Privacy Policy

Article 1 (Purposes of processing personal data)

KOWON Plastic Surgery Clinic ("the Clinic") establishes and discloses this privacy policy pursuant to Article 30 of the Personal Information Protection Act, in order to protect the personal data of data subjects and to handle related grievances promptly and smoothly. The Clinic processes personal data for the following purposes and does not use it for any other purpose.

• Receiving, confirming and following up appointment and consultation requests
• Providing medical services, billing and collecting fees, and managing medical records
• Managing consultation history and handling complaints
• Meeting statutory obligations (creating and retaining medical records under the Medical Service Act, etc.)

Article 2 (Items of personal data collected and methods of collection)

• Online consultation request: name, contact number, procedure of interest, message (required: name and contact number)
• Phone, KakaoTalk, LINE and WhatsApp consultations: name, contact number, message
• In-person treatment: name, resident registration number, address, contact number and other information required for treatment under medical legislation
• Methods of collection: the website consultation form, telephone, messenger consultation channels, and reception on arrival

Article 3 (Processing and retention periods)

The Clinic processes and retains personal data within the retention and use period prescribed by law, or the period consented to by the data subject at the time of collection.

• Online consultation requests: destroyed without delay once the purpose is met (maximum 1 year)
• Medical records: 10 years (Article 15, Enforcement Rules of the Medical Service Act)
• Prescriptions: 2 years; examination reports, radiographs and reading reports: 5 years (Article 15, Enforcement Rules of the Medical Service Act)
• Records of consumer complaints and dispute handling in e-commerce: 3 years (Act on Consumer Protection in Electronic Commerce)

Article 4 (Provision of personal data to third parties)

The Clinic processes personal data only within the scope specified in Article 1, and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply — with the data subject's consent, or under a specific provision of law. At present the Clinic does not provide personal data to any third party.

Article 5 (Outsourcing of processing)

The Clinic may outsource certain work, such as website operation and maintenance, in order to provide services smoothly. When entering into such a contract, the Clinic specifies in writing — in accordance with Article 26 of the Personal Information Protection Act — the prohibition on processing personal data beyond the purpose of the outsourced work, the technical and administrative safeguards required, and restrictions on re-outsourcing, and supervises whether the processor handles personal data safely.

Article 6 (Rights and obligations of data subjects and legal representatives, and how to exercise them)

A data subject may at any time exercise rights against the Clinic, including access, correction, deletion and suspension of processing. These rights may be exercised in writing, by email and by other means, and the Clinic will act on them without delay. For children under the age of 14, a legal representative may exercise these rights.

However, information for which medical legislation imposes a retention obligation, such as medical records, cannot be deleted during the period prescribed by that legislation.

Article 7 (Procedure and method of destruction)

• Procedure: personal data whose retention period has expired or whose purpose has been achieved is destroyed without delay.
• Electronic files: permanently deleted by technical means that make the records irrecoverable
• Paper documents: destroyed by shredding or incineration

Article 8 (Measures to ensure the security of personal data)

• Administrative: establishing and implementing an internal management plan; minimising and training the staff who handle personal data
• Technical: managing access rights to the personal data processing system, installing security software, encrypting data in transit (HTTPS)
• Physical: access control and locks on the areas where medical records are stored

Article 9 (Cookies and other automatic collection devices)

The Clinic's website may use cookies, which store and periodically retrieve usage information in order to provide individually tailored services. Users may refuse the storage of cookies through their browser settings, though some services may then be difficult to use.

Article 10 (Personal data protection officer)

• Data protection officer: Kim Hyung-taek (Director)
• Telephone: 02-6242-7080
• Email: kowon@kowonps.com
• Address: 2F KBL Building, 110 Dosan-daero, Gangnam-gu, Seoul, Korea

Article 11 (Remedies for infringement of rights)

To obtain relief for infringement of personal data rights, a data subject may apply to the following bodies for dispute resolution or advice.

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Privacy Infringement Report Centre: 118 / privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 / www.spo.go.kr
• National Police Agency: 182 / ecrm.police.go.kr

Article 12 (Changes to this privacy policy)

This privacy policy applies from 19 August 2026. Its contents may be added to, deleted or amended in line with changes to legislation, policy or the Clinic's internal rules, and any change will be announced on the website.