ReFace Dental Hospital (hereinafter "the Hospital") values customers' personal information and complies with the Act on Promotion of Information and Communications Network Utilization and Information Protection.

The Hospital informs you, through this Personal Information Handling Policy, of what purposes and methods your provided personal information is used for and what measures are taken to protect personal information.

○ This policy takes effect from June 1, 2025.

1. Items of personal information collected

The hospital collects the following personal information for customer convenience services such as membership registration, consultations, and service reservations.

1) Items collected: unique identifying information (name, date of birth (year of birth), login ID, password, email address, home phone number, mobile phone number, home address, areas of interest, email) / medical information (medical history, areas of cosmetic surgery, infectious diseases, etc.)

2) Method of personal information collection: website (membership registration, surgery inquiries, appointment bookings, online consultations, consultation reservations, surgery reservations, surgery reviews)

※ Under the Medical Service Act, unique identifying information and medical information must be retained as required (separate consent not necessary)

2. Purpose of Collection and Use of Personal Information

The hospital uses the collected personal information for the following purposes.

1) Performance of contracts related to service provision and settlement of charges arising from service provision

2) Provision of content

3) Member management - Verification of identity, personal identification, prevention of fraudulent use by malicious members and unauthorized use, confirmation of intent to join, and handling of complaints such as grievance processing arising from the use of member services

4) Use for marketing and advertising - Delivery of promotional information such as new service offerings and events, determining access frequency, or compiling statistics on members' use of services

5) Other - Provision of short message service

3. Retention and use period of personal information

In principle, once the purpose of collecting and using personal information has been achieved, the information will be destroyed without delay. However, when it is necessary to retain information under applicable laws and regulations, the hospital will keep member information for the periods prescribed by those laws and regulations as described below.

Retention items: Login ID, service usage records, connection IP information

Legal basis for retention: Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Retention period: 1 year

Records of consumer complaints or dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)

Records on collection/processing and use of credit information: 3 years (Act on the Use and Protection of Credit Information)

Records on identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.)

Records of visits: 3 months (Protection of Communications Secrets Act)

4. Procedures and methods for destruction of personal information

The hospital, in principle, will promptly destroy personal information once the purpose of collecting and using such information has been fulfilled. The destruction procedures and methods are as follows.

1) Destruction procedure - The information you provided for purposes such as membership registration will, after the purpose has been fulfilled, be transferred to a separate database (for paper records, to a separate file cabinet) and retained for a certain period in accordance with internal policies and other applicable laws and regulations for information protection (see retention and use period), after which it will be destroyed. Personal information moved to a separate database will not be used for purposes other than retention unless required by law.

2) Method of Destruction - Personal data stored in electronic file form will be deleted using technical methods that make it impossible to reproduce the records.

5. Provision of Personal Information

The hospital, in principle, does not provide users' personal information to external parties. However, the following cases are exceptions.

- When users have given prior consent

- When required by law, or when an investigative agency requests it in accordance with procedures and methods prescribed by law for investigative purposes

6. Outsourcing of Collected Personal Information

The hospital and the company outsource operations to external specialized firms as follows to fulfill service performance.

1) Entrusted party: 메디컬피알(주)

2) Entrusted tasks: Website and system management

3) Entrusted personal information items: Items collected when registering as a website member

4) Personal information retention and use period: Until the termination of the entrustment contract

7. Rights of Users and Legal Representatives and How to Exercise Them

Users may at any time view or correct their registered personal information and may also request account termination.

To view or modify personal information, click "Change Personal Information" (or "Edit Member Information," etc.); to terminate your account (withdraw consent), click "Unsubscribe" and follow the identity verification procedure to directly view, correct, or withdraw.

Alternatively, contact the person responsible for personal information management in writing, by phone, or by email and we will take action without delay.

If you have requested correction of errors in your personal data, we will not use or provide the personal data in question until the correction is completed.

When personal data has been deleted or withdrawn at the user's request, the hospital processes it in accordance with "Retention and Use Period of Personal Data Collected by the Hospital" and ensures it cannot be accessed or used for other purposes.

8. How to Withdraw Consent/Cancel Membership

You may withdraw your consent to the collection, use, and provision of personal data that you agreed to at the time of registration at any time.

You may cancel your membership yourself by clicking "Withdraw Membership" on My Page of the hospital's website and completing the identity verification process, or you may contact the person responsible for personal data management in writing, by phone, or by fax, and we will promptly take necessary measures such as destroying your personal information.

9. Installation, operation, and refusal of automatic personal data collection devices

The hospital operates "cookies" and similar tools that store and retrieve your information as needed. A cookie is a very small text file that the server operating the 리페이스치과병원 website sends to your browser and which is stored on your computer's hard drive. The hospital uses cookies for the following purposes.

▶Purpose of using cookies - Analyze access frequency and visit times of members and non-members, identify users' preferences and interests and track their traces, determine participation levels in various events and number of visits for targeted marketing and provision of personalized services

You have a choice regarding the installation of cookies. Therefore, you can set your web browser options to allow all cookies, to confirm each time a cookie is stored, or to refuse the storage of all cookies.

▶How to refuse cookie settings - For example: To refuse cookie settings, you can choose an option in your web browser to ask for confirmation each time a cookie is saved, or to refuse saving all cookies. Example of how to set it (for Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy

However, if you refuse the installation of cookies, there may be difficulties in providing the service.

10. Customer Service for Personal Information

The hospital designates the departments and the person responsible for managing personal information as follows to protect customers' personal information and handle complaints related to personal information.

Name of the person responsible for managing personal information: 김도섭

Phone number: 02-6204-1004

You may report any complaints related to personal data protection arising from your use of the hospital's services to the person in charge of personal data management or the responsible department.

The hospital will provide prompt and adequate responses to users' reports.

If you need to report or consult about other personal data infringements, please contact the organizations below.

1) Personal Dispute Mediation Committee (www.1336.or.kr/1336)

2) Information Security Certification Committee (www.eprivacy.or.kr/02-580-0533~4)

3) Supreme Prosecutors' Office Internet Crime Investigation Center (http://icic.sppo.go.kr/02-3480-3600)

4) National Police Agency Cyber Terror Response Center (www.ctrc.go.kr/02-392-0330)

11. Obligation to Notify of Policy Changes

This Privacy Policy was established on July 12, 2013, and if additions, deletions, or modifications are made due to changes in laws, policies, or security technologies, we will notify the reasons and details of the changed Privacy Policy on our website at least 7 days before its enforcement.

- Effective date: June 1, 2025