Privacy Policy
Effective from · September 1, 2026
QD Clinic (“the Clinic”), a medical clinic established in Seoul, Republic of Korea, establishes and discloses the following privacy policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related concerns promptly.
1. Why we process personal information
The Clinic processes personal information only for the purposes below. If a purpose changes, we will tell you in advance and ask for your consent.
- To receive and answer consultation enquiries — so that we can contact you and explain what you asked about.
- To analyse how this website is used — so that we can see which information is needed and improve the pages.
This policy covers only the personal information we receive through this website and through the messaging channels linked from it. Medical records created after you visit the Clinic are handled separately under the Medical Service Act of the Republic of Korea. This website has no membership, no login and no payment.
2. What personal information we process
| Category | Items | How we receive it |
|---|---|---|
| Consultation enquiry (required) | Name, country, how you would like us to reply, and the contact detail that reply method needs — a mobile number if you choose WhatsApp, an e-mail address if you choose e-mail — and your enquiry | Entered by you on the enquiry form |
| Consultation enquiry (optional) | When you are planning to visit, and the treatments you are interested in | Your enquiry is accepted even if you leave these blank. |
| Consultation through a messaging app | The name, account and contact detail you give us in a conversation on WhatsApp, LINE, WeChat or the KakaoTalk channel, and what you ask | Entered into our system by the counsellor handling the conversation, so that your enquiry is not lost when the conversation ends |
| Website usage records (collected automatically) | Cookies, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived (search or advertising link information) | Generated automatically while you use the website |
If you choose WhatsApp as the reply method, our reply reaches you through WhatsApp, and that conversation is also subject to WhatsApp’s own privacy policy, which the Clinic does not control. Your IP address is used only at the moment a request arrives, to block repeated spam enquiries from the same source, and it is not stored. The Clinic does not collect resident registration numbers or any other unique identifiers through this website.
3. How long we keep personal information
The Clinic keeps personal information for the periods below and destroys it without delay once the period has passed.
| Category | Retention period | Once the period has passed |
|---|---|---|
| Consultation enquiries | 3 years from the date received | Your name, contact number and e-mail address are deleted beyond recovery. What remains of the enquiry can no longer be traced to you and is used only as a statistic. |
| Website usage records (Google Analytics) | 14 months | Google deletes them automatically. |
| Records of staff access to personal information | 2 years | Deleted automatically. We delete them as soon as the minimum period required by law has passed, because holding less personal information is the safer position. |
Regardless of these periods, if you ask us to delete your information we will do so without delay, unless a law requires us to keep it.
4. Providing personal information to third parties
The Clinic does not provide personal information to third parties.
The only exceptions are where a law specifically provides otherwise, or where an investigative authority requests it through the procedure and in the manner set out by law.
5. Processing entrusted to others
To run this website, the Clinic entrusts the following work to others.
| Who | What they do for us | How long they hold it |
|---|---|---|
| Amazon Web Services, Inc. | Operating and storing the servers on which this website and the enquiry system run | Until the contract ends, or until the retention period in section 3 has passed |
| Google LLC | Analysing how this website is used (Google Analytics) | 14 months |
| Microsoft Corporation | Analysing how these pages are used on screen (Microsoft Clarity) | 30 days for recordings (9 months for heatmaps) |
The servers are located in the Republic of Korea (Seoul region). Google Analytics and Microsoft Clarity transfer information abroad as set out in section 6 below. When we enter into such contracts we require that personal information is handled safely, and if the entrusted work changes we will update and publish this policy.
6. Personal information that crosses a border
The Clinic is in the Republic of Korea, and this site is read from all over the world. Two different movements of information follow from that, and they are set out separately below.
Your enquiry comes to Korea. If you send an enquiry, or write to us on one of the messaging channels, what you send is transmitted to and stored on servers in the Republic of Korea, where the Clinic is established and where it answers you from. It is not passed on anywhere else.
Usage statistics go to the United States. To produce statistics about how this website is used, and to see which parts of a page people struggle with, the following is transferred abroad.
| Item | Google Analytics | Microsoft Clarity |
|---|---|---|
| Who receives it | Google LLC | Microsoft Corporation |
| Country | United States | United States. The data is held in the Microsoft Azure cloud |
| When and how it is transferred | Sent automatically over the network by your browser when you open a page | The same |
| What is transferred | Cookie identifier, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived | Cookie identifier, browser and device type, the country you connect from, the pages you view, how you arrived, and a record of how you moved, pressed and scrolled on the page together with what was on screen at the time. Anything you type — every input field and dropdown — is masked before it is sent. |
| Purpose | Analysing how this website is used | Analysing how these pages are used on screen, so that they can be improved |
| How long it is held | 14 months | 30 days for recordings; up to 9 months for heatmaps and for recordings we have marked |
Information that could identify you personally — your name, contact number or e-mail address — is never sent to either company. One consequence is worth stating plainly: because nothing identifying you is sent, the screen records held by Microsoft Clarity cannot be picked out as yours, and so cannot be deleted on request. If you would rather they were not made, refuse cookies by the methods in section 9. Refusing either transfer does not affect your use of the website or your ability to send an enquiry. If you are reading this in the European Economic Area, the United Kingdom or Switzerland: Microsoft contracts with visitors from those regions through Microsoft Ireland Operations Limited, which transfers to Microsoft Corporation in the United States under Standard Contractual Clauses; and on 17 December 2021 the European Commission adopted an adequacy decision for the Republic of Korea, recognising that Korea provides an equivalent level of protection for personal data transferred from the EEA.
7. How personal information is destroyed
- Personal information is destroyed without delay once the retention period has passed or the purpose has been achieved.
- Personal information held as electronic files is deleted beyond recovery. Every day, at a set time, the Clinic’s enquiry system automatically erases the name, contact number and e-mail address of enquiries whose retention period has passed.
- Personal information printed on paper is shredded or incinerated.
8. Your rights and how to exercise them
You may exercise the following rights in relation to the Clinic at any time.
- Ask to see the personal information we hold about you
- Ask us to correct anything that is wrong
- Ask us to delete it
- Ask us to stop processing it
You may exercise these rights by telephone or e-mail to the privacy officer named in section 11, wherever in the world you are writing from. We will check the request, act on it without delay and tell you the outcome. If someone acts on your behalf, please send a letter of authority with the request. The Clinic does not collect personal information from children under 14 without the consent of their legal representative, so enquiries should be sent by someone aged 14 or over, or by a legal representative.
9. Cookies and similar tools, and how to refuse them
The Clinic uses cookies to produce website usage statistics. A cookie is a small record stored in the browser you use to open the website, and it is what lets us tell whether the same visitor has returned.
The Clinic sets one cookie of its own. It remembers the language you picked from the language menu, so that the website opens in that language when you come back. It holds nothing but a language code, expires after a year, and is never sent to our servers. Every other cookie is set by the tools below.
| What | What it does | How to refuse it |
|---|---|---|
| Google Analytics | Counts the pages you view and how you arrived, and turns that into statistics. | Block cookies in your browser settings, or install the opt-out add-on Google provides. |
| Microsoft Clarity | Records where on a page people press and how far down they read, so that pages can be improved. Anything you type is masked before it is sent. | Block cookies in your browser settings. |
| Google Maps | Shows the map of how to reach us. It loads together with the page it is on. | Google may set its own cookies. Block third-party cookies in your browser settings. |
| Instagram posts · TikTok videos | Shows our posts and plays our videos inside the page. | These companies may set their own cookies. Nothing of theirs loads until you press the item you want to see, so leaving them alone means nothing is loaded at all. |
| YouTube videos | Plays the Clinic’s videos inside the page. | They are embedded in the mode that does not use cookies, and they too load only when you press play. |
- Where to get Google’s opt-out add-on — tools.google.com/dlpage/gaoptout
- Where to refuse cookies in your browser — Chrome: Settings › Privacy and security › Third-party cookies / Edge: Settings › Cookies and site permissions / Safari: Settings › Privacy
- Separately from cookies, the Clinic uses your browser’s own storage for three things, none of which holds anything that identifies you. One is the date on which you pressed “do not show again today” on a notice. One is whether you arrived through an advertisement or a search, which is sent with your enquiry if you send one. One is a marker saying that this browsing session has already been counted, so that reading ten pages counts as one visit rather than ten. The last two are erased when you close the browser.
The Clinic also counts visits itself, without Google: the page tells our server that a page was viewed, which page it was and which kind of route it was reached by. No cookie, no identifier and no IP address is stored with that count, and it cannot be traced back to a person — it is a set of daily totals. You can refuse every cookie and still read the website and send an enquiry.
10. How we keep personal information safe
The Clinic takes the following measures to keep personal information safe.
- Access to personal information is limited to the smallest number of staff the work requires, and every grant, change and removal of access is recorded.
- Records of staff viewing or editing personal information are kept and reviewed.
- Everything sent between this website and the Clinic’s systems is encrypted (HTTPS).
- Requests arriving repeatedly from the same source within a short time are limited, which blocks automated harvesting and spam.
- Personal information whose retention period has passed is destroyed automatically, without anyone having to remember to do it.
11. Privacy officer
The Clinic has designated the following privacy officer, who takes overall responsibility for the processing of personal information and handles enquiries, complaints and remedies from data subjects.
| Name | Hong Sahyeok |
|---|---|
| Telephone | +82-2-514-1650 |
| qdclinic@naver.com |
You may raise any privacy-related question arising from your use of this website with the privacy officer. We will answer and act without delay.
12. Where to seek redress
If you wish to seek redress for an infringement of your personal information, you may apply to the bodies below for dispute resolution or advice. These bodies are separate from the Clinic.
| Body | Telephone (within Korea) | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Centre (KISA) | 118 | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office, Cybercrime Investigation Division | 1301 | www.spo.go.kr |
| Korean National Police Agency, Cyber Bureau | 182 | ecrm.police.go.kr |
These are the Korean authorities, because the Clinic is a Korean data controller — they are the bodies that can act on a complaint about us. The telephone numbers are the domestic numbers those bodies publish and are dialled within Korea; each of them can be reached from anywhere through the website beside it.
13. Changes to this policy
- This policy applies from the effective date shown above.
- If we change this policy because the law changes or because what we process changes, we will announce the change and its effective date on this website at least seven days beforehand.
- This is the first version of this policy; there is no earlier one.