NAYA Clinic Privacy Policy

Article 1 (Purposes of Processing Personal Information)

NAYA Clinic (hereinafter referred to as the “Clinic”) processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those specified below. If the purposes of use change, the Clinic will take all necessary measures, including obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Website User Management: To identify and manage website users, prevent unauthorized use, and provide various notices and notifications.
2. Provision of Goods or Services: To provide medical care, schedule medical appointments, provide consultation services, allow access to medical records and other information, provide health-related content and personalized services, process payments and settlements, collect debts, conduct marketing, promotional activities, and events, verify the identity of complainants and the details of their complaints, and handle grievances.
3. Employee and Business Partner Management: To recruit and manage employees and to manage entrusted processors and business partners.

Article 2 (Processing and Retention Period of Personal Information)

① The Clinic processes and retains personal information within the retention and use periods prescribed by applicable laws and regulations or within the retention and use periods consented to by the data subject at the time the personal information is collected.

② The processing and retention periods for each category of personal information are as follows:

1. Website User Management: Five years from the termination of the commercial relationship. However, in the following cases, the information will be retained until the relevant circumstances have ended:
2. If an investigation or inquiry concerning an unlawful act is ongoing, until the investigation or inquiry is completed.
3. If any creditor-debtor relationship remains outstanding, until the relationship has been fully settled.
4. Provision of Goods or Services: Five years from the termination of the commercial relationship. However, in the following cases, the information will be retained until the end of the applicable period:
5. Records retained pursuant to the Act on Consumer Protection in Electronic Commerce, Etc.:
6. Records concerning labeling and advertising: Six months
7. Records concerning contracts, withdrawal of offers, payments, and the provision of services: Five years
8. Records concerning consumer complaints or dispute resolution: Three years
9. Communications confirmation data retained pursuant to the Protection of Communications Secrets Act:
10. Date and time of telecommunications by subscribers, start and end times, and similar information: One year
11. Computer communications records, internet log records, and similar information: Three months
12. Medical records retained pursuant to the Medical Service Act:
13. Patient registers: Five years
14. Medical records: Ten years
15. Prescriptions: Two years
16. Surgical records: Ten years
17. Examination results and medical opinion records: Five years
18. Radiographic images and related medical reports: Five years
19. Nursing records: Five years
20. Copies of medical certificates: Three years
21. Employee and Business Partner Management:
22. Employee information: Three years from termination of employment
23. Applicant information: One year from completion of the recruitment process
24. Information concerning representatives of business partners and entrusted processors: Five years from the termination of the business relationship

Article 3 (Provision of Personal Information to Third Parties)

The Clinic processes personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information). The Clinic provides personal information to third parties only where permitted under Articles 17 and 18 of the Personal Information Protection Act, including where the data subject has given consent or where special provisions of law apply.

Article 4 (Entrustment of Personal Information Processing)

① To ensure the efficient handling of personal information-related operations, the Clinic entrusts the following personal information processing activities to third parties:

1. Entrusted Processor: Weing Co., Ltd.
2. Entrusted Activities: Clinic customer management, marketing operations, payroll and accounting services, and system maintenance
3. Entrusted Processors: Kakao Corp., NAVER Corporation, Meta, Inc., and Google LLC
4. Entrusted Activities: Promotion and marketing of the Clinic

② When entering into an entrustment agreement, the Clinic specifies in the agreement, in accordance with Article 26 of the Personal Information Protection Act, matters including the prohibition of processing personal information for purposes other than performing the entrusted activities, technical and administrative safeguards, restrictions on sub-entrustment, and the management and supervision of the entrusted processor. The Clinic also supervises entrusted processors to ensure that personal information is processed securely.

③ If the entrusted activities or entrusted processors change, the Clinic will disclose such changes through this Privacy Policy without delay.

Article 5 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

① Data subjects may exercise their rights against the Clinic at any time, including the right to request access to, correction or deletion of, or suspension of the processing of their personal information.

② The rights set forth in Paragraph ① may be exercised by submitting a written request or sending an email to the Clinic. The Clinic will take the necessary action without delay.

Article 6 (Categories of Personal Information Processed)

1. Website User Management: Name, confirmation of whether the user is aged 14 or older, telephone number, and email address
2. Provision of Goods or Services:
3. Required Information: Name, date of birth, gender, address, telephone number, email address, and payment information
4. Optional Information: Aesthetic procedures of interest, previous procedure history, medical history, medication information, and history of allergic reactions
5. Employee and Business Partner Management:
6. Employees and Applicants: Name, date of birth, address, contact information, and employment history
7. Business Partner Representatives: Name, contact information, company or workplace, and responsibilities

Article 7 (Destruction of Personal Information)

① The Clinic destroys personal information without delay when it is no longer necessary, including when the applicable retention period has expired or the purpose of processing has been fulfilled.

② If personal information must continue to be retained pursuant to applicable laws and regulations, the Clinic transfers and stores such personal information in a separate database.

Article 8 (Measures to Ensure the Security of Personal Information)

1. Administrative Measures: Establishing and implementing an internal management plan and providing regular employee training
2. Technical Measures: Managing access rights to personal information processing systems, installing access control systems, and installing security software
3. Physical Measures: Controlling access to server rooms, document storage rooms, and other restricted areas

Article 9 (Installation and Operation of Devices That Automatically Collect Personal Information and the Right to Refuse Such Collection)

① The Clinic uses cookies to provide personalized services.

② Purpose of Using Cookies: To analyze users’ website visits, usage patterns, and similar information.

Article 10 (Chief Privacy Officer)

1. Name: Jonghyun Lee
2. Position: Medical Director
3. Telephone: +82 2-537-0977
4. Email: naya@nayaclinic.kr

Article 11 (Criteria for Determining Additional Use or Provision)

When additionally using or providing personal information, the Clinic considers the necessary factors in accordance with Article 15(3) and Article 17(4) of the Personal Information Protection Act.

Article 12 (Requests for Access to Personal Information)

Data subjects may request access to their personal information in accordance with Article 35 of the Personal Information Protection Act.

Article 13 (Remedies for Infringement of Rights)

1. Personal Information Dispute Mediation Committee: 1833-6972 (no area code required)
2. Privacy Infringement Report Center: 118 (no area code required)
3. Supreme Prosecutors’ Office: 1301 (no area code required)
4. Korean National Police Agency: 182 (no area code required)

Article 14 (Installation and Operation of Video Information Processing Devices)

1. Grounds for Installation: Facility safety and fire prevention
2. Installation Locations: Clinic treatment rooms and hallways
3. Person Responsible for Management: Medical Director Jonghyun Lee

Article 15 (Effective Date and Amendments)

This Privacy Policy will take effect on August 1, 2026.