Last updated: July 31, 2026
Beautystone Clinic provides the following Privacy Policy for our patients.
Beautystone Clinic (“the Clinic”) complies with the Personal Information Protection Act, the Medical Service Act, and other relevant laws of the Republic of Korea, and safely manages the personal information of data subjects. In accordance with Article 30 of the Personal Information Protection Act, the Clinic establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for processing and protecting personal information, and to ensure that related complaints can be handled promptly and smoothly.
Article 1 (Purpose of Processing)
The Clinic processes personal information only within the following purposes.
Provision of medical services: appointment scheduling, medical record management, diagnosis and treatment, prescriptions, examinations, and other medical services, as well as billing, payment, and refund management for medical fees
Compliance with laws: retention of medical records under the Medical Service Act, and responding to requests from health authorities
Marketing and advertising: sending promotional information such as events, tracking visit frequency, and compiling statistics on service use
Reservation and consultation intake: receiving appointment and consultation requests through the Clinic website's online booking and consultation forms, confirmation contact, and notification of results
※ For reservations or consultations made through external platforms such as Naver Place, the collection and use of personal information follows that platform's own policy.
Article 2 (Items of Personal Information Processed)
The Clinic collects and uses personal information only for the purposes of medical treatment and legal compliance.
Items collected during treatment: name, resident registration number, address, contact information, medical records (health information), and other items required under the Medical Service Act
Items collected when receiving medical fees: card issuer name, approval number, and other payment approval information
Items collected via the website reservation/consultation form: name, contact information, email (optional), treatment item, preferred appointment date, and consultation content
Items collected at website member (account) sign-up: name, email, password (stored encrypted), and contact information
Items collected automatically on the website: access logs, cookies, IP address, etc. (for security and quality management purposes)
Article 3 (Retention and Use Period)
The Clinic processes and retains personal information within the retention/use period required by law, or the retention/use period agreed to by the data subject at the time of collection.
In accordance with Article 15 of the Enforcement Rules of the Medical Service Act (retention of medical records):
Patient register: 5 years
Medical records: 10 years
Surgical records: 10 years
Prescriptions: 2 years
Examination findings: 5 years
Website reservation/consultation records: 1 year from the date of collection (destroyed without delay once the purpose is achieved)
Website member (account) information: retained until membership withdrawal, and destroyed without delay upon withdrawal (information required to be retained under relevant laws is separately stored for the applicable period before destruction)
Reservation/consultation records (external platforms): follows the policy of the relevant platform
Information used for marketing and advertising: until consent is withdrawn
Article 4 (Procedures and Methods for Destroying Personal Information)
The Clinic destroys personal information without delay once the retention period has elapsed or the purpose of processing has been achieved.
Personal information stored in electronic file form is destroyed using methods that make the records unrecoverable.
Personal information printed on paper is destroyed by shredding or incineration.
Article 5 (Provision of Personal Information to Third Parties)
As a general rule, the Clinic does not provide personal information to third parties without the data subject's consent.
However, information may be provided where required by law, at the lawful request of a public institution, or to the extent necessary for continuity of care, such as the transfer of an emergency patient.
Article 6 (Measures to Ensure the Security of Personal Information)
The Clinic implements protective measures to ensure the security of personal information, including establishing and enforcing an internal management plan, managing access authority, encryption, retaining and inspecting access logs, and administrative, technical, and physical measures such as securing the server room.
Article 7 (Rights of Data Subjects and Their Legal Representatives)
Data subjects (and their legal representatives) may at any time request the Clinic to access, correct, delete, suspend processing of, or withdraw consent for their personal information.
Such rights may be exercised with the Clinic in writing, by email, fax, telephone, etc., in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Clinic will act on the request without delay.
Such rights may also be exercised through a representative, such as the data subject's legal representative or an authorized agent. In this case, a power of attorney in the form of Attached Form No. 11 under the "Notification on Methods of Processing Personal Information" must be submitted.
A data subject's right to request access to, or suspension of processing of, personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
Deletion may not be requested where the personal information is specified as subject to collection under other laws.
The Clinic verifies whether the person exercising these rights is the data subject or a legitimate representative.
Article 8 (Data Protection Officer)
The Clinic has designated a Data Protection Officer, as shown below, to take overall responsibility for personal information processing and to handle complaints and remedy harm for data subjects in connection with personal information processing.
Data Protection Officer: Gaeul Kim
Contact: 02-3144-0107 / bsclinchj@naver.com
Article 9 (Remedies for Infringement of Rights)
To obtain remedy for infringement caused by a breach of personal information, data subjects may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, and other relevant bodies. For other reports of, or consultations about, personal information infringement, please contact the organizations below.
Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
National Police Agency: 182 (no area code) (ecrm.cyber.go.kr)
Article 10 (Changes to the Privacy Policy)
This Policy takes effect on July 31, 2026, and any changes will be announced through the website.
As of July 31, 2026, the Clinic has resumed operating website member sign-up and login features. Personal information collected at sign-up is processed only within the purposes and retention periods set out in Articles 1 through 3, and members may update their information or withdraw membership (request destruction of personal information) at any time in My Page.
