Privacy Policy
Bocelle Clinic (hereinafter referred to as the "Clinic") complies with the Personal Information Protection Act, the Medical Service Act, and other relevant laws and regulations in order to protect the freedom and rights of data subjects. The Clinic lawfully processes personal information and manages it safely. Pursuant to Article 30 of the Personal Information Protection Act, the Clinic hereby establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for the processing and protection of personal information, and to ensure that related complaints are handled promptly and smoothly.
Article 1 (Purpose of Processing Personal Information)
The Clinic collects and uses personal information only to the minimum extent necessary for service provision. If the purpose of use is changed, the Clinic shall take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
- Provision of Medical Services
Personal information is processed for purposes including appointment scheduling, medical record management, diagnosis and treatment, prescriptions, examinations, and other medical services, as well as medical fee billing, payment, and refunds.
- Membership Registration and Management
Personal information is processed for purposes including confirmation of intent to register as a member, identification and authentication for membership-based services, maintenance and management of membership status, prevention of fraudulent use of services, delivery of notices and announcements, and complaint handling.
- Use for Marketing and Advertising (with consent)
For the purpose of service improvement and provision of customized information, as well as delivery of promotional and advertising information (via SMS, phone calls, email, etc.).
Article 2 (Items of Personal Information Processed)
The Clinic processes the following personal information items with the consent of the data subject pursuant to Article 15 (1) 1 of the Personal Information Protection Act.
- Personal Information Processed Without the Data Subject's Consent
The Clinic processes the following personal information items for service provision.
a. Provision of Medical Services and Patient Register Management
- Legal basis: Article 22 of the Medical Service Act, Article 15 (1) 2 of the Personal Information Protection Act
- Purpose of collection: Patient treatment and preservation of patient registers pursuant to the Medical Service Act
- Items collected and used: Name, Resident Registration Number, address, telephone number, email address
※ Resident Registration Numbers are collected only for identity verification procedures required by medical treatment and the Medical Service Act.
- Personal Information Processed with the Data Subject's Consent
The Clinic processes the following personal information items with the consent of the data subject pursuant to Article 15 (1) 1 of the Personal Information Protection Act.
a. Website Membership Registration and Management
- Required items: Name, mobile phone number, login ID, password, email address
- Automatically collected items: IP address, service usage records, cookies
Collection methods: Website membership registration, online consultation, online reservation, event applications, and customer inquiries
b. Use for Marketing and Advertising (with consent)
- Items collected and used: Name, mobile phone number, email address
Article 3 (Processing of Personal Information of Children Under 14)
In principle, the Clinic does not collect personal information of children under the age of 14.
Article 4 (Processing and Retention Period of Personal Information)
- The Clinic processes and retains personal information within the retention and use period prescribed by applicable laws and regulations, or within the retention and use period agreed upon by the data subject at the time of collection.
- In accordance with Article 15 of the Enforcement Rules of the Medical Service Act, the Clinic retains personal information for the following periods:
- Patient Register: 5 years
- Medical Records: 10 years
- Prescriptions: 2 years
- Surgical Records: 10 years
- Test Results and Examination Findings Records: 5 years
- Radiological Images (including video materials) and Related Reports: 5 years
- Nursing Records: 5 years
- Copies of Certificates (including medical certificates, death certificates, and post-mortem examination certificates, which shall be preserved separately): 3 years
In addition, where necessary for continuous medical treatment, the retention period for each item may be extended once only, for a period equivalent to the original retention period.
3. The retention periods for personal information collected and retained by the Clinic for purposes other than those under the Medical Service Act are as follows:
a. Website Member Information: Until membership withdrawal
b. Information used for marketing and advertising: Until consent is withdrawn
c. Complaint-handling information: Until the purpose is fulfilled
Article 5 (Procedures and Methods for the Destruction of Personal Information)
- The Clinic shall destroy personal information without delay when the retention period expires, the processing purpose is achieved, medical services are discontinued, the business is closed, or the personal information becomes unnecessary.
- If personal information must be retained pursuant to other laws despite expiration of the consented retention period or fulfillment of the processing purpose, such personal information shall be transferred to a separate database (DB) or stored in a different location.
3. Procedures and methods for destruction are as follows:
a. Destruction procedure
The Clinic identifies personal information subject to destruction and destroys it with the approval of the Clinic's Personal Information Protection Officer.
b. Destruction method
- Personal information stored in electronic file format shall be deleted using technical methods that make recovery and reproduction impossible.
- Personal information recorded or stored in paper documents shall be shredded or incinerated.
Article 6 (Provision of Personal Information to Third Parties)
- The Clinic processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or where otherwise permitted by law.
- Pursuant to Article 11 of the Emergency Medical Service Act, when transferring an emergency patient to another medical institution, the Clinic may provide necessary medical records to the receiving institution.
- The Clinic allows access to or issuance of copies of patient records in cases falling under Article 21 (3) of the Medical Service Act.
- Currently, the Clinic does not provide personal information to third parties. If provision to third parties becomes necessary in the future, the Clinic shall inform the data subject of the following matters and obtain consent pursuant to Article 17 (2) of the Personal Information Protection Act:
a. Recipient of personal information
b. Purpose of use by the recipient
c. Items of personal information provided
d. Retention and use period by the recipient
e. The right to refuse consent and any disadvantages resulting from refusal, if applicable
Article 7 (Measures to Ensure the Safety of Personal Information)
The Clinic implements the following measures to ensure the safety of personal information:
- Administrative measures: Establishment and implementation of internal management plans, designation of responsible personnel, and regular employee training
- Technical measures: Access control to personal information processing systems, installation of access control systems, encryption of personal information, and installation and updates of security programs
- Physical measures: Access control to computer rooms and data storage rooms
Article 8 (Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise)
- Data subjects may exercise rights such as access, correction, deletion, suspension of processing, and withdrawal of consent (hereinafter referred to as "exercise of rights") with respect to their personal information at any time.
- Rights may be exercised through written request, email, or telephone pursuant to Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the Clinic shall take action without delay.
- Data subjects may withdraw consent to the collection and use of personal information at any time through "membership withdrawal" after identity verification.
- Rights may also be exercised through a legal representative or an authorized agent. In such cases, a power of attorney in the form prescribed in Appendix No. 11 of the "Public Notice on Personal Information Processing Methods" must be submitted.
- The right to request access to or suspension of processing may be restricted pursuant to Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.
- If personal information is explicitly designated as subject to collection under other laws, deletion may not be requested.
- The Clinic verifies whether the person exercising rights is the data subject or a legitimate representative.
- Data subjects may exercise their rights by contacting the person in charge below. The Clinic endeavors to process such requests promptly.
Article 9 (Operation of Cookies and Automatic Data Collection Devices)
- The Clinic may use cookies and similar automatic data collection devices to provide more convenient services.
- Cookies are small amounts of information stored in a user's web browser and are used to analyze service usage records and access frequency to improve services and provide personalized features.
- Users may refuse or delete cookies through browser settings; however, refusal may limit the use of certain services.
- Instructions for changing cookie settings can be found in the help menu of the web browser in use.
Article 10 (Personal Information Protection Officer)
The Clinic designates the following Personal Information Protection Officer to oversee personal information processing and handle complaints and remedies related to personal information protection:
Personal Information Protection Officer: Yoon In-sang
Email: bocellecd1@gmail.com
Contact: 1599-8828
Data subjects may contact the Personal Information Protection Officer regarding any inquiries, complaints, or remedies related to personal information protection arising during service use. The Clinic shall respond and process such inquiries without delay.
Article 11 (Remedies for Infringement of Rights)
Data subjects may contact the following organizations for remedies and consultations regarding personal information infringement:
Personal Information Infringement Report Center
Responsibilities: Reporting and consultation regarding personal information infringement
Website: privacy.kisa.or.kr
Phone: 118 (no area code)
Address: 3F, 9 Jinheung-gil, Naju-si, Jeonnam (Bitgaram-dong 301-2), 58324
Personal Information Dispute Mediation Committee
Responsibilities: Dispute mediation applications, collective dispute mediation (civil resolution)
Website: www.kopico.go.kr
Phone: 1833-6972 (no area code)
Address: 4F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul, 03171
Supreme Prosecutors' Office Cyber Crime Investigation Division
Website: www.spo.go.kr
Phone: 02-3480-3573
National Police Agency Cyber Bureau
Website: http://cyberbureau.police.go.kr
Phone: 182 (no area code)
Article 12 (Enforcement and Amendment of the Privacy Policy)
- This Privacy Policy has been in effect since February 14, 2017.
- This Privacy Policy was amended on February 4, 2026, and supersedes the previous Privacy Policy.
