Privacy policy

1. Data controller and contact

The data controller is:

2. What we collect

a) Information you give us

• Contact details: name, email address, phone number, preferred messaging channel (WhatsApp, Instagram, LINE, WeChat).
• Booking details: travel dates in Seoul, treatment(s) of interest, prior treatment history you choose to share, and free-text questions in the booking form.
• Messaging consultations: messages you exchange with our WhatsApp consultation channel, including information about your skin and health, treatment history, and any photographs you attach. See §5 for how this channel works and what you agree to before a consultation starts.
• Health-related information: photographs you voluntarily attach for preliminary assessment, and any medical history relevant to safety screening (allergies, medications, prior aesthetic procedures, IV-sedation contraindications). This is treated as sensitive personal information under PIPA Art. 23 and as special-category data under GDPR Art. 9, and is processed only with your explicit consent and only for the purpose you submitted it.
• In-clinic records: clinical notes, treatment plans, consent forms, before/after photographs taken during your visit. These are governed by the Korean Medical Service Act and our internal medical-records protocol.

b) Information collected automatically

• Device & usage data: IP address, browser type, language, referring URL, pages viewed, approximate geographic region.
• Cookies and similar technologies: see §6.
• Session replays: aggregated, anonymised mouse-movement / scroll data collected by Microsoft Clarity to improve the website experience. Form-field content is masked by default.

3. Why we use it (legal bases)

• To respond to your booking or consultation request — necessary for the performance of the requested service (GDPR Art. 6(1)(b); PIPA Art. 15(1)(4)).
• To provide medical care during your visit — performance of a contract and compliance with the Korean Medical Service Act (GDPR Art. 6(1)(c) + 9(2)(h); PIPA Art. 23(1)(2)).
• To send treatment-related follow-ups (aftercare instructions, photo follow-up reminders) — performance of the requested service.
• To improve our website and services — our legitimate interest in operating the site, balanced against your rights (GDPR Art. 6(1)(f)). For EU/EEA/UK/Swiss visitors, analytics and marketing cookies are loaded only after explicit consent (see §6).
• To measure advertising and operate remarketing audiences — we use Google Ads (incl. Enhanced Conversions, the Conversion API, remarketing, and Customer Match) and Meta Pixel to measure which campaigns lead to bookings and to show our advertising to people who have previously interacted with the site. This processing relies on your consent (GDPR Art. 6(1)(a); PIPA Art. 15(1)(1)) and is described in detail in §6.
• To comply with legal obligations — including medical record retention (Korean Medical Service Act Art. 22, Enforcement Decree Art. 15).

4. Third-party processors

We rely on a small number of vetted processors. Each only receives the minimum information needed for its function and is bound by a written processing agreement where applicable.

We do not sell personal information. We share it only with the processors listed above and with the named partners identified in §8 who take part in your care or in arranging your visit. We do not share it with unnamed brokers or referral networks.

5. WhatsApp consultations

You can use WhatsApp to ask questions and plan before you visit. Messages are not a diagnosis or an emergency service. Suitability, consent and the final treatment plan are confirmed in person.

a) What we collect and why

• Items: what you tell us about your skin and health, your treatment history, photographs you choose to send, and your name and contact details.
• Purpose: answering your consultation questions and preparing your visit.
• Retention: consultation records that do not lead to a visit are kept for up to 6 months from your last message, then deleted. If you become a patient, your in-clinic records follow the medical-record retention rules in §7.

b) Your consent, and your right to say no

Health information and photographs are sensitive. Send only what you choose to share for your consultation. You may keep your question general, omit photographs, use the booking form instead, or ask us to stop processing information you previously sent, subject to any medical-record retention duty that applies. Contact us in the chat or at [email protected].

c) Processing outside Korea

WhatsApp processes messages through its service, which may involve systems outside Korea. The recipient, purpose and transfer details are described in §8(a). If you do not want to use WhatsApp, use the booking form or call the clinic instead.

d) If you book a visit

If you go on to book, your name, contact details, and preferred dates are passed to the clinic’s own booking system so the clinic team can confirm your appointment.

6. Cookies, analytics & advertising

a) Cookie categories

• Strictly necessary — session, security, and bot-protection cookies required for the site and booking flow to work. Always on.
• Analytics — Google Analytics 4 and Microsoft Clarity. Help us understand how the site is used so we can improve it.
• Advertising — Google Ads tags (conversion measurement, remarketing) and Meta Pixel. Used only for measuring our advertising and showing it to people who have visited the site.

b) How consent works

For all visitors, this website’s optional analytics and advertising tags are blocked by default and load only after you choose “Accept” in Cookie preferences. Choose “Reject” in Cookie preferences to withdraw consent. Clearing site data also removes your saved choice.

Booking and appointment-management pages do not load these optional tags. Global Privacy Control (GPC) also keeps these tags disabled. To request deletion of information already collected, contact us using the details in §1.

Clicking a WhatsApp, LINE or booking button sends a first-party contact click count to the clinic's own server. This also happens on booking pages and does not require optional tracking consent. The record includes the channel, page path, button location, locale, timestamp, allowlisted campaign labels and a click reference. For WhatsApp, the same reference appears in the message so the clinic can match the enquiry to its source. We use these records to measure which pages and buttons lead to enquiries and to match an enquiry to its source. Google click identifiers are added only with optional tracking consent. Only those identifiers are used for advertising measurement. The sessionStorage key tc_src holds the campaign labels and the first page for the session. The record includes no name, message text or contact details. To object to this use or request deletion, contact us using the details above.

c) Google Ads conversion measurement & Customer Match

Where you have consented (or, outside the EU/EEA/UK/CH, where applicable local law permits), we use Google Ads to measure which advertising campaigns lead to bookings or consultations, and to build remarketing audiences so we can show our advertising to people who have previously visited the site. This may include:

• Conversion tags — client-side tags fired when you reach the booking-confirmation page.
• Enhanced Conversions / Conversion API — a potential future server-side transmission of conversion events to Google. The current booking form does not transmit a one-way SHA-256 hash of your email and/or phone number to Google. If this feature is introduced, we will ask for separate consent before sending a hashed identifier.
• Customer Match — we may include the same one-way hashed identifier in an audience uploaded to Google Ads so we can show or suppress advertising to people who have already booked. Hashed identifiers are uploaded only for users who have consented (where consent is required) and only when we have a lawful basis to do so. We do not upload identifiers belonging to anyone who has opted out, and we delete identifiers from Customer Match audiences on request (see §9). Use of this feature is governed by Google’s Customer Match policy.

d) How to opt out of Google advertising

• Adjust personalised advertising at adssettings.google.com.
• Review and delete your Google activity at myactivity.google.com.
• Read Google’s overall practices at policies.google.com/privacy and how Google uses partner-site data at policies.google.com/technologies/partner-sites.
• Ask us directly to suppress your hashed identifier from our Customer Match audiences — email [email protected] with the subject “Customer Match removal.”

7. Retention

• Booking-form submissions that do not result in a visit: retained up to 12 months, then deleted.
• WhatsApp consultation records that do not result in a visit: retained up to 6 months from your last message, then deleted (see §5).
• Medical records of patients who visit the clinic: retained for the periods required by the Korean Medical Service Act (Enforcement Decree Art. 15) — generally 5 to 10 years depending on record type.
• Before/after photographs: retained for the duration of your patient relationship plus the statutory medical-record period, unless you withdraw consent for clinical photography earlier.
• Analytics data: retained for the default period configured in each platform (Google Analytics 4: 14 months; Microsoft Clarity: 1 year; Meta Pixel: 2 years).

8. Sharing & international transfers

We do not share personal information for commercial purposes. We may disclose limited information when legally required (court order, regulatory request, public-health authority) or when necessary to protect the safety of patients or staff. Some of the processors listed in §4 are based outside Korea; transfers to those processors rely on Standard Contractual Clauses or the data-importer’s adequacy mechanism, as applicable.

a) Overseas transfers subject to PIPA Art. 28-8 disclosure

When you use our WhatsApp consultation channel (§5), or when our foreign-patient partner agency helps prepare your visit, the recipients below process part of your information outside Korea. The details required by Art. 28-8(2) of the Korean Personal Information Protection Act are set out in the recipient disclosures below.

How to refuse, and what refusal means: if you do not want WhatsApp to process your messages, do not use that channel. You can still request an appointment through the booking form or call the clinic. For information already shared, contact us in the chat or at [email protected] to ask us to stop processing it, subject to any legal retention duty.

Partner agency — how to refuse, and what refusal means: Memory Store Co., Ltd. may access information only when you give separate overseas-transfer consent in a direct conversation with the clinic. The current booking form does not collect this consent in any language; submitting it does not give Memory Store access. You may refuse, and may withdraw consent previously given through an Indonesian-language channel at any time at [email protected]. Your care, price and appointment are not affected. Refusing carries no other disadvantage.

b) Overseas transfers for website analytics & advertising

The website processors in §4 that are based outside Korea (Google LLC, Microsoft Corporation, Meta Platforms, Inc., Ploy, Inc., Cloudflare, Inc.) receive the device and usage data, cookie identifiers, and (where you consent) hashed identifiers described in §2(b) and §6, automatically while you use the site, for the purposes and retention periods stated in §4, §6, and §7. You can refuse these transfers by declining or withdrawing cookie consent (§6(b)) or contacting us; the site remains browsable without them.

9. Your rights

Subject to applicable law, you can ask us to:

• Confirm what information we hold about you.
• Correct inaccurate information.
• Delete information we no longer have a legal basis to retain (subject to medical-record retention obligations).
• Restrict or object to specific processing activities.
• Receive a portable copy of the information you provided to us.
• Withdraw consent to WhatsApp consultation processing (§5), clinical photography, marketing cookies, or advertising-data uploads (Google Ads Customer Match / Enhanced Conversions, Meta Pixel) at any time. We will remove your hashed identifier from our Customer Match audiences within 7 days of receiving a request and propagate the removal to Google.

To exercise any of these rights, contact us at [email protected]. We respond within 30 days. You also have the right to lodge a complaint with the Korean Personal Information Protection Commission or, for EU/EEA/UK/Swiss residents, your local supervisory authority.

10. Security

We protect personal information with administrative, technical, and physical safeguards proportionate to its sensitivity. Booking and messaging traffic is encrypted in transit; sensitive records held in Supabase are encrypted at rest; physical medical records inside the clinic are stored in locked cabinets in a restricted-access area. Access is limited to the physician and trained reception staff bound by confidentiality obligations.

11. Children

Our services are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a minor, please contact us and we will delete it.

12. Updates to this policy

We may update this policy from time to time. Substantive changes will be flagged on this page with a revised “Last updated” date. For changes that materially affect how we process your information, we will use reasonable means to notify you in advance.