Privacy Policy

Article 1 (Purposes of Processing Personal Information)

COCO Clinic processes personal information for the following purposes. The personal information being processed is not used for any purpose other than those below, and if the purpose of use changes, we will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

• Consultation and appointment management
• Provision of medical services
• Handling of grievances and complaints
• Sending clinic news and medical column update emails (newsletter)
• Providing chat consultation (AI auto-replies and staff responses)
• Analysis of website usage and service improvement
• Clinic operating statistics (analysis of how patients found COCO Clinic)
• Providing online access to treatment records (visit dates and treatment names, for patients whose identity has been verified)
• Operating the prepaid membership (prepayments, deduction of medical fees, expiry notices and ledger records, refunds)

Article 2 (Processing and Retention Period of Personal Information)

COCO Clinic processes and retains personal information within the retention and use period prescribed by law, or the period consented to by the data subject when the personal information was collected.

• Consultation and appointment information: 3 years after the consultation ends
• Newsletter subscription information: until consent is withdrawn (unsubscribe)
• Chat consultation records: 3 years after the consultation ends (same as consultation and appointment information)
• Notification messages and messenger consultation records (KakaoTalk notifications, text messages, WhatsApp): 3 years after the consultation ends (same as chat consultation records)
• Medical records: 10 years, as required by the Medical Service Act
• Website access logs and usage statistics: up to 26 months from the date of collection
• Pre-visit questionnaire (including how you found COCO Clinic): 3 years from the date of submission
• Treatment record viewing service: mobile phone number until you cancel the service; access logs for 1 year; records of sign-up, cancellation and consent for 2 years after cancellation
• Prepaid membership: 5 years from the day the membership ends (refund completed or balance used up), or longer where the law (such as the Framework Act on National Taxes) requires; if an unrefunded paid balance remains, until it is refunded

Article 3 (Items of Personal Information Processed)

COCO Clinic processes the following items of personal information.

1. Newsletter subscription

• Required: email address
• Automatically generated: date and time of consent, and the IP address at the time of consent

2. Chat consultation

• Chat messages (the inquiries you type into the chat window)
• Optional (when you ask to be connected to staff or to be contacted back): name, phone number
• Automatically generated: chat session identifier, the page address and referrer you arrived from, display language

3. Items automatically generated and collected while using the website

• IP address (to block unauthorized repeated submissions of website forms)
• Inquiry language (the display language selected on the website)
• Cookies, date and time of visit, service usage records, page views, clicks, scrolls and other on-screen interaction records, browser and device information

4. Pre-visit medical questionnaire

• Basic information: name, phone number (mobile), date of birth, address, gender
• Information for treatment planning: emergency contact (relationship, name, phone number), plans for the next 2–3 weeks
• Sensitive information (health information; for the online questionnaire, processed with separate consent): allergies, medicines currently taken, current or past illnesses, implanted devices and implants, skin conditions, history of treatments and surgery, pregnancy and breastfeeding, smoking and drinking, recent health condition
• Clinic operating statistics: how you found COCO Clinic
• Automatically generated: date and time the questionnaire was submitted

5. Notification messages and messenger consultations

• Name, mobile phone number, and the content of messages exchanged (KakaoTalk notification messages, SMS, WhatsApp)

6. Treatment record viewing service

• Mobile phone number, records of sign-up and cancellation (date and time, staff member who processed it), consent records (date and time of consent, consent form version, IP address)
• Sensitive information (treatment records, processed with separate consent): visit dates, treatment names
• Automatically generated: access logs (date and time of access, IP address, verification code requests)

7. Prepaid membership

• Required items: name, chart number, contact details, tier, payment amount, payment method, prepayment date, expiry date, paid balance and points usage history
• For refunds to a bank account in Korea: bank, account number, account holder
• For refunds by international wire transfer: name, account number, bank, address, contact details

Article 4 (Provision of Personal Information to Third Parties)

COCO Clinic processes personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law.

However, when a prepaid membership balance is refunded by international wire transfer, the following information is provided with the data subject's separate consent.

Article 5 (Outsourcing of Personal Information Processing)

COCO Clinic outsources the following personal information processing tasks for the smooth handling of personal information.

When concluding an outsourcing contract, COCO Clinic specifies in the contract or other documents, pursuant to Article 26 of the Personal Information Protection Act, the prohibition of processing personal information for purposes other than the outsourced task, technical and managerial safeguards, restrictions on re-outsourcing, and the management and supervision of the trustee, and supervises whether the trustee processes personal information safely. If the content of an outsourced task or a trustee changes, we will disclose it through this Privacy Policy without delay.

Article 6 (Overseas Transfer of Personal Information)

COCO Clinic transfers personal information overseas as follows, in accordance with Article 28-8 of the Personal Information Protection Act.

Data subjects may refuse the overseas transfer of their personal information. If you wish to refuse, please contact the Privacy Officer listed in Article 11. However, if you refuse the overseas transfer, the use of some services, such as the website itself, may be limited.

Article 7 (Destruction of Personal Information)

COCO Clinic destroys personal information without delay when it becomes unnecessary, such as upon expiry of the retention period or fulfillment of the purpose of processing.

Article 8 (Rights and Obligations of Data Subjects and How to Exercise Them)

Data subjects may exercise the following rights regarding personal information protection against COCO Clinic at any time.

• Request access to personal information
• Request correction of any errors
• Request deletion
• Request suspension of processing

Article 9 (Measures to Ensure the Safety of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, COCO Clinic takes the following technical and managerial measures necessary to ensure safety.

• Minimizing the number of staff who handle personal information and training those who do
• Granting differentiated access rights to, and controlling access to, personal information processing systems
• Encrypting personal information in transit (HTTPS/TLS)
• Storing sensitive materials, such as before-and-after photos, separately, with access limited to authenticated users
• Retaining access logs of personal information processing and preventing their forgery or alteration
• Restricting access to, and operating security programs on, systems where personal information is stored and processed

Article 10 (Installation, Operation, and Refusal of Automatic Collection Devices)

COCO Clinic uses 'cookies' and similar technologies that store and periodically retrieve usage information, in order to provide personalized services and understand how the website is used.

• Purpose of cookies — remembering your language setting and whether notice pop-ups have been shown, keeping your chat consultation session, and improving the service by analyzing website visits and usage patterns
• Analytics tools used — Vercel Analytics (visitor statistics), Google Analytics (usage analysis) and Microsoft Clarity (on-screen interaction analysis such as heatmaps and session replay). These tools collect access records and similar data; you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on (opens in a new window). Microsoft Clarity is configured to mask the contents of input fields and records only on-screen interactions; refusing cookies in your browser prevents collection (see the Microsoft Privacy Statement (opens in a new window) for details).
• Installing, operating, and refusing cookies — you can refuse or delete cookies in your web browser under Settings > Privacy. However, if you refuse cookies, some convenience features, such as keeping your language setting, may not work properly.

Article 11 (Privacy Officer)

COCO Clinic designates the following Privacy Officer, who takes overall responsibility for personal information processing and handles data subjects' complaints and remedies related to personal information processing.

Article 12 (Remedies for Infringement of Rights)

To obtain relief from an infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA), and other bodies. For other reports or consultations regarding personal information infringement, please contact the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.police.go.kr)

In addition, a person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal as prescribed by the Administrative Appeals Act.

Article 13 (Changes to the Privacy Policy)

This Privacy Policy applies from its effective date. When changes are added, deleted, or corrected in accordance with laws or policies, we will give notice through announcements at least 7 days before the changes take effect.

[Annex] Consent to the Collection and Use of Health Information in the Pre-visit Questionnaire

To keep your treatment safe, we ask about your health before your visit. Health information is specially protected by law, so we ask for your consent separately.

• Why we ask — To check safety before a procedure and to plan your treatment.
• What we ask — Your health, such as allergies, medicines you take, and past illnesses and procedures. The full list is in Article 3, “4. Pre-visit medical questionnaire”.
• Who sees it — Only COCO Clinic's medical staff and the staff who assist with your care. We entrust receiving and storing the questionnaire to Healingpaper Co., Ltd. (KOS), and we do not provide it to anyone else except as required by law.
• How long we keep it — 3 years from the date you submit it. The questionnaire is a reference we read before your visit and is kept separately from your medical records.
• You don't have to consent — Our medical staff will ask you in person in the consultation room instead, and it does not affect your care in any way.