Privacy Policy

This Privacy Policy explains how Apgujeong Tune Clinic (“Tune Clinic,” “we,” “us”) collects, uses, discloses, and protects personal information processed through our website tuneclinic-global.com and our booking / messaging channels. It is written to comply with the Korean Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR) for visitors in the EU/EEA/UK/Switzerland, and equivalent obligations in other jurisdictions our international patients travel from.

If you do not agree with this policy, please do not submit personal information through our forms. You may continue to browse the site under the cookie controls described in §6.

Contents

1. Data controller and contact
2. What we collect
3. Why we use it (legal bases)
4. Third-party processors
5. WhatsApp consultations & AI-assisted replies
6. Cookies, analytics & advertising
7. Retention
8. Sharing & international transfers
9. Your rights
10. Security
11. Children
12. Updates to this policy

1. Data controller and contact

The data controller is:

2. What we collect

a) Information you give us

• Contact details: name, email address, phone number, preferred messaging channel (WhatsApp, Instagram, LINE, WeChat).
• Booking details: travel dates in Seoul, treatment(s) of interest, prior treatment history you choose to share, and free-text questions in the booking form.
• Messaging consultations: messages you exchange with our WhatsApp consultation channel, including information about your skin and health, treatment history, and any photographs you attach. See §5 for how this channel works and what you agree to before a consultation starts.
• Health-related information: photographs you voluntarily attach for preliminary assessment, and any medical history relevant to safety screening (allergies, medications, prior aesthetic procedures, IV-sedation contraindications). This is treated as sensitive personal information under PIPA Art. 23 and as special-category data under GDPR Art. 9, and is processed only with your explicit consent and only for the purpose you submitted it.
• In-clinic records: clinical notes, treatment plans, consent forms, before/after photographs taken during your visit. These are governed by the Korean Medical Service Act and our internal medical-records protocol.

b) Information collected automatically

• Device & usage data: IP address, browser type, language, referring URL, pages viewed, approximate geographic region.
• Cookies and similar technologies: see §6.
• Session replays: aggregated, anonymised mouse-movement / scroll data collected by Microsoft Clarity to improve the website experience. Form-field content is masked by default.

3. Why we use it (legal bases)

• To respond to your booking or consultation request — necessary for the performance of the requested service (GDPR Art. 6(1)(b); PIPA Art. 15(1)(4)).
• To provide medical care during your visit — performance of a contract and compliance with the Korean Medical Service Act (GDPR Art. 6(1)(c) + 9(2)(h); PIPA Art. 23(1)(2)).
• To send treatment-related follow-ups (aftercare instructions, photo follow-up reminders) — performance of the requested service.
• To improve our website and services — our legitimate interest in operating the site, balanced against your rights (GDPR Art. 6(1)(f)). For EU/EEA/UK/Swiss visitors, analytics and marketing cookies are loaded only after explicit consent (see §6).
• To measure advertising and operate remarketing audiences — we use Google Ads (incl. Enhanced Conversions, the Conversion API, remarketing, and Customer Match) and Meta Pixel to measure which campaigns lead to bookings and to show our advertising to people who have previously interacted with the site. This processing relies on your consent (GDPR Art. 6(1)(a); PIPA Art. 15(1)(1)) and is described in detail in §6.
• To comply with legal obligations — including medical record retention (Korean Medical Service Act Art. 22, Enforcement Decree Art. 15).

4. Third-party processors

We rely on a small number of vetted processors. Each only receives the minimum information needed for its function and is bound by a written processing agreement where applicable.

We do not sell personal information. We share it only with the processors listed above and with the named partners identified in §8 who take part in your care or in arranging your visit. We do not share it with unnamed brokers or referral networks.

5. WhatsApp consultations & AI-assisted replies

You can consult with the clinic over WhatsApp before you visit. Replies in that channel are drafted with software and reviewed by a clinic coordinator; they are not a medical diagnosis, and any clinical assessment or treatment decision is made by the physician in person. This section explains what that channel does with your information.

a) What we collect and why

• Items: what you tell us about your skin and health, your treatment history, photographs you choose to send, and your name and contact details.
• Purpose: answering your consultation questions and preparing your visit.
• Retention: consultation records that do not lead to a visit are kept for up to 6 months from your last message, then deleted. If you become a patient, your in-clinic records follow the medical-record retention rules in §7.

b) Your consent, and your right to say no

Because what you share about your health is sensitive personal information (PIPA Art. 23), we ask for your explicit agreement inside the chat before any treatment-related conversation starts. You are free to decline, and declining carries no disadvantage: a coordinator will simply handle your enquiry personally instead. You can also withdraw at any time by telling us in the chat or writing to reception@tuneclinic-global.com.

c) Processing outside Korea

To draft replies, the messages you send in this channel are processed on secure servers outside Korea. The recipients, the countries involved, what is transferred, when and how, and for how long are set out in the transfer table in §8. If you would rather your consultation not be processed overseas, do not give the in-chat agreement (or withdraw it); a coordinator will assist you directly and no message content will be sent to the overseas providers in §8(a).

d) If you book a visit

If you go on to book, your name, contact details, and preferred dates are passed to the clinic’s own booking system so the clinic team can confirm your appointment. Booking confirmation is done by clinic staff, not by software.

6. Cookies, analytics & advertising

a) Cookie categories

• Strictly necessary — session, security, and bot-protection cookies required for the site and booking flow to work. Always on.
• Analytics — Google Analytics 4 and Microsoft Clarity. Help us understand how the site is used so we can improve it.
• Advertising — Google Ads tags (conversion measurement, remarketing) and Meta Pixel. Used only for measuring our advertising and showing it to people who have visited the site.

b) How consent works

For visitors in the EU, EEA, UK, and Switzerland, analytics and advertising cookies are blocked by default and load only after you click “Accept” on the consent banner. You can withdraw consent at any time by clearing site data in your browser; the banner will reappear on your next visit. We honour Global Privacy Control (GPC) signals where required.

For visitors elsewhere, analytics and advertising cookies are enabled by default in accordance with applicable local law. You can disable them at the browser level or by using widely-available browser extensions; if you would like us to delete analytics data already associated with you, contact us at the address in §1.

c) Google Ads conversion measurement & Customer Match

Where you have consented (or, outside the EU/EEA/UK/CH, where applicable local law permits), we use Google Ads to measure which advertising campaigns lead to bookings or consultations, and to build remarketing audiences so we can show our advertising to people who have previously visited the site. This may include:

• Conversion tags — client-side tags fired when you reach the booking-confirmation page.
• Enhanced Conversions / Conversion API — server-side transmission of conversion events to Google. When you submit a booking form, we may transmit a one-way SHA-256 hash of your email and/or phone number to Google so the conversion can be matched against the ad that brought you to us. The hash is irreversible; Google does not receive your raw email or phone number from us.
• Customer Match — we may include the same one-way hashed identifier in an audience uploaded to Google Ads so we can show or suppress advertising to people who have already booked. Hashed identifiers are uploaded only for users who have consented (where consent is required) and only when we have a lawful basis to do so. We do not upload identifiers belonging to anyone who has opted out, and we delete identifiers from Customer Match audiences on request (see §9). Use of this feature is governed by Google’s Customer Match policy.

d) How to opt out of Google advertising

• Adjust personalised advertising at adssettings.google.com.
• Review and delete your Google activity at myactivity.google.com.
• Read Google’s overall practices at policies.google.com/privacy and how Google uses partner-site data at policies.google.com/technologies/partner-sites.
• Ask us directly to suppress your hashed identifier from our Customer Match audiences — email reception@tuneclinic-global.com with the subject “Customer Match removal.”

7. Retention

• Booking-form submissions that do not result in a visit: retained up to 12 months, then deleted.
• WhatsApp consultation records that do not result in a visit: retained up to 6 months from your last message, then deleted (see §5).
• Medical records of patients who visit the clinic: retained for the periods required by the Korean Medical Service Act (Enforcement Decree Art. 15) — generally 5 to 10 years depending on record type.
• Before/after photographs: retained for the duration of your patient relationship plus the statutory medical-record period, unless you withdraw consent for clinical photography earlier.
• Analytics data: retained for the default period configured in each platform (Google Analytics 4: 14 months; Microsoft Clarity: 1 year; Meta Pixel: 2 years).

8. Sharing & international transfers

We do not share personal information for commercial purposes. We may disclose limited information when legally required (court order, regulatory request, public-health authority) or when necessary to protect the safety of patients or staff. Some of the processors listed in §4 are based outside Korea; transfers to those processors rely on Standard Contractual Clauses or the data-importer’s adequacy mechanism, as applicable.

a) Overseas transfers subject to PIPA Art. 28-8 disclosure

When you use our WhatsApp consultation channel (§5), or when our foreign-patient partner agency helps prepare your visit, the recipients below process part of your information outside Korea. The details required by Art. 28-8(2) of the Korean Personal Information Protection Act are consolidated in the single table below.

How to refuse, and what refusal means: these transfers happen only if you give the in-chat agreement described in §5(b). If you decline or later withdraw (in the chat, or via reception@tuneclinic-global.com), we will not process your consultation through the overseas providers above; a coordinator will assist you personally instead, and you can still book by phone or through the booking form. Refusing carries no other disadvantage.

Partner agency — how to refuse, and what refusal means: Memory Store Co., Ltd. may access information only when you enquire or book in Indonesian and tick the separate overseas-transfer box shown on the Indonesian booking form, or give equivalent consent in the chat. The English booking form has no such box; you can submit it normally, and submitting it does not give Memory Store access. You may refuse, and may withdraw consent previously given through an Indonesian-language channel at any time at reception@tuneclinic-global.com. Your care, price and appointment are not affected. Refusing carries no other disadvantage.

b) Overseas transfers for website analytics & advertising

The website processors in §4 that are based outside Korea (Google LLC, Microsoft Corporation, Meta Platforms, Inc., Netlify, Inc., Cloudflare, Inc.) receive the device and usage data, cookie identifiers, and (where you consent) hashed identifiers described in §2(b) and §6, automatically while you use the site, for the purposes and retention periods stated in §4, §6, and §7. You can refuse these transfers by declining or withdrawing cookie consent (§6(b)) or contacting us; the site remains browsable without them.

9. Your rights

Subject to applicable law, you can ask us to:

• Confirm what information we hold about you.
• Correct inaccurate information.
• Delete information we no longer have a legal basis to retain (subject to medical-record retention obligations).
• Restrict or object to specific processing activities.
• Receive a portable copy of the information you provided to us.
• Withdraw consent to WhatsApp consultation processing (§5), clinical photography, marketing cookies, or advertising-data uploads (Google Ads Customer Match / Enhanced Conversions, Meta Pixel) at any time. We will remove your hashed identifier from our Customer Match audiences within 7 days of receiving a request and propagate the removal to Google.

To exercise any of these rights, contact us at reception@tuneclinic-global.com. We respond within 30 days. You also have the right to lodge a complaint with the Korean Personal Information Protection Commission or, for EU/EEA/UK/Swiss residents, your local supervisory authority.

10. Security

We protect personal information with administrative, technical, and physical safeguards proportionate to its sensitivity. Booking and messaging traffic is encrypted in transit; sensitive records held in Supabase are encrypted at rest; physical medical records inside the clinic are stored in locked cabinets in a restricted-access area. Access is limited to the physician and trained reception staff bound by confidentiality obligations.

11. Children

Our services are intended for adults. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a minor, please contact us and we will delete it.