Essential Clinic (hereinafter referred to as “the Company”) has established and published the following personal information handling guidelines in accordance with Article 30 of the Personal Information Protection Act, with the aim of protecting the personal information of data subjects and ensuring that any related complaints can be handled promptly and efficiently.

Article 1 (Purpose of Processing Personal Information)
The company processes personal information for the following purposes. The personal information collected is not used for any other purposes beyond these designated uses. Should the purpose of its use change, the company will take necessary measures, such as obtaining additional consent in accordance with Article 18 of the Personal Information Protection Act.

Registration and management of website members
Personal information is processed for the purposes of confirming members' intentions to register, conducting identity verification and authentication in connection with the provision of membership services, maintaining and managing member status, verifying identities under the limited identity verification system, preventing unauthorized use of services, confirming the consent of legal guardians when processing personal information of children under 14 years of age, as well as for various notifications, communications, and complaint handling.

Provision of goods or services
Personal information is processed for purposes such as product delivery, service provision, sending contracts and invoices, providing content, offering customized services, conducting identity verification and age verification, processing fee payments and settlements, and pursuing debts.

3. Complaint Resolution
Personal information is processed for purposes such as verifying the identity of the complainant, confirming the details of the complaint, contacting or notifying the relevant parties for factual investigation, and informing them of the handling results.

Article 2 (Processing and Retention Period of Personal Information)
The company shall process and retain personal information within the periods specified by laws and regulations, or within the limits agreed upon with the individuals from whom the information was collected.
② The specific periods for processing and retaining each type of personal information are as follows.

Registration and management of website members: Valid until the business/organization terminates its membership on the website.
However, in cases falling under the following circumstances, this shall remain in effect until such circumstances cease to exist.
In cases where investigations or inquiries are underway due to violations of relevant laws and regulations, such proceedings shall continue until they are completed.
2) In the event that any creditor-debtor relationships arise from the use of the website, such relationships shall remain in effect until they are fully settled.


2. Provision of goods or services: Until the completion of the supply of goods or services and the settlement of fees.
However, in the following circumstances, this period shall continue until its end.
Records related to transactions, such as disclosures and advertisements in accordance with the "Law on the Protection of Consumers in E-commerce and Other Areas," contract terms, and their execution.
Records related to labeling and advertising: June
Records of contract or offer cancellation, payment transactions, and supply of goods: 5 years
Records regarding the handling of consumer complaints or disputes: 3 years
2) Retention of communication record verification information in accordance with Article 41 of the "Communication Privacy Protection Act"
- Subscriber's telecommunications date, start and end times of service, recipient subscriber number, number of usage instances, location tracking data of the sending base station: 1 year
Computer communication records, internet log data, and location tracking information: 3 months


Article 3 (Provision of Personal Information to Third Parties)
The company shall process the personal information of data subjects only within the scope specified in Article 1 (Purposes of Personal Information Processing). Personal information shall be provided to third parties only in cases where consent has been obtained from the data subjects or where there are special legal provisions, in accordance with Articles 17 and 18 of the Personal Information Protection Act. In all other circumstances, the company shall not disclose the personal information of data subjects to third parties.
② In order to provide smooth services, the company may, in accordance with Article 17, Paragraph 1, Item 1 of the Personal Information Protection Act, obtain the consent of the information subject and provide personal information to third parties only within the necessary minimum scope.
Party receiving personal information: (OOO Card Co., Ltd.)
Purpose of using the recipient’s personal information: Business collaboration such as co-hosting events, as well as the issuance of cooperative credit cards>
Items of personal information provided: Name, address, phone number, email address, card payment account information
Period of possession and use by the recipient: During the validity period of the credit card issuance agreement>


Article 4 (Delegation of Personal Information Processing)
To ensure the smooth processing of personal information, the company has entrusted the following tasks related to the handling of personal data.
- Contents of the commissioned services
Entrusted Party: (Co., Ltd.) AimWeb Nature of the Entrusted Services: Provision of system services for e-commerce hosting, mobile app development, marketing services, as well as additional and collaborative services; also includes agency services for sending notification messages via AlloTalk, FriendTalk, and text messages.
- Principal: OOO PG
- Details of the entrusted task: Payment processing and escrow services
- Entrusted Party (Agent): OOO Delivery Service
Content of the commissioned task: Product delivery services
- Entrusted Party (Agent): OOO Customer Service Center
- Content of the commissioned task: Customer consultation services
- The entrusted party (agent): OOO
- Content of the entrusted task: Identity verification services
- **Subcontractor**
- Subcontractor: (Co., Ltd.) AimWeb → InfoBip (CDU)
- **Content of the commissioned service: Sending text messages and informational notifications via Kakao Talk.**
- Subcontractor: (Corp.) AimWeb → (Corp.) LunaSoft
- **Scope of the commissioned services: Sending text messages, as well as notifications via Kakao Talk (informational messages) and private chats.**
② When entering into a commission contract, the company shall specify in documents such as the contract the provisions regarding responsibilities, including prohibitions on processing personal information for purposes other than those specified in the commission agreement, technical and managerial safeguards, restrictions on sub-contracting, supervision and management of the subcontractor, and liability for damages, in accordance with Article 25 of the Personal Information Protection Act. The company also oversees whether the subcontractor is handling personal information in a secure manner.
In the event that the content of the entrusted services or the trustee changes, we will promptly disclose such information through this Privacy Policy.

Article 5 (Rights of Information Subjects and Legal Representatives and Methods of Exercising Those Rights)

Information subjects may exercise the following rights related to personal information protection against the company at any time.
Request for access to personal information
In case of any errors, corrections will be requested.
3. Request for Deletion
4. Request for Suspension of Processing
The exercise of rights pursuant to Article 1 may be carried out in writing, by telephone, via email, or fax to the company, and the company shall take prompt action in response.
③ When the information subject requests corrections or deletion due to errors in their personal information, the company shall refrain from using or providing such personal information until the corrections or deletions are completed.
④ The exercise of rights pursuant to Article 1 may be carried out through an authorized representative, such as the legal representative of the information subject or a person entrusted with powers. In such cases, a power of attorney in accordance with Form 11 of the Implementing Rules of the Personal Information Protection Act must be submitted.
⑤ The data subject must not violate relevant laws and regulations, such as the Personal Information Protection Act, by infringing upon the personal information or privacy of themselves or others that are being processed by the company.


Article 6 (Types of Personal Information Being Processed)
The company processes the following types of personal information.

Registration and management of website members
Required information: Name, Date of Birth, ID, Password, Address, Telephone Number, Gender, Email Address, IP Number
Optional fields: Marital status, areas of interest

Provision of goods or services
Required information:
Optional fields:

Article 7 (Deletion of Personal Information)
The company shall promptly destroy any personal information that becomes unnecessary, such as when the retention period has expired or the purpose for which it was collected has been achieved.
② Even if the period for retaining personal information as agreed upon by the individual has expired or the purpose for processing such information has been achieved, if continued retention of the personal information is required by other laws and regulations, then such information shall be transferred to a separate database or stored in a different location.
The procedures and methods for destroying personal information are as follows.
1. Destruction Procedures
The company identifies the personal information for which deletion is warranted and proceeds to delete it upon obtaining the approval of the company’s person in charge of data protection.
2. Methods of Destruction
The company destroys personal information recorded and stored in electronic file format by making it impossible to retrieve the data. For personal information recorded and stored in paper documents, it is destroyed by shredding or incineration.

Article 8 (Measures to Ensure the Security of Personal Information)
The company has taken the following measures to ensure the security of personal information.
Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.
2. Technical Measures: Management of access rights for personal information processing systems, implementation of access control systems, and use of unique identification information.
Encryption and installation of security programs.
3. Physical measures: Access control for computer rooms, data storage areas, etc.

Article 9 (Provisions regarding the installation, operation of automatic personal information collection devices, and the right to refuse their use)
The company uses “cooki” to store and retrieve user information on a regular basis, thereby providing personalized services to its users.
A cooki is a small amount of information sent by a server (HTTP) that operates a website to a user's computer browser, and it is stored on the user's PC or mobile device.
③ Users can adjust their settings regarding cookie acceptance and blocking through their web browser options. However, refusing to allow cookie storage may result in difficulties using customized services.

▶ Allow/Block Cooki in Your Web Browser
- Chrome: Go to Web Browser Settings > Privacy & Security > Clear Browsing Data
- Edge: Web Browser Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data

▶ Allow/Block cooki in mobile browsers
- Chrome: Mobile Browser Settings > Privacy & Security > Clear Browsing Data
- Safari: Go to Mobile Device Settings > Safari > Advanced > Block All Cooki
- Samseong Internet: Mobile Browser Settings > Internet History > Delete Internet History

④ During the service usage process, the company collects and utilizes information regarding the services and websites visited by users, their patterns of access and usage, popular search terms, and whether secure connections were used. This data is gathered to provide users with more optimized information.


Article 10 (Duty of Personal Information Protection Officer)
The company is responsible for overseeing all matters related to the processing of personal information. To handle complaints from data subjects and provide compensation for any resulting damages, the company has appointed the following individual as the Privacy Officer in charge of personal information protection.

▶ Personal Information Protection Officer
Statement: OOO
Position: OOO
Contact Information: , ,
※ This will direct you to the department responsible for handling personal information protection matters.

▶ Department Responsible for Personal Information Protection
Department Name: OOO Team
Contact Information: , ,

② If you have any inquiries regarding the protection of your personal information, wish to file a complaint, or seek compensation for any damages incurred while using the company’s services (or products), you may contact the person in charge of personal information protection or the relevant department. The company will respond to and address your inquiries without delay.


Article 11 (Request for Access to Personal Information)
According to Article 35 of the Personal Information Protection Act, individuals may submit requests to access their personal information to the departments listed below. The company will make every effort to process such requests promptly.

▶ Department responsible for receiving and processing requests to access personal information
Department Name: OOO
Contact Information: , ,

Article 12 (Methods for Remedying Infringements on Rights and Interests)
Individuals affected by violations of their personal information rights may seek compensation, consultation, or other assistance from the institutions listed below.
Personal Information Dispute Resolution Committee: (Dial without area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Violation Reporting Center: (Dial without area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors’ Office: (without area code) 1301 (www.spo.go.kr)
4. National Police Agency: (Dial without area code) 182 (ecrm.police.go.kr/minwon/main)


Article 13 (Implementation and Amendment of Personal Information Handling Policies)
This Privacy Policy shall come into effect on October X, 20XX.