Privacy Policy

Article 1 (Purposes of Processing Personal Information)

COCO Clinic processes personal information for the following purposes. The personal information being processed is not used for any purpose other than those below, and if the purpose of use changes, we will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

• Consultation and appointment management
• Provision of medical services
• Handling of grievances and complaints
• Analysis of website usage and service improvement

Article 2 (Processing and Retention Period of Personal Information)

COCO Clinic processes and retains personal information within the retention and use period prescribed by law, or the period consented to by the data subject when the personal information was collected.

• Consultation and appointment information: 3 years after the consultation ends
• Medical records: 10 years, as required by the Medical Service Act
• Website access logs and usage statistics: up to 26 months from the date of collection

Article 3 (Items of Personal Information Processed)

COCO Clinic processes the following items of personal information.

1. Online consultation requests

• Required: name, treatment of interest, preferred contact method
• Required (depending on the contact method): phone number — not collected if you choose KakaoTalk consultation.
• Optional: inquiry details

2. Items automatically generated and collected while using the website

• IP address (to block unauthorized repeated submissions of the consultation form)
• Inquiry language (the display language selected on the website)
• Cookies, date and time of visit, service usage records, browser and device information

Article 4 (Provision of Personal Information to Third Parties)

COCO Clinic processes personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law.

Article 5 (Outsourcing of Personal Information Processing)

COCO Clinic outsources the following personal information processing tasks for the smooth handling of personal information.

When concluding an outsourcing contract, COCO Clinic specifies in the contract or other documents, pursuant to Article 26 of the Personal Information Protection Act, the prohibition of processing personal information for purposes other than the outsourced task, technical and managerial safeguards, restrictions on re-outsourcing, and the management and supervision of the trustee, and supervises whether the trustee processes personal information safely. If the content of an outsourced task or a trustee changes, we will disclose it through this Privacy Policy without delay.

Article 6 (Overseas Transfer of Personal Information)

COCO Clinic transfers personal information overseas as follows, in accordance with Article 28-8 of the Personal Information Protection Act.

Data subjects may refuse the overseas transfer of their personal information. If you wish to refuse, please contact the Privacy Officer listed in Article 11. However, if you refuse the overseas transfer, the use of some services, such as online consultation requests, may be limited.

Article 7 (Destruction of Personal Information)

COCO Clinic destroys personal information without delay when it becomes unnecessary, such as upon expiry of the retention period or fulfillment of the purpose of processing.

Article 8 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise the following rights regarding personal information protection against COCO Clinic at any time.

• Request access to personal information
• Request correction of any errors
• Request deletion
• Request suspension of processing

Article 9 (Measures to Ensure the Safety of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, COCO Clinic takes the following technical and managerial measures necessary to ensure safety.

• Minimizing the number of staff who handle personal information and training those who do
• Granting differentiated access rights to, and controlling access to, personal information processing systems
• Encrypting personal information in transit (HTTPS/TLS)
• Storing sensitive materials, such as before-and-after photos, separately, with access limited to authenticated users
• Retaining access logs of personal information processing and preventing their forgery or alteration
• Restricting access to, and operating security programs on, systems where personal information is stored and processed

Article 10 (Installation, Operation, and Refusal of Automatic Collection Devices)

COCO Clinic uses 'cookies' and similar technologies that store and periodically retrieve usage information, in order to provide personalized services and understand how the website is used.

• Purpose of cookies — remembering your language setting and whether notice pop-ups have been shown, and improving the service by analyzing website visits and usage patterns
• Analytics tools used — Vercel Analytics (visitor statistics) and Google Analytics (usage analysis). These tools collect access records and similar data; you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Installing, operating, and refusing cookies — you can refuse or delete cookies in your web browser under Settings > Privacy. However, if you refuse cookies, some convenience features, such as keeping your language setting, may not work properly.

Article 11 (Privacy Officer)

COCO Clinic designates the following Privacy Officer, who takes overall responsibility for personal information processing and handles data subjects' complaints and remedies related to personal information processing.

Article 12 (Remedies for Infringement of Rights)

To obtain relief from an infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), and other bodies. For other reports or consultations regarding personal information infringement, please contact the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.police.go.kr)

In addition, a person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act.

Article 13 (Changes to the Privacy Policy)

This Privacy Policy applies from its effective date. When changes are added, deleted, or corrected in accordance with laws or policies, we will give notice through announcements at least 7 days before the changes take effect.