Privacy Policy

Collected personal information is used for the following purposes:

· Performance of service contracts and provision of content

· Identity verification, personal identification, prevention of fraudulent/unauthorized use, grievance handling, and delivery of notices

· Verifying the identity and details of complainants, contact/notification for fact-finding, and notification of results

· [Optional] Marketing and advertising: providing event/promotional information and participation opportunities, demographic-based service and ad delivery, and access/usage statistics

Use for marketing and advertising purposes requires separate, optional consent. Declining does not restrict sign-up or use of the service, and consent may be withdrawn at any time by the methods described in "Rights of Data Subjects and How to Exercise Them" below.

We collect the following personal information for sign-up, consultation requests, and similar purposes.

· Sign-up (required): username, email address, name, phone number, nickname, password

· Consultation request (required): name, and at least one of phone number, email address, or messenger ID

· Consultation request (optional): treatment of interest, preferred consultation time, inquiry details

· Community use (optional): post/comment content, attached images

· Consent status for receiving promotional information (optional)

· Automatically collected: access IP and access logs, cookies, service usage records, referral path (visit source and ad campaign identifiers), and the language of the consultation form

· Retention: member information is retained until you withdraw your membership. Consultation request information is retained for 3 years from the date of the request and then destroyed. Community posts and comments are anonymised on withdrawal — the author information is deleted while the post itself remains, and attached images are deleted. Where preservation is required by law, the statutory period applies.

· Method: via the website (sign-up, consultation request, community posting)

We process and retain personal information within the consented retention/use period or the period prescribed by law.

· Membership registration and management: until withdrawal of membership (until settlement if credit/debt remains)

· Consultation request information: 3 years from the date of the request (keeping a record of the consultation, reference for treatment if you visit the clinic or undergo surgery, and statistical and quality-improvement analysis)

· Community posts and comments: on withdrawal of membership, author information is deleted and the post is kept in anonymised form (attached images are deleted)

· E-commerce contract/withdrawal, payment, and supply records: 5 years

· Information collected for diagnosis/treatment: per the Medical Service Act

· Retained for the applicable period where preservation is required by other laws

For smooth processing of personal information, the Clinic outsources the following processing tasks to external parties.

· Trustee: BEKR Inc. — Outsourced work: website development, operation, and maintenance

· Trustee: Solapi Co., Ltd. — Outsourced work: sending SMS and messenger notifications for consultation requests

· Trustee: Vercel Inc. — Outsourced work: website server operation and hosting

· Trustee: Supabase, Inc. — Outsourced work: operation of the database, member authentication, and image storage

· Trustee: Plus Five Five, Inc. (service name: Resend) — Outsourced work: sending email notifications of consultation requests

· Trustee: Google LLC — Outsourced work: analysis of website usage statistics (Google Analytics)

When entering into an outsourcing agreement, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing beyond the purpose, technical/managerial safeguards, restriction of re-outsourcing, supervision of the trustee, and liability for damages are specified in documents, and the Clinic supervises whether the trustee handles personal information safely.

To provide the service, the Clinic transfers personal information overseas as follows.

· Transferee: Vercel Inc. (privacy@vercel.com) / Country: United States (the service runs in the Republic of Korea (Seoul) region; the storage location of some operational data such as access logs is not disclosed, so storage or access outside Korea may occur) / Items transferred: information entered during use of the service and access logs / Time and method: transmitted over the network as needed at the time of use / Purpose: website server operation / Retention: until the outsourcing agreement ends

· Transferee: Supabase, Inc. (privacy@supabase.com) / Country: United States (data and backups are stored and processed in the Republic of Korea (Seoul) region; access from outside Korea may occur in the course of operations and technical support) / Items transferred: username, email address, name, phone number, nickname, password (encrypted), consultation request details, posts/comments and attached images / Time and method: transmitted over the network as needed at the time of use / Purpose: operation of the database, member authentication, and image storage / Retention: until withdrawal of membership or until the outsourcing agreement ends (anonymised posts and comments are retained until the agreement ends)

· Transferee: Plus Five Five, Inc. (service name: Resend, support@resend.com) / Country: United States / Items transferred: name, mobile number, email address, messenger ID, language of the request, treatment of interest, preferred date and time, referral channel, and enquiry details / Time and method: transmitted over the network when a consultation request is received / Purpose: sending email notifications of consultation requests / Retention: until the outsourcing agreement ends

· Transferee: Google LLC (googlekrsupport@google.com) / Country: United States / Items transferred: access IP address, online identifiers stored in cookies, device and browser information, pages visited and service usage records / Time and method: transmitted over the network while the service is used / Purpose: analysis of website usage statistics / Retention period: the data retention period configured in Google Analytics (up to 14 months) or until the outsourcing agreement ends

Data subjects may refuse the overseas transfer of their personal information. However, these transfers are essential to providing the service, so refusal will restrict the use of related services such as sign-up and online consultation requests. To refuse, please contact the Personal Information Protection Officer listed below.

Pretty Body and Line Clinic does not provide personal information to third parties, except in cases falling under Article 17 of the Personal Information Protection Act, such as separate consent of the data subject or special provisions of law.

Data subjects may at any time exercise the rights to (1) request access, (2) request correction of errors, (3) request deletion, and (4) request suspension of processing, and the Clinic will act without delay.

These rights may be exercised by calling the telephone number given in "12. Personal Information Protection Officer" below, or by post or in person at the address given in the same section.

Upon a request for correction or deletion, the relevant personal information will not be used or provided until the request is completed.

Rights may be exercised through a legal representative or an authorized agent.

· Member information: username, email address, name, phone number, nickname, password

· Consultation request information: name, the phone number / email address / messenger ID you provided, treatment of interest, preferred consultation time, inquiry details

· Community content: post/comment content, attached images

· Automatically collected information: access IP and access logs, cookies, service usage records, referral path, and the language of the consultation form

When the processing purpose is achieved, personal information is destroyed without delay. When it becomes unnecessary due to expiry of the retention period, achievement of purpose, or discontinuation of the service, it is destroyed within 5 days.

· Electronic files: deleted using technical methods that prevent recovery

· Paper documents: shredded or incinerated

We operate cookies that store and retrieve user information to provide customized services.

Cookies are used to analyze access frequency and visit times, identify interests, and measure event participation and visit counts to provide personalized services.

We also use Google Analytics analytics cookies to analyze website usage statistics; information collected through these cookies is transferred to Google LLC as described in Section 5 (International Transfer of Personal Information) above.

Users may allow all cookies, confirm each time a cookie is stored, or refuse storage via their web browser options.

Pursuant to Article 29 of the Personal Information Protection Act, we take the following technical/managerial/physical measures:

· Regular internal audits (once a year)

· Minimization and training of staff handling personal information

· Establishment and implementation of an internal management plan

· Technical measures against hacking (installation/update/inspection of security programs, restricted-access zones)

· Encryption of personal information (passwords and other sensitive data)

· Access control for personal information (access-rights management, intrusion prevention systems)

· Name: Jung Chaehong

· Contact: +82-2-544-3441

· Address: 10F, Brand Khan Bldg, 527 Gangnam-daero, Seocho-gu, Seoul

Oversees personal information processing and handles complaints and remedies for data subjects.

Users (data subjects) have the right to refuse consent to the collection and use of personal information. However, if you do not consent, the provision of related services may be restricted.

This Privacy Policy takes effect on September 1, 2026.