Privacy Policy

Article 1 (Purposes of Processing Personal Information)

Beauty Again Co., Ltd. (the “Company”) processes personal information for the following purposes.

1. 1.
   Service provision: providing AI-based hospital management solution services
2. 2.
   Member management: confirming the intention to sign up, and identifying and authenticating members for the provision of membership services
3. 3.
   Customer support: customer consultations, complaint handling and delivery of notices
4. 4.
   Service improvement: understanding how the service is used and improving its quality

Article 2 (Personal Information Items Processed)

Required items

• Name, mobile phone number, email address
• Hospital name, business registration number, contact person information

Automatically collected items

• IP address, cookies, service usage records
• Access logs, information on the device used for access

Article 3 (Processing and Retention Periods of Personal Information)

1. 1.
   The Company processes and retains personal information within the retention and use period prescribed by law, or within the retention and use period to which the data subject consented when the personal information was collected.
2. 2.
   The processing and retention period for each category of personal information is as follows:

   • Service use management: from the conclusion of the service agreement until the termination of the service agreement
   • Customer consultations and complaint handling: 3 years from the date on which handling is completed

Article 4 (Provision of Personal Information to Third Parties)

1. 1.
   In principle, the Company does not provide users’ personal information to outside parties.
2. 2.
   However, the following cases are exceptions:

   • Where users have given their prior consent
   • Where required under the provisions of law, or where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by law

Article 5 (Entrustment of Personal Information Processing)

1. 1.
   To ensure the smooth handling of personal information, the Company entrusts personal information processing tasks as follows:

   • Cloud services: Amazon Web Services (AWS), storage and management of personal information
   • Email delivery: NAVER Cloud Platform, sending of service-related emails
2. 2.
   When concluding an entrustment contract, the Company sets out in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act of the Republic of Korea, matters concerning responsibility, such as the prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of the trustee, and compensation for damages, and it supervises whether the trustee processes personal information securely.

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

1. 1.
   Data subjects may exercise the following rights related to personal information protection against the Company at any time:

   • Request for notification of the status of personal information processing
   • Request for access to personal information
   • Request for correction or deletion of personal information
   • Request for suspension of personal information processing
2. 2.
   The rights under Paragraph 1 may be exercised in writing, by email, by facsimile (FAX) or by other means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act of the Republic of Korea, and the Company will take action on such requests without delay.

Article 7 (Measures to Ensure the Security of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act of the Republic of Korea, the Company takes the following technical, managerial and physical measures necessary to ensure security:

1. 1.
   Minimizing the number of staff who handle personal information, and training them
2. 2.
   Controlling access to personal information, and restricting, changing and revoking access rights
3. 3.
   Using encryption techniques that allow personal information to be stored and transmitted securely
4. 4.
   Establishing security systems to prevent the leakage of and damage to personal information caused by hacking, computer viruses and the like

Article 8 (Chief Privacy Officer)

The Company has designated the Chief Privacy Officer below, who has overall responsibility for tasks related to personal information processing and handles data subjects’ complaints and remedies for damages related to personal information processing: