1. What the website processes and why
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Website access | IP address, browser/device information, time and requested address (server logs) | Delivering the site, security and incident response | Under the hosting provider’s (Cloudflare) security-log policy. The clinic keeps no separate copy. |
| On-site consultation request (optional) | Name, phone, treatment of interest, preferred date/time, message (optional), submission time, page, language | Contacting you to arrange a consultation or booking | Deleted automatically 1 year after submission (earlier on request). The IP address is used only as an irreversible hash for up to 24 hours to block abuse. |
| First-party visit counter | Page path, event type (page view, contact-button click, page-speed rating), date | Daily totals for content improvement | Only daily totals per page are kept. No cookies. The IP address is used only as an irreversible hash for one-minute abuse limits. Not sent when your browser’s DNT or GPC signal is on. |
| AI assistant (optional) | Your questions and recent conversation (up to 7 messages), page language | General answers based on the clinic’s public information | The clinic’s server does not store conversation text or IP addresses. For usage limits it keeps an irreversible daily identifier and counts until the end of the UTC day. The conversation stays only in your browser and is cleared on reload, navigation or deletion. |
| Web analytics (Google Analytics 4, Microsoft Clarity) | Cookie identifiers, pages viewed, scrolling, clicks and other usage, device/browser information, approximate location (country/city), referrer | Visit statistics, usability improvement, counting clicks on contact channels | According to each service’s settings and policy (Google Analytics data retention up to 14 months; Clarity per Microsoft’s policy). |
2. Processors and international transfers
| Recipient | Country | Service | Data |
|---|---|---|---|
| Cloudflare, Inc. | USA (global network) | Hosting, database/file storage, security and traffic handling | Access logs, website data |
| Google LLC | USA | Google Analytics 4 | Cookie identifiers, usage, device information |
| Microsoft Corporation | USA | Microsoft Clarity (usability recordings, heatmaps) | Cookie identifiers, usage, device information |
| Genspark AI API and the connected AI model provider | USA and the providers’ countries | Generating AI assistant answers (only with your consent) | Questions and recent conversation, page language |
| Browser push services of clinic staff devices (Google LLC, Apple Inc., Mozilla, etc.) | USA and others | Delivering encrypted new-request alerts to clinic staff devices | Partially masked name, treatment of interest, preferred date/time |
3. Using the AI assistant
- The assistant works only after you tick the consent box for sending your questions to an external AI provider. All other contact channels remain available without it.
- Do not enter names, phone numbers, ID numbers, photos or medical records. Obvious contact or ID numbers are blocked before sending, but not every kind of personal data can be detected.
- We ask the provider not to store requests (store=false), but data already sent is handled under the provider’s policy and the clinic cannot delete it.
- AI answers do not replace a clinician’s diagnosis, prescription or booking confirmation.
4. Cookies and how to refuse them
The clinic’s own pages and visit counter use no cookies. Google Analytics (_ga, _ga_*) and Microsoft Clarity (_clck, _clsk) use cookies to distinguish visits.
You can block or delete cookies in your browser. If your browser sends the Global Privacy Control (GPC) signal, this website does not load Google Analytics or Clarity. You can also use Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). Refusing cookies does not limit use of the website.
5. External contact channels
KakaoTalk, Naver Place/Booking, LINE, WhatsApp, Instagram and other external channels are governed by their operators’ privacy policies. The website does not receive those conversations or bookings. Information you give the clinic while consulting is used only for consultation and booking.
6. Case photographs
The website does not accept photos from visitors. Case notes are published only with the patient’s separate written consent and are withdrawn if consent is withdrawn.
7. Administrator accounts
The admin area (/admin) is used only by clinic staff and processes their email, name, passkey public keys, 8-hour login sessions, activity logs and the push subscriptions of devices that receive alerts. Consultation requests are visible only to administrator and reviewer accounts.
8. Deletion
Personal information is deleted without delay once the retention period ends or the purpose is fulfilled. Electronic files are deleted irreversibly. First-party statistics retain only daily totals that cannot identify individuals.
9. Your rights
You may request access, correction, deletion or suspension of processing at any time by contacting the privacy officer below by phone or in person. Because the website keeps almost no identifying data, requests are handled to the extent the data can be identified. Children under 14 should not use the AI assistant.
10. Security measures
- Encryption in transit (HTTPS, HSTS)
- Passkey authentication, role separation and activity logs for administrators
- IP-derived values are irreversible and used only for usage limits
- API keys and other secrets are kept only in private server settings
11. Privacy officer
You may also contact the Korean Personal Information Infringement Report Center (privacy.kisa.or.kr, +82-118).
| Item | Details |
|---|---|
| Privacy officer | Park Suho (Representative Director) |
| Telephone | +82-2-540-0700 (Mon–Fri 09:00–19:00, Sat 09:00–17:00, Korea time) |
| Address | 66 Sinbanpo-ro 47-gil, Seocho-gu, Seoul, Korea (BANAL House) |
12. Changes
Changes are announced on this website at least 7 days before they take effect. When analytics, the AI provider or hosting changes, this policy is updated in the same release.