Privacy Policy

LITING Plastic Surgery Clinic (hereinafter referred to as the “Clinic”) highly values the personal information of its customers and is committed to handling such information lawfully and appropriately in order to protect the rights and interests of data subjects.

The Clinic complies with applicable laws and regulations, including the Framework Act on Telecommunications, the Telecommunications Business Act, the Personal Information Protection Act, and the Enforcement Decree thereof.

This Privacy Policy explains how the personal information you provide is collected and used, for what purposes it is processed, and what measures the Clinic takes to protect your personal information.

⸻

1. Categories of Personal Information Collected

The Clinic collects the following personal information for membership registration, customer consultations, and the provision of various services:

* Individual Members: Name, date of birth, gender, address, age, contact information, mobile phone information, email address

* Members Under the Age of 14: Information regarding the legal representative (resident registration number or i-PIN number, mobile phone information)

* Other Information: Visit information, prescription information, medical treatment information, card issuer name, card number, and other card payment authorization information

* When Participating in Events: Name, age, contact information, email address, address, gender, reservation information, medical treatment information, and consultation history

Personal information may be collected through the following channels:

* Website

* Written forms

* Fax

* Telephone

* Online bulletin boards

* Email

* Event participation

3. Information Automatically Collected During Use of Services

The following information may be automatically generated and collected while using the Clinic’s services:

* IP address

* Cookies

* Date and time of visits

* Service usage records

* Records of improper or unauthorized use

⸻

The Clinic will not use personal information for purposes other than those stated below. If the purpose of use changes, the Clinic will obtain the data subject’s consent where required by applicable law.

1. Provision of Services

* Medical Information: Provision of medical services for diagnosis and treatment, as well as administrative services including billing, payment, and refunds

* Reservation Information: Identity verification for medical appointments, appointment inquiries, and other related services

* Consultation Information: Medical consultations and guidance via telephone, text message, KakaoTalk, or other communication channels

* Other Information: Providing hospital news and health-related information via text messages and social media, conducting surveys, handling complaints, and maintaining effective communication channels

2. Membership Management

Personal information may be used for:

* Identity verification in connection with the use of services

* Individual identification

* Prevention of unauthorized or improper use

* Verification of consent from a legal representative when collecting personal information from children under the age of 14

* Subsequent verification of the identity of legal representatives

* Retention of records for dispute resolution

* Handling complaints and other inquiries

* Delivery of notices

* Provision of information related to membership management

* Delivery of news and updates

* Conducting surveys

3. Development of New Services, Marketing, and Advertising

* Development of new services and provision of customized services

* Provision of promotional and advertising information

* Providing opportunities to participate in events and promotions

When a member participates in an event or promotion or chooses to use an optional service, the Clinic may collect the following information with the member’s separate consent:

* Name, age, contact information, email address, address, gender, reservation information, medical treatment information, and consultation information

* Mobile phone numbers of third parties stored in the member’s mobile phone contacts, only for services equipped with social community functions. In such cases, the third-party mobile phone numbers will not be stored.

* Credit card number, mobile phone number, and the ID and password of affiliated gift certificate payment service providers, where applicable to members using paid services

4. Event Participation

* Customer consultation by LITING Plastic Surgery Clinic via telephone and text message

⸻

The Clinic processes and retains personal information within the retention and usage periods prescribed by applicable laws and regulations or within the periods agreed to by the data subject at the time the personal information is collected.

Even after the purpose of collection or provision has been fulfilled, personal information may be retained where necessary pursuant to the Korean Commercial Act or other applicable laws and regulations.

The applicable processing and retention periods are as follows:

1) Website Membership Registration and Management

Personal information will be retained until the member withdraws from the website.

However, where any of the following circumstances apply, the information will be retained until the relevant circumstance has been resolved:

* If an investigation or inquiry concerning a violation of applicable laws is ongoing, until the investigation or inquiry has been completed

Website Visit Records

* Reason for Retention: Protection of Communications Secrets Act

* Retention Period: 3 months

Records Concerning Identity Verification

* Reason for Retention: Act on Promotion of Information and Communications Network Utilization and Information Protection

* Retention Period: 6 months

Records Concerning Consumer Complaints or Dispute Resolution

* Reason for Retention: Act on the Consumer Protection in Electronic Commerce

* Retention Period: 3 years

Records Concerning the Collection, Processing, and Use of Credit Information

* Reason for Retention: Credit Information Use and Protection Act

* Retention Period: 3 years

2) Medical Services

Medical records are retained in accordance with Article 15 of the Enforcement Rule of the Medical Service Act:

* Patient register: 5 years

* Medical records: 10 years

* Prescriptions: 2 years

* Surgical records: 10 years

* Examination results and findings: 5 years

* Radiographic images, including digital images, and related reports: 5 years

* Copies of medical certificates and similar documents: 3 years

3) Handling of Civil Complaints and Inquiries

* Retention Period: 3 years after completion of the complaint or inquiry handling process

During the use of services, certain information such as IP addresses, cookies, service usage records, and device information may be automatically generated and collected.

Depending on whether such information can be linked to an identifiable individual or other personal information, it may or may not constitute personal information under applicable law.

⸻

The Clinic outsources certain tasks necessary for the provision of its services to external service providers.

The Clinic establishes appropriate requirements and conducts necessary management and supervision to ensure that outsourced service providers process personal information safely and in accordance with the Personal Information Protection Act.

If the scope of outsourced services or any service provider changes, the Clinic will disclose such changes without delay through this Privacy Policy.

The Clinic’s personal information processing service providers and the scope of outsourced services are as follows:

Retention Period: Until termination of the applicable outsourcing agreement

Service Provider   Outsourced Services   Personal Information Processed   Retention Period

Carelabs Co., Ltd.   Customer management system operation   Clinic registration number, medical information, name, resident registration number, address, telephone number, email address, etc.   Until termination of the outsourcing agreement

Meta S&C Co., Ltd.   Customer management system operation, call system operation, IT system management   Clinic registration number, medical information, name, resident registration number, address, telephone number, email address, etc.   Until termination of the outsourcing agreement

Crado Co., Ltd.   Use of customer information in external tools for raw material management   Name, resident registration number, telephone number   Until termination of the outsourcing agreement

Techlabs Co., Ltd.   Telemarketing customer management, marketing, IT system management   Name, telephone number, address, email address, medical information, reservation and consultation information, etc.   Until termination of the outsourcing agreement

※ Website operation and management, delivery of promotional information including event-related advertisements, IT management outsourcing services, customer management, etc.:

* LITING Labs Co., Ltd.

* LITING Busan Co., Ltd.

* LITING Daegu Co., Ltd.

* Selting Suwon Co., Ltd.

* LITING Plastic Surgery Clinic (Seoul, Busan, and Daegu branches)

* Selting Clinic (Suwon, Gyeonggi-do)

⸻

In principle, the Clinic destroys personal information without delay once the retention period has expired or the purpose of processing has been fulfilled.

However, this does not apply where personal information must be retained pursuant to other applicable laws.

The procedures, timeframes, and methods for destruction are as follows:

1. Destruction Procedure

Information provided by users will be destroyed in accordance with the Clinic’s internal policies and applicable laws and regulations once the applicable retention period has expired or the purpose of processing has been fulfilled.

Please refer to the section titled “Processing and Retention Period of Personal Information.”

2. Destruction Period

When the retention period for personal information expires, the Clinic will destroy the personal information within five (5) days from the expiration date.

Where personal information becomes unnecessary due to fulfillment of the processing purpose or for any other reason, the Clinic will destroy such information within five (5) days from the date on which the information is deemed no longer necessary.

3. Methods of Destruction

The Clinic destroys personal information using the following methods:

* Electronic files: Permanently deleted using methods that prevent restoration or recovery

* Paper records, printed materials, written documents, and other physical recording media: Shredded or incinerated

⸻

In accordance with Article 29 of the Personal Information Protection Act, the Clinic implements the following technical, administrative, and physical measures necessary to ensure the security of personal information.

1. Establishment and Implementation of an Internal Management Plan

The Clinic establishes and implements an internal management plan in accordance with Article 29 of the Personal Information Protection Act.

2. Minimization and Training of Personnel Handling Personal Information

The Clinic limits the number of personnel authorized to handle personal information to the minimum necessary and provides regular training in accordance with its internal management plan.

3. Administrative Measures

* Upon employment, all employees are required to sign confidentiality and security agreements to prevent unauthorized disclosure of information. The Clinic also maintains internal procedures to audit compliance with its privacy policies and employee obligations.

* The transfer of responsibilities involving personal information is conducted under strict security controls, and responsibilities relating to personal information incidents are clearly defined both during and after employment.

4. Restrictions on Access to Personal Information

The Clinic controls access to personal information by granting, modifying, and revoking access rights to database systems that process personal information.

The Clinic also uses intrusion prevention and detection systems to prevent unauthorized external access. Records concerning the granting, modification, or revocation of access rights are maintained for at least three (3) years.

5. Retention and Prevention of Alteration of Access Records

The Clinic retains and manages access records to personal information processing systems, including web logs and summary information, for at least six (6) months and takes appropriate measures to prevent such records from being altered, stolen, or lost.

6. Encryption of Personal Information

Users’ personal information is encrypted when stored and managed. Important data is also protected using additional security measures, including encryption during storage and transmission.

7. Technical Measures Against Hacking and Other Security Threats

To prevent the loss, damage, or unauthorized disclosure of personal information caused by hacking, computer viruses, or other security threats, the Clinic installs security software and regularly updates and inspects such software.

The Clinic also places its systems in areas where external access is controlled and implements technical and physical monitoring and access restrictions.

8. Physical Access Control for Unauthorized Persons

The Clinic maintains separate physical locations for systems containing personal information and establishes and operates access control procedures to prevent unauthorized entry.

⸻

The Clinic has designated the following Personal Information Protection Officer to oversee the protection of personal information and handle matters related to personal information:

* Name: Yeonju Yang

* Affiliation: Blooming Labs Co., Ltd.

* Email: bloominglabsglobal@gmail.com

⸻

This Privacy Policy shall take effect as of the effective date stated below.

If any provisions of this Privacy Policy are added, deleted, or amended due to changes in applicable laws, regulations, or internal policies, the Clinic will endeavor to provide notice of such changes through its website at least seven (7) days prior to their implementation.

* Date of Amendment: September 1, 2026

* Effective Date: September 1, 2026

⸻

Customers may contact the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center to seek dispute resolution or consultation regarding infringements of personal information rights.

For other reports or consultations concerning personal information infringement, please contact the following organizations:

* Personal Information Infringement Report Center

    * Website: privacy.kisa.or.kr

    * Telephone: 118 (without area code)

* Cyber Investigation Department, Supreme Prosecutors’ Office

    * Website: www.spo.go.kr

    * Telephone: 1301 (without area code)

* Korean National Police Agency Cyber Bureau

    * Website: police.go.kr

    * Telephone: 182 (without area code)

⸻