Privacy Policy

Last updated: October 2026

This English version is provided for convenience. In case of any discrepancy, the Korean version prevails.

미오의원 (“the Clinic”) values your personal information and complies with the Personal Information Protection Act, the Medical Service Act and other applicable laws of the Republic of Korea. This policy explains what personal information we process, for what purposes, and how we protect it.

1. Information we collect and how we collect it

We do not operate website accounts. We collect the following personal information to provide consultations and medical services.

a. Information collected

• Website consultation booking: name, date of birth, contact number, email address, nationality, desired treatments/skin concerns, need for an interpreter, treatments or surgery in the last 3 months (treatment name and date), facial surgery history (for filler requests), preferred messenger, preferred visit date, inquiry details
• Messenger consultations (WhatsApp, LINE, WeChat, KakaoTalk Channel): your messenger account identifier (the user ID assigned by the messenger), the name shown in the messenger, your phone number (where the messenger provides it), the content of messages exchanged, attached photos and files, and the time and delivery/read status of messages
• When the Clinic connects its WhatsApp Business account (one time): past conversation history stored in the Clinic’s WhatsApp Business app (message content, attachments, time) and contacts saved on the Clinic’s phone (name, phone number)
• Other: additional information needed for treatment is collected at the Clinic with a separate written consent.

b. How we collect it

The website booking form, written consent forms, messages you send to the Clinic’s messenger accounts, and the one-time import when the Clinic connects its WhatsApp Business app.

2. Purposes of use

• Name, address, contact number: treatment at the Clinic, treatment and medical information notices, service guidance, and dispute resolution
• Email: news and notices, and a reliable channel for communication such as handling complaints
• Video (CCTV): facility safety, fire prevention, crime prevention for patient safety, and dispute resolution
• Photos: after complete removal of identifying information, improving the quality of medical services, developing personalized treatment services, and as training data for developing and improving artificial intelligence (AI) models
• Messenger consultation records (messages, attachments, account identifiers): responding to consultations and bookings, pre-visit and aftercare instructions, keeping a consultation history, and resolving disputes
• Imported WhatsApp history and contacts: continuing earlier WhatsApp conversations in the same consultation screen

3. Retention period

We process and retain personal information within the retention period set by law or agreed when it was collected. In principle, personal information is destroyed without delay once the purpose of collection and use has been achieved, except that the following are kept for the periods below for the stated reasons.

1. Records of consumer complaints or dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce)
2. Records of identity verification: 6 months (Act on Promotion of Information and Communications Network Utilization and Information Protection)
3. Medical records: 10 years (Enforcement Rule of the Medical Service Act)

Messenger consultation records

• Messages and attachments exchanged via messengers are kept as consultation and treatment history. Retention period: 10 years from the date of the last consultation (in line with the retention period for medical records under the Medical Service Act)
• After 90 days, stored photos and files move to a different storage tier; their content and availability do not change.
• Files uploaded by staff but never sent are deleted after 1 day.
• Raw WhatsApp delivery records are deleted 30 days after processing, except the history and contacts imported at connection, which are kept with the consultation records.

4. Destruction procedure and method

• Procedure: personal information whose purpose has been achieved is moved to a separate database (or a separate cabinet for paper), kept for a period under internal policy and applicable laws, and then destroyed.
• Method: electronic files are deleted using technical methods that make the records unrecoverable; printed personal information is shredded or incinerated.

5. Provision to third parties

In principle, we do not provide your personal information to third parties, except where you have consented in advance; where required by law or requested by investigative authorities following procedures set by law; or where we claim medical fees from public institutions such as the National Health Insurance Service as required by law.

Current provision to third parties

• Recipient: Carelogic Co., Ltd.
• Purpose: skin analysis and personalized solutions
• Items: name, contact number, facial images, consultation details
• Retention: until the end of the contract

6. Outsourcing of processing

• Carelogic Co., Ltd.: photos (before/after treatment, treatment process) — development and training of skin diagnosis solutions, for 10 years from the date of consent; Carelogic takes technical, administrative and physical safeguards under the Personal Information Protection Act
• Amazon Web Services, Inc.: servers, database and file storage — all of the information above, stored in the Seoul region (Republic of Korea)
• Anthropic, PBC: translating consultation messages and visit review text when staff request a translation — overseas transfer (see 7-3)
• Infobank (Bizgo): sending KakaoTalk notifications and text messages — phone number, message content

Messenger consultation messages are delivered through the messenger you use (WhatsApp by Meta Platforms, LINE by LY Corporation, WeChat by Tencent, KakaoTalk by Kakao).

7. Your rights and how to exercise them

You or your legal representative may at any time request access to, correction or deletion of, or suspension of processing of your personal information held by the Clinic (including messenger consultation records), and may withdraw consent to collection.

• How to request: in person at the Clinic, or by email to hello@mioclinic.kr
• Identity verification: we may check minimal information such as your name, date of birth, contact number or the messenger account you used, to confirm that the request comes from you or your legal representative.
• Response time: we will act within 10 days of receiving your request and tell you the result.
• Records the law requires us to keep (for example, medical records for 10 years) cannot be deleted during that period; we will tell you if this applies.

7-3. Overseas transfer

• Recipient: Anthropic, PBC
• Country: United States
• Items: consultation message and visit review text that staff ask to translate
• Purpose: translation
• When and how: at the time of the translation request, over an encrypted connection (HTTPS)

8. Cookies

We may use “cookies” that store and retrieve your information. A cookie is a small text file that the server running a website sends to your browser and that is stored on your device.

• Purpose: improving our services by analyzing visit frequency and time
• How to refuse: you can refuse cookies in your browser’s privacy settings. Some services may be less convenient if you do.

9. Privacy officer

We have designated the following privacy officer to protect your personal information and handle related complaints.

• Name: 정구현
• Title: Chief Director
• Phone: 02-558-5550
• Email: hello@mioclinic.kr

10. Changes to this policy

This policy applies from its effective date. If content is added, deleted or changed under laws or policy, we will announce it on our website or notice board at the Clinic from 7 days before the change takes effect.