Privacy Policy

The personal information collected is used for the following purposes:

· Performance of contracts for the provision of services and delivery of content

· Identity verification and personal identification, prevention of fraudulent or unauthorized use, handling of inquiries and complaints, and delivery of notices

· Verification of the identity of individuals submitting complaints and the details of such complaints, communication and notification for fact-finding purposes, and notification of the results

· [Optional] Marketing and Advertising: Providing information about events and promotions and opportunities to participate, providing services and displaying advertisements based on demographic characteristics, and analyzing access frequency and service usage statistics

Separate optional consent is obtained for the use of personal information for marketing and advertising purposes. Refusal to provide such consent will not restrict membership registration or use of the services. Even after providing consent, you may withdraw it at any time using the methods described in the “Rights of Data Subjects and How to Exercise Them” section below.

We collect the following personal information for sign-up, consultation requests, and similar purposes.

· Sign-up (required): username, email address, name, phone number, nickname, password

· Consultation request (required): name, and at least one of phone number, email address, or messenger ID

· Consultation request (optional): treatment of interest, preferred consultation time, inquiry details

· Community use (optional): post/comment content, attached images

· Consent status for receiving promotional information (optional)

· Automatically collected: access IP and access logs, cookies, service usage records, referral path (visit source and ad campaign identifiers), and the language of the consultation form

· Retention: member information is retained until you withdraw your membership. Consultation request information is retained for 3 years from the date of the request and then destroyed. Community posts and comments are anonymized on withdrawal — the author information is deleted while the post itself remains, and attached images are deleted. Where preservation is required by law, the statutory period applies.

· Method: via the website (sign-up, consultation request, community posting)

We process and retain personal information within the retention and use period agreed to by the data subject or for the period required by applicable law.

· Membership registration and management: until membership withdrawal (or until any outstanding financial obligations have been settled)

· Consultation request information: 3 years from the date of submission, for purposes such as maintaining consultation history, reference for treatment in the event of a clinic visit or surgery, and statistical and quality improvement analysis

· Community Posts and Comments: upon membership withdrawal, author information is deleted and anonymized, while the posts remain in anonymized form; attached images are deleted

· Records of E-commerce contracts, cancellations, payments, and supply of goods or services: 5 years

· Information collected for diagnosis or treatment: retained in accordance with the Medical Service Act

· Other Information Required to Be Retained by Law: retained for the applicable statutory period

To ensure the efficient handling of personal information, the Clinic entrusts certain personal information processing tasks to the following service providers.

· Service Provider: BEKR Inc. — Entrusted Services: website development, operation, and maintenance

· Service Provider: Solapi Co., Ltd. — Entrusted Services: sending SMS and KakaoTalk notifications related to consultation requests

· Service Provider: Vercel Inc. — Entrusted Services: website server operation and hosting

· Service Provider: Supabase, Inc. — Entrusted Services: database operation, member authentication, and image storage

· Service Provider: Plus Five Five, Inc. (service name: Resend) — Entrusted Services: sending email notifications related to consultation requests

· Service Provider: Google LLC — Entrusted Services: analysis of website usage statistics through Google Analytics

When entering into an entrustment agreement, the Clinic specifies in writing, in accordance with Article 26 of the Personal Information Protection Act, matters including the prohibition of processing personal information beyond the entrusted purpose, technical and administrative safeguards, restrictions on sub-entrustment, management and supervision of service providers, and liability for damages. The Clinic also supervises service providers to ensure that personal information is handled securely.

To provide the service, the Clinic transfers personal information overseas as follows.

· Recipient: Vercel Inc. (privacy@vercel.com) / Country: United States (the service is operated in the Seoul, Republic of Korea region; however, the storage location of certain operational data, including access logs, is not publicly disclosed, and such data may therefore be stored or accessed outside Korea) / Items transferred: information entered during use of the service and access logs / Time and method of Transfer: transmitted on an ongoing basis through information and communications networks when the service is used / Purpose: website server operation / Retention and Use Period: until termination of the service outsourcing agreement

· Recipient: Supabase, Inc. (privacy@supabase.com) / Country: United States (data and backups are stored and processed in the Seoul, Republic of Korea region; however, access from outside Korea may occur during operations or technical support) / Items Transferred: username, email address, name, phone number, nickname, encrypted password, consultation request details, posts, comments, and attached images / Time and Method of Transfer: transmitted on an ongoing basis through information and communications networks when the service is used / Purpose: database operation, member authentication, and image storage / Retention and Use Period: until membership withdrawal or termination of the service outsourcing agreement (anonymized posts and comments are retained until termination of the outsourcing agreement)

· Recipient: Plus Five Five, Inc. (service name: Resend, support@resend.com) / Country: United States / Items Transferred: name, mobile phone number, email address, messenger ID, request language, treatment of interest, preferred date and time, referral channel, and inquiry details / Time and Method of Transfer: transmitted through information and communications networks when a consultation request is submitted / Purpose: sending email notifications regarding consultation requests / Retention and Use Period: until termination of the service outsourcing agreement

· Recipient: Google LLC (googlekrsupport@google.com) / Country: United States / Items Transferred: IP address, online identifiers stored in cookies, device and browser information, pages visited, and service usage records / Time and Method of Transfer: transmitted on an ongoing basis through information and communications networks when the service is used / Purpose: analysis of website usage statistics / Retention and Use Period: the data retention period configured in Google Analytics (up to 14 months) or until termination of the service outsourcing agreement

Data subjects may refuse the overseas transfer of their personal information. However, as these transfers are necessary for the provision of certain services, refusal may restrict access to related services, including membership registration and online consultation requests. To exercise the right to refuse, please contact the Personal Information Protection Officer using the contact information provided in the “Personal Information Protection Officer” section below.

Pretty Body and Line Clinic does not provide personal information to third parties except in cases permitted under Article 17 of the Personal Information Protection Act, including where separate consent has been obtained from the data subject or where otherwise specifically provided by law.

Data subjects may exercise the following rights at any time: ① request access to their personal information, ② request correction of errors or inaccuracies, ③ request deletion, and ④ request suspension of processing. The Clinic will take appropriate action without undue delay upon receiving such a request.

These rights may be exercised by calling the telephone number provided in “12. Personal Information Protection Officer” below, by sending a written request by mail to the address specified in the same section, or by visiting the Clinic in person.

If correction or deletion of personal information is requested, the relevant personal information will not be used or provided to third parties until the request has been completed.

These rights may also be exercised through a legal representative or an authorized agent.

· Member Information: username, email address, name, phone number, nickname, and password

· Consultation request information: name, phone number, email address, messenger ID, treatment of interest, preferred consultation time, and inquiry details, as provided by the user

· Community Content: content of posts and comments, and attached images

· Automatically collected information: IP address, access logs, cookies, service usage records, referral source, and the language selected on the consultation request page

Personal information is destroyed without undue delay once the purpose of processing has been fulfilled. If personal information is no longer necessary due to expiration of the retention period, fulfillment of the processing purpose, discontinuation of the service, or other reasons, it will be destroyed within 5 days.

· Electronic files: deleted using technical methods that prevent restoration or recovery

· Paper documents: shredded or incinerated

We use cookies to store and retrieve user information in order to provide customized services.

Cookies are used to analyze access frequency and visit duration, identify user interests, and measure event participation and the number of visits, thereby enabling us to provide personalized services.

We also use Google Analytics cookies to analyze website usage statistics. Information collected through these cookies is transferred to Google LLC in accordance with Section 5 (Transfer of Personal Information Overseas) above.

Users may configure their web browser settings to allow cookies, receive a prompt before cookies are stored, or block cookies.

Pursuant to Article 29 of the Personal Information Protection Act, we implement the following technical, administrative, and physical measures:

· Conducting regular internal audits (once a year)

· Minimizing the number of personnel who handle personal information and providing relevant training

· Establishment and implementation of an internal management plan

· Implementing technical safeguards against hacking and other threats (installation, updates, and inspection of security software; establishment of access-controlled areas)

· Encrypting personal information (including passwords and other important information)

· Restricting access to personal information (management of access privileges and operation of intrusion prevention systems)

· Name: Jung Chaehong

· Contact: +82-2-544-3441

· Address: 10F, Brand Khan Bldg, 527 Gangnam-daero, Seocho-gu, Seoul

The Personal Information Protection Officer oversees matters related to the processing of personal information and is responsible for handling complaints and requests for remedies from data subjects.

Users (data subjects) have the right to refuse consent to the collection and use of their personal information. However, refusal to provide consent may result in restrictions on the availability of certain services.

This Privacy Policy is effective as of September 1, 2026.