KR
US
AE
ID
CN
TW
JP
MN
RU
TH
VNPrivacy Policy
Privacy Policy
In accordance with Article 30 of the Personal Information Protection Act, Golden Diamant Plastic Surgery Clinic (hereinafter the ‘clinic’) establishes·publishes the following privacy policy in order to protect the personal information of data subjects and to handle related grievances promptly.
Article 1 (Purposes of processing personal information)
The clinic processes personal information for the following purposes and does not use it for any purpose other than these. Where the purpose of use changes, the clinic implements the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
- Provision of medical treatment and medical services — patient identification, treatment·examination·surgery and procedures, prescription, aftercare, and the preparation and retention of medical records
- Consultation and reservation — receipt of and reply to online·telephone consultations, confirmation of appointments and notice of changes
- Member management — identity verification for use of the membership service (viewing before · after photographs), confirmation of intention to join, and prevention of improper use
- Claiming and settling health insurance benefits — claims to the National Health Insurance Service·Health Insurance Review and Assessment Service, and the receipt and refund of medical fees
- Fulfilment of statutory obligations — the preparation·retention and reporting of records prescribed by relevant legislation such as the Medical Service Act
Article 2 (Items of personal information processed)
| Category | Items collected | Method of collection |
|---|---|---|
| Medical treatment | Name, date of birth, gender, contact details, address, resident registration number (where required by law for health insurance claims), records of treatment·examination·surgery, information concerning health such as medical history and adverse drug reactions, and before · after treatment photographs | Registration forms on visiting, medical questionnaires, and the course of treatment |
| Consultation·reservation | Name, contact number, enquiry details (required) / Email, preferred contact method, preferred visit date (optional) | The website consultation form, telephone, and messenger consultation |
| Member | ID, password, name, contact details | The membership registration process |
| Automatically generated | Access IP, cookies, date and time of visit, service use records, device and browser information | Automatically generated in the course of using the website |
The clinic does not collect sensitive information not required for medical treatment, such as ideology·beliefs, political opinions or trade union membership. Information concerning health is processed only for the purpose of medical treatment.
Article 3 (Period of processing and retention of personal information)
The clinic processes·retains personal information within the period of retention·use prescribed by legislation or the period consented to by the data subject. The retention periods for the principal items are as follows.
| Item retained | Period | Basis |
|---|---|---|
| Medical records, surgical records | 10 years | Article 15 of the Enforcement Rule of the Medical Service Act |
| Patient register, examination content and examination findings records, radiographs and reports, nursing records | 5 years | Article 15 of the Enforcement Rule of the Medical Service Act |
| Copies of medical certificates and the like | 3 years | Article 15 of the Enforcement Rule of the Medical Service Act |
| Prescriptions | 2 years | Article 15 of the Enforcement Rule of the Medical Service Act |
| Records concerning contracts or withdrawal of offers, payment and the supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records concerning consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Website visit (access) records | 3 months | Protection of Communications Secrets Act |
| Member information | Until withdrawal of membership | Consent of the data subject |
| Consultation history | 1 year after the consultation ends | Consent of the data subject |
Article 4 (Provision of personal information to third parties)
The clinic processes the personal information of data subjects only within the scope specified in Article 1, and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the consent of the data subject or under a special provision of law. At present the clinic provides it only in the following cases.
- National Health Insurance Service·Health Insurance Review and Assessment Service — to the extent necessary for claiming and reviewing health insurance benefits
- Where the data subject has consented in advance
- Where an investigative agency or the like requests it in accordance with due process on the basis of legislation
Article 5 (Consignment of personal information processing)
Where the clinic consigns personal information processing tasks for the smooth conduct of its business, on concluding the consignment contract it stipulates in the document, in accordance with Article 26 of the Personal Information Protection Act, matters concerning responsibility such as the prohibition of processing beyond the purpose of the consigned task, restrictions on re-consignment, measures to ensure security, management·supervision and compensation for damage, and it supervises whether the consignee processes personal information safely.
The status of consignment is disclosed through this policy, and where the content of the consignment or the consignee changes, this policy is amended and disclosed without delay. (Current status of consignment — to be entered after confirmation by the clinic)
Article 6 (Rights·obligations of data subjects and legal representatives, and how to exercise them)
Data subjects may exercise the following rights at any time.
- Request to view personal information
- Request for correction where there is an error
- Request for deletion (however, records for which other legislation such as the Medical Service Act prescribes a retention obligation cannot be deleted)
- Request for suspension of processing
Rights may be exercised in relation to the clinic in writing, by telephone, by email and so on, and the clinic will take action without delay. Where a data subject requests correction of an error in personal information, the clinic will not use or provide that personal information until the correction is complete. Where rights are exercised through a representative, a power of attorney must be submitted.
Article 7 (Destruction of personal information)
Where personal information becomes unnecessary, for instance because the retention period has elapsed or the purpose of processing has been achieved, the clinic destroys that personal information without delay. However, where it must be retained under other legislation, that personal information is moved to a separate database or retained in a different storage location.
- Information in the form of electronic files — permanently deleted by a method that makes restoration impossible
- Paper documents — shredded or incinerated
Article 8 (Measures to ensure the security of personal information)
The clinic takes the following measures to ensure the security of personal information.
- Administrative measures — establishment·implementation of an internal management plan, minimisation of staff handling personal information, and regular training
- Technical measures — management of access rights to the personal information processing system, installation of an access control system, encryption of passwords and the like, and installation and updating of security programmes
- Physical measures — access control to the storage location for medical records and the document storage room
Article 9 (Installation·operation of and refusal of devices that automatically collect personal information)
The clinic may use cookies in order to provide users with tailored services. A cookie is a small amount of information sent to the user's browser by the server used to operate the website, and it is stored on the user's device. Users may refuse the storage of cookies through their browser settings, in which case there may be restrictions on the use of some services.
Article 10 (Operation·management of video information processing devices)
Where the clinic installs·operates video information processing devices in accordance with Article 25 of the Personal Information Protection Act and Article 38-2 of the Medical Service Act, it gives separate notice of the purpose and location of installation, the scope and times of recording, the person responsible for management, the retention period and the viewing procedure, and installs a notice board. The recording·retention·provision of video information from inside the operating theatre follows the procedures and periods prescribed by the Medical Service Act. (Specific operational status — to be entered after confirmation by the clinic)
Article 11 (Personal information protection officer)
The clinic designates a personal information protection officer as below, to take overall responsibility for work concerning the processing of personal information and for handling complaints and providing remedies to data subjects in relation to the processing of personal information.
| Category | Details |
|---|---|
| Personal information protection officer | Song Sang-hoon (Director) — clinic confirmation required |
| Contact | +82 2-6480-7800 / prs7067@naver.com |
| Address | 3F, Building A, Cheongdam Square, 420 Dosan-daero, Gangnam-gu, Seoul |
Data subjects may direct to the personal information protection officer any enquiry, complaint or matter concerning remedies relating to personal information protection arising while using the clinic's services, and the clinic will respond·act without delay.
Article 12 (Remedies for infringement of rights)
To obtain a remedy for infringement of personal information, data subjects may apply to the following bodies for dispute resolution, consultation and the like.
- Personal Information Infringement Report Centre — 118 (no area code) / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee — 1833-6972 / www.kopico.go.kr
- Supreme Prosecutors' Office Cyber Investigation Division — 1301 (no area code) / www.spo.go.kr
- National Police Agency Cyber Investigation Bureau — 182 (no area code) / ecrm.police.go.kr
Article 13 (Changes to the privacy policy)
This privacy policy applies from its effective date. Where there is an addition·deletion or amendment of content following a change in legislation·policy or security technology, notice is given through the website from seven days before the change takes effect.