Privacy, Sensitive Information and Overseas Transfer Notice

1. Controller and privacy contact

SOEUN CLINIC (소은의원) is the controller. Privacy officer: Dr. Soeun Kim (김소은 원장).

Rights requests, withdrawal and complaints: 02-515-2005 / drsov@naver.com.

2. Required personal information — separate consent

• Required: name, name as shown on passport (Latin letters), nationality, date of birth, phone number with country code (a WeChat ID may replace it for Simplified Chinese requests), email, preferred language, preferred visit dates and times (multiple), doctor, treatments of interest, and first or return visit.
• Optional: messenger ID and how you heard about the clinic.
• If you choose to link LINE: your LINE user identifier.
• Automatically collected: consent status, time and policy version, submission time, IP address, user agent, referral code, limited attribution data and a random session identifier for booking conversion measurement.
• Purpose: consultation response, appointment coordination, identity verification at your visit, sending a receipt confirmation (when LINE is linked), duplicate prevention, security, audit, referral attribution and traffic-source analysis.
• Retention: while the request is active; the original record is destroyed or anonymized 90 days after completion, cancellation or no-show. Legal exceptions are separated for the required statutory period.
• You may refuse, but the online reservation request cannot be submitted. You may contact the clinic by phone or email instead.

3. Sensitive information — separate consent

• Items: selected treatments of interest and consultation text that may reveal desired procedures, medical history or health condition.
• Purpose: understand the inquiry and prepare an appropriate consultation response.
• Retention: the same active-request period and 90-day post-closure rule described above.
• You may refuse, but the online reservation request cannot be submitted because consultation details are required. This form does not provide a diagnosis.

4. Overseas transfer — separate consent

Data is transferred over encrypted HTTPS when you submit and is then processed for hosting, storage, security, backup and authenticated reservation operations.

• Vercel Inc. (privacy@vercel.com) — United States and countries where its subprocessors operate; the HTTPS request, IP/user-agent and service log data; hosting, API execution, security and incident response; provider log/backup periods and our 90-day original-record rule apply.
• Supabase Pte. Ltd (privacy@supabase.io) — Singapore (ap-southeast-1) and subprocessor locations; customer, reservation, consultation, consent, attribution and audit data; database storage, retrieval and backup; active-request period plus 90 days after closure, subject to limited provider backups.
• Authenticated CS Manager on Vercel — the same hosting regions; minimum reservation data needed by the SOEUN operations team and executive office; reservation response and status management; active-request period plus 90 days after closure.
• Internal TX Office on Vercel — the same hosting regions; referral code, booking UUID, allowlisted UTM values, conversion time and tenant/category only; referral attribution and settlement; raw identifiers and attribution snapshots for 90 days, after which the booking UUID and raw attribution are removed and only non-identifying settlement records remain.
• Slack Technologies, LLC — United States; name, passport name, nationality, age (calculated from date of birth), phone number, email, messenger ID, LINE user identifier, language, preferred dates and times, treatments of interest, first or return visit, how you heard about us, consultation text, booking identifier and a traffic-source summary; new-request notification and case assignment in an internal SOEUN operations channel accessible only to the SOEUN operations team and executive office; retained under the Slack workspace retention policy.
• Railway Corporation — Singapore region; LINE user identifier and receipt message content (name, preferred dates and times, treatments of interest, consultation summary); sending the receipt confirmation for LINE-linked requests; conversation records are used in the authenticated CS Manager for reservation response.
• LY Corporation (LINE) — Japan; LINE user identifier and message content when you choose to link LINE; LINE Login authentication and delivery of the receipt message from the SOEUN LINE official account; the LINE privacy policy also applies.
• Google LLC (Google Analytics 4) — United States; page visits, clicks, booking conversion events, cookies and other online identifiers and approximate location; visit statistics and advertising performance measurement; no name, contact details or consultation text are sent; retained for up to 14 months under the GA4 setting.
• You may refuse overseas transfer, but the online reservation request cannot be provided. Use the clinic phone or email above as an alternative.

5. Rights and destruction

You may request access, correction, deletion, suspension or withdrawal through the privacy contact. Browser form drafts are kept for up to 24 hours and removed after successful submission or reset. Closed reservation originals are automatically anonymized after 90 days; audit network identifiers are erased and only non-identifying operational evidence remains.