Privacy Policy
Effective from · September 1, 2026
This is a translation provided for your convenience. The Korean version is the authoritative text; where the two differ, the Korean version prevails.
QD Clinic (“the Clinic”) establishes and discloses the following privacy policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related concerns promptly.
1. Why we process personal information
The Clinic processes personal information only for the purposes below. If a purpose changes, we will tell you in advance and ask for your consent.
- To receive and answer online consultation enquiries — so that we can contact you and explain what you asked about.
- To analyse how this website is used — so that we can see what information is needed and improve the pages.
This policy covers only the personal information we receive through this website. Medical records created after you visit the Clinic are handled separately under the Medical Service Act. This website has no membership, no login and no payment.
2. What personal information we process
| Category | Items | How we receive it |
|---|---|---|
| Online consultation enquiry (required) | Name, country, how you would like us to reply, the contact detail that reply method needs (mobile number or e-mail address), and your enquiry | Entered by you on the enquiry form |
| Online consultation enquiry (optional) | When you would like to visit, and the treatments you are interested in | Your enquiry is accepted even if you leave these blank. |
| Website usage records (collected automatically) | Cookies, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived (search or advertising link information) | Generated automatically while you use the website |
Your IP address is used only at the moment a request arrives, to block repeated spam enquiries from the same source, and it is not stored. The Clinic does not collect resident registration numbers or any other unique identifiers through this website.
3. How long we keep personal information
The Clinic keeps personal information for the periods below and destroys it without delay once the period has passed.
| Category | Retention period | Once the period has passed |
|---|---|---|
| Online consultation enquiries | 3 years from the date received | Your name, contact number and e-mail address are deleted beyond recovery. What remains of the enquiry can no longer be traced to you and is used only as a statistic. |
| Website usage records (Google Analytics) | 14 months | Google deletes them automatically. |
| Records of staff access to personal information | 2 years | Deleted automatically. We delete them as soon as the minimum period required by law has passed, because holding less personal information is the safer position. |
Regardless of these periods, if you ask us to delete your information we will do so immediately, unless a law requires us to keep it.
4. Providing personal information to third parties
The Clinic does not provide personal information to third parties.
The only exceptions are where a law specifically provides otherwise, or where an investigative authority requests it through the procedure and in the manner set out by law.
5. Processing entrusted to others
To run this website, the Clinic entrusts the following work to others.
| Who | What they do for us | How long they hold it |
|---|---|---|
| Amazon Web Services, Inc. | Operating and storing the servers on which this website and the enquiry system run | Until the contract ends, or until the retention period in section 3 has passed |
| Google LLC | Analysing how this website is used (Google Analytics) | 14 months |
| Microsoft Corporation | Analysing how these pages are used on screen (Microsoft Clarity) | 30 days for recordings (9 months for heatmaps) |
The servers are located in the Republic of Korea (Seoul region), so personal information from your enquiry is not transferred abroad. Google Analytics and Microsoft Clarity data is transferred abroad as described in section 6. When we enter into such contracts we require that personal information is handled safely, and if the entrusted work changes we will update and publish this policy.
6. Transfer of personal information abroad
To produce website usage statistics, personal information is transferred abroad as follows.
| Item | Google Analytics | Microsoft Clarity |
|---|---|---|
| Who receives it | Google LLC | Microsoft Corporation |
| Country | United States | United States. The data is held in the Microsoft Azure cloud |
| When and how it is transferred | Sent automatically over the network by your browser when you open a page | The same |
| What is transferred | Cookie identifier, browser and device type, the country you connect from, browser language, the pages you view, and how you arrived | Cookie identifier, browser and device type, the country you connect from, the pages you view, how you arrived, and a record of how you moved, pressed and scrolled on the page together with what was on screen at the time. Anything you type — every input field and dropdown — is masked before it is sent. |
| Purpose | Analysing how this website is used | Analysing how these pages are used on screen, so that they can be improved |
| How long it is held | 14 months | 30 days for recordings; up to 9 months for heatmaps and for recordings we have marked |
Information that could identify you personally — your name, contact number or e-mail address — is never sent to either company. One consequence is worth stating plainly: because nothing identifying you is sent, the screen records held by Microsoft Clarity cannot be picked out as yours, and so cannot be deleted on request. If you would rather they were not made, refuse cookies by the methods in section 9. Refusing either transfer does not affect your use of the website or your ability to send an enquiry.
7. How personal information is destroyed
- Personal information is destroyed without delay once the retention period has passed or the purpose has been achieved.
- Personal information held as electronic files is deleted beyond recovery. Every day, at a set time, the Clinic’s enquiry system automatically erases the name, contact number and e-mail address of enquiries whose retention period has passed.
- Personal information printed on paper is shredded or incinerated.
8. Your rights and how to exercise them
You may exercise the following rights in relation to the Clinic at any time.
- Ask to see your personal information
- Ask us to correct anything that is wrong
- Ask us to delete it
- Ask us to stop processing it
You can exercise these rights by telephone or e-mail to the privacy officer named in section 11. We will check the request, act on it without delay and tell you the outcome. If someone acts on your behalf, please send a letter of authority with the request. The Clinic does not collect personal information from children under 14 without the consent of their legal representative, so enquiries should be sent by someone aged 14 or over, or by a legal representative.
9. Cookies and similar tools, and how to refuse them
The Clinic uses cookies to produce website usage statistics. A cookie is a small record stored in the browser you use to open the website, and it is what lets us tell whether the same visitor has returned.
The Clinic sets one cookie of its own. It remembers the language you picked from the language menu, so that the website opens in that language when you come back. It holds nothing but a language code, expires after a year, and is never sent to our servers. Every other cookie is set by the tools below.
| What | What it does | How to refuse it |
|---|---|---|
| Google Analytics | Counts the pages you view and how you arrived, and turns that into statistics. | Block cookies in your browser settings, or install the opt-out add-on Google provides. |
| Microsoft Clarity | Records where on a page people press and how far down they read, so that pages can be improved. Anything you type is masked before it is sent. | Block cookies in your browser settings. |
| Google Maps · Instagram posts · TikTok videos | Shows the map of how to reach us and our Instagram posts, and plays our TikTok videos, inside the page. | These companies may set their own cookies. Block third-party cookies in your browser settings. |
| YouTube videos | Plays the Clinic’s videos inside the page. | We have embedded them in the mode that does not use cookies. If you do not play a video, nothing is stored. |
- Where to get Google’s opt-out add-on — tools.google.com/dlpage/gaoptout
- Where to refuse cookies in your browser — Chrome: Settings › Privacy and security › Third-party cookies / Edge: Settings › Cookies and site permissions / Safari: Settings › Privacy
- Separately from cookies, the Clinic uses your browser’s storage for three things only, and none of them holds anything that identifies you. The first is the date on which you pressed “do not show again today” on a notice; the second is whether you arrived through an advertisement or a search; the third is whether you have already opened a page during this visit. The first two are never sent to our servers; the third is sent only as a single yes or no — whether this is your first page — so that visitor numbers can be counted. The last two are erased when you close the browser.
You can refuse every cookie and still read the website and send an enquiry.
10. How we keep personal information safe
The Clinic takes the following measures to keep personal information safe.
- Access to personal information is limited to the smallest number of staff the work requires, and every grant, change and removal of access is recorded.
- Records of staff viewing or editing personal information are kept and reviewed.
- Everything sent between this website and the Clinic’s systems is encrypted (HTTPS).
- Requests arriving repeatedly from the same source within a short time are limited, which blocks automated harvesting and spam.
- Personal information whose retention period has passed is destroyed automatically, without anyone having to remember to do it.
11. Privacy officer
The Clinic has designated the following privacy officer, who takes overall responsibility for the processing of personal information and handles enquiries, complaints and remedies from data subjects.
| Name | Hong Sahyeok |
|---|---|
| Telephone | 02-514-1650 |
| qdclinic@naver.com |
You may raise any privacy-related question arising from your use of this website with the privacy officer. We will answer and act without delay.
12. Where to seek redress
If you wish to seek redress for an infringement of your personal information, you may apply to the bodies below for dispute resolution or advice. These bodies are separate from the Clinic.
| Body | Telephone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Centre (KISA) | 118 | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office, Cybercrime Investigation Division | 1301 | www.spo.go.kr |
| Korean National Police Agency, Cyber Bureau | 182 | ecrm.police.go.kr |
13. Changes to this policy
- This policy applies from the effective date shown above.
- If we change this policy because the law changes or because what we process changes, we will announce the change and its effective date on this website at least seven days beforehand.
- This is the first version of this policy; there is no earlier one.