In accordance with Article 30 of the Personal Information Protection Act, ARNA CLINIC (the “Clinic”) establishes and discloses this privacy policy to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
This policy applies to personal information processed on the ARNA CLINIC website (arnaclinic.co.kr). Medical records and other information processed in the course of treatment are handled separately in accordance with the Medical Service Act and other applicable laws.
Article 1 (Purpose of Processing Personal Information)
The Clinic processes personal information for the following purposes. Personal information processed is not used for any purpose other than those below, and if the purpose of use changes, the Clinic will take the necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
1. Membership registration and management
Confirming the intention to register, identifying and authenticating members, providing member-only content such as before-and-after photos, maintaining and managing membership, preventing misuse, and sending notices and notifications
2. Website operation and security
Providing website services, responding to access errors and outages, and preventing misuse such as automated sign-ups
3. Website usage analytics and advertising
Analyzing website usage, measuring advertising performance, and showing Clinic ads to website visitors
Article 2 (Items of Personal Information Processed and Collection Methods)
1. Membership registration and management
Required items: email address, password, mobile phone number (including country code)
Passwords are stored encrypted, and even the Clinic cannot see the original password.
2. Information automatically generated and collected while using the website
IP address, date and time of access, pages visited, referral source, browser and device information, cookies, security check results for preventing misuse, and records of clicks on the phone, KakaoTalk, LINE and Naver booking buttons
3. Collection methods
Information is entered directly by the data subject on the membership registration screen, or collected automatically through cookies and scripts while using the website.
The Clinic does not collect resident registration numbers or sensitive information such as health conditions through the website. If you contact us by phone, KakaoTalk, LINE or Naver booking, the privacy policy of that service also applies.
Article 3 (Processing and Retention Period of Personal Information)
① The Clinic processes and retains personal information within the retention and use period prescribed by law or consented to by the data subject at the time of collection.
② The processing and retention period for each item of personal information is as follows.
1. Member information: until membership is withdrawn
However, if an investigation or inquiry for violation of relevant laws is in progress, until that investigation or inquiry is concluded
2. Website usage analytics records: 14 months from the date of collection
3. Google advertising audience lists: 180 days from the date added to the list
4. Access logs of hosting and security services: retained for the period needed for outage response and security checks, then deleted according to each service’s settings
Article 4 (Processing of Personal Information of Children Under 14)
The Clinic does not accept membership registration from children under 14. If the Clinic learns that a child under 14 has registered as a member, the information will be destroyed without delay. The Clinic also does not collect behavioral information for personalized advertising from users it knows to be under 14.
Article 5 (Provision of Personal Information to Third Parties)
The Clinic processes personal information only within the scope specified in Article 1, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject’s consent or under special provisions of law. The Clinic currently does not provide any personal information to third parties.
Article 6 (Entrustment of Personal Information Processing)
① To process personal information smoothly, the Clinic entrusts personal information processing tasks as follows.
- Contractor: Amber & Forge Concierge
- Entrusted tasks: website operation and maintenance, collection and analysis of website visit records, analysis of advertising referral sources, and advertising operation and performance analysis and reporting
- Contractor: Vercel Inc.
- Entrusted tasks: website hosting and content delivery
- Contractor: Supabase, Inc.
- Entrusted tasks: member authentication, database and file storage
- Contractor: Cloudflare, Inc.
- Entrusted tasks: security checks to prevent misuse such as automated sign-ups
② When concluding an entrustment contract, the Clinic specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, the prohibition on processing personal information for purposes other than the entrusted tasks, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the contractor, and responsibilities such as compensation for damages, and supervises whether the contractor processes personal information safely.
③ If the details of the entrusted tasks or the contractor change, the Clinic will disclose the change through this privacy policy without delay.
Article 7 (Overseas Transfer of Personal Information)
① The Clinic transfers personal information overseas as follows to perform entrusted tasks and store personal information. This disclosure is made in this policy in accordance with Article 28-8(1)(3)(a) of the Personal Information Protection Act.
1. Supabase, Inc. (privacy@supabase.io)
- Destination country: Singapore
- Items transferred: randomly generated visitor identifier, date and time of access, path and title of pages accessed, navigation history, referral source, device information, and transformed IP address value
- Date, time and method of transfer: transmitted as needed over information and communications networks while the website is used
- Purpose of use: storing website usage analytics records
- Retention and use period: 14 months from the date of collection
2. Vercel Inc. (privacy@vercel.com)
- Destination country: the United States and the countries where Vercel’s content delivery network is located (the analytics collection server is in Singapore)
- Items transferred: IP address, date and time of access, pages requested, browser and device information, and the usage analytics items in item 1
- Date, time and method of transfer: transmitted as needed over information and communications networks while the website is used
- Purpose of use: website hosting and content delivery, and operation of the analytics collection server
- Retention and use period: until the entrustment contract ends or the retention period in Article 3 expires
3. Cloudflare, Inc. (privacyquestions@cloudflare.com)
- Destination country: the United States
- Items transferred: IP address, browser and device information, and security check results
- Date, time and method of transfer: transmitted over information and communications networks at membership registration and login
- Purpose of use: preventing misuse such as automated sign-ups
- Retention and use period: until the purpose of the security check is achieved
4. Google LLC (https://support.google.com/policies/contact/general_privacy_form)
- Destination country: the United States
- Items transferred: the behavioral information in Article 11
- Date, time and method of transfer: transmitted over information and communications networks when you visit the website or click a button
- Purpose of use: measuring advertising performance and showing personalized ads
- Retention and use period: 180 days from the date added to the advertising audience list
② Member information is stored in Supabase’s data center in Seoul, Republic of Korea. However, it may be accessed from overseas in the course of operational support such as outage response.
③ Data subjects may request the Privacy Officer in Article 13 in writing, by phone or by email to stop the overseas transfer. Transfers for usage analytics and advertising can also be refused by blocking cookies as described in Article 10. If you refuse the overseas transfer, the use of some website functions, such as member-only content, may be restricted, but there is no restriction on the use of the Clinic’s services, such as treatment.
Article 8 (Procedures and Methods for Destroying Personal Information)
① When personal information becomes unnecessary, such as when the retention period has elapsed or the purpose of processing has been achieved, the Clinic destroys it without delay.
② If personal information must continue to be retained under other laws, it is moved to a separate database or stored in a different location.
③ Information in electronic files is deleted using a method that makes it unrecoverable, and information recorded on paper is shredded or incinerated.
Article 9 (Measures to Ensure the Security of Personal Information)
The Clinic takes the following measures to ensure the security of personal information.
1. Administrative measures: establishing and implementing an internal management plan, and minimizing the number of personal information handlers
2. Technical measures: encrypted password storage, encryption in transit (HTTPS), database access control, and access control for administrator screens
3. Physical measures: use of the data center protection measures of cloud service providers
Article 10 (Installation, Operation and Refusal of Automatic Personal Information Collection Tools)
① The Clinic uses cookies and browser storage, which store and retrieve website usage information, as follows.
- Member login information: keeps you logged in (deleted when you log out)
- Pop-up display preference: remembers your choice of “Don’t show again today”
- _gwv: randomly generated visitor identifier, usage analytics (expires after 400 days)
- _gws: visit session identifier, usage analytics (expires after 30 minutes)
- _gwu: advertising referral information, advertising performance measurement (expires after 30 days)
- Google advertising cookies: advertising performance measurement and personalized ads (set by Google)
② You can refuse to store cookies or delete stored cookies in your web browser settings.
- Chrome: Settings > Privacy and security > Third-party cookies
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari: Settings > Privacy > Cookies and website data
- Mobile (iOS): Settings > Safari > Advanced > Block All Cookies
- Mobile (Android): Browser app > Settings > Site settings > Cookies
③ If you refuse to store cookies, you may have difficulty using some website functions, such as member login.
Article 11 (Collection, Use, Provision and Refusal of Behavioral Information)
① The Clinic collects and uses behavioral information as follows for website usage analytics and advertising.
- Behavioral information collected: address and title of pages visited, date and time of visit, navigation history, referral source, records of clicks on the phone, KakaoTalk, LINE and Naver booking buttons, cookies and other online identifiers, and browser and device information
- Collection method: collected automatically through scripts installed on the website when you visit the website or click a button
- Collected and processed by: the Clinic (contractor: Amber & Forge Concierge) and Google LLC
- Purpose of use: website usage analytics, advertising performance measurement, and showing ads to website visitors on Google Search, YouTube and display networks
- Retention and use period: usage analytics records for 14 months from the date of collection, and Google advertising audience lists for 180 days from the date added
② The Clinic does not link behavioral information with information that can identify individuals, such as names or contact details. The Clinic does not infer users’ health conditions or treatments of interest from the treatment pages they visit to segment advertising audiences, and does not collect behavioral information on member-only pages or before-and-after photo pages.
③ You can refuse the collection of behavioral information and personalized ads in the following ways.
- Google personalized ads: turn off personalized ads in My Ad Center (https://myadcenter.google.com)
- Web browser: block cookies as described in Article 10(2)
- Mobile advertising ID: Android (Settings > Google > Ads > Delete advertising ID), iOS (Settings > Privacy and security > Tracking)
④ Inquiries, refusal requests and damage reports regarding behavioral information can be directed to the Privacy Officer in Article 13.
Article 12 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)
① Data subjects may exercise their rights against the Clinic at any time, including requesting access to, correction or deletion of, or suspension of processing of personal information, and withdrawing consent.
② Rights may be exercised in writing, by phone, by email or by other means, and the Clinic will take action without delay after verifying your identity. Membership withdrawal can be requested in the same way.
③ Rights may be exercised through a representative, such as a legal representative or a person delegated by you; in this case, a power of attorney must be submitted.
④ If a data subject requests correction or deletion of personal information, the Clinic will not use or provide that personal information until the correction or deletion is complete.
⑤ Deletion cannot be requested for personal information that other laws require to be retained, and requests for access or suspension of processing may be restricted under applicable laws.
Article 13 (Privacy Officer and Department Receiving Access Requests)
The Clinic has designated a Privacy Officer as follows to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects regarding personal information processing. Requests for access to personal information can also be made to the contact below.
▶ Privacy Officer
Name: Hyun Ah Lee
Position: Representative Director
Tel : 02-518-2228
Address: 3F, Gwanyeong Building, 170 Apgujeong-ro, Gangnam-gu, Seoul
Article 14 (Remedies for Infringement of Rights)
Data subjects may apply to the following organizations for dispute resolution or consultation to obtain remedies for infringement of personal information.
▶ Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency): (no area code) 118, privacy.kisa.or.kr
▶ Personal Information Dispute Mediation Committee: (no area code) 1833-6972, www.kopico.go.kr
▶ Supreme Prosecutors’ Office: (no area code) 1301, www.spo.go.kr
▶ Korean National Police Agency: (no area code) 182, ecrm.police.go.kr
Article 15 (Changes to the Privacy Policy)
This privacy policy takes effect on November 3, 2026.
The previous privacy policy (effective October 1, 2026) will be sent to you upon request to the contact in Article 13.