservation information, medical treatment information, consultation history
• Third-party mobile phone numbers stored in the member's mobile phone address book (limited to services equipped with social community functions; in this case, third-party mobile phone numbers are not stored)
• Credit card numbers, mobile phone numbers, IDs and passwords of gift certificate payment partners (limited to members using paid payment services)
4. When participating in events
- Used for customer consultation at Da-eat Korean Medicine Clinic (phone, text)
■ Processing and Retention Period of Personal Information
"The Clinic" processes and retains personal information within the period of retention and use of personal information according to laws or within the period agreed upon when collecting personal information from the data subject. However,
even if the purpose of collection or provision is achieved, your personal information may be retained if it is necessary to be preserved under the provisions of laws such as the Commercial Act.
The processing and retention period for each type of personal information is as follows:
1) Website membership registration and management: Until withdrawal from the website
However, in the following cases, until the reason ends (View details)
• If an investigation or inquiry is in progress due to a violation of relevant laws, until the end of such investigation or inquiry
- Website visit records
• Reason for retention: Protection of Communications Secrets Act
• Retention period: 3 months
- Records regarding identity verification
• Reason for retention: Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.
• Retention period: 6 months
- Records regarding consumer complaints or dispute handling
• Reason for retention: Act on the Consumer Protection in Electronic Commerce, Etc.
• Retention period: 3 years
- Records regarding collection/processing and use of credit information
• Reason for retention: Use and Protection of Credit Information Act
• Retention period: 3 years
2) Medical services: Preserved in accordance with Article 15 of the Enforcement Rules of the "Medical Service Act" on "Preservation of Medical Records" (View details)
• Patient register: 5 years
• Medical record: 10 years
• Prescription: 2 years
• Surgical record: 10 years
• Test results and examination findings: 5 years
• X-rays (including images) and their findings: 5 years
3) Civil complaint handling: 3 years after the completion of complaint handling
During the service usage process, IP addresses, cookies, service usage records, and device information may be generated and collected.
- Information collected in this way may or may not constitute personal information depending on whether it is linked to personal information.
■ Matters Concerning Third-Party Provision and Entrustment of Personal Information Processing
"The Clinic" entrusts some of the tasks necessary for providing services to external companies and ensures that the entrusted companies handle personal information safely in accordance with the Personal Information Protection Act.
We regulate and supervise necessary matters. If the content of the entrusted work or the trustee changes, we will disclose it through this Privacy Policy without delay.
The Clinic's personal information entrusted processing agencies and details of entrusted work
• Personal information retention period: Until the end of the entrustment contract
| Entrusted Company | Details of Entrusted Work | Entrusted Personal Information | Retention Period |
|---|---|---|---|
| CareLabs Co., Ltd. | Customer management system operation | Hospital registration number, medical information, name, resident registration number, address, phone number, email, etc. | Until the end of the entrustment contract |
| MetaS&C Co., Ltd. | Customer management system operation, call system operation, computer system management | Hospital registration number, medical information, name, resident registration number, address, phone number, email, etc. | Until the end of the entrustment contract |
| SJ Softtech Co., Ltd. | Customer management | Name, phone number, address, email | Until the end of the entrustment contract |
| TechLabs Co., Ltd. | TM customer management, marketing, computer system management | Name, phone number, address, email, medical information, appointment consultation information, etc. | Until the end of the entrustment contract |
■ Rights and Obligations of Data Subjects and Methods of Exercise
1. Request for access to personal information: You may request access to the personal information files held by "the Clinic" in accordance with Article 35 (Access to Personal Information) of the Personal Information Protection Act.
However, the request for access to personal information may be restricted as follows in accordance with Article 35, Paragraph 5 of the Personal Information Protection Act:
- When access is prohibited or restricted by law
- When there is a risk of harming the life or body of another person or unfairly infringing on the property and other interests of another person
2. Request for correction/deletion of personal information: Regarding personal information files held by "the Clinic," you may request correction or deletion of personal information from "the Clinic" in accordance with Article 36 (Correction and Deletion of Personal Information) of the Personal Information Protection Act.
3. Request for suspension of processing of personal information: Regarding personal information files held by "the Clinic," you may request the suspension of processing of personal information from the clinic in accordance with Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act. In addition, the legal representative of a child under 14 may request access, correction, deletion, or suspension of processing of the child's personal information from the clinic.
However, in cases where the personal information is specified as a collection target in other laws, you cannot request its deletion.
(Note: The original text had a line break in the middle of the sentence, handled here.)
However, a request for suspension of processing may be refused in accordance with Article 37, Paragraph 2 of the "Personal Information Protection Act" when:
- There are special provisions in the law or it is inevitable to comply with legal obligations
- There is a risk of harming the life or body of another person or unfairly infringing on the property and other interests of another person
- It is difficult to fulfill the contract, such as being unable to provide the agreed service to the data subject without processing the personal information, and the data subject has not clearly expressed their intention to terminate the contract
■ Procedures and Methods for Destruction of Personal Information
"The Clinic" destroys the relevant personal information without delay when the retention period has expired or the purpose of processing has been achieved. However, this does not apply if it must be preserved according to other laws. The procedures, deadlines, and methods of destruction are as follows:
1. Destruction procedure
Information entered by the user is destroyed according to internal policies and relevant laws after the retention period has expired or the purpose of processing has been achieved. (Refer to Personal Information Processing and Retention Period)
2. Destruction deadline
The user's personal information is destroyed within 5 days from the end of the retention period if the retention period has expired, or within 5 days from the day it is recognized that the processing of personal information is unnecessary when the purpose of processing has been achieved.
3. Destruction method
When destroying personal information processed by "the Clinic," we use the following methods.
1. Establishment and implementation of internal management plan "The Clinic" establishes and implements an internal management plan in accordance with Article 29 of the (Personal Information Protection Act).
2. Minimization and training of personal information handlers
We minimize the designation of personal information handlers and conduct regular training according to the internal management plan.
3. Administrative measures
- We prevent information leakage by personnel in advance through security pledges from all employees upon joining and have established internal procedures to audit the implementation of the personal information protection policy and employee compliance.
- Handover of duties for personal information handlers is carried out thoroughly while maintaining security, and responsibility for personal information accidents after joining and leaving the company is clarified.
4. Access restriction to personal information
We control access to personal information through the granting, changing, and revocation of access rights to the database system that processes personal information, and control unauthorized access from the outside using intrusion prevention and detection systems. We record the history of granting, changing, or revoking rights and keep the records for at least 3 years.
5. Storage of access logs and prevention of forgery/alteration
We store and manage logs (web logs, summary information, etc.) of access to the personal information processing system for at least 6 months and manage them so that access logs are not forged, altered, stolen, or lost.
6. Encryption of personal information
User personal information is stored and managed in an encrypted state. In addition, we use separate security functions such as encrypting important data during storage and transmission.
7. Technical measures against hacking, etc.
To prevent the leakage and damage of personal information by hacking or computer viruses, the clinic installs security programs, performs periodic updates and inspections, installs systems in areas where access from the outside is controlled, and monitors and blocks them technically and physically.
8. Access control for unauthorized persons
We have a separate physical storage location for the personal information system that stores personal information and have established and operated access control procedures for it.
■ Personal Information Protection Officer
"The Clinic" designates a Personal Information Protection Officer as follows to protect personal information and handle matters related to personal information.
- Name: Bang Min-woo
- Affiliation: Da-eat Korean Medicine Clinic Seoul Branch
- Email: bmwdoctor@da-eat.co.kr
- Name: Shin Soo-yong
- Affiliation: Da-eat Korean Medicine Clinic Bupyeong Branch
- Email: sypride081@daeat-bp.com
- Name: Kim Jung-sang
- Affiliation: Da-eat Korean Medicine Clinic Suwon Branch
- Email: sportplayer1@daeat-sw.com
- Name: Kang Min-hwi
- Affiliation: Da-eat Korean Medicine Clinic Ilsan Branch
- Email: kmh@daeat-is.co.kr
- Name: Lee Dong-hoon
- Affiliation: Da-eat Korean Medicine Clinic Busan Branch
- Email: dh.lee@daeat-bs.co.kr
- Name: Kim Jun-ho
- Affiliation: Da-eat Korean Medicine Clinic Daegu Branch
- Email: dgdaeat@daeat-dg.co.kr
- Name: Kim Chung-hee
- Affiliation: Da-eat Korean Medicine Clinic Changwon Branch
- Email: megachung1@daeat-cw.co.kr
- Name: Son Ji-young
- Affiliation: Da-eat Korean Medicine Clinic Cheonan Branch
- Email: sjy0425@daeat-ca.co.kr
- Name: Jeon Seonghyeon
- Affiliation: Da-eat Korean Medicine Clinic Daejeon Branch
- Email: rastgeleo@daeat-dn.co.kr
■ Changes to the Privacy Policy
This Privacy Policy applies from the effective date, and if there are additions, deletions, or corrections to the contents according to laws and policies, we will notify you through announcements at least 7 days before the changes take effect.
- Date of change: April 8, 2024
- Effective date: April 15, 2024
Customers can apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center, etc., to receive relief from personal information infringement. For other reports or consultations regarding personal information infringement, please contact the following agencies.
- Personal Information Infringement Report Center / privacy.kisa.or.kr / 118 (no area code)
- Supreme Prosecutors' Office Cyber Investigation Division / www.spo.go.kr / 1301 (no area code)
- National Police Agency Cyber Safety Bureau / police.go.kr / 182 (no area code)
■ Go to check previous Privacy Policy contents