Privacy Policy

Pursuant to Article 30 of the Personal Information Protection Act (PIPA), DAMI Clinic (hereinafter the “Clinic”) establishes and publishes this Privacy Policy as set out below in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

Article 1 (Purposes of Processing Personal Information)

The Clinic processes personal information for the following purposes. The personal information processed will not be used for any purpose other than those below, and if the purpose of use changes, the Clinic will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the PIPA.

Provision of Medical Care and Services — appointment booking and registration, diagnosis, treatment and prescription, collection of fees and issuance of receipts, management of medical records, and aftercare (follow-up checks and guidance on touch-up treatments)
Handling Consultation Bookings — receiving and replying to inquiries through the website consultation form, messengers (WhatsApp · WeChat · LINE · KakaoTalk) and phone, and providing booking confirmation notices
International Patient Attraction Operations — performing the duties of a medical institution attracting international patients under the Act on Support for Overseas Expansion of Healthcare System and Attraction of International Patients, and providing guidance on interpretation and stay support
Compliance with Legal Obligations — preparing and retaining medical records under the Medical Service Act, and filing notifications and reports under relevant laws and regulations

Article 2 (Items of Personal Information Processed)

Category	Items collected	How collected
Book a Consultation	Name, contact details (phone number · messenger ID · email), treatment of interest, preferred date, inquiry details, language used	Website consultation form, messenger, phone
Medical care	Full name, date of birth, gender, contact details, address, nationality and passport number (international patients), medical records (medical history · treatment history · treatment photos), payment information (such as card approval details)	At check-in and during medical care
Automatically collected	Access IP address, cookies, date and time of visit, service usage records	Website access

※ The website operates without membership registration. Before-and-after photos are taken and published only with separate written consent, which may be withdrawn at any time.

Article 3 (Processing and Retention Periods of Personal Information)

The Clinic processes and retains personal information within the retention and use period required by law, or within the retention and use period to which the data subject consented when the personal information was collected.

Category	Retention period	Legal basis
Consultation booking information	1 year after the consultation ends (destroyed without delay if the data subject requests deletion)	Data subject's consent
Medical records	Medical charts 10 years · Prescriptions 2 years · Patient register 5 years · Copies of medical certificates, etc. 3 years · Test findings records 5 years · Nursing records 5 years	Article 15 of the Enforcement Rule of the Medical Service Act
Payment and tax records	5 years	Framework Act on National Taxes and other relevant laws
Website access logs	3 months	Protection of Communications Secrets Act

Article 4 (Provision of Personal Information to Third Parties)

The Clinic processes the personal information of data subjects only within the scope of the purposes set out in Article 1, and does not provide it to third parties except in the following cases.

Where separate consent has been obtained from the data subject
Where special provisions of law exist, or where it is unavoidable in order to comply with legal obligations
Where, under Article 21 of the Medical Service Act, the patient or a person who meets the statutory requirements requests to view or obtain a copy of medical records
Where the Clinic reports its international-patient attraction results to the Ministry of Health and Welfare (Korea Health Industry Development Institute, KHIDI) under Article 11 of the Act on Support for Overseas Expansion of Healthcare System and Attraction of International Patients (limited to statistical items such as nationality, age group and treatment details; identifying information such as names is excluded)

Article 5 (Entrustment of Personal Information Processing and Overseas Transfer)

To ensure smooth operations, the Clinic entrusts the processing of personal information as set out below. In entrustment contracts, the Clinic specifies matters concerning the management and supervision of the processor (entrusted party) in accordance with Article 26 of the PIPA, and supervises to ensure that personal information is processed securely. If a processor changes, the change will be disclosed through this Policy.

Entrusted task	Processor
Website hosting · consultation form transmission	Provider of website hosting and form transmission services
Card payment authorization · sales slip processing	Credit card companies and payment processing providers (VAN · PG)

If you consult through a messenger such as WhatsApp (Meta Platforms), WeChat (Tencent), LINE (LY Corporation) or a KakaoTalk Channel (Kakao), the content of your conversation may be stored on the servers of the relevant service provider (overseas servers, in the case of overseas providers), and each provider's privacy policy applies in addition. The Clinic uses information collected through messengers only for the purpose of responding to consultation and booking inquiries.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

Data subjects may exercise rights against the Clinic at any time, including requests for access, correction, deletion and suspension of processing of their personal information.
Rights may be exercised in writing, by phone or by email, and the Clinic will act without delay. Access to and copies of medical records are handled in accordance with the procedures and documents required under Article 21 of the Medical Service Act.
Where rights are exercised through an agent, such as a legal representative or an authorized delegate, a power of attorney in the form of Attached Form No. 11 of the Notice on Personal Information Processing Methods must be submitted.
Under Article 35(4) and Article 37(2) of the PIPA, the rights of data subjects to request access and suspension of processing may be restricted, and deletion cannot be requested for personal information expressly designated for collection under other laws (such as medical records).

Article 7 (Destruction of Personal Information)

When personal information becomes unnecessary — for example, because the retention period has elapsed or the purpose of processing has been achieved — the Clinic destroys it without delay.
Where personal information must continue to be retained under applicable laws, the Clinic moves it to a separate database or storage location and retains it there.
Information in electronic file form is deleted by technical methods that make recovery impossible, and paper documents are destroyed by shredding or incineration.

Article 8 (Measures to Ensure the Security of Personal Information)

Administrative Measures — establishing and implementing an internal management plan, minimizing the number of staff who handle personal information, and providing regular training
Technical Measures — managing access rights to the medical information system, encrypting passwords and unique identification information, installing and updating security programs, and retaining access logs
Physical Measures — controlling access to medical record storage areas and the server room, and using locking devices

Article 9 (Installation, Operation and Refusal of Automatic Data Collection Devices Such as Cookies)

The website has no login function and does not use cookies that identify individuals. Analytics tools may be used for visit statistics, and when external services such as maps and web fonts are loaded, connection information (such as IP addresses) may be transmitted to the relevant provider. Users may refuse cookie storage in their browser settings, and doing so does not restrict use of the website.

Article 10 (Privacy Officer)

The Clinic bears overall responsibility for matters relating to the processing of personal information, and has designated a Privacy Officer (Chief Privacy Officer) as set out below to handle data subjects' complaints and provide remedies for damage relating to the processing of personal information.

Category	Details
Privacy Officer	Director Park Deok-kyu
Contact	Tel. +82 2 761 1188 (Korea: 02-761-1188) · Email drdamiclinic@gmail.com
Address	9F & 15F, Irex Tower, 375 Yeouidaebang-ro (44-37 Yeouido-dong), Yeongdeungpo-gu, Seoul

Data subjects may contact the Privacy Officer regarding any matter relating to the protection of personal information that arises in connection with the Clinic's services, including inquiries, complaints and requests for remedies, and the Clinic will respond and act without delay.

Article 11 (Remedies for Infringement of Rights and Interests)

Data subjects may apply to the following organizations for dispute resolution, counseling and similar assistance in order to obtain remedies for infringement of personal information.

Personal Information Infringement Report Center (KISA) — 118 (no area code) · privacy.kisa.or.kr
Personal Information Dispute Mediation Committee — 1833-6972 (no area code) · www.kopico.go.kr
Supreme Prosecutors' Office Cyber Investigation Division — 1301 (no area code) · www.spo.go.kr
Korean National Police Agency Cyber Bureau — 182 (no area code) · ecrm.cyber.go.kr

Article 12 (Changes to This Privacy Policy)

This Privacy Policy takes effect on October 2, 2026. If its contents are added to, deleted or amended due to changes in laws, policies or security technology, notice will be given through the website announcements (or this page) starting 7 days before the changes take effect.