Privacy Policy

HanStep Korean Medicine Clinic(hereinafter referred to as the 'Clinic') establishes and discloses this Privacy Policy in accordance with Article 30 of the 「Personal Information Protection Act」 to protect the personal information of data subjects and to handle related complaints promptly and smoothly.

Article 1 (Purpose of Personal Information Processing)

The Clinic processes personal information for the following purposes. The personal information being processed will not be used for any purposes other than the following, and if the purpose of use is changed, necessary measures such as obtaining separate consent will be implemented.

• Medical Appointment and Management: Identity verification, appointment schedule notification, processing of appointment changes and cancellations
• Medical Service Provision: Checking preliminary information (symptoms, areas of interest) for diagnosis and consultation, providing customized medical services
• AI Chatbot Service Operation: Identifying consultation context based on chatbot conversation content and linking with reservations

Article 2 (Items of Personal Information Processed)

The Clinic collects the minimum amount of personal information necessary to provide services.

• Required Items: Name, Contact Information (mobile phone number), Appointment Date and Time
• Optional Items (collected when using the AI chatbot):
  Full conversation history with the chatbot (symptoms, pain areas, areas of interest, consultation details, etc.)
  The moment a user completes a reservation through the chatbot, the conversation log is delivered to the medical staff for medical reference purposes.
• Automatically Collected Items: IP address, cookies, service usage records, access logs

Article 3 (Processing and Retention Period of Personal Information)

The Clinic processes and retains personal information within the period of personal information retention and use as permitted by law or within the period agreed upon when collecting personal information from the data subject.

• Retention Period: Medical appointment information and chatbot consultation logs: Until the purpose of medical treatment is achieved or for [3 years/5 years] from the reservation date (in accordance with the medical record retention period under the Medical Service Act)
• However, if the patient does not receive treatment and simply cancels the consultation/appointment: Destroyed after [1 year] from the date of collection

Article 4 (Provision of Personal Information to Third Parties and Access Rights)

The Clinic provides personal information to third parties only when it falls under Articles 17 and 18 of the 「Personal Information Protection Act」, such as the consent of the data subject or special provisions of the law.

[Specification of System Access Rights] For smooth operation of the reservation system and medical connection, the collected personal information (appointment information and chatbot conversation content) is stored in the Clinic's database and can be accessed by the following entities:

• Medical Staff (Doctors, Nurses, Consultation Managers): For the purpose of preparing for medical consultations and managing appointments
• System Administrators (Web/DB Administrators): For the purpose of system error correction, data backup, and security management

Article 5 (Delegation of Personal Information Processing)

The Clinic entrusts personal information processing tasks as follows for the smooth operation of personal information tasks.

• Delegatee (Trustee): PREDAQ
• Details of Delegated Tasks: Website and reservation system maintenance, DB management, AI chatbot system technical support

Article 6 (Rights, Duties, and Methods of Exercise of Data Subjects)

Users may exercise rights such as requests for access, correction, deletion, and suspension of processing of their personal information at any time, and the Clinic will take action without delay. However, the deletion of medical records that must be preserved under relevant laws, such as the Medical Service Act, may be restricted.

Article 7 (Measures for Ensuring the Safety of Personal Information)

The Clinic is taking the following measures to ensure the safety of personal information.

• Administrative Measures: Establishment and implementation of internal management plans, regular employee training
• Technical Measures: Management of access rights to personal information processing systems (access limited to authorized personnel such as medical staff and system administrators), installation of security programs, encryption of unique identification information
• Physical Measures: Access control to computer rooms, document storage rooms, etc.

Article 8 (Chief Privacy Officer)

The Clinic designates the following Chief Privacy Officer to oversee tasks related to personal information processing and to handle complaints and provide damage relief for data subjects regarding personal information processing.

• Name: Lee Byung-hee (Chief Director)
• Affiliation: HanStep Korean Medicine Clinic
• Contact: 02-546-5455