Grace Plastic Surgery Privacy Policy

Effective Date: August 13, 2026

Grace Plastic Surgery Clinic (hereinafter referred to as "the Clinic") collects, retains, and processes personal information in accordance with relevant laws and regulations, such as the Personal Information Protection Act and the Medical Service Act, and is doing its best to protect the rights and interests of data subjects and to manage personal information safely.

Through its Privacy Policy, this institution provides information on the purposes for which personal information is collected and used, and the procedures by which it is managed. We are also continuously improving our Privacy Policy in accordance with relevant laws and internal operating policies.

Article 1. Items of Personal Information Collected and Methods of Collection

1. When consulting or making a reservation on the website

• name
• mobile phone number
• Email address
• Consultation details
• Directions to visit

2. When using medical services

• name
• birth date
• address
• contact
• Medical records
• case history
• family history
• Health information that medical professionals deem necessary for treatment

3. When using the payment service

• Card company name
• Card authorization information
• Refund Information

4. Automatically collected information

• IP address
• cookie
• Connection logs
• Browser Information
• Service usage records

5. Methods of Collecting Personal Information

• Homepage
• Online consultation
• KakaoTalk Consultation
• Phone consultation
• email
• Seomyeon
• Medical registration

Article 2. Purpose of Collection and Use of Personal Information

This institution collects and uses personal information for the following purposes.

• Medical Appointments and Consultations
• Provision of medical and surgical services
• Medical billing and payment
• Reservation Confirmation and Schedule Information
• Post-operative follow-up and aftercare
• Customer Inquiry and Complaint Handling
• Website operation and service improvement
• Hospital news and event information (upon separate consent)
• Statistics and Analysis for Improving Medical Service Quality

Article 3. Period of Retention and Use of Personal Information

This institution destroys personal information without delay after the purpose of its collection and use has been achieved.

However, in accordance with relevant laws and regulations, personal information may be stored as follows.

• Medical records: Period prescribed by the Medical Service Act
• Website consultation records: Destroyed after purpose is achieved
• Event and marketing information: Until consent is withdrawn

Article 4. Procedures and Methods for Destruction of Personal Information

1. Destruction Procedure

Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed immediately after undergoing separate storage procedures.

2. Method of destruction

• Electronic files: Permanently deleted in an unrecoverable manner
• Paper documents: Shredding or incineration

Article 5. Provision and Sharing of Personal Information

This institution does not provide personal information to external parties without the consent of the data subject.

However, the following cases are exceptions.

• Fulfillment of obligations under laws and regulations
• Performing health insurance-related duties
• lawful request by investigative agencies
• When processing into a form that cannot identify specific individuals for statistical and academic research purposes

Article 6. Entrustment of Personal Information Processing

This institution may entrust personal information processing tasks as follows to ensure the smooth provision of services.

If there is a change in the entrusted company, we will announce it through this Privacy Policy.

Article 7. Rights of Data Subjects and Method of Exercise

Data subjects may request access to, correction of, deletion of, and suspension of processing of their personal information at any time.

Requests regarding personal information may be received through the Chief Privacy Officer, and the Institute processes them without delay in accordance with relevant laws and regulations.

However, the modification or deletion of personal information that is required to be retained for a certain period under relevant laws, such as the Medical Service Act, may be restricted within the statutory retention period.

Article 8. Installation and Operation of Cookies

This institution may use cookies to improve the website user experience.

Users can refuse to store cookies through their web browser settings.

However, if you refuse to store cookies, the use of some services may be restricted.

Article 9. Chief Privacy Officer

Article 10. Measures to Ensure the Safety of Personal Information

This institution is implementing the following measures to protect personal information.

• Personal Information Access Permission Management
• Firewall and security system operation
• Minimize personnel handling personal information
• Regular security training
• Password Management and Access Control
• Establishment and implementation of internal management plans

Article 11. Consultation Agency Regarding Personal Information Infringement

• Personal Information Dispute Mediation Committee: 1833-6972
• Personal Information Infringement Report Center: 118
• Supreme Prosecutors' Office: 1301
• National Police Agency: 182

Article 12. Changes to the Personal Information Processing Policy

This Privacy Policy may be amended in accordance with changes in relevant laws, government policies, or internal operating policies.

If the Privacy Policy is changed, we will announce it in advance through the website.