TOV Plastic Surgery Clinic (the "Clinic") establishes and discloses this Privacy Policy, in accordance with Article 30 of the Personal Information Protection Act, to protect the personal information of data subjects and to handle related complaints promptly.

 

This Policy applies to personal information the Clinic processes in the course of medical care, appointments and consultations, operation of the website (https://www.tovps.co.kr), and operation of video surveillance devices. The preparation, retention and access of medical records also follow the Medical Service Act.

 

Article 1 (Purposes of Processing Personal Information)

The Clinic processes personal information only for the following purposes. If a purpose changes, the Clinic takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

 

1. Appointments and consultations: receiving, changing and confirming appointments; answering consultation inquiries

2. Website operation and security: providing services, checking access errors, preventing misuse

3. Medical care and medical record management: registration; diagnosis, treatment and surgery; preparation and retention of medical records; collection of fees; issuance of certificates such as medical certificates; fulfillment of legal obligations under the Medical Service Act and other laws

4. Facility safety, prevention of theft and fire, and ensuring patient safety and the safety of the treatment process: operation of video surveillance devices (under a separate policy)

 

Article 2 (Personal Information Processed and Collection Methods)

1. Appointments and consultations by phone or KakaoTalk Channel: name, contact number, preferred appointment date and time, consultation details (information provided directly by the data subject). For the KakaoTalk Channel, the KakaoTalk profile name is also collected.

2. Automatically collected when using the website: IP address, cookies, access date and time, pages visited, browser and device information

3. Medical care: name, resident registration number (alien registration number for foreign nationals), address, contact number, medical records such as medical history, symptoms, diagnoses, tests, surgery and prescriptions, health-related information such as before-and-after photos, and payment records

- Legal basis: Article 22 of the Medical Service Act, Article 14 of its Enforcement Rule, and Article 42-2 of its Enforcement Decree (processing of sensitive information and unique identification information)

4. Fixed video surveillance devices: video recorded inside the Clinic (under the Fixed Video Surveillance Device Operation and Management Policy)

 

The website currently has no online inquiry form or membership sign-up. If these are introduced, we will revise this Policy and notify you.

 

Article 3 (Processing of Sensitive Information)

1. If, during a consultation via the KakaoTalk Channel or similar, a data subject sends sensitive information such as their health condition, medical history or photos of the treatment area, the Clinic informs them of the purpose, items, retention period and their right to refuse consent, and processes it only after obtaining separate consent (Article 23(1)1 of the Personal Information Protection Act).

2. Health information arising in the course of medical care is processed in accordance with Article 22 of the Medical Service Act and Article 42-2 of its Enforcement Decree.

3. Sensitive information is not used or disclosed for any purpose other than consultation and medical care.

 

Article 4 (Processing and Retention Periods)

1. Appointment and consultation information: retained for one year after the consultation ends, then destroyed. If it leads to medical care, it is managed as part of the medical record.

2. Information automatically collected by the website: retained for the validity period of each cookie (from the end of the browser session up to about 13 months).

3. Medical records: retained for the following periods in accordance with Article 22 of the Medical Service Act and Article 15 of its Enforcement Rule.

- Medical charts and surgical records: 10 years

- Patient registers, test details and test findings, radiographs and their reports, nursing records: 5 years

- Copies of medical certificates, etc.: 3 years

- Prescriptions: 2 years

4. Video information: retained for the period set out in the Fixed Video Surveillance Device Operation and Management Policy.

 

Article 5 (Provision of Personal Information to Third Parties)

The Clinic provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law. Medical records are provided only in cases prescribed by law, such as Article 21(3) of the Medical Service Act. Apart from this, no personal information is regularly provided to third parties.

 

Article 6 (Outsourcing of Personal Information Processing)

The Clinic outsources personal information processing as follows. In accordance with Article 26 of the Personal Information Protection Act, the outsourcing contracts set out the matters necessary to protect personal information, and the Clinic manages and supervises the contractors.

 

- Wix.com Ltd.: website hosting and operation

- Jeonneung IT Co., Ltd.: operation and maintenance of medical information systems such as electronic medical records (EMR)

- S-1 Corporation (SECOM): installation and management of fixed video surveillance devices (CCTV)

- Kakao Corp.: sending, receiving and storing KakaoTalk Channel consultation messages

 

If the outsourced work or contractors change, we will disclose it through this Policy without delay.

 

Article 7 (Transfer of Personal Information Overseas)

For website operation, the Clinic entrusts personal information to be processed and stored overseas as follows (Article 28-8(1)3 of the Personal Information Protection Act).

 

- Recipient: Wix.com Ltd. and its affiliates (contact: privacy@wix.com, 5 Yunitsman St., Tel Aviv, Israel)

- Countries: Israel (Wix.com Ltd.), the United States and Ireland (data centers), Brazil, Mexico, Luxembourg, Lithuania, India, Germany, the United Kingdom and Ukraine (Wix affiliates), the Netherlands (Wix sub-processor)

- Basis: the list of sub-processors published by Wix as of the effective date of this Policy (https://support.wix.com/en/article/list-of-wixs-sub-processors)

- Items transferred: the information automatically collected by the website under Article 2(2)

- Time and method of transfer: transmitted from time to time over information and communications networks when the website is accessed

- Purpose of use: website hosting, operation and security

- Retention and use period: the retention period in Article 4 or until the outsourcing contract ends

- How to refuse and its effect: if you do not want your information transferred overseas, you may contact us by phone (051-744-1031) instead of using the website. Because the transfer is necessary to use the website, refusing it may make the website difficult to use.

 

Article 8 (Procedures and Methods of Destruction)

1. Personal information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Personal information for which a reason for destruction arises is destroyed with the approval of the Chief Privacy Officer.

2. Where information must continue to be retained under other laws (such as retention of medical records under the Medical Service Act as set out in Article 4(3)), it is stored separately from other personal information.

3. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated. KakaoTalk Channel consultation histories whose retention period has expired are also deleted regularly.

 

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

1. Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal information, or withdraw consent (Articles 35 to 37 of the Personal Information Protection Act).

2. Rights may be exercised in writing, by phone (051-744-1031) or by email (tov.ps.tov@gmail.com). After verifying your identity, the Clinic will take action within 10 days and notify you of the result.

3. A legal representative or a person delegated by you may also exercise these rights; in that case a power of attorney must be submitted.

4. Deletion cannot be requested for personal information that must be retained under other laws, and access may be restricted as provided by law.

5. Access to and copies of medical records are handled under the procedure in Article 21 of the Medical Service Act.

6. The Clinic does not make decisions affecting data subjects through fully automated systems (Article 37-2 of the Personal Information Protection Act).

 

Article 10 (Personal Information of Children Under 14)

Personal information of children under 14 is processed with the consent of their legal representative (Article 22-2 of the Personal Information Protection Act). Appointments and consultations for children under 14 are made through their legal representative.

 

Article 11 (Installation, Operation and Refusal of Cookies and Other Automatic Collection Tools)

1. For operation and security, the website uses the essential cookies of the website platform (Wix).

2. External content included on the website (Naver Blog in the Blog menu and Google Maps on the Location page) may set cookies by the respective providers (NAVER Corp., Google LLC), and those cookies are subject to each provider's privacy policy.

3. The Clinic does not collect behavioral information for targeted advertising, and does not use any separate advertising or analytics tools beyond the features provided by default by the website platform (Wix).

4. You can refuse or delete cookies in your browser settings.

- Chrome: Settings > Privacy and security > Third-party cookies

- Edge: Settings > Cookies and site permissions

- Safari (iOS): Settings > Safari > Block All Cookies

 

If you refuse cookies, some website features may be difficult to use.

 

Article 12 (Measures to Ensure the Security of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, the Clinic takes the following measures.

1. Administrative measures: designating the minimum number of staff necessary for their work to handle personal information, and providing privacy training.

2. Access control: granting, changing and revoking permissions for electronic medical record (EMR), website and KakaoTalk Channel administrator accounts by role, and managing passwords.

3. Encryption: unique identification information such as resident registration numbers is stored encrypted, and the website uses encrypted communication (HTTPS).

4. Technical measures: electronic medical records (EMR) are stored on a server computer inside the Clinic, protected by passwords so that only authorized persons can access them.

 

Article 13 (Chief Privacy Officer)

The Clinic has designated the following Chief Privacy Officer to oversee personal information processing and to handle related complaints and remedies for damage.

 

- Chief Privacy Officer: Hankyeol Kim, Representative Director

- Contact: 051-744-1031 / tov.ps.tov@gmail.com

 

Please contact the Chief Privacy Officer with any inquiries, complaints or requests for remedies related to personal information. We will respond and handle them without delay.

 

Article 14 (Remedies for Infringement of Rights)

If you need remedies or counseling for infringement of personal information, you may contact the following organizations.

 

- Personal Information Dispute Mediation Committee: (no area code) 1833-6972 (www.kopico.go.kr)

- Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)

- Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)

- Korean National Police Agency: (no area code) 182 (ecrm.police.go.kr)

 

Article 15 (Operation of Fixed Video Surveillance Devices)

The Clinic installs and operates fixed video surveillance devices (CCTV) inside the Clinic. For details, please refer to the Fixed Video Surveillance Device Operation and Management Policy.

 

Article 16 (Changes to This Privacy Policy)

1. This Privacy Policy is effective from October 24, 2026.

2. If any content is added, deleted or modified, we will announce the changes and the effective date through the website.

3. Previous privacy policy: none (first established)

 

TOV Plastic Surgery Clinic | Representative: Hankyeol Kim | Business Registration No. 441-37-00191

924, Zenith Square Tower B, 33 Marine City 2-ro, Haeundae-gu, Busan | Tel 051-744-1031 | Email tov.ps.tov@gmail.com