Privacy Policy

Serene Clinic (the "Clinic") establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea to protect personal information and to handle related concerns promptly.

1. Purposes of Processing

The Clinic processes personal information through its website (www.sereneclinic.kr) only for the following purposes. If a purpose changes, the Clinic will take the necessary steps, such as obtaining separate consent under Article 18 of the Act.

1. Receiving international booking requests (SERENE DIRECT), verifying identity, arranging preferred dates and confirming appointments
2. Replying to consultations and inquiries in the preferred language and contact method
3. Confirming booking deposits and deducting them at the visit
4. Website usage statistics and service improvement (in a form that does not identify individuals)

2. Personal Information Collected

1. International booking request form
   • Required: name as on passport, date of birth, nationality, country of residence, mobile number (with country code), email, messenger and messenger ID, preferred consultation language, preferred visit date and time, main treatment interest, how you found us
   • Optional: alternative date, Instagram/Threads ID, concerns and requests
   • Facial photos you choose to send by messenger during consultation (for treatment consultation, optional)
2. Deposit confirmation: payer name, amount and payment date (payment is made on PayPal; the Clinic does not receive card numbers or other payment details)
3. Information generated automatically when using the website: IP address, access time, browser and device information, visit records

The Clinic does not collect unique identifiers such as resident registration or passport numbers, or sensitive information such as medical records or medical history, through the website. Medical information is managed separately as the Clinic's medical records under the Medical Service Act after your visit.

3. Retention Periods

1. Booking request information: 3 years from the date of request (including when you do not visit)
2. Consultation photos: destroyed without delay after the consultation (if included in medical records after a visit, kept for the period required by the Medical Service Act)
3. Deposit payment records: 5 years under the Act on Consumer Protection in Electronic Commerce
4. Access logs: 3 months under the Protection of Communications Secrets Act

4. Provision to Third Parties

The Clinic does not provide personal information to third parties except with your consent or where the law specifically requires it (Articles 17 and 18 of the Act).

5. Outsourcing of Processing

The Clinic outsources processing as follows.

• Re-outsourcing: inblog Inc. re-outsources website usage analytics and error diagnostics to PostHog, Inc. (see Sections 6 and 10).

Under Article 26 of the Act, the outsourcing contract specifies the prohibition of processing beyond the purpose, security measures, restrictions on re-outsourcing, supervision and liability, and the Clinic supervises the processor. Any change will be announced through this Policy.

6. Overseas Transfer

Because the infrastructure used by the website operator and the email and spreadsheet services used by the Clinic are located overseas, booking request information is stored and processed abroad as follows. This is outsourcing and storage necessary to perform your booking and is disclosed in this Policy under Article 28-8(1)(3) of the Act.

• Time and method of transfer: sent over an encrypted network (HTTPS) when you submit the form or visit the website
• If you do not want your information transferred overseas, you can book by phone (+82-2-499-9956) or messenger instead of the website form. In that case, no website form data is transferred overseas.

7. Destruction

1. Personal information is destroyed without delay when the retention period expires or the purpose is achieved.
2. Information that must be kept under other laws is stored separately.
3. Electronic files are deleted so that they cannot be recovered; paper documents are shredded or incinerated.

8. Your Rights

1. You may request access to, correction, deletion or suspension of processing of your personal information, and withdraw consent, at any time.
2. The Clinic will act without delay on requests made by phone, email or in writing.
3. You may exercise these rights through a representative by submitting a power of attorney.
4. The Clinic does not collect personal information of children under 14 through the website.

9. Security Measures

1. Administrative: minimizing staff who handle personal information, internal management rules
2. Technical: access control for website administrator accounts, encryption in transit (HTTPS)
3. Physical: access control for places where documents are kept

10. Automatic Collection Tools

The website uses cookies and similar tools to collect visit records (pages viewed, device and browser information, referral source, clicks on contact and booking buttons) for usage statistics and ad performance measurement. Information you enter in the booking form, such as your name and contact details, is not sent to these tools.

• How to opt out: refuse cookies in your browser settings or install the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout). Opting out does not affect your use of the website or booking requests.

11. Privacy Officer

• Privacy officer: Dr. Kim Serim (Representative Director)
• Phone: +82-2-499-9956 · Fax: +82-2-499-9957 · Email: sereneclinic@kakao.com
• Address: 4F Baekseok Building, 122 Achasan-ro, Seongdong-gu, Seoul, Korea

12. Remedies

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / +82-118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972
• Supreme Prosecutors' Office Cyber Investigation: www.spo.go.kr / 1301
• Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182

13. Changes

This Policy takes effect on October 4, 2026. Changes will be announced on the website at least 7 days before they take effect.

• Revision history: announced October 6, 2026, effective October 13, 2026 — disclosed PostHog, the website operator's analytics tool (Section 5 re-outsourcing, Section 6 overseas transfer, Section 10)
• Revision history: announced October 6, 2026, effective October 13, 2026 — added Japanese pages to plaintics in Section 10
• Revision history: October 5, 2026 — corrected the countries in Section 6 (database in Singapore, notification emails sent from Japan) and added Google LLC to Sections 5 and 6, listed the analytics and ad measurement tools in Section 10 (Meta Platforms added to Section 6)