1. Purposes of processing personal information
The Clinic processes personal information for the purposes below. Personal information we process is not used for any other purpose. If a purpose changes, we will take the necessary steps, such as obtaining separate consent under Article 18 of Korea’s Personal Information Protection Act.
- Understanding how the Website is used and improving the service
- Checking that links to outside services, such as booking, phone, and KakaoTalk, work properly
- Keeping staff logged in to the admin screen (only for users of that screen)
The Clinic processes only the minimum personal information needed for the purposes above.
2. Personal information we process
The Clinic does not collect personal information that data subjects enter directly on the Website, such as name, date of birth, resident registration number, phone number, email address, or medical records. The Website has no fields for entering personal information, and booking requests are made through third-party services such as Naver booking. Personal information processed on those services is governed by the privacy policy of each provider.
While a data subject uses the Website, the Clinic automatically creates and collects the items below. The legal basis for processing is Article 15(1)(6) of Korea’s Personal Information Protection Act (legitimate interests of the personal information controller). The Clinic’s legitimate interest is running and improving the Website reliably, and we do not combine the visitor identifier with identity information such as medical records, booking lists, or call logs.
| Category | Items | How collected | Legal basis |
|---|---|---|---|
| Website usage records | Path visited (excluding the query string), screen width, previous page address (if any), sections reached, whether a phone, KakaoTalk, or Naver booking link was selected, and a randomly generated visitor identifier | Collected automatically when you visit the Website | Article 15(1)(6) of Korea’s Personal Information Protection Act |
| Admin screen usage records | Session identifier for keeping you logged in | Created automatically when logging in to the admin screen | Article 15(1)(4) of Korea’s Personal Information Protection Act |
We do not record the query string of the path visited (the part after the question mark). This is so that, even if an address contains personal information, it does not remain in usage records.
3. Personal information of children under 14
The Clinic does not collect personal information of children under 14 through the Website and does not run services mainly intended for children. Accordingly, we do not collect a legal guardian’s personal information from a child to obtain the guardian’s consent.
4. Processing and retention periods
The Clinic processes and retains personal information within the retention and use period set by law, or the period consented to when the personal information was collected from the data subject. The processing and retention periods are as follows.
| Item processed | Retention and use period |
|---|---|
| Website usage records | 1 year from the date of collection |
| Cookie insight_v | 1 year |
| Cookie wj_admin | Until the login session ends |
Where related laws require retention, we keep the information for the period those laws set. At present, no other law requires us to retain Website usage records.
5. Procedure and method for destroying personal information
When personal information is no longer needed, for example because the retention period has passed or the purpose of processing has been achieved, the Clinic destroys it without delay.
- Procedure: We identify personal information for which a reason for destruction has arisen and destroy it with the approval of the Clinic’s Chief Privacy Officer.
- Method: Personal information recorded and stored as electronic files is destroyed so that the records cannot be restored. Cookies are deleted from the data subject’s browser when they expire. We do not print or keep Website usage records on paper.
6. Provision of personal information to third parties
The Clinic processes a data subject’s personal information only within the scope set out in “1. Purposes of processing personal information,” and provides it to third parties only in cases under Articles 17 and 18 of Korea’s Personal Information Protection Act, such as with the data subject’s consent or where a law specifically provides.
The Clinic does not provide personal information collected on the Website to third parties. However, if a data subject selects a link on the Website and moves to phone, the KakaoTalk channel, Naver booking, Naver Map, or Google Maps, that provider becomes the personal information controller from that point, and its privacy policy applies. Before the data subject selects such a link, the Clinic does not provide personal information to those providers.
Map images shown on the Website are fetched and served by the Clinic’s server. The data subject’s device does not connect directly to the map provider’s server.
7. Outsourcing of personal information processing
The Clinic does not outsource the processing of personal information collected automatically during use of the Website. We use a cloud database to store and manage Website content, but data subjects’ usage records are not kept in that storage.
If we outsource personal information processing in the future, under Article 26 of Korea’s Personal Information Protection Act we will state in writing the prohibition on processing personal information beyond the outsourced purpose, technical and administrative safeguards, limits on sub-outsourcing, management and supervision of the contractor, and responsibilities such as compensation for damages. We will supervise whether the contractor processes personal information securely, and disclose the outsourced work and the contractor in this policy without delay.
8. Collection and transfer of personal information outside Korea
The Clinic does not transfer personal information collected on the Website outside Korea, and does not directly collect personal information of data subjects in Korea from outside Korea.
9. Measures to keep personal information secure
Under Article 29 of Korea’s Personal Information Protection Act, the Clinic takes the following measures to keep personal information secure.
- Administrative measures: Access to the admin screen is restricted by password.
- Technical measures: The Website is served over encrypted communication (HTTPS). The visitor identification cookie is set so that only the server can read it (HttpOnly, SameSite=Lax), and query strings are removed from addresses before recording. We do not combine the visitor identifier with identity information such as medical records or booking lists.
- Physical measures: Website usage records are processed as electronic files and are not printed or kept on paper.
10. Possible disclosure of sensitive information and how to choose non-disclosure
The Clinic does not disclose data subjects’ sensitive information through the Website, and does not provide any service where data subjects can post sensitive information.
11. Processing of pseudonymized information
The Clinic does not process pseudonymized information under Article 28-2 of Korea’s Personal Information Protection Act.
12. Installation, operation, and refusal of automatic collection tools
To provide individual services to data subjects, the Clinic uses cookies, which store usage information and retrieve it as needed. A cookie is a small piece of information that the server used to run the Website sends to the data subject’s browser. It is stored on the data subject’s computer or mobile device and is sent automatically from the browser to the server when the Website is visited.
| Cookie name | Purpose | Retention period | Applies to |
|---|---|---|---|
| insight_v | A random identifier used to link visits by the same visitor. It is not linked to identity information such as a name. It is set as HttpOnly, so browser scripts cannot read it. | 1 year | Website visitors |
| wj_admin | Keeps the admin screen logged in | Until the login session ends | Staff (not set for visitors) |
Data subjects can refuse or delete cookies through their browser settings. If you refuse cookies, you can still view the Website, but repeat visits will not be linked as a single use.
How to allow or block cookies (may vary by browser version): Chrome or Edge — open a new incognito window (InPrivate window) from the menu at the top right of the browser, or delete or block cookies and site data in Settings. Safari (mobile) — Settings > Safari > Advanced > Block All Cookies. Samsung Internet — Tabs > Secret mode.
13. Collection, use, and refusal of behavioral information
The Clinic does not collect or use behavioral information for targeted advertising, or provide it to third parties. The behavioral information we process is for improving the Website, and even when we use the visitor identifier, we do not combine it with the data subject’s identity. We do not allow third parties to collect behavioral information on the Website.
| Items collected | How collected | Purpose | Retention and use period |
|---|---|---|---|
| Path visited, screen width, previous page, sections reached, whether an external link was selected, visitor identifier | Collected automatically when visiting and using the Website (our own server) | Understanding usage and improving the Website | 1 year from the date of collection |
Data subjects can refuse the collection of behavioral information by blocking or deleting cookies as described in “12. Installation, operation, and refusal of automatic collection tools.”
14. Rights and obligations of data subjects and legal guardians, and how to exercise them
Data subjects may exercise the following rights regarding personal information protection against the Clinic at any time. The legal guardian of a child under 14 may exercise these rights on the child’s behalf.
- Request to view personal information
- Request for correction if there are errors
- Request for deletion
- Request to suspend processing
- Request to transmit personal information (Article 35-2 of Korea’s Personal Information Protection Act)
Please exercise your rights by phone (+82-2-3476-2879). The Clinic will act on your request without delay. If a data subject requests correction or deletion of errors in personal information, we will not use or provide that personal information until the correction or deletion is complete.
Website usage records are processed with a random identifier, so a phone inquiry alone may not let us link a specific visit record to a data subject. In that case, the data subject can break the link to that identifier by deleting cookies in the browser.
Data subjects must not violate laws on personal information protection by infringing on their own or others’ personal information or privacy processed by the Clinic.
15. Automated decisions
The Clinic does not make fully automated decisions under Article 37-2 of Korea’s Personal Information Protection Act (decisions made solely by personal information processing equipment that significantly affect a data subject’s rights or obligations).
16. Chief Privacy Officer and complaints department
The Clinic has designated a Chief Privacy Officer, as below, to oversee and take responsibility for personal information processing, and to handle data subjects’ complaints and remedies for damage related to personal information processing.
| Role | Name and title | Contact |
|---|---|---|
| Chief Privacy Officer | Jaehyung Park, head dentist | +82-2-3476-2879 / 13F Mijin Plaza, 390 Gangnam-daero, Gangnam-gu, Seoul |
| Privacy protection and complaints department | Wonjin Dental Clinic | +82-2-3476-2879 |
Data subjects may contact the Chief Privacy Officer and the responsible department about any inquiries, complaints, or remedies for damage related to personal information protection that arise while using the Clinic’s services (or business). The Clinic will answer and act on inquiries without delay.
17. Designation of a domestic representative
The Clinic is not required to designate a domestic representative under Article 31-2 of Korea’s Personal Information Protection Act.
18. Remedies for infringement of data subjects’ rights
To seek a remedy for infringement of personal information, data subjects may apply for dispute resolution or counseling to bodies such as Korea’s Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center of the Korea Internet & Security Agency. For other reports or counseling on personal information infringement, please contact the agencies below (all are Korean agencies; numbers are dialed within Korea without an area code).
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Anyone whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (viewing of personal information), Article 36 (correction and deletion of personal information), or Article 37 (suspension of processing, etc.) of Korea’s Personal Information Protection Act may file an administrative appeal as provided by Korea’s Administrative Appeals Act. Please refer to the Central Administrative Appeals Commission (www.simpan.go.kr).
19. Operation and management of video information processing devices
This privacy policy applies to the Website and does not cover the operation and management of fixed or mobile video information processing devices at the Clinic. Information on those is provided separately at the Clinic under the relevant laws.
20. Changes to this privacy policy
This privacy policy applies from September 20, 2026.
If laws, guidelines, or the Website’s personal information processing change, we will publish the changes on this page before they take effect. The revised privacy policy will remain posted on this page, with the effective date and last updated date shown so that data subjects can check what has changed.