Privacy Policy

1. Information and purposes

Accounts: name, user ID, password, email, phone number, signup language and account identifiers support authentication, account administration and member-only content. Password confirmation checks matching input.

Optional information: gender and email/SMS preferences are stored. They are not required for basic membership. Contact the clinic to withdraw promotional communication preferences.

Requests: area of interest, name, contact details (phone/WhatsApp or LINE ID, as shown on the language-specific form), optional message, submission language/time and request identifiers support handling, follow-up and request history. Signed-in requests are linked to the account.

Connections/security: IP address, request URL, browser/device information and connection time may be processed by hosting and authentication services. Request identifiers and identifiers derived from IP/browser information help prevent duplicate or excessive submissions.

Do not enter identification/passport numbers, detailed diagnoses, test results or unnecessary sensitive information in messages. Provide necessary health information through the separate process explained by medical staff.

2. Retention and deletion

Account information and linked website requests are retained until account withdrawal. Guest requests are retained until the individual requests deletion. Contact +82-2-6933-7587; deletion requests are processed after identity verification.

Completing withdrawal in My Page deletes the account and its linked website appointment/consultation requests. Guests should request deletion by telephone. Marking a request as completed is different from deleting its record.

Information is destroyed without delay when its retention period ends or its purpose is fulfilled. Electronic records are deleted to prevent recovery or reproduction. Legally required information is managed separately to the extent needed. Clinical records have separate statutory retention requirements.

Operational/security logs and analytics are processed separately as described below. Provider recovery copies follow provider deletion/backup procedures; withdrawal does not erase every copy at the same instant.

3. Providers and overseas processing

The primary region for member and appointment databases is Seoul, South Korea. A Korean storage region does not exclude overseas processing by international hosting, authentication and analytics providers.

Supabase Pte. Ltd. — authentication and member/appointment database operations. Data includes account, authentication, member and inquiry information. The project storage region is Seoul, South Korea. Encrypted connections process service use/requests under the member/guest retention criteria above. Provider resources below explain support and subprocessors.

Vercel Inc. — website/CMS hosting and request processing, including IP address, request URL, browser information and data necessary to process service requests. Website functions run in the United States and CMS functions in Seoul, South Korea, with a global delivery network processing requests. The current Hobby plan provides a one-hour dashboard runtime-log window. This is not a claim that every provider security/operational log is deleted after one hour.

Google LLC — GA4 usage statistics. Page views, referrals, device and event data are sent over encrypted connections during visits/interactions and may be processed in the United States and other Google service locations. Configured retention appears below. Inquiry names, phone numbers and messages are excluded from analytics event parameters.

Contact the clinic about providers/overseas processing or to object. Analytics blocking options are linked below. Refusing processing required for authentication or online requests may prevent those features; telephone requests remain available. External social, map and YouTube links follow the respective service’s policy.

4. Browser storage, cookies and analytics

Browser storage maintains login sessions. Production-site GA4 measures visited pages, referrals, device/browser information and interactions including page views, clicks and completed appointment requests.

Current GA4 settings retain event data for 2 months and user data for 14 months, resetting user retention on new activity. Aggregated standard reports may follow different retention rules.

Restrict or delete cookies/site data in browser privacy settings, or use Google’s Analytics opt-out guidance below. Restricting/clearing storage may affect persistent login and other functions.

5. Rights and requests

Request access, correction, deletion, restriction or withdrawal of consent at +82-2-6933-7587. Account editing and withdrawal are also available in My Page. Identity is verified before handling requests; applicable legal restrictions will be explained.

Legal guardians may exercise a child’s privacy rights. Information necessary to verify identity/authority may be requested. Do not upload sensitive identity documents in public posts or inquiry messages; contact the clinic first for instructions.

Privacy complaints or disputes may also be referred to Korea’s Personal Information Infringement Report Center or Personal Information Dispute Mediation Committee.

6. Safeguards and privacy contact

The website uses HTTPS encryption, server-side member/administrator authorization and administrator-only operational screens. Private cache controls apply to responses containing member/request information.

Privacy officer: Taek Kyun Kim / Operator: THE PLUS Plastic Surgery / Telephone: +82-2-6933-7587 / Address: 3F–4F, 9 Garosu-gil, Gangnam-gu, Seoul, South Korea.

7. Effective date and changes

This policy takes effect on October 28, 2026. Material changes to information, retention or service providers will be announced on this page with their effective date.