Gowoonmon Clinic (hereinafter referred to as "the Clinic") highly values your privacy and complies with the Personal Information Protection Act.
Through this Privacy Policy, we inform you of how the personal information you provide is used and managed, as well as what measures are in place to protect your personal information.

The structure of this Privacy Policy is as follows:

1. Items of Personal Information Collected and Collection Methods
2. Purpose of Collecting and Using Personal Information
3. Retention Period of Personal Information and Destruction Procedures & Methods
4. Rights of Users and Legal Representatives and How to Exercise Them
5. Provision of Personal Information to Third Parties
6. Entrustment of Personal Information Processing
7. Personal Information Protection Officer and Department in Charge
8. Measures for Ensuring the Security of Personal Information
9. Obligation to Notify Changes to the Policy


1. Items of Personal Information Collected and Collection Methods
The Clinic collects only the minimum amount of personal information necessary for medical treatment and additional services. Information required for medical treatment is collected without separate consent in accordance with the Medical Service Act.

- Personal Information Collected for Medical Treatment (Consent Not Required):
Name, Resident Registration Number (or Alien Registration Number), Address, Phone Number, Medical History, Family History, and other health information necessary for treatment.

- Personal Information Collected for Additional Services: Name, Date of Birth, Phone Number, Address, Email

- For Website Membership Registration and Management: Name, Date of Birth, Gender, Email, Address, Contact Information

- For Kiosk Management (Insurance Claims, Infectious Disease Screening):
Relevant personal information as required

2. Purpose of Collecting and Using Personal Information
The Clinic uses the collected personal information only for medical treatment, additional services, and website user management, as specified in advance and agreed upon. If the purpose of use changes, the Clinic will obtain prior consent.

3. Retention Period of Personal Information and Destruction Procedures & Methods
The Clinic retains personal information collected for medical purposes in accordance with the Medical Service Act (e.g., medical records must be kept for 10 years). For other cases, the retention period will be pre-notified, and personal information will only be retained for the agreed-upon period if individual consent is obtained.

However, even if the purpose of collection or provision has been achieved, personal information may still be retained if required by applicable laws. After the legally required period expires, the personal information will be promptly destroyed.

Destruction Procedure: Information is immediately destroyed according to the designated method.
Destruction Methods:
Electronic files are deleted using technical methods that prevent data recovery.
Printed documents are shredded or incinerated.

4. Rights of Users and Legal Representatives and How to Exercise Them
Users and their legal representatives may exercise their rights regarding personal information, such as requesting access, by contacting the Clinic via phone or in writing. The Clinic will take the necessary measures without delay.

※ Personal information that is legally required to be retained cannot be modified or deleted during the mandatory retention period, even upon request.

5. Provision of Personal Information to Third Parties
The Clinic only uses personal information within the scope stated in its intended purposes and does not use it beyond this scope or provide it to third parties, except in the following cases:

1.For statistical, academic, or market research purposes, when the information is anonymized so that individuals cannot be identified before being provided to research institutions, survey organizations, or research firms.

2.When required by law, including but not limited to the Personal Information Protection Act, Real Name Financial Transactions and Confidentiality Act, Credit Information Use and Protection Act, Medical Service Act, Medical Care Act, National Health Insurance Act, Statistics Act, Consumer Protection Act, Criminal Procedure Act, and Civil Procedure Act.

3.For compliance with legal obligations, when it is unavoidable to fulfill legal requirements. (Even if requested for administrative or investigative purposes, personal information will only be provided following a legal process, such as a warrant or an official document with the seal of the head of the investigative agency.)

4.When the data subject or their legal representative is unable to express consent, or if obtaining prior consent is impossible due to unknown address, etc., and it is clearly necessary to protect the life, body, or property of the data subject or a third party.

If personal information needs to be provided for purposes beyond the agreed-upon scope, users will be notified in advance via phone or written notice, and their explicit consent will be obtained. Users have the right to refuse or withdraw their consent at any time.

6. Entrustment of Personal Information Processing
A. When the Clinic entrusts personal information processing, it establishes a contract in accordance with Article 25 of the Personal Information Protection Act, which includes clauses on:

Prohibition of processing personal information for purposes other than the designated task
Technical and administrative security measures
Restrictions on subcontracting
Supervision of subcontractors
Liability for damages
B. If there are changes to the outsourced tasks or service providers, the Clinic will disclose this information in its Privacy Policy without delay.

7. Personal Information Protection Officer
The Clinic has designated a Personal Information Protection Officer and a dedicated department to manage privacy-related matters and handle complaints.

Personal Information Protection Officer:
Personal Information Protection Department:

8. Measures for Ensuring the Security of Personal Information
The Clinic has implemented technical security measures, such as firewalls and other security devices, to protect users’ personal information.
The Clinic has established administrative security measures, including procedures for restricting access to personal information and minimizing the number of personnel authorized to handle it.
Staff members who handle personal information receive continuous security training.
The Clinic assigns unique user IDs and passwords to authorized personnel and regularly updates these passwords.

9. Obligation to Notify Changes to the Policy
This Privacy Policy was enacted on December 23, 2021.

If there are any changes due to legal, policy, or security updates, the Clinic will notify users at least 7 days before the changes take effect via its website, stating the reasons and details of the changes.

Effective Date: December 23, 2021