Privacy Policy Terms and Conditions
Article 1 (Purpose of Processing Personal Information)
Onlif Clinic (hereinafter referred to as "Clinic") processes personal information for the purposes of each of the following goals, and the processed personal information will not be used for purposes other than the following purposes. If the purpose of use is changed, necessary measures will be implemented, such as obtaining separate consent under Article 18 of the 「Personal Information Protection Act」.
Homepage User Management
Identification and management of homepage users, prevention of unauthorized use, and various notifications and announcementsProvision of Goods or Services
Medical treatment/treatment reservation, counseling services, reading information such as medical records, health-related content, customized services, fee payment/settlement, debt collection, marketing/promotions/events operations, identifying civil petitioners/complaint matters, and resolution of grievancesManagement of Executives, Employees, and Partners
Recruitment and management of executives and employees, and management of trustees and partners
Article 2 (Processing and Retention Period of Personal Information)
① The Clinic processes and retains personal information within the personal information retention/use period according to relevant laws and regulations or within the period agreed upon when collecting the personal information from the information subject.
② The processing and retention period for each piece of personal information is as follows:
A. Homepage User Management : For 5 years from the termination of the commercial relationship
However, in the event of the following grounds, until the end of the relevant grounds:
If an investigation or inquiry due to illegal acts is in progress, until the end of such investigation or inquiry
If credit/debt relations remain, until the settlement of the relevant credit/debt relations
B. Provision of Goods or Services : For 5 years from the termination of the commercial relationship
However, in the event of the following grounds, until the end of the relevant period:
Records on transactions such as displays/advertisements, contract details, and performance, in accordance with the 「Act on Consumer Protection in Electronic Commerce, etc.」
- Records on displays/advertisements: 6 months
- Records on contract or withdrawal of subscription, payment, supply of services, etc.: 5 years
- Records on consumer complaints or dispute resolution: 3 yearsRetention of communication confirmation data in accordance with the 「Protection of Communications Secrets Act」
- Subscriber's telecommunication date/time, start/end time, counterpart subscriber number, frequency of use, location tracking data of transmission base station: 1 year
- Computer communication, internet log record data, access point tracking data: 3 monthsRetention of medical records, etc. in accordance with the 「Medical Service Act」
- Patient list: 5 years
- Medical record: 10 years
- Prescription: 2 years
- Surgical record: 10 years
- Examination details and examination finding records: 5 years
- Radiograph (including imaging) and finding report: 5 years
- Nursing record: 5 years
- Copy of certificate (such as medical certificate): 3 years
C. Management of Executives, Employees, and Partners
- Executive/Employee information: 3 years from retirement
- Applicant information: 1 year from the completion of recruitment
- Information of the person in charge from partners and trustees: 5 years from the termination of the business relationship
Article 3 (Provision of Personal Information to Third Parties)
The Clinic processes the personal information of the information subject only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides personal information to third parties only in cases that fall under Articles 17 and 18 of the 「Personal Information Protection Act」, such as the consent of the information subject and special provisions of the law.
Article 4 (Entrustment of Personal Information Processing)
① The Clinic entrusts the personal information processing work as follows to ensure smooth processing of personal information.
② When concluding a consignment contract, the Hospital specifies in documents such as the contract matters regarding the prohibition of processing personal information outside the purpose of performing the consigned tasks, technical and administrative protection measures, restrictions on re-consignment, management and supervision of the trustee, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the trustee processes personal information safely.
③ If the contents of the consigned tasks or the trustee change, we will disclose it through this Privacy Policy without delay.
Article 5 (Rights, Obligations, and Verification Methods of Information Subjects and Legal Representatives)
① The data subject may exercise rights such as requesting access to, correction of, deletion of, or suspension of processing of personal information against the Hospital at any time.
② The exercise of rights pursuant to Paragraph 1 may be made in writing, by e-mail, etc. to the Hospital in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Hospital will take measures on this without delay.
③ The exercise of rights pursuant to Paragraph 1 may be made through an agent, such as a legal representative of the data subject or a person who has been delegated. In this case, you must submit a power of attorney in accordance with Form No. 11 of the "Notification on the Method of Processing Personal Information".
④ The request for access to and suspension of processing of personal information may be restricted under Article 35, Paragraph 4, and Article 37, Paragraph 2 of the Personal Information Protection Act.
⑤ Requests for the correction and deletion of personal information cannot be made if the personal information is explicitly designated as a subject of collection in other laws and regulations.
⑥ When a request for access, correction/deletion, or suspension of processing is made in accordance with the rights of the data subject, the Hospital verifies whether the person making the request for access, etc. is themselves or a legitimate agent.
Article 6 (Items of Personal Information Processed) The Hospital processes the following personal information items.
Website User Management
- Name, whether they are 14 years of age or older, phone number, email address
Provision of Goods or Services
- Required items: Name, date of birth, gender, address, phone number, email address, payment information (credit card information, etc.) - Optional items: Area of interest for procedures, past procedure experience, past medical history, medication information, allergic reaction status
3. In the process of using the Internet, IP addresses, cookies, MAC addresses, service usage records, and visit records may be automatically generated and collected.
Article 7 (Destruction of Personal Information)
① When personal information became unnecessary, such as the expiration of the retention period of personal information or attainment of the purpose of processing, the Hospital destroys the personal information without delay.
② If the personal information retention period consented to by the data subject has elapsed or the purpose of processing has been achieved, but personal information must continue to be preserved in accordance with laws and regulations, the relevant personal information is moved to a separate database (DB) or stored in a different location.
③ The procedure and method of destroying personal information are as follows.
Destruction Procedure
The Hospital selects the personal information for which the reason for destruction occurred and destroys the personal information with the approval of the Personal Information Protection Officer (Lee Jae-woon).
2. Destruction Method
The Hospital destroys personal information recorded and stored in the form of electronic files so that the records cannot be reproduced, and personal information recorded and stored in paper documents is shredded with a shredder or incinerated.
Article 8 (Measures to Ensure the Safety of Personal Information) The Hospital takes the following measures to ensure the safety of personal information.
1. Administrative measures: Formulation and implementation of internal management plans, etc.
2. Technical measures: Management of access rights to personal information processing systems, etc., installation of access control systems, encryption of unique identification information, etc., installation of security programs 1. Administrative measures: Formulation and implementation of internal management plans, etc.
1. Administrative measures: Formulation and implementation of internal management plans, etc.
3. Physical measures: Access control to computers containing medical data, etc.
Article 9 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)
① The Hospital uses 'cookies' that store and periodically retrieve user information in order to provide individual customized services to users.
② Cookies are a small amount of information that the server used to operate the website sends to the browser of the user's device, such as a computer, and is also stored on the users' devices.
A. Purpose of using cookies: It is used to provide optimized information to users by understanding the visit and usage patterns of each service and website visited by users, popular search terms, and secure connection status.
B. Installation, operation, and refusal of cookies: You can refuse to store cookies through the option settings in the Tools > Internet Options > Privacy menu at the top of the web browser.
C. If you refuse to store cookies, difficulties may arise in using customized services.
Article 10 (Personal Information Protection Officer)
① The Hospital is in charge of overall responsibility for the processing of personal information and has designated a Personal Information Protection Officer as follows for handling complaints and remedying damages of data subjects related to the processing of personal information.
[Personal Information Protection Officer]
Name: Lee Jae-woon
Position: Representative Director
Contact: <Phone Number> 1833-8171
② Users may inquire to the Personal Information Protection Officer and the department in charge about all inquiries related to personal information protection, complaint handling, damage relief, etc. that occurred while using the Hospital's services. The Hospital will respond and process the user's inquiries without delay.
Article 11 (Criteria for Determining Additional Use/Provision)
The Hospital may additionally use and provide personal information without the consent of the data subject in consideration of matters in accordance with Article 15 and Article 17 of the Personal Information Protection Act, and Article 14-2 of the Enforcement Decree of the Personal Information Protection Act. Accordingly, in order for the Hospital to make additional use and provision without the consent of the data subject, the following matters were considered.
- Whether the purpose of additionally using and providing personal information is related to the original purpose of collection
- Whether there is predictability of additional use and provision in light of the circumstances under which the personal information was collected or the processing practices
- Whether the additional use and provision of personal information unfairly infringes upon the interests of the data subject
- Whether necessary measures to secure safety, such as pseudonymization or encryption, have been taken
Article 12 (Request for Inspection of Personal Information)
The data subject may make a request for access to personal information in accordance with Article 35 of the Personal Information Protection Act to the Personal Information Department in Article 10.
Article 13 (Method of Remedying Infringement of Rights)
To obtain remedy for personal information infringement, the data subject can apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency Personal Information Infringement Report Center, etc. In addition, for other reports and consultations on personal information infringement, please contact the institutions below.
- Personal Information Dispute Mediation Committee: (Without area code) 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: (Without area code) 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: (Without area code) 1301 (www.spo.go.kr)
- National Police Agency: (Without area code) 182 (cyberbureau.police.go.kr)
Article 14 (Installation and Operation of Visual Information Processing Devices)
The Hospital installs and operates visual information processing devices as follows.
Basis and Purpose of Installation of Visual Information Processing Devices: Facility safety and fire prevention of the Hospital
Number of installations, installation location, and shooting range: 65 units are installed in hospital treatment rooms, corridors, etc. to record the entire scope of the relevant space.
Person in charge of management, person in charge, and person authorized to access visual information
- Manager & Person in charge: Lee Jae-woon
- Persons authorized to access visual information: Onlif Plastic Surgery, Onlif & Partners Co., Ltd., Hikvision Co., Ltd.
Visual information recording time, storage period, storage place, processing method
- Recording time: 24-hour recording
- Retention period: 90 days from the time of recording
- Storage place and processing method: Stored and processed in the visual information processing equipment control room
5. Method and location to verify visual information: Request to the Personal Information Department of Article 10
6. Measures in response to data subject's request for inspection, etc. of visual information: Application must be made through a request form for inspection or confirmation of existence of personal visual information, and inspection is allowed only in cases where the data subject themselves is recorded or when it is clearly necessary for the life, body, or property interests of the data subject
7. Technical, administrative, and physical measures for the protection of visual information: Establishment of internal management plans, control of access and restriction of access rights, application of technology for safe storage and transmission of visual information, retention of processing records and preventive measures against forgery/falsification, provision of storage facilities and installation of locking devices, etc.
Article 15 (Application and Change of Privacy Policy)
If there are additions, deletions, or modifications to the contents of the Privacy Policy, we will notify you in advance through the website.
Article 16 (Addendum)
1. This Privacy Policy (ver2.0) will be enforced from September 10, 2025.
2. Privacy Policy version number: v2.0
You can check the previous Privacy Policy at the link below.
Ver1.0 / Jan 01, 2021 ~ Sep 10, 2025