privacy statement

◆ In accordance with Article 30 of the Personal Information Protection Act, LE ROSE Clinic establishes and discloses the following Privacy Policy to protect the personal information of data subjects (customers) and to ensure that related complaints and concerns are handled promptly and efficiently.

1. Purpose of Collecting and Using Personal Information
□ Purpose of Collection and Use of Personal Information
The Company uses the personal information it collects for the following purposes:
ο Fulfillment of contracts for the provision of services and delivery of content related to such services.
ο Identity verification and personal identification in connection with service use, prevention of fraudulent use by problematic members and unauthorized access, handling of complaints and other customer inquiries, and delivery of notices.
ο Marketing and advertising purposes, including providing information about events and promotional content, offering opportunities to participate, providing services and displaying advertisements based on demographic characteristics, analyzing access frequency, and compiling statistics on service usage.
ο Verification of the identity of complainants, confirmation of complaint details, contact and notification for fact-finding purposes, and notification of processing results.

2. Categories of Personal Information Collected
□ The following personal information is collected for purposes such as membership registration, consultations, and service applications.
ο Information collected: Name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, and service usage records
ο Optional information: Branch location, areas of interest, event-related selections, registration source, and consent to receive email and SMS communications
ο Retention period: Retained on a semi-permanent basis until the user separately requests to opt out or withdraws their membership
ο Method of collection: Website (membership registration, consultation board, reservation board, simplified login, etc.)

3. Retention and Use Period of Personal Information
① processes and retains personal information within the period agreed to by the data subject at the time of collection or within the retention and use period prescribed by applicable laws and regulations.
② The specific processing and retention periods are as follows:
ο Customer registration and management: Until termination or cancellation of the service agreement; however, if any outstanding claims or obligations remain, until such claims or obligations have been fully settled
ο Records related to contracts, withdrawal of offers, payments, and the supply of goods or services in electronic commerce: 5 years
ο Where personal information is collected for diagnosis and treatment: In accordance with the standards prescribed by the Medical Service Act
ο Even after the purpose of collection or provision has been achieved, personal information may be retained where preservation is required under the Commercial Act or other applicable laws and regulations.

4. Outsourcing of Personal Information Processing
① entrusts the following personal information processing tasks to an external service provider for the efficient handling of personal information-related operations.
ο Entrusted party (Processor): Cross Design
* Scope of entrusted tasks: Identity verification related to membership services, handling of complaints and other customer inquiries, delivery of notices, development of new services (products), provision of customized services, and provision of event and promotional information and participation opportunities
② When entering into an outsourcing agreement, LE ROSE Clinic specifies in writing, in accordance with Article 25 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than the entrusted tasks, technical and administrative safeguards, restrictions on subcontracting, management and supervision of the entrusted party, liability for damages, and other relevant responsibilities. LE ROSE Clinic also supervises the entrusted party to ensure that personal information is processed securely.

5. Provision of Personal Information to Third Parties
LE ROSE Clinic does not provide personal information to third parties except in cases permitted under Article 17 of the Personal Information Protection Act, such as when separate consent has been obtained from the data subject or when specifically required by law.

6. Rights and Obligations of Data Subjects and How to Exercise Them
Data subjects may exercise the following rights related to personal information protection at any time with respect to LE ROSE Clinic:
① Request access to personal information
② Request correction of errors or inaccuracies
③ Request deletion of personal information
④ Request suspension of personal information processing
These rights may be exercised in writing, by email, fax, or other means in accordance with Form No. 8 of the Enforcement Rule of the Personal Information Protection Act, and LE ROSE Clinic will take action without delay.
If a data subject requests correction or deletion of inaccurate personal information, LE ROSE Clinic will not use or provide the relevant personal information until the correction or deletion has been completed.
These rights may also be exercised through a legal representative or an authorized agent of the data subject. In such cases, a power of attorney in accordance with Form No. 11 of the Enforcement Rule of the Personal Information Protection Act must be submitted.

7. Categories of Personal Information Processed
LE ROSE Clinic processes the following categories of personal information.
ο Information collected: Name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, and service usage records
ο Optional information: Branch location, areas of interest, event-related selections, registration source, and consent to receive email and SMS communications

8. Destruction of Personal Information
① In principle, LE ROSE Clinic destroys personal information without delay once the purpose of processing the personal information has been fulfilled. The procedures, time limits, and methods of destruction are as follows.
If the retention period for personal information has expired, the information will be destroyed within 5 days from the expiration date. If the personal information is no longer necessary due to fulfillment of the processing purpose, termination of the relevant service, closure of the business, or other reasons, it will be destroyed within 5 days from the date on which it is determined that further processing is no longer necessary.
② LE ROSE Clinic destroys personal information using the following methods:
ο Electronic files: Files are deleted, disks are formatted, or other technical methods are used to ensure that the records cannot be restored or reproduced.
ο Paper documents: Documents are shredded or incinerated.

9. Installation and Operation of Automatic Personal Information Collection Devices and How to Refuse Them
LE ROSE Clinic uses “cookies” and similar technologies that periodically store and retrieve users’ information in order to provide personalized services tailored to individual users.
ο Cookies are used to provide personalized services by analyzing access frequency and visit times, identifying users’ preferences and areas of interest, tracking usage patterns, and measuring participation in events and the number of visits.
ο Users may configure their web browser settings to allow all cookies, receive a notification whenever a cookie is stored, or refuse the storage of all cookies.

10. Measures to Ensure the Security of Personal Information
In accordance with Article 29 of the Personal Information Protection Act, LE ROSE Clinic implements the following technical, administrative, and physical measures necessary to ensure the security of personal information.
ο Regular Internal Audits
LE ROSE Clinic conducts regular internal audits (once a year) to ensure the secure handling of personal information.
ο Minimization and Training of Personnel Handling Personal Information
LE ROSE Clinic designates employees who are authorized to handle personal information and limits access to the minimum number of personnel necessary for proper management.
ο Establishment and Implementation of an Internal Management Plan
LE ROSE Clinic establishes and implements an internal management plan to ensure the secure processing of personal information.
ο Technical Measures Against Hacking and Other Threats
To prevent personal information from being leaked or damaged due to hacking, computer viruses, or other threats, LE ROSE Clinic installs security programs, performs regular updates and inspections, and places systems in areas with controlled external access while implementing technical and physical monitoring and blocking measures.
ο Encryption of Personal Information
Users’ passwords and other personal information are encrypted for storage and management so that only the user can access them. Important data is additionally protected through measures such as file encryption, encryption of transmitted data, and file-locking functions.
ο Restrictions on Access to Personal Information
LE ROSE Clinic takes necessary measures to control access to personal information by granting, modifying, and revoking access privileges to database systems that process personal information. Unauthorized external access is also controlled through the use of intrusion prevention systems.

11. Personal Information Protection Officer
LE ROSE Clinic designates the following Personal Information Protection Officer to oversee and take responsibility for matters related to the processing of personal information and to handle complaints and requests for relief from data subjects regarding personal information processing.

ο Personal Information Protection Officer
* Name:
* Contact: 02-543-9053

12. Consequences of Refusing Consent
Users (data subjects) have the right to refuse consent to the collection and use of their personal information. However, if consent is not provided, access to certain related services may be restricted.