DEAR Korean Medicine Clinic Privacy Policy

Article 1. Purposes of processing

DEAR processes the minimum personal information necessary to provide medical care, verify patients and manage records, collect and refund fees, confirm insurance eligibility and submit lawful claims, manage appointments and notices, respond to inquiries and complaints, and fulfill duties under applicable laws. If a purpose changes, DEAR takes the measures required by law, including obtaining separate consent where necessary.

Article 2. Categories of personal information

Information may include name, date of birth, sex, address, contact details, identity and insurance eligibility information; resident or foreign registration numbers where processing is permitted by law; symptoms, medical history, medications, test results, diagnoses, prescriptions, treatment and progress; payment, insurance and certificate information; and guardian details for minors or patients requiring a representative.

Website use

This website has no membership, online consultation form, or field through which visitors directly submit personal information. Cookies and online identifiers, pages viewed, access times, referral sources and NAVER Search Ads (Powerlink) inflow parameters (including NaPm), device and browser information, approximate region, and clicks on call or booking buttons may be processed automatically. A click records only an attempt to open external booking or initiate a call; this tracking does not receive booking-completion status, call-connection status, or consultation content. After moving to an external service, that service provider's privacy policy applies.

Article 3. Retention period

Information is retained for the period required by law or necessary for its purpose. Under Korea's Medical Service Act Enforcement Rule, key periods include: patient register 5 years; medical records 10 years; prescriptions 2 years; surgery records 10 years; examination findings 5 years; radiographs and reports 5 years; nursing and midwifery records 5 years; and copies of medical certificates 3 years. A period applies only when the relevant record is created and may be extended where permitted for continuing care.

Article 4. Provision to third parties

DEAR does not provide personal information to third parties beyond the stated purposes unless the patient consents or the law specifically permits or requires it. Lawful recipients may include the National Health Insurance Service, Health Insurance Review and Assessment Service, competent government bodies, courts, and investigative agencies acting under a lawful request.

Article 5. Entrustment of processing

DEAR entrusts Google LLC with website usage statistics and key-button analysis through Google Analytics 4(GA4). DEAR entrusts NAVER Corporation with visit, referral and page-usage statistics through NAVER Analytics, and with website inflow and booking/call-button performance analysis through NAVER Search Ads (Powerlink) conversion tracking. Where processing is entrusted, DEAR documents purpose limitations, safeguards, subcontracting limits, supervision, and responsibility as required by Article 26 of the Personal Information Protection Act and discloses material changes.

Article 6. Overseas processing

When Google Analytics 4(GA4) is used, cookie identifiers, page visits, access times, referral sources, device and browser information, approximate region, and key-button events may be transmitted over an encrypted network to Google LLC and processed in the United States and other countries where Google operates data centers. The purpose is website analytics and service improvement, and retention is governed by the Analytics setting for up to 14 months.

DEAR does not send names, contact details, medical records, or other directly identifying patient information in analytics events. You may block or delete cookies in your browser to refuse this processing without losing ordinary access to the website.

Article 7. Destruction

When a retention period expires or a purpose is achieved, information is destroyed without delay unless continued retention is legally required. Electronic files are deleted so they cannot be restored; paper is shredded or incinerated; and storage media is securely erased or physically destroyed.

Article 8. Rights of data subjects and representatives

You may request access, correction or deletion, suspension of processing, withdrawal of consent, or an explanation of or objection to an automated decision. A legal representative may exercise rights for a child under 14. Requests may be made in person or by calling DEAR, and identity or authority may be verified. Rights may be limited where another law requires retention, another person's rights could be harmed, or the law restricts access or suspension.

Article 9. Security measures

DEAR applies administrative, technical, and physical safeguards, including staff oversight and training, minimum access privileges, access-control and security software, protection of credentials and important information, preservation of access logs, and controlled storage and destruction of documents and media.

Article 10. Cookies and analytics

DEAR uses Google Analytics 4(GA4), NAVER Analytics, and NAVER Search Ads (Powerlink) conversion tracking to understand website use, improve services, and measure website inflow and conversions from Powerlink. Cookies and online identifiers, including the `_ga` cookie, may distinguish visitors and sessions. Page visits, access times, referral sources and NAVER Search Ads (Powerlink) inflow parameters (including NaPm), IP address, device, browser, operating-system and screen information, approximate region, and clicks on key call or booking buttons may be collected.

A conversion records only an attempt to open external booking or initiate a call, not a completed booking, connected call, or consultation content. This information is not used to create profiles for personalized advertising, and DEAR does not enter or transmit names, contact details, medical records, or other directly identifying patient information in analytics events. You may reject or delete cookies in your browser without losing ordinary access to the website or its call and external-booking links.

Article 11. Automated decisions

DEAR does not use personal information to make fully automated decisions about eligibility for care, treatment methods, or other matters that significantly affect patient rights or obligations.

Article 12. Privacy officer and inquiries

Requests concerning access, correction, deletion, suspension, complaints, or other privacy matters may be made through the contact above.

Article 13. Remedies

For consultation or remedies concerning a privacy infringement in Korea, contact the Personal Information Infringement Report Center at 118, the Personal Information Dispute Mediation Committee at 1833-6972, the Supreme Prosecutors' Office at 1301, or the Korean National Police Agency at 182.

Article 14. Changes to this policy

This policy takes effect on September 3, 2026. Changes and their effective date will be published on the website.