Privacy Policy
Effective from · October 29, 2026
QD Clinic (“the Clinic”), a medical clinic established in Seoul, Republic of Korea, establishes and discloses the following privacy policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related concerns promptly.
1. Why we process personal information
The Clinic processes personal information only for the purposes below. If a purpose changes, we will tell you in advance and ask for your consent.
- To receive and answer consultation enquiries — so that we can contact you and explain what you asked about.
- To analyse how this website is used — so that we can see which information is needed and improve the pages.
This policy covers only the personal information we receive through this website and through the messaging channels linked from it. Medical records created after you visit the Clinic are handled separately under the Medical Service Act of the Republic of Korea. This website has no membership, no login and no payment.
2. What personal information we process
| Category | Items | How we receive it |
|---|---|---|
| Consultation enquiry (required) | Name, country, how you would like us to reply, and the contact detail that reply method needs — a mobile number if you choose WhatsApp, an e-mail address if you choose e-mail — and your enquiry | Entered by you on the enquiry form |
| Consultation enquiry (optional) | When you are planning to visit, and the treatments you are interested in | Your enquiry is accepted even if you leave these blank. |
| Consultation through a messaging app | The name, account and contact detail you give us in a conversation on WhatsApp, LINE, WeChat or the KakaoTalk channel, and what you ask | Entered into our system by the counsellor handling the conversation, so that your enquiry is not lost when the conversation ends |
| Website usage records (collected automatically) | Cookies, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived (search or advertising link information) | Generated automatically while you use the website |
If you choose WhatsApp as the reply method, our reply reaches you through WhatsApp, and that conversation is also subject to WhatsApp’s own privacy policy, which the Clinic does not control. Your IP address is used only at the moment a request arrives, to block repeated spam enquiries from the same source, and it is not stored. The Clinic does not collect resident registration numbers or any other unique identifiers through this website.
3. How long we keep personal information
The Clinic keeps personal information for the periods below and destroys it without delay once the period has passed.
| Category | Retention period | Once the period has passed |
|---|---|---|
| Consultation enquiries | 3 years from the date received | Your name, contact number and e-mail address are deleted beyond recovery. What remains of the enquiry can no longer be traced to you and is used only as a statistic. |
| Website usage records (Google Analytics) | 14 months | Google deletes them automatically. |
| Records of staff access to personal information | 2 years | Deleted automatically. We delete them as soon as the minimum period required by law has passed, because holding less personal information is the safer position. |
Regardless of these periods, if you ask us to delete your information we will do so without delay, unless a law requires us to keep it.
4. Providing personal information to third parties
The Clinic does not provide personal information to third parties.
The only exceptions are where a law specifically provides otherwise, or where an investigative authority requests it through the procedure and in the manner set out by law.
5. Processing entrusted to others
To run this website, the Clinic entrusts the following work to others.
| Who | What they do for us | How long they hold it |
|---|---|---|
| Amazon Web Services, Inc. | Operating and storing the servers on which this website and the enquiry system run | Until the contract ends, or until the retention period in section 3 has passed |
| Google LLC | Analysing how this website is used (Google Analytics) | 14 months |
| Microsoft Corporation | Analysing how these pages are used on screen (Microsoft Clarity) | 30 days for recordings (9 months for heatmaps) |
The servers are located in the Republic of Korea (Seoul region). Google Analytics and Microsoft Clarity transfer information abroad as set out in section 6 below. When we enter into such contracts we require that personal information is handled safely, and if the entrusted work changes we will update and publish this policy.
6. Personal information that crosses a border
The Clinic is in the Republic of Korea, and this site is read from all over the world. Two different movements of information follow from that, and they are set out separately below.
Your enquiry comes to Korea. If you send an enquiry, or write to us on one of the messaging channels, what you send is transmitted to and stored on servers in the Republic of Korea, where the Clinic is established and where it answers you from. It is not passed on anywhere else.
Usage statistics go to the United States. To produce statistics about how this website is used, and to see which parts of a page people struggle with, the following is transferred abroad.
| Item | Google Analytics | Microsoft Clarity |
|---|---|---|
| Who receives it | Google LLC | Microsoft Corporation |
| Country | United States | United States. The data is held in the Microsoft Azure cloud |
| When and how it is transferred | Sent automatically over the network by your browser when you open a page | The same |
| What is transferred | Cookie identifier, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived | Cookie identifier, browser and device type, the country you connect from, the pages you view, how you arrived, and a record of how you moved, pressed and scrolled on the page together with what was on screen at the time. Anything you type — every input field and dropdown — is masked before it is sent. |
| Purpose | Analysing how this website is used | Analysing how these pages are used on screen, so that they can be improved |
| How long it is held | 14 months | 30 days for recordings; up to 9 months for heatmaps and for recordings we have marked |
Information that could identify you personally — your name, contact number or e-mail address — is never sent to either company. One consequence is worth stating plainly: because nothing identifying you is sent, the screen records held by Microsoft Clarity cannot be picked out as yours, and so cannot be deleted on request. If you would rather they were not made, refuse cookies by the methods in section 9. Refusing either transfer does not affect your use of the website or your ability to send an enquiry. If you are reading this in the European Economic Area, the United Kingdom or Switzerland: Microsoft contracts with visitors from those regions through Microsoft Ireland Operations Limited, which transfers to Microsoft Corporation in the United States under Standard Contractual Clauses; and on 17 December 2021 the European Commission adopted an adequacy decision for the Republic of Korea, recognising that Korea provides an equivalent level of protection for personal data transferred from the EEA.
7. How personal information is destroyed
- Personal information is destroyed without delay once the retention period has passed or the purpose has been achieved.
- Personal information held as electronic files is deleted beyond recovery. Every day, at a set time, the Clinic’s enquiry system automatically erases the name, contact number and e-mail address of enquiries whose retention period has passed.
- Personal information printed on paper is shredded or incinerated.
8. Your rights and how to exercise them
You may exercise the following rights in relation to the Clinic at any time.
- Ask to see the personal information we hold about you
- Ask us to correct anything that is wrong
- Ask us to delete it
- Ask us to stop processing it
You may exercise these rights by telephone or e-mail to the privacy officer named in section 11, wherever in the world you are writing from. We will check the request, act on it without delay and tell you the outcome. If someone acts on your behalf, please send a letter of authority with the request. The Clinic does not collect personal information from children under 14 without the consent of their legal representative, so enquiries should be sent by someone aged 14 or over, or by a legal representative.
9. Cookies and similar tools, and how to refuse them
The Clinic uses cookies to produce website usage statistics. A cookie is a small record stored in the browser you use to open the website, and it is what lets us tell whether the same visitor has returned.
The Clinic sets no cookies of its own. Every cookie is set by one of the tools below.
If you connect from the European Economic Area, the United Kingdom or Switzerland, a cookie consent banner appears at the bottom of the page. It asks whether cookies may be used for visit statistics (Google Analytics), on-page usage recordings (Microsoft Clarity) and advertising measurement. For Google Analytics and advertising measurement, if Google judges that you are connecting from one of these regions, they are told not to use cookies until you press “Accept”; Microsoft Clarity is not loaded until you press “Accept”. Pressing “Decline” keeps it that way. Declining will not affect browsing the site or requesting a consultation. You can change your choice, or withdraw your consent, at any time under “Cookie settings” at the bottom of the page. Whether the banner is shown is decided only from the country you connect from. That decision is made by our website’s server, while the default settings of the Google tools follow Google’s own judgement of your location, so on rare occasions the two may differ.
If you connect from anywhere else, no banner is shown and the tools below work from the start. You can refuse them by the methods in the table.
| What | What it does | How to refuse it |
|---|---|---|
| Google Analytics | Counts the pages you view and how you arrived, and turns that into statistics. | Block cookies in your browser settings, or install the opt-out add-on Google provides. From the EEA, the UK or Switzerland you can also press “Decline” on the cookie consent banner, which “Cookie settings” at the bottom of the page opens again. |
| Microsoft Clarity | Records where on a page people press and how far down they read, so that pages can be improved. Anything you type is masked before it is sent. | Block cookies in your browser settings. From the EEA, the UK or Switzerland you can also press “Decline” on the cookie consent banner, which “Cookie settings” at the bottom of the page opens again. |
| Google Maps | Shows the map of how to reach us. It loads together with the page it is on. | Google may set its own cookies. Block third-party cookies in your browser settings. |
| Instagram posts · TikTok videos | Shows our posts and plays our videos inside the page. | These companies may set their own cookies. Nothing of theirs loads until you press the item you want to see, so leaving them alone means nothing is loaded at all. |
| YouTube videos | Plays the Clinic’s videos inside the page. | They are embedded in the mode that does not use cookies, and they too load only when you press play. |
- Where to get Google’s opt-out add-on — tools.google.com/dlpage/gaoptout
- Where to refuse cookies in your browser — Chrome: Settings › Privacy and security › Third-party cookies / Edge: Settings › Cookies and site permissions / Safari: Settings › Privacy
- Separately from cookies, the Clinic uses your browser’s own storage for four things only, none of which holds anything that identifies you. The first is the date on which you pressed “do not show again today” on a notice; the second is the advertising information (utm values) attached to the address of the first page you opened on this visit; the third is the choice you made on the cookie consent banner (“Accept” or “Decline”); the fourth is whether, on this visit, you are connecting from a region where we ask for cookie consent. The second is sent to the Clinic’s server together with your enquiry if you send one, and is not sent otherwise; the other three are never sent to the Clinic’s server. A “Decline” is remembered for 7 days and an “Accept” for 6 months, after which you are asked again; while it is remembered, your choice applies only when you connect from the European Economic Area, the United Kingdom or Switzerland. The second and the fourth are erased when you close the browser (or the tab).
You can refuse every cookie and still read the website and send an enquiry.
10. How we keep personal information safe
The Clinic takes the following measures to keep personal information safe.
- Access to personal information is limited to the smallest number of staff the work requires, and every grant, change and removal of access is recorded.
- Records of staff viewing or editing personal information are kept and reviewed.
- Everything sent between this website and the Clinic’s systems is encrypted (HTTPS).
- Requests arriving repeatedly from the same source within a short time are limited, which blocks automated harvesting and spam.
- Personal information whose retention period has passed is destroyed automatically, without anyone having to remember to do it.
11. Privacy officer
The Clinic has designated the following privacy officer, who takes overall responsibility for the processing of personal information and handles enquiries, complaints and remedies from data subjects.
| Name | Hong Sahyeok |
|---|---|
| Telephone | +82-2-514-1650 |
| qdclinic@naver.com |
You may raise any privacy-related question arising from your use of this website with the privacy officer. We will answer and act without delay.
12. Where to seek redress
If you wish to seek redress for an infringement of your personal information, you may apply to the bodies below for dispute resolution or advice. These bodies are separate from the Clinic.
| Body | Telephone (within Korea) | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Centre (KISA) | 118 | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office, Cybercrime Investigation Division | 1301 | www.spo.go.kr |
| Korean National Police Agency, Cyber Bureau | 182 | ecrm.police.go.kr |
These are the Korean authorities, because the Clinic is a Korean data controller — they are the bodies that can act on a complaint about us. The telephone numbers are the domestic numbers those bodies publish and are dialled within Korea; each of them can be reached from anywhere through the website beside it.
13. Changes to this policy
- This policy applies from the effective date shown above.
- If we change this policy because the law changes or because what we process changes, we will announce the change and its effective date on this website at least seven days beforehand.
Previous versions of this policy are available below.