Online Consultation New Post

[RESUM Plastic Surgery Clinic Privacy Policy] RESUM Plastic Surgery Clinic (hereinafter "the Clinic") places great importance on the protection of personal information on the Internet and does its utmost to ensure that the personal information users provide to the Clinic when using its services is protected. Accordingly, the Clinic has established and complies with a personal information protection policy based on the relevant laws and regulations that information and communications service providers must observe, including the Protection of Communications Secrets Act, the Telecommunications Business Act, and the Act on Promotion of Information and Communications Network Utilization, etc. This Privacy Policy may be revised from time to time due to changes in government laws and guidelines or in the Clinic's internal policies, and whenever a change is made, the Clinic immediately reflects it in the Privacy Policy posted on the home page of its website. Through this Privacy Policy, users can understand for what purposes and in what manner the personal information collected is used, and how it is kept safe. This Privacy Policy is organized in the following order. 1. Items of Personal Information Collected and Methods of Collection 2. Purposes of Collection and Use of Personal Information 3. Provision and Sharing of Personal Information 4. Period of Retention and Use of Personal Information 5. Procedures and Methods for Destruction of Personal Information 6. Rights of Users and Legal Representatives and How to Exercise Them 7. How to Withdraw Consent / Cancel Membership 8. Installation and Operation of Automatic Personal Information Collection Devices and Refusal Thereof 9. Operation and Management of Visual Data Processing Devices 10. Measures to Ensure the Security of Personal Information 11. Chief Privacy Officer 12. Duty to Give Notice of Policy Changes 1. Items of Personal Information Collected and Methods of Collection At the time of membership registration, the Clinic collects only the minimum personal information necessary for the use of its services. The information collected for you to use the Clinic's services consists of required items and optional items entered at the time of membership registration, and your use of the services is not restricted even if you do not enter optional items such as whether to receive emails. a. Items collected at the time of medical care - Required items: Name (in Korean), address, contact information - Health information: Personal health information that the medical staff deems necessary for the provision of medical services, such as medical history and family history. ※ Under the Medical Service Act, the Clinic is required to retain unique identification information and medical treatment information. (Separate consent is not obtained for the collection of medical treatment information.) b. Items collected at the time of website membership registration - Required items: Name, ID, password, address, contact information (telephone number, mobile phone number) - Optional items: Email address, whether to receive emails - Sensitive information: Past medical history, surgical history, surgical fields of interest - The following information may be automatically generated and collected in the course of using the services or processing service-related tasks. (Service use records, access logs, cookies, access IP information) - Identity verification (mobile phone verification / i-PIN verification): Name, identity verification value, i-PIN number for i-PIN members, date of birth, gender, ID, password, contact information (email address, mobile phone number), legal representative information for persons under 14 years of age, registration verification information c. Items collected at the time of payment of medical fees - For credit card payments: Card payment approval information such as the name of the card company and the card number d. Methods of collecting personal information - Personal information is collected by the following methods. Website (membership registration, surgery cost consultation, KakaoTalk consultation, live consultation, online reservation, online consultation, real reviews, etc.), written forms, fax, telephone, email 2. Purposes of Collection and Use of Personal Information The Clinic uses the personal information it collects for the following purposes. All information provided by users will not be used for any purpose other than those required for the purposes below, and prior consent will be sought if the purpose of use changes. - Medical care, examinations, reservation inquiries, and identity verification procedures for medical care - Services for diagnosis and treatment - Administrative services such as billing, receipt, and refund of medical fees - Sending of medical bills, statements, and various certificates, and sending of medicines, goods, and results - Provision of medical information to other medical institutions in connection with referrals and return referrals - Securing channels of communication for delivering notices and handling civil complaints and grievances - Materials for responding to online consultations - Provision of information on new services and events - Quality management of medical care, and legal and administrative responses and measures for the operation of the Clinic - Minimum analytical data necessary for education and research - Provision of medical information, academic information, and information about the Clinic - Use as reference materials for the smooth provision of services during consultation and medical care - Collection of information for consumers pursuant to Article 52 of the Framework Act on Consumers 3. Provision and Sharing of Personal Information Except where you have given your consent or where required by the provisions of relevant laws and regulations, the Clinic will not under any circumstances use your personal information beyond the scope notified in "Purposes of Collection and Use of Personal Information" or provide it to other persons, companies, or institutions. However, the following cases are exceptions. - Where users have consented to disclosure in advance - Where required by the provisions of laws and regulations, or where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by laws and regulations - Where it is necessary for the compilation of statistics, academic research, or market research, and the information is provided after being processed into a form in which a specific individual cannot be identified 4. Period of Retention and Use of Personal Information The Clinic destroys your personal information without delay once the purpose for which it was collected or provided has been achieved. - Membership registration information: When you cancel your membership or are expelled from membership - Information collected for purposes such as surveys and events: When the survey, event, etc. concerned has ended - Information collected for medical purposes: Retained in accordance with the periods specified in Article 15, "Preservation of Medical Records," of the Enforcement Rule of the Medical Service Act (patient register: 5 years, medical records: 10 years), (items retained: name, address, medical treatment information) - Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.) - Records on the collection, processing, and use of credit information: 3 years (Credit Information Use and Protection Act) - Records on identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.) - Records on visits: 3 months (Protection of Communications Secrets Act) ※ However, even where the purpose of collection or provision has been achieved, your personal information may be retained where it is necessary to preserve it under the provisions of laws and regulations such as the Commercial Act. 5. Procedures and Methods for Destruction of Personal Information The Clinic destroys personal information immediately after the "Purposes of Collection and Use of Personal Information" have been achieved. The procedures and methods of destruction are as follows. a. Destruction procedure Information entered by users for membership registration and the like is destroyed immediately after its purpose has been achieved, by the destruction methods set out below. b. Time limit for destruction Where the retention period of a user's personal information has expired, the personal information is destroyed within 5 days from the last day of the retention period, and where the personal information has become unnecessary, such as upon achievement of the purpose of processing, discontinuation of the relevant service, or termination of the business, it is destroyed within 5 days from the date on which the processing of the personal information is deemed unnecessary. c. Destruction methods Personal information stored in the form of electronic files is deleted using technical methods that make the records impossible to reproduce. Personal information printed on paper is destroyed by shredding or incineration. 6. Rights of Users and Legal Representatives and How to Exercise Them When a customer requests access to, correction of, or deletion of personal information, the Clinic responds to the request in good faith and handles it without delay. To protect personal information, the Clinic does not provide procedures for access to, correction of, or deletion of a customer's personal information by any method of application other than a visit by the customer, such as telephone, mail, or fax. a. Access to personal information Customers may visit the Clinic and request access to their personal information, and the Clinic will respond promptly. b. Correction/deletion of personal information - When a customer requests correction/deletion of personal information, the Clinic makes the correction/deletion without delay where it is deemed necessary, such as where the personal information is found to contain an error. The Clinic may request supporting documents necessary to verify the facts of the correction/deletion. The personal information concerned will not be used or provided until the correction is completed. In addition, where incorrect personal information has already been provided to a third party, the Clinic will notify the third party of the result of the correction without delay so that the correction is made. - When a customer requests access to, correction of, or deletion of his or her own personal information, the Clinic verifies the customer's identity by having the customer present an identification document such as a resident registration card, passport, or driver's license. - When a customer's agent visits and requests access, correction, or deletion, the Clinic verifies whether the person is a legitimate agent by checking the customer's power of attorney and consent form, the agent's identification document, and the like. - Where the Clinic has justifiable grounds to refuse access to, correction of, or deletion of all or part of the personal information, it notifies the customer and explains the reasons. - Cases in which access to and correction of personal information may be restricted - Where there is a risk of significant harm to the life, body, property, or rights and interests of the person concerned or a third party - Where there is a risk of significant interference with the business of the service provider concerned - Where it would violate laws and regulations, etc. - Membership registration by children under 14 years of age (hereinafter "children") is carried out through a separate form, and the consent of a legal representative is always sought when personal information is collected. - To obtain the consent of the legal representative, the Clinic collects from the child the minimum information required, such as the name and contact information of the legal representative, and obtains the consent of the legal representative by the methods prescribed in the Privacy Policy. - Users and legal representatives may exercise their rights concerning personal information by contacting the Clinic via the Internet, telephone, in writing, or the like, and the Clinic will take the necessary measures without delay. ※ Personal information that is required by law to be retained cannot be corrected/deleted within the retention period even upon request. 7. How to Withdraw Consent or Cancel Membership You may at any time withdraw the consent you gave at the time of membership registration to the collection, use, and provision of your personal information. To withdraw consent (cancel membership), you may click "Withdraw Consent (Cancel Membership)" on the website and, after completing the identity verification procedure, withdraw your consent (cancel your membership) directly, or you may contact the person in charge of personal information, in which case the Clinic will take the necessary measures without delay, such as destroying your personal information. 8. Installation and Operation of Automatic Personal Information Collection Devices and Refusal Thereof To provide users with specialized, customized services, the Clinic uses "cookies," which store users' information and retrieve it from time to time. A cookie is a small amount of information that a website sends to the web browser on a user's computer, and it may also be stored on the PC's hard disk. a. Purposes of using cookies - Cookies identify a user's computer but do not individually identify each user. Using these cookies, the Clinic can determine the patterns of visits to and use of each service that users have visited, the number of users, and the like, and thereby create more convenient services. - Users can choose whether to use cookies by adjusting the options in their web browser. That is, you may accept all cookies, have a notice sent whenever a cookie is installed, or refuse all cookies. - However, users must allow cookies in order to log in and use the services after accessing the Clinic's website. b. Installation, operation, and refusal of cookies - Users have the right to choose whether cookies are installed. Accordingly, by setting the options in their web browser, users may allow all cookies, be asked for confirmation each time a cookie is stored, or refuse the storage of all cookies. - As a method of refusing cookie settings, users may, by selecting the options in the web browser they use, allow all cookies, be asked for confirmation each time a cookie is stored, or refuse the storage of all cookies. - Examples of settings • Internet Explorer: Tools menu at the top of the web browser > Internet Options > Privacy > Settings • Chrome: Settings menu on the right side of the web browser > Show advanced settings at the bottom of the screen > Content settings button under Privacy > Cookies - However, if you refuse the storage of cookies, you may have difficulty using some of the Clinic's services that require login. 9. Measures to Ensure the Security of Personal Information [Minimization and training of employees handling personal information] The Clinic keeps the designation of personal information handlers to a minimum and provides regular training. [Regular internal inspections] To ensure security in the handling of personal information, the Clinic regularly conducts internal inspections at least once a year. [Establishment and implementation of an internal management plan] The Clinic has established and implements an internal management plan for the safe processing of personal information. [Encryption of personal information] Among users' personal information, passwords are stored and managed in encrypted form so that only the user knows them, and for important data the Clinic uses separate security functions such as encrypting files and transmitted data. [Technical measures against hacking and the like] To prevent the leakage of or damage to personal information caused by hacking, computer viruses, and the like, the Clinic installs security programs and periodically updates and inspects them, installs its systems in an area where access from outside is controlled, and monitors and blocks intrusions by technical and physical means. [Restriction of access to personal information] The Clinic takes the measures necessary to control access to personal information by granting, changing, and revoking access rights to the database systems that process personal information, and controls unauthorized access from outside by using an intrusion prevention system. [Access control for unauthorized persons] The Clinic maintains a separate physical storage location for the personal information systems that hold personal information, and has established and operates access control procedures for that location. 10. Operation and Management of Visual Data Processing Devices The Clinic operates and manages visual data processing devices as follows. [Grounds and purposes of installation] Safety of patients and facilities, and prevention of fire and crime [Number of devices, locations, and areas recorded] Number of devices: 00 in total Locations and areas recorded: Lobby, corridors, consultation rooms, treatment rooms, recovery rooms, etc. [Person in charge of management] Person in charge of management: Chief Director [Recording hours and processing methods of visual data] Recording hours: 24 hours a day Processing methods: Matters concerning the use of personal visual data for purposes other than the intended purpose, its provision to third parties, its destruction, and requests for access and the like are recorded and managed, and upon expiration of the retention period the data is permanently deleted by a method that makes recovery impossible (printed materials are shredded or incinerated). [Measures in response to data subjects' requests for access to visual data and the like] If you wish to access your personal visual data or confirm its existence, you may make a request to the operator of the visual data processing devices at any time. However, this is limited to personal visual data in which you were recorded and personal visual data that is clearly necessary for the urgent interests of a data subject's life, body, or property. Notwithstanding a data subject's request for access and the like, such a request concerning personal visual data may be refused in the following cases. - Where the personal visual data has been destroyed because its retention period has expired - Where there are other justifiable grounds for refusing the data subject's request for access and the like [Technical, administrative, and physical measures for the protection of visual data] Visual data processed by the Clinic is managed safely through measures such as encryption. In addition, as administrative measures for the protection of personal visual data, the Clinic grants differentiated access rights to personal information, and to prevent forgery and alteration of personal visual data, it records and manages the date and time the personal visual data was created and, when it is accessed, the purpose of access, the person accessing it, and the date and time of access. Locking devices are also installed for the safe physical storage of personal visual data. 11. Chief Privacy Officer To protect your personal information and handle complaints related to personal information, the Clinic has appointed a Chief Privacy Officer as follows. [Chief Privacy Officer] Person in charge of management: Chief Director Person in charge of handling: Chief Director Affiliation: RESUM Plastic Surgery Clinic Position: Director Telephone: 02-3445-7770 Email: kws0788@drkook.co.kr You may report all complaints related to personal information protection that arise while using the Clinic's services to the Chief Privacy Officer. The Clinic will respond promptly and sufficiently to matters reported by users. If you need to report or consult about any other infringement of personal information, please contact the organizations below. Personal Information Dispute Mediation Committee (http://www.1336.or.kr / 1336) Cybercrime Investigation Division, Supreme Prosecutors' Office (http://www.spo.go.kr / (02) 3480-3573) Cyber Terror Response Center, National Police Agency (http://www.ctrc.go.kr / (02) 392-0330) 12. Duty to Give Notice of Policy Changes This Privacy Policy was established on August 16, 2012. If any content is added, deleted, or amended due to changes in laws and regulations, policies, or security technology, the Clinic will give notice of the reasons for and details of the change through its website at least 7 days before the revised Privacy Policy takes effect. Date of announcement: August 23, 2012 Effective date: September 1, 2012