ABLE Dermatology Clinic (the "Clinic") has established and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related complaints promptly. This English version is a translation for reference; if it differs from the Korean version, the Korean version prevails.
Privacy Policy
Effective Date: October 5, 2026
1. Purposes of Processing
The Clinic processes personal information for the purposes below. Personal information is not used for any other purpose, and if a purpose changes, the Clinic takes the necessary steps, such as obtaining separate consent, under Article 18 of the Personal Information Protection Act.
- Medical care: registration and appointments, examination, procedures and treatment, creating and keeping medical records, follow-up after procedures
- Payment: calculating, collecting and refunding medical fees, issuing receipts and itemized statements, claiming benefits for care covered by National Health Insurance or Medical Aid
- Certificates: issuing medical certificates, written opinions and visit confirmations, and providing access to or copies of medical records
- Appointment and care notices: confirming or changing appointments, pre- and post-procedure instructions
- Consultation and complaints: consultation by phone, Naver Booking, KakaoTalk Channel, email, and messenger or social media messages, and handling inquiries and complaints
- Legal obligations: record keeping, reporting and notification required by the Medical Service Act, the Infectious Disease Control and Prevention Act and other laws
- Website operation: visit statistics and improving the website
- Facility safety: crime prevention, facility safety management and fire prevention using fixed video surveillance devices (CCTV)
2. Personal Information We Process
A. During medical care
- Identity: name, resident registration number (for foreign nationals, alien registration number, passport number or similar), address, contact details
- Medical information: chief complaint and history, diagnosis, clinical course, procedures, treatment and prescriptions, test results, date and time of care, clinical photographs taken during care
- Payment information: payment and refund records, payment method and approval details
- Care covered by National Health Insurance or Medical Aid: information needed to verify eligibility
- Where consent of a legal representative is required (e.g. minors): the representative's name, contact details and relationship to the patient
The identity information above, and the medical information that must be entered in the medical chart, is processed without the data subject's consent on the basis of Article 22 of the Medical Service Act, Article 42-2 of its Enforcement Decree and Article 14 of its Enforcement Rule.
B. During booking and consultation
- Phone: name, contact details, appointment date and time, content of the consultation
- Naver Booking (Naver Place): name, contact details, appointment date, time and item, requests
- KakaoTalk Channel: KakaoTalk profile name and the content of the conversation (name, contact details, skin condition, photos and other information you choose to share)
- Email: email address, name, the content of your inquiry and any photos you attach
- Messengers and social media used for consultation in other languages (WhatsApp, LINE, WeChat, Instagram, X): account name and the content of the conversation (preferred dates, skin concerns, photos you send and similar)
Naver Booking, KakaoTalk Channel, WhatsApp, LINE, WeChat, Instagram and X are services run by their respective operators under their own privacy policies, and conversations are stored on those operators' servers (outside Korea for WhatsApp, LINE, WeChat, Instagram and X). The Clinic processes the information above only to the extent needed for booking and consultation.
Health-related information that you choose to send during a consultation, such as your skin condition or photos, is used only to answer the consultation and to prepare the booking and care that follow. You do not need to send information that is not necessary for the consultation.
C. Generated and collected automatically when you use the website
- IP address, date and time of access, pages visited and referrer, browser, operating system and device information, cookies (online identifiers that distinguish visitors)
The website has no member sign-up, online booking form or consultation form that asks you to enter your name or contact details.
D. Fixed video surveillance devices (CCTV)
- Video recorded inside the Clinic (no audio is recorded)
3. Processing and Retention Periods
The Clinic processes and retains personal information within the period set by law or the period consented to by the data subject.
A. Medical records (Medical Service Act, Article 22(2); Enforcement Rule of the Medical Service Act, Article 15(1))
- Patient register: 5 years
- Medical charts: 10 years
- Prescriptions: 2 years
- Surgical records: 10 years
- Test records and test findings: 5 years
- Radiographs (including images) and their reports: 5 years
- Nursing records: 5 years
- Copies of medical certificates and similar documents: 3 years
Where necessary for continuing care, retention may be extended once, within the periods above (proviso to Article 15(1) of the Enforcement Rule of the Medical Service Act).
B. Other records
- Documents on benefit claims under National Health Insurance or Medical Aid: 5 years from the date the covered care ended (National Health Insurance Act, Article 96-4; Medical Care Assistance Act, Article 11-2)
- Books and supporting documents on transactions such as fee payments: 5 years from the day after the statutory filing deadline for the relevant tax period (Framework Act on National Taxes, Article 85-3)
- Booking and consultation records that did not lead to medical care: 1 year from the last consultation
- Website access records (hosting): up to 30 days (see item 7 below)
- Website visit statistics (Google Analytics): up to 14 months (see item 8 below)
- CCTV footage: within 30 days of recording (see item 12 below)
4. Sensitive Information and Unique Identification Information
The Clinic processes health information needed for medical care (sensitive information) and resident registration numbers, alien registration numbers and passport numbers (unique identification information) on the following legal bases.
- Medical Service Act, Article 22; its Enforcement Decree, Article 42-2 (Processing of Sensitive Information and Unique Identification Information); its Enforcement Rule, Article 14
- Personal Information Protection Act, Article 23(1)2, Article 24(1)2 and Article 24-2(1)1
Health-related information that you choose to send during a consultation before medical care is used only to answer the consultation and for the booking and care that follow; it is not used for other purposes or provided to third parties.
Possibility of disclosure of sensitive information and how to choose non-disclosure
The Clinic does not disclose a patient's health information or other sensitive information on its website, social media or elsewhere without the patient's consent. If the Clinic wishes to publish before-and-after photographs or a treatment course for educational or promotional purposes, it first informs the patient of the scope and media of publication and obtains separate consent; declining does not affect your care in any way. Even after consenting, you may withdraw consent and ask that publication stop at any time (see item 13 below for contact details).
5. Provision to Third Parties
The Clinic processes personal information only within the purposes in item 1 above and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject's consent or under a specific provision of law. The main cases of provision required or permitted by law are as follows.
- National Health Insurance Service and Health Insurance Review and Assessment Service: eligibility verification for National Health Insurance or Medical Aid, and claims for and review of benefits (National Health Insurance Act; Medical Care Assistance Act) — only for care covered by National Health Insurance or Medical Aid
- Other medical institutions: sending copies of medical records with the consent of the patient or the patient's guardian (Medical Service Act, Article 21-2)
- The patient's family or representative, courts and investigative authorities: where a request meets the requirements and documents set out in the subparagraphs of Article 21(3) of the Medical Service Act
- Korea Disease Control and Prevention Agency and public health centers: reports and notifications required by law, such as infectious disease reports (Infectious Disease Control and Prevention Act, Article 11)
Other than in these cases, the Clinic does not provide personal information to third parties without the data subject's separate consent.
6. Outsourcing of Processing
The Clinic outsources the following personal information processing task.
- Processor: TNH (㈜티엔에이치)
Outsourced task: operation and maintenance of the electronic medical record and customer management system (Vegas CRM), and storage of medical, booking and consultation information
Overseas outsourcing for website hosting is described in item 7 below, and third-party tools embedded in the website, such as visit statistics, in item 8.
The Clinic sets out, in an outsourcing contract or the processor's terms of service, the matters required by Article 26(1) of the Personal Information Protection Act and Article 28(1) of its Enforcement Decree (prohibition on processing beyond the outsourced purpose, security measures, restrictions on sub-outsourcing, supervision, liability for damages and others), and supervises whether the processor handles personal information safely. Any change in the outsourced tasks or processors will be disclosed through this Privacy Policy without delay.
7. Overseas Transfer of Personal Information
To serve the website, the Clinic uses a web hosting service of an overseas provider, and website access records are transferred overseas (outsourced processing and storage) in the process.
- Recipient: Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA · privacy@vercel.com)
- Country: the United States
- Time and method of transfer: transmitted over the network each time you access the website
- Items transferred: IP address, date and time of access, requested address (URL), browser information
- Purpose of use: serving the website (web hosting) and processing access records for security and incident response
- Retention period: up to 30 days (Vercel's access log retention period)
- Legal basis: Personal Information Protection Act, Article 28-8(1)3(a) — outsourced processing and storage necessary to conclude and perform the contract with the data subject (use of the website), with the matters in paragraph (2) of that Article disclosed in this Privacy Policy
- How to refuse and the effect of refusal: processing of access records for hosting is essential to reach the website. If you do not wish this transfer, please contact us by phone (+82-2-431-0831) instead of using the website.
In addition, information collected by third-party tools embedded in the website (Google Analytics, Google Maps, YouTube and others) and conversations on the messengers and social media used for consultation in other languages are processed on each operator's servers outside Korea. See item 2 above and item 8 below for details.
9. Rights and Obligations of Data Subjects and Legal Representatives
- You may at any time ask the Clinic for access to, correction or deletion of, or suspension of processing of your personal information, or withdraw your consent.
- You may exercise these rights in person, by phone (+82-2-431-0831) or by email (ablederm@naver.com). After confirming that the request comes from you or a duly authorized representative, the Clinic acts without delay and informs you of the result within 10 days of receiving the request.
- You may exercise your rights through a legal representative or an authorized agent. In that case, a power of attorney in Form 11 annexed to the Public Notice on the Methods of Processing Personal Information must be submitted. The rights of a child under 14 may be exercised by the child's legal representative.
- Access to and copies of medical records may be requested by the patient or by a representative designated by law, with identification and the required documents, under Article 21 of the Medical Service Act and Article 13-3 of its Enforcement Rule.
- Personal information that another law, such as the Medical Service Act, expressly requires to be collected, such as medical records, cannot be deleted on request (proviso to Article 36(1) of the Personal Information Protection Act). Requests for access or suspension of processing may be limited or refused where Article 35(4) or Article 37(2) of that Act applies; in that case the Clinic will inform you of the reason.
- You must provide accurate personal information and must not misuse another person's personal information or infringe another person's privacy.
10. Destruction of Personal Information
- The Clinic destroys personal information without delay once the retention period has passed or the purpose of processing has been achieved and the information is no longer needed.
- Personal information that must be kept under other laws is stored separately from other personal information, for the period and on the legal basis in item 3 above, and then destroyed.
- Procedure: personal information subject to destruction is identified and destroyed with the approval of the Privacy Officer.
- Method: electronic files are deleted in a way that prevents recovery or reproduction; paper documents are shredded or incinerated.
11. Security Measures
The Clinic takes the following measures under Article 29 of the Personal Information Protection Act.
- Administrative measures: limiting and training staff who handle personal information, and establishing and implementing internal management standards
- Technical measures: access rights management and access control for the medical information system, encryption of unique identification information and passwords, encryption in transit (HTTPS), retention of access logs, and installation and updating of security software
- Physical measures: access control and locks for places where medical records are kept and for computer equipment
12. Operation and Management of Fixed Video Surveillance Devices (CCTV)
Under Article 25 of the Personal Information Protection Act, the Clinic has installed fixed video surveillance devices inside the Clinic and operates and manages them as follows.
- Legal basis and purpose: Personal Information Protection Act, Article 25(1)2 and 3 — crime prevention, facility safety and management, fire prevention
- Location, coverage and recording hours: shown on the notice posted at each location. The interiors of changing rooms, restrooms and other places where privacy could be seriously infringed are not recorded.
- Manager and access rights: Manager — Dr. Jeong Kyungmuk, Director (+82-2-431-0831). Footage may be viewed only by the manager and staff designated by the manager.
- Retention period and handling: footage is kept for no more than 30 days from recording and then deleted. The audio recording function is not used.
- How and where footage is checked: at the Clinic, on request to the manager
- Response to access requests: You may ask to view, or confirm the existence of, footage in which you appear. After verifying your identity, the Clinic takes the necessary steps without delay and, where other people appear in the footage, protects them, for example by masking. Where there is a legitimate reason, such as footage already deleted after the retention period, the Clinic will explain the reason and may limit access.
- Protection measures: restricted access to and locking of the recording device, and records of viewing and provision of footage
13. Privacy Officer
The Clinic has designated the Privacy Officer below to oversee the processing of personal information and to handle inquiries, complaints and remedies. Requests for access to personal information are also received at the contact details below.
- Privacy Officer
Name: Jeong Kyungmuk | Title: Director
Phone: +82-2-431-0831 | Email: ablederm@naver.com
14. Remedies for Infringement of Rights
To seek a remedy for infringement of personal information, you may apply to the following bodies for dispute resolution or consultation. The short numbers below are dialed from within Korea.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
15. Changes to This Privacy Policy
This Privacy Policy applies from October 5, 2026. If content is added, deleted or amended, the Clinic will give notice on the website from 7 days before the effective date, or from 30 days before for changes that materially affect the rights of data subjects. Changes that are not unfavorable to data subjects, such as corrections to conform to law, may take effect upon notice.
Revision History
- June 1, 2026: established and effective
- October 5, 2026: fully revised. Because this revision corrects statements that did not match the law and supplements the items disclosed, it takes effect upon notice. The new rule on when changes are announced applies from the next revision.
Before and After (revision of October 5, 2026)
- Retention of medical records: (before) 3 years from the last visit for medical records, 3 years for prescription records, 3 years for surgery and anesthesia records, and others → (after) under Article 15 of the Enforcement Rule of the Medical Service Act: 10 years for medical charts and surgical records; 5 years for the patient register, test records and nursing records; 3 years for copies of medical certificates; 2 years for prescriptions
- Purposes and items: (before) included matters the Clinic does not actually process, such as health screening, occupation, family relationship information and copies of health insurance cards → (after) only the purposes and items actually processed, with items added for each booking and consultation channel
- Provision to third parties: (before) stated broadly, including provision for statistics and academic research → (after) the legal basis and the recipients are stated specifically
- Outsourcing: (before) only types of business were stated, without processor names (including tasks the Clinic does not actually outsource, such as delivery of prescription drugs) → (after) the actual processor's name and the outsourced task are stated
- Rights of data subjects: (before) included a "right to data portability" → (after) limited to the rights that currently apply to the Clinic (access, correction or deletion, suspension of processing, withdrawal of consent)
- Automatic collection tools: (before) stated uses that did not match reality, such as keeping you logged in and personalized services, and did not name the tools → (after) the names of the third-party tools embedded in the website, what they collect, their purposes and how to refuse them are stated
- New items: legal basis for sensitive and unique identification information and the possibility of disclosure, overseas transfer, operation and management of fixed video surveillance devices
- Remedy bodies: (before) Personal Information Protection Commission, Supreme Prosecutors' Office, National Police Agency → (after) current contact details of the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center, the Supreme Prosecutors' Office and the Korean National Police Agency
- Notice of changes: (before) 30 days before the effective date → (after) 7 days before the effective date (30 days for changes that materially affect rights; corrections that are not unfavorable take effect upon notice)
16. Medical Institution Information
- Medical Institution Name: ABLE Dermatology Clinic
- Director: Dr. Jeong Kyungmuk
- Business Registration No.: 666-28-02025
- Address: 4-5F 140 Jungdae-ro, Songpa-gu, Seoul
- Phone: +82-2-431-0831
- Email: ablederm@naver.com
- Medical Institution Type: Clinic