Book Now

Privacy Policy

Effective Date: April 23, 2025

Forever Clinic Seoul National University Entrance Branch (hereinafter referred to as the 'clinic') establishes and discloses this personal information processing policy to protect data subjects’ personal information and respect rights and interests in accordance with Article 30 of the Personal Information Protection Act and Article 22 of the Medical Service Act.

Article 1 (Purpose of Personal Information Processing)

The clinic processes personal information for the following purposes. Personal information in process is not used for any purpose other than those stated below, and where the purpose of use changes, separate consent is obtained in accordance with Article 18 of the Personal Information Protection Act, or other necessary actions are taken.

1. Homepage membership registration and management

  • Confirming intent to register, maintaining and managing member qualifications, personal identification and authentication
  • Providing appointment scheduling, confirmation, modification, and cancellation services
  • Retention of records for grievance handling and dispute resolution arising from service use

2. Provision of treatment and medical services

  • Provision of appointment and medical services in dermatology, plastic surgery, aesthetics, etc.
  • Medical consultation, guidance on procedures or surgery, and prior consent
  • Processing of medical payment and verification of payment details
  • Issuance of prescriptions and various certificates such as medical certificates

3. Use for marketing and advertising purposes (for those with separate consent only)

  • Sending event and promotion notifications by text message, email, or KakaoTalk
  • Provision of new procedure information and health information newsletter
  • Use for statistics and analysis to improve service

Article 2 (Personal Information Items Processed)

The hospital processes the following personal information items.

1. Items collected upon membership registration

  • [Required] Name, date of birth, gender, mobile phone number, email address, login ID, password
  • [Optional] Address, occupation, source of visit, procedures of interest

2. Items collected when making medical appointments and consultations

  • [Required] Name, contact information, desired department or procedure for appointment, appointment date and time
  • [Optional] Previous procedure history, skin type, special notes, consultation details

3. Items automatically collected during use of medical services

  • IP address, cookies, service usage records, visit records, records of improper use

4. Sensitive information (collected in accordance with Medical Service Act and Personal Information Protection Act Article 23)

  • Health information, medical records, and prescription details collected during treatment process
  • Pre- and post-treatment/surgery photos (collected after written consent from the patient)

Sensitive information is collected based on laws such as Article 22 of the Medical Service Act, Article 14 of its Enforcement Rules, and Article 23 (2)-(2) of the Personal Information Protection Act.

Article 3 (Retention and Processing Period of Personal Information)

  • The hospital processes and retains personal information within the period prescribed by law or agreed upon by the data subject at the time of collection.
  • The retention and processing period for each type of personal information is as follows.

■ Member information: Until withdrawal of membership (stored for one year after withdrawal to prevent misuse)

■ Medical records: At least 5 years under Medical Service Act Enforcement Rule Article 15 (some records are kept for 10 years)

■ Reservation and consultation records: 3 years

■ Upon withdrawal of marketing consent: Immediate destruction (however, withdrawal records retained for 1 year)

■ Electronic commerce transaction records: 5 years according to Electronic Commerce Act

■ Consumer complaint/dispute records: 3 years according to Electronic Commerce Act

Article 4 (Provision of Personal Information to Third Parties)

  • The hospital processes personal information only within the scope specified in Article 1 (Purpose of Processing), and provides it to third parties only in cases covered by the data subject's consent, special provisions of the law, or Articles 17 and 18 of the Personal Information Protection Act.
  • In the following cases, information may be provided to third parties without the data subject's consent.
  • Transfer of medical records to another medical institution under Article 21 of the Medical Service Act
  • Provision to Health Insurance Review and Assessment Service and National Health Insurance Corporation under the National Health Insurance Act
  • Upon request from investigative agencies in accordance with law

Article 5 (Consignment of Personal Information Processing)

  • For smooth service provision, the hospital outsources the processing of personal information as follows.

Consigned companies and their business descriptions

  • Consignee: SMS/Kakao notification sending company / Consigned duty: Sending reservation confirmation and notification messages
  • Consignee: Website operation and management company / Consigned duty: Website maintenance and server operation
  • Consignee: Payment agency / Consigned duty: Processing online payment of medical fees
  • When concluding an outsourcing contract, the hospital specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing for purposes other than the consigned business, technical/managerial protection measures, and re-consignment restrictions.

Article 6 (Rights and Obligations of the Data Subject and Methods of Exercise)

  • The data subject may exercise the following personal information protection rights with respect to the hospital at any time.
  • Request access to personal information
  • Request correction in case of errors, etc.
  • Request deletion
  • Request suspension of processing
  • Exercise of the rights under Paragraph 1 may be made to the hospital in writing, by email, or fax under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the hospital will take action without delay.
  • In the case of access to medical records, separate identity verification procedures are required pursuant to Article 21 of the Medical Service Act and Article 13-3 of its Enforcement Rules.
  • Processing of personal information for children under the age of 14 requires the consent of a legal guardian, who may request access, correction, deletion, or suspension of processing of the child's personal information.

Article 7 (Destruction of Personal Information)

  • When the purpose of processing personal information is achieved, the hospital will destroy the corresponding personal information without delay.
  • If the retention period agreed to by the data subject has expired or the processing purpose has been achieved, but other laws require continued retention, the personal information will be transferred to a separate database (DB) or preserved in a different storage location.
  • Procedures and methods for destruction of personal information are as follows.
  • Destruction procedure: Cause for destruction occurs → Approval by Personal Information Protection Officer → Execution of destruction → Record of completion of destruction
  • Method of destruction (electronic): Permanent deletion in an unrecoverable manner
  • Method of destruction (hardcopy): Shredding with a shredder or incineration

Article 8 (Measures to Ensure Safety of Personal Information)

The hospital takes the following technical, managerial and physical measures necessary for ensuring safety in accordance with Article 29 of the Personal Information Protection Act.

  • Establishment and implementation of an internal management plan
  • Minimization and education of personal information handling staff
  • Access restriction to personal information (operation of access control system)
  • Encryption applied when storing or transmitting personal information
  • Technical measures against hacking, etc. (anti-virus programs, firewalls, etc.)
  • Storage of access logs to personal information processing systems and prevention of forgery/tampering
  • Physical access control such as to treatment spaces

Article 9 (Operation and Refusal of Cookies)

  • The hospital uses 'cookies' to store and occasionally retrieve user information to provide customized services to users.
  • Cookies are small amounts of information sent by the server operating the website to the user's browser, and are stored on the user's computer.
  • Users have the option to accept or refuse the installation of cookies, and can allow or refuse cookies through their web browser settings. However, if cookies are refused, some services may be restricted.

Article 10 (Personal Information Protection Officer)

The clinic takes full responsibility for matters related to the processing of personal information, and designates a personal information protection officer as below to handle complaints and provide relief for personal data subjects.

■ Personal Information Protection Officer (To Be Determined)

  • Name: [Name]
  • Position: [Director / Administration Manager, etc.]
  • Contact: [Phone Number] / [Email]

■ Department in Charge of Personal Information Protection (To Be Determined)

  • Department Name: [Administration / Admin Team, etc.]
  • Contact: [Phone Number] / [Email]

The data subject may make a request for access to personal information according to Article 35 of the Personal Information Protection Act to the department below. The clinic will strive to process requests swiftly.

Article 11 (Remedies for Infringement of Rights and Interests)

Data subjects may inquire regarding remedies or counseling for personal information infringements to the agencies listed below.

  • Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
  • Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
  • Supreme Prosecutors' Office Cyber Crime Investigation Division: www.spo.go.kr / 1301
  • Korean National Police Agency Cyber Security Bureau: cyberbureau.police.go.kr / 182 (no area code)

Article 12 (Changes to the Personal Information Processing Policy)

  • This personal information processing policy applies from the effective date, and if additions, deletions, or corrections are made according to laws and policies, such changes will be notified through the notice board 7 days prior to enforcement.
  • However, if there are significant changes to the rights of the data subject, notification will be made at least 30 days in advance.