KR
EN
CNCHEONGDAM AIOO Clinic Privacy Policy
We hereby inform you of the Privacy Policy of CHEONGDAM AIOO Clinic.
All personal information handled by CHEONGDAM AIOO Clinic (hereinafter referred to as "the Clinic") is collected, retained, and processed in compliance with the personal information protection regulations of related laws, including the "Personal Information Protection Act" (hereinafter referred to as "the Act").
The Clinic has established the following processing policy to protect users' personal information and rights and interests according to the Act and to smoothly handle users' grievances related to personal information.
In addition, when changing the Privacy Policy, we plan to disclose the timing of implementation and compare before and after the change so that data subjects can easily check the changed contents.
1. Purpose of Processing, Processing and Retention Period, and Items of Personal Information Processed
The Clinic registers and discloses the purpose of processing, processing and retention period, and items of personal information processed to the Ministry of the Interior and Safety in accordance with Article 32 of the Act.
The status of personal information files can be found by entering "CHEONGDAM AIOO Clinic" in the agency name field under Personal Information Protection Comprehensive Support Portal (www.privacy.go.kr) > Personal Information Complaints > Request for View of Personal Information > Search Personal Information File List.
2. Matters Concerning Use Beyond Purpose and Provision to Third Parties
Status of Use Beyond Purpose and Provision to Third Parties: As a rule, the Clinic processes the personal information of the data subject within the scope specified for the purpose of collection and use, and does not process it beyond the original purpose or provide it to a third party without the prior consent of the data subject, except in the following cases.
○ When separate consent is obtained from the data subject
○ When there are special provisions in other laws
○ When it is deemed clearly necessary for the urgent life, physical, or property interests of the data subject or a third party, and the data subject or their legal representative is unable to express their intention or prior consent cannot be obtained due to unknown address, etc.
○ When necessary for purposes such as compiling statistics and academic research, and personal information is provided in a form that cannot identify specific individuals
○ When the competent affairs prescribed by other laws cannot be performed unless personal information is used for purposes other than the intended purpose or provided to a third party, and it has undergone deliberation and resolution by the Protection Commission
○ When necessary to provide it to a foreign government or an international organization to implement treaties and other international agreements
○ When necessary for criminal investigation and the filing and maintenance of a public prosecution
○ When necessary for the court's trial procedures
○ When necessary for the execution of a sentence, care and custody, or protective disposition
The Clinic may link and provide personal information to other institutions in accordance with the above. In this case, we request in writing that the institution wishing to use or receive personal information limit the purpose, method, period, and form of use, or establish specific measures necessary to ensure the safety of personal information, and the personal information linked and provided is provided to the minimum extent appropriate for the purpose of use and provision.
3. Matters Concerning the Entrustment of Personal Information Processing
Status of Entrustment of Personal Information Processing: When entrusting the processing of personal information, it is handled according to a document containing the following contents in accordance with Article 26 of the Act.
○ Matters concerning the prohibition of processing personal information for purposes other than the performance of entrusted tasks
○ Matters concerning technical and administrative protective measures for personal information
○ Other matters concerning the safe management of personal information
○ Purpose and scope of entrusted tasks
○ Matters concerning restrictions on re-entrustment
○ Matters concerning measures to secure safety, such as restricting access to personal information
○ Matters concerning supervision, such as checking the management status of personal information held in connection with entrusted tasks
○ Matters concerning liability, such as compensation for damages, when the person entrusted with processing personal information (hereinafter referred to as the "Trustee") violates the obligations to be observed
○ The Clinic discloses the Trustee and the contents of the entrusted tasks on this website.
4. Matters Concerning the Rights and Obligations of Data Subjects and Methods of Exercising Them
The data subject may exercise the following rights, and the legal representative of a child under the age of 14 may request access, correction/deletion, and suspension of processing of the child's personal information.
A. Request for Access to Personal Information
The data subject may request access to their personal information in accordance with Article 35 of the Act. However, access may be restricted or denied in the following cases.
○ When access is prohibited or restricted by law
○ When there is a risk of harming the life or body of another person, or unjustly infringing on the property and other interests of another person
○ When it causes a serious hindrance to the performance of the following tasks by a public institution
○ Tasks related to the imposition, collection, or refund of taxes
○ Tasks related to grade evaluation or selection of enrollees at schools of each level under the "Elementary and Secondary Education Act" and "Higher Education Act," lifelong educational facilities under the "Lifelong Education Act," and higher education institutions established under other laws
○ Tasks related to testing and qualification screening concerning academic background, skills, and employment
○ Tasks related to ongoing evaluation or judgment regarding the calculation of compensation or benefits
○ Tasks related to ongoing audits and investigations under other laws
B. Request for Correction/Deletion of Personal Information
The data subject who has viewed their personal information may request correction/deletion in accordance with Article 36 of the Act. However, if the personal information is specified as an object of collection in other laws, deletion cannot be requested.
C. Request for Suspension of Processing of Personal Information
The data subject may request the suspension of processing of their personal information in accordance with Article 37 of the Act. However, the request for suspension of processing may be rejected in the following cases.
○ When there are special provisions in the law or when it is inevitable to comply with legal obligations
○ When there is a risk of harming the life or body of another person, or unjustly infringing on the property and other interests of another person
○ When the competent affairs prescribed by other laws cannot be performed if the public institution does not process the personal information
○ When it is difficult to fulfill the contract, such as being unable to provide the services agreed upon with the data subject, if personal information is not processed, and the data subject has not clearly expressed the intention to terminate the contract
The exercise of rights according to the above can be done in writing, via email, or fax according to the "Request for Access, Correction/Deletion, Suspension of Processing of Personal Information" in [Form 1], and the Clinic will take action without delay.
In the case of exercising rights according to the above, a verification process must be gone through to prove that you are the data subject as follows.
In the case of the data subject (oneself), submission of a certificate that can verify identity (such as a Resident Registration Card, Driver's License, etc., officially certified by an administrative agency that cannot be easily altered or stolen)
The legal representative of the data subject or a delegated person must submit a certificate that can verify identity, such as a Power of Attorney [Form 2], and the Resident Registration Card of the delegator and representative
Verification through an authentication process using an accredited certificate on the website or online
5. Procedure and Method for Destroying Personal Information
In principle, when the retained personal information becomes unnecessary (expiration of the retention period, achievement of the processing purpose, etc.), the Clinic destroys the relevant personal information without delay.
However, this may not apply if preservation is required by other laws. The procedure, deadline, and method of destruction are as follows.
A. Destruction Procedure
Unnecessary personal information and personal information files are processed according to internal policies and legal procedures under the responsibility of the Chief Privacy Officer.
B. Destruction Deadline
When the retention period has expired or the personal information becomes unnecessary, such as the achievement of the personal information processing purpose or abolition of the relevant business, it is destroyed without delay.
C. Destruction Method
Electronic files are permanently deleted using technical methods that cannot reproduce the records, and personal information printed on paper is destroyed by shredding or incineration.
6. Measures to Ensure the Safety of Personal Information
The Clinic takes the following measures to ensure the safety of personal information.
A. Restriction of Access to Personal Information
We take necessary measures to control access to personal information by granting, modifying, and canceling access rights to the database system that processes personal information, and we control unauthorized access from the outside using an intrusion prevention system.
B. Retention of Access Records
Records of accessing the personal information processing system (web logs, summary information, etc.) are kept and managed for at least 6 months.
C. Encryption of Personal Information
Personal information is safely stored and managed through encryption, etc., and important data uses separate security functions such as being encrypted when stored and transmitted.
D. Minimization and Training of Employees Handling Personal Information
Employees who handle personal information are designated and managed only to the strictly necessary personnel, and training for safe management is provided for those employees.
E. Installation of Security Programs and Periodic Inspection/Update
Security programs are installed and periodically updated and inspected to prevent personal information from being leaked or damaged by hacking or computer viruses.
F. Access Control for Unauthorized Persons
A separate physical storage location is set for the personal information system holding personal information, and access control procedures for this are established and operated.
7. Remedies for Infringement of Rights and Interests
Data subjects can apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center, etc., to seek relief for damages caused by personal information infringement.
List of Supplementary Materials / Category / Contact
Personal Information Dispute Mediation Committee: 02-405-5150 (kopico.or.kr), 118 (privacy.kisa.or.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office Cyber Crime Investigation Division: 02-3480-3571 (cybercid@spo.go.kr)
National Police Agency Cyber Safety Bureau: 182 (www.netan.go.kr)
In addition, those whose rights or interests are infringed due to dispositions or omissions made by the Clinic regarding requests for access, correction/deletion, or suspension of processing of personal information can file an objection with the Clinic and may request an administrative appeal as prescribed by the Administrative Appeals Act.
Filing an Objection: Submit a formal objection for access to personal information [Form 3] to the Clinic.
Request for Administrative Appeal: Submit a request for administrative appeal [Form 4] (2 copies) to the Administrative Appeals Commission or the Clinic.
※ Administrative Appeals Commission: ☎110 (www.simpan.go.kr) refer to the guide
8. Privacy Officer and Person in Charge Contact Information
The Privacy Officer and related staff are as follows.
Chief Privacy Officer: Kim Dong-yeop
Privacy Protection Department and Person in Charge: Kim Dong-yeop
Contact: 02-6953-1175
9. Installation and Operation of Visual Data Processing Devices
Please refer to the [Visual Data Processing Device Operation and Management Policy].
Self-inspection results of visual data processing device installation and operation
10. Matters Concerning Changes to the Privacy Policy
This policy was revised on October 15, 2026, and if there are any additions, deletions, or modifications due to changes in laws, policies, or security technologies, we will notify the changes through the Clinic's website by 7 days before implementation.
Announcement Date: August 25, 2026 / Effective Date: August 25, 2026