Privacy Policy

MyClinic ("Company") collects the following personal information to provide our services.

Patients (Visitors): When you request a free MyClinic Plan: your contact channel and contact details (email, or the messenger ID / phone number you choose), the type of care you need help with, where you are in your planning, and any question (optional); if you add more details, preferred timing or dates, departure date, length of stay, budget and priorities (all optional). When you send an inquiry from the instant estimate calculator: selected treatments, visit timing, length of stay, country of residence, preferred language, contact channel and contact details, and a message (optional). On the contact page: name, email, country of residence and message. When you join MyPass: name, date of birth, gender, nationality, email, phone / messenger contact (optional), preferred language, whether you are enrolled in Korean national health insurance, and the care records and follow-up information recorded while you use the service (treatment names, fees, etc.). When you pay for a paid service: the transaction details PayPal passes to us (transaction ID, payment status, payer name and email). We do not store card or bank account numbers. Health-related items above — type of care, selected treatments, care records — are processed with your separate consent under Article 23 of PIPA; if you prefer not to share the type of care, you can choose "Not sure yet".

Inquiries sent by messenger or email: If you first contact us through our Instagram account @myclinic.story (from September 29, 2026) or through Facebook Messenger on our Facebook Page “MyClinic Story” at facebook.com/myclinic.io.kr (from September 29, 2026), that first inquiry and the later messages in the same conversation are recorded automatically in our inbox so that a staff member can review them. From October 5, 2026, for emails received in our mailbox contact@mediround.co.kr (emails sent to contact@myclinic.io.kr are also delivered to this mailbox), an email and the later emails in the same email conversation (thread) are recorded automatically in our inbox only if we have reviewed that email in the mailbox and marked it for intake (a mailbox label). Emails we have not marked for intake (such as advertising, spam or business email) are not recorded in our inbox, and for those emails the automatic recording function checks only the identification numbers the mailbox assigns and whether they are marked for intake; it does not look up their sender, subject or text. Emails received before automatic recording of email takes effect are not recorded automatically, even if they are marked for intake. Inquiries sent to our other Instagram accounts or other Facebook Pages, or via WhatsApp, are not yet recorded automatically in our inbox; before automatic recording begins for any of those channels, we will revise this policy and announce the change. From October 8, 2026, if you ask us for a consultation or a MyClinic Plan through our WhatsApp or another messenger not connected to our inbox, a staff member may register your inquiry in our inbox manually; no automatic reply is sent. We register only the channel, your contact details (phone number or messenger ID) and a value derived from them to recognise repeat inquiries, the language for our replies, and a display name if you gave one; we process these without separate consent under PIPA Article 15(1)(4), only to the minimum extent needed to receive your inquiry, we do not register message text or attachments, and we record health-related information such as treatment interests only after confirming your separate consent. Sections 2, 3, 4-1 and 5 on messenger inquiries also apply to inquiries registered this way, and for retention purposes your last message means the last contact from you that our staff recorded in the inbox. The provisions of this policy on messenger and email inquiries (this item and Sections 2, 3, 4, 4-1 and 5) apply to that Instagram account from September 29, 2026, to that Facebook Page from September 29, 2026, to that mailbox from October 5, 2026, to inquiries registered manually by our staff from October 8, 2026 to the extent stated in the previous sentence, and to automatic recording on each other channel from the date automatic recording takes effect for that channel. We always record the channel, your contact details or channel identifier (the ID assigned by the messenger service, or your email address) and a value derived from that identifier to recognise repeat inquiries, the display name of an email, conversation and message identifiers, the message time, the type and number of attachments, and an intake processing record (whether the message contained text and the length of that text, how many times the same message was delivered, and when and with what result it was processed). The intake processing record does not contain the message text. We process these items without separate consent under PIPA Article 15(1)(4), and only to the minimum extent needed to carry out the step you requested — receiving the inquiry you sent us — in the course of entering into or performing a MyClinic service agreement with you. We use the identifiers to register your inquiry as one case and link later messages in the same conversation to it, the times to manage the order of replies and the retention period, the type and number of attachments to tell staff whether to check an attachment in the original channel, and the intake processing record to check that the same message has not been registered twice and that intake was processed properly. Because Instagram and Facebook Messenger messages are recorded automatically when they arrive, messages unrelated to using MyClinic (such as plain advertising or spam) may also be recorded at first. For email, we record only emails we have marked for intake, but later emails in an email conversation already registered in our inbox are recorded without a separate review. For any channel, when a staff member reviews a message and classifies it as unrelated to the service, its intake record is deleted under the rule for spam records in Section 3. Because message text (including an email subject line, up to 1,500 characters) may contain health information, we record the text only for messages received after we have confirmed your separate consent to that processing. Until consent is confirmed, or if it is withdrawn, we do not store the message text, a summary or a preview in the inbox; our staff read and reply to your inquiry in the original messenger or mailbox. We do not store attachment files, photos or voice messages themselves, their links or original email files, and we do not send automatic replies. We do not ask you to include health details in your message, and we ask you not to send medical records or identity documents through these channels.

When you raise a complaint or dispute: Your name, nationality or country of residence, contact details, the related clinic and booking, the content of your complaint and how it was handled. We process these items without separate consent, to the extent needed to receive and handle the complaint you raised (PIPA Article 15(1)(4)) and to keep the handling record for the period in Section 3 (Article 15(1)(2) for records we are legally required to keep; Article 15(1)(6), to respond to disputes, for other records). Health-related details are recorded only within the scope of your separate consent.

Clinic Administrators: Name, email, phone number, clinic information

Coordinators (Interpreters): Full name, nationality, languages spoken, certification types, certification/career proof files, bio, business-card shipping address (recipient, address, contact)

Automatically Collected: IP address, browser information, pages visited, access time (via Google Analytics, Vercel Analytics)

We use collected personal information for the following purposes:

• Preparing and explaining your free MyClinic Plan (treatment estimate), requesting treatment and cost confirmation from clinics, and arranging appointments

• Receiving inquiries from external channels (messenger or email), assigning a staff member, handling replies and follow-up, and preparing the MyClinic Plan you request

• Receiving and handling complaints and disputes, and keeping a record of how they were handled

• Operating and managing clinic landing pages

• Analyzing service usage statistics and improving our platform

• Processing payments and billing when you use a paid service

• Keeping and managing MyPass members' care records and follow-up information (with separate consent)

• Using an operations-assistant AI to help our staff handle inquiries and scheduling (Section 4-1 ②)

• Sending service-related notices and notifications

• Coordinator credential verification and MyCoordy credential issuance, clinic–coordinator interpretation matching (no fee), online resume operation, and physical business-card printing/shipping

• Patient inquiry data (free MyClinic Plan requests, contact page): 3 years from the date of submission (deleted sooner on request)

• Instant estimate calculator inquiries: destroyed within 12 months of our last interaction

• Inquiries received by messenger or email (inbox records and message copies): no more than 12 months after the later of your last message or our staff's last substantive reply. If there is no further message or reply after receipt, the period starts at receipt. Records identified as spam, tests or duplicates are kept only until 30 days after first receipt or the end of the retention period already set for them, whichever is earlier, and once that period has ended they are deleted without delay under the rule at the end of this Section. Information is deleted sooner when its purpose has been fulfilled, and reassigning a staff member, changing a status or reprocessing a message does not by itself extend this period. This period applies to the records and copies in our inbox; it does not mean that messages remaining in the original mailbox, Instagram, Facebook or WhatsApp are automatically deleted on the same schedule. Original messages that remain in the Company's own mailbox and messenger accounts are nonetheless personal information held by the Company, and once their purpose is fulfilled they become subject to the destruction rule at the end of this Section. When you request deletion, we also check and address the related original-channel records under our control, and we explain any part retained separately by a platform or beyond our ability to delete directly, and how to request its deletion. If the inquiry leads to a MyClinic Plan request, information from that request onward follows the "Patient inquiry data" rule above.

• Complaint and dispute handling records: 3 years from the date the case is closed (under the Act on the Consumer Protection in Electronic Commerce, and to respond to disputes). If there is no progress for 12 months after receipt or after the last contact or response, we close the case. We delete these records sooner if you request deletion or withdraw your membership; however, records that we are legally required to keep are stored separately from other data for that period even after a deletion request or membership withdrawal.

• MyPass member information: until membership withdrawal — personal details (name, contact, etc.) and care records are destroyed immediately upon withdrawal, and the remaining account marker is fully deleted 30 days later

• Clinic account information: Until account deletion is requested

• Payment information: 5 years (as required by applicable e-commerce laws)

• Access logs: 3 months (as required by applicable telecommunications laws)

• Error records (Sentry error monitoring): up to 90 days after collection

• Coordinator account/profile/credential data: until membership withdrawal (certification/career proof files retained during membership, destroyed upon withdrawal)

• Coordinator business-card shipping address: destroyed within 90 days after the card is shipped

When a retention period ends or the purpose is fulfilled, we delete the personal information without delay in a way that cannot be restored. Where the law requires us to keep information longer — for example to handle a dispute — we record the reason and the end date and keep it separately from other data only for that period. Service backups are deleted automatically 30 days after they are created; if a backup must be restored before then, the information due for destruction is deleted again immediately after the restore.

We do not share your personal information with third parties without your consent, except in the following cases:

• When a patient requests a free MyClinic Plan, we share only the minimum details needed to confirm a quote — the requested treatments and preferred timing, without your name or contact details — with the clinics MyClinic has chosen to work with.

• When a patient asks, through the Plan, for an appointment at a specific clinic, we share the name, contact details, requested treatments and appointment schedule needed to arrange it with that clinic, within the scope you separately agree to when requesting the booking. The clinic keeps this information until the purpose (appointment and treatment) is fulfilled; any further retention follows that clinic's medical-record obligations under the Medical Service Act and its own privacy policy.

• When required by law for investigative purposes

Third-party services used for platform operation: Firebase (Google), Vercel, PayPal (payments), Resend (email), Google Analytics, Sentry (error monitoring to detect service outages — when an error occurs, stores the IP address, URL, stack trace, browser/device information and a short record of activity leading up to the error in the US region for up to 90 days; the items are listed in Section 6), Google Drive (business-card order document storage), Google Workspace (email inquiry inbox), Slack (staff notifications — only a notice that something needs checking and a link to the admin screen; no names, contact details or inquiry contents), YouTube (Google LLC · showing preview images of, and playing, videos embedded in articles and clinic pages — the information sent to Google is described in Section 4-1 ④)

• When a coordinator publishes an online resume, information such as nickname, language regions, and verified activity summary becomes public on the internet and may be indexed by search engines (with separate consent at the time of publication).

To provide the service you request (a free MyClinic Plan — quote confirmation and appointment arrangement — and receiving and responding to inquiries you send by messenger or email), we entrust the processing of personal information to providers located outside the Republic of Korea, limited to what that service requires. The following is disclosed under Article 28-8(1)3 of the Personal Information Protection Act (PIPA).

① Service operating infrastructure Items transferred = account details, inquiry contents (including the messenger and email inquiry records in Section 1), and access logs generated while using the service · Recipients and countries = Google LLC (Firebase · Google Workspace Gmail for the email inquiry inbox and API access, the United States and other countries where Google operates data centers) · Vercel Inc. (the United States and other countries) · Resend (US) · Functional Software, Inc. (Sentry, US — error monitoring: the items transferred are the error records described in Section 6, sent when an error occurs) · PayPal (US) · Slack Technologies, LLC (the United States and other countries — staff notifications: the notifications we send now contain only a notice that something needs checking and a link to the admin screen; some notifications sent before we changed their contents in this way may contain numbers that identify a record about a person, such as reference numbers, consultation numbers or coordinator IDs, and links to individual records, names, contact details (email address, phone number or messenger ID), nationality or country of residence, the medical field or treatment of interest, visit timing, estimated quote amounts, consultation progress (clinic matching, booking confirmed, treatment completed), interpreting schedules and coordinator pay, inquiry notes, raw error messages or similar details) · Timing and method = transmitted and stored through each provider’s encrypted APIs and cloud infrastructure while you use the service · Purpose = data storage, authentication, email delivery, payments, error monitoring, staff notifications · Retention = records the Company keeps and manages on the providers’ infrastructure above follow the retention periods in Section 3. Copies or logs that remain in, or are separately generated by, each provider’s systems in providing the service — including after the Company deletes a record — are kept and deleted under the terms and settings that apply between the Company and that provider. The Slack notifications sent before we changed their contents as described above remain in Slack, where they are kept and deleted under the terms and settings that apply between the Company and Slack. Under the Slack plan we currently use, notifications more than 90 days old are no longer shown on our screen, so we cannot confirm how long such notifications remain in Slack. We do not use these notifications

①-1 Processing used for automatic intake of Instagram, Facebook Messenger and email inquiries (the part of ① that applies) Items, purpose, country and contact for each recipient = Google LLC (Firebase · Google Cloud): (transmission and temporary processing) the whole message notification Meta sends to our intake function (which may include message text, and notifications we do not record) — processed while the function runs to check that the notification came from Meta and to pick out what is to be recorded; the whole notification is not stored as an intake record / (email look-up) for emails marked for intake and later emails in an email conversation already registered in our inbox, the header information (sender, message identifier, date and similar) and the structure of attachments, and, for emails received after consent is confirmed, the subject and text — looked up by our intake function in our mailbox (Google Workspace Gmail) and processed while the function runs to pick out what is to be recorded / (storage) of that, only the items recorded under “Inquiries sent by messenger or email” in Section 1 (the items always recorded, and the text of messages received after consent is confirmed) — storing intake records, processing intake, and carrying out the deletion of records whose retention period has ended — the United States and other countries where Google operates data centers — privacy contact: support.google.com/policies/troubleshooter/7575787 · Vercel Inc.: the intake records displayed in the staff inbox — providing the inbox screen where staff review intake records (the records themselves are kept on the Google infrastructure above) — the United States and other countries — privacy contact: privacy@vercel.com · Timing and method = sent over encrypted connections when Meta’s message notification arrives and when our intake function looks up emails in our mailbox (Google), and when staff use the inbox (Vercel) · Retention = the intake records the Company manages (stored on the Google infrastructure above) follow the retention period for messenger and email inquiries in Section 3. Copies or logs that remain in, or are separately generated by, each provider’s systems in providing the service — including after the Company deletes a record — are kept and deleted under the terms and settings that apply between the Company and that provider · Staff notifications = when a new inquiry is received, we notify our staff through Slack, but the notification contains only a notice that a new inquiry has been received and a link to the inbox list — no reference number, link to the individual inquiry, time received, channel, name, contact details or message text — so Slack is not listed as a recipient in this item (Slack keeps the time the notification was sent) · How to refuse and its effect = if you tell us, using the contact details in Section 7, that you refuse, we handle the intake records already made as a deletion request under Section 5. Because messages sent to the Instagram account and Facebook Page named in Section 1 are recorded automatically when they arrive, messages you send to that account or Page after that are also recorded, and later emails you send in an email conversation already registered in our inbox are also recorded automatically; if you do not want this transfer, we cannot handle your inquiry through that account, Page or mailbox.

② Operations-assistant AI processing (AI processing) Items transferred = inquiry and appointment details referenced when a Company staff member asks the operations-assistant AI while handling your inquiry or appointment (may include name, nationality, contact channel, requested treatments and appointment schedule) · Recipient = Google LLC (United States; privacy contact: policies.google.com/privacy) · Countries = the United States and other countries where Google operates · Timing and method = sent at the moment a staff member submits a question, via an HTTPS-encrypted API call · Purpose = assisting staff with inquiry handling and scheduling (not used to reply to you directly) · Retention = Google processes the data only to generate the reply. The Company does not store the staff question or the AI reply on its servers; the preceding turns of a conversation are passed along only within that conversation by the tool the staff member uses. The Company keeps only per-call usage (token counts, cost) and a hash of the content as an operations record

③ How messenger inquiries reach us (for information) Messages you send via Instagram, Facebook Messenger or WhatsApp reach the Company through the operator of the service you chose (Meta Platforms, Inc. and its affiliates, the United States and other countries). The Company records only the items listed in Section 1 from the message notifications Meta delivers. Our staff reply to you within that same messenger, and in connection with that inquiry the Company does not provide Meta with any other information it holds about you. Handling of messages inside those services is governed by each service’s own privacy policy. This item describes how messages reach the Company.

④ YouTube videos embedded in articles and clinic pages (for information) When you open an article that contains a video (and, on list pages, when that article has no separate cover image), your browser loads the video’s preview image from servers of Google LLC (YouTube; the United States and other countries), and your IP address, browser information, which video the image belongs to (the video identifier) and the address of this site (without the page path) are sent to Google. A video in an article loads YouTube’s privacy-enhanced mode player (youtube-nocookie.com) only after you press the play button; from then on, information about playback is also sent to Google. A video embedded in a clinic page loads the YouTube player (youtube.com) as soon as the page opens, so the same information and information about your use of the player are sent to Google even if you do not press play, and any YouTube or Google cookies stored in your browser may be sent with it, depending on your browser settings. Your browser sends this information directly to Google; the Company does not, through this, provide Google with information it holds about you, and Google’s processing is governed by the Google Privacy Policy (policies.google.com/privacy). A video in an article does not load the player unless you press play. You can block preview images and clinic-page videos through your browser settings or an extension and still read the article and clinic information.

You may refuse these transfers. However, this processing is essential to providing the service, so refusing may limit your use of certain features. To refuse, please contact us using the details in Section 7.

For transfers outside Korea we apply the safeguards required by PIPA Article 28-8(4): encryption in transit, access controls, and limiting each provider to the scope entrusted.

You may exercise the following rights at any time:

• Request to view, correct, or delete your personal information

• Request to suspend processing of your personal information

• Request account deletion

• Access, correction or deletion of an inquiry received by messenger or email, or withdrawal of your consent to health-information processing: contact help@mediround.co.kr. We verify only the minimum information needed to confirm the requester and handle the related records in our inbox and in the original channels under our control together. If you withdraw consent, we delete without delay the message text already recorded in our inbox and stop recording the text of later messages. You can still receive general service information if you decline or withdraw health-information consent; individual assistance requiring that information may be limited.

To exercise these rights, please contact us using the information below.

MyClinic uses cookies and similar technologies for service improvement and analytics. Cookies are grouped into three categories by purpose.

Essential cookies — always on Login session (Firebase Auth), language preference (NEXT_LOCALE), security / CSRF prevention. Required for core functionality; cannot be disabled.

Analytics cookies — stored only with consent Google Analytics 4 (_ga, _gid) collects anonymized statistics on visits, session duration, and referral source. Stored only when the visitor grants explicit consent under Google Consent Mode v2.

Marketing cookies — stored only with consent Used to measure the performance of Google Ads and Meta (Facebook · Instagram) campaigns and to show relevant content. The Meta pixel (_fbp, _fbc) runs only if you allow marketing cookies; without that consent no conversion data is sent to Meta.

You can change your cookie choices anytime via the "Cookie Settings" link in the footer. Your choice is saved for 12 months in the cc_consent cookie.

• Vercel Analytics uses header-based (cookieless) aggregation and does not require consent.

• Sentry error tracking does not store or read cookies on your device, does not attach this site's cookies to the requests it sends to Sentry, and sends a record of your access and activity only when an error occurs. That error record contains your IP address (and an approximate location derived from it), the URL of the page where the error occurred, the stack trace, your browser, operating system, device type and other request-header information, and a short record of activity leading up to the error (page navigation, which button or input field was used — not what you typed — network request URLs and console logs). Request bodies, such as the contents of an inquiry, and cookie values are not included in the error record, and the values of fields labelled as name, email, contact details, authentication values and the like are automatically replaced with [REDACTED] before transmission. Text contained in a URL or an error message may, however, be sent as is.

• YouTube videos embedded in articles and clinic pages: a video in an article does not load the YouTube player until you press the play button (only the preview image is loaded). Through the YouTube privacy-enhanced mode player that opens when you press play, and the YouTube player that opens as soon as a clinic page loads, Google may store or read cookies or similar technologies (such as local storage) on your device. These are set by Google, are not linked to your choices in "Cookie Settings" above, and can be blocked by turning off third-party cookies in your browser settings. For the information sent to Google, see Section 4-1 ④.

Disabling all cookies via browser settings is possible but may break login, language switching, and page navigation.

Privacy Officer: Youngjong Sihn (CEO)

For privacy-related inquiries, please contact us at:

• Email: help@mediround.co.kr

• Website: https://myclinic.io.kr

• Effective 2026-10-08 (second revision) — Section 4: YouTube (Google LLC) added to the list of third-party services (YouTube videos embedded in clinic pages were already being shown before this date, but this policy did not mention them) / Section 4-1 ④ added: the information sent to Google when preview images of YouTube videos embedded in articles and clinic pages are shown and when those videos play, and how to block it / Section 6: added that Google may store or read cookies or similar technologies on your device through the YouTube player, and how to block them

• Effective 2026-10-08 — Section 1: states that, if you ask us for a consultation or a MyClinic Plan through our WhatsApp or another messenger not connected to our inbox, a staff member may register the inquiry in our inbox manually (no automatic reply), the items registered (channel, contact details and a repeat-inquiry value, the language for our replies, and a display name if given), the legal basis (PIPA Article 15(1)(4)), that message text and attachments are not registered, and that health-related information is recorded only after separate consent is confirmed / Sections 2, 3, 4-1 and 5 on messenger inquiries apply to inquiries registered this way (added to the sentence on when these provisions apply), and for retention purposes the last message means the last contact our staff recorded in the inbox

• Effective 2026-10-05 — Section 1: automatic inbox recording of email inquiries takes effect (channel: email · our mailbox contact@mediround.co.kr, including emails sent to contact@myclinic.io.kr) — only emails we have reviewed in the mailbox and marked for intake (a mailbox label), and later emails in an email conversation already registered in our inbox, are recorded; emails not marked for intake (such as advertising, spam or business email) are not recorded, and the automatic recording function checks only their identification numbers and whether they are marked · emails received before this date are not recorded (the items recorded, their legal basis, the purpose of each item and the separate-consent rule for message text and subject are the same as for messengers) / Section 1: the statement that messages unrelated to the service may be recorded at first is limited to Instagram and Facebook Messenger, and the recording rule for email is stated separately / our other Instagram accounts, other Facebook Pages and WhatsApp are not yet recorded automatically (this policy will be revised and announced before they are) / the automatic-intake provisions of Sections 2, 3, 4, 4-1 and 5 apply to that mailbox from this date / Section 4-1 ①-1: email added to the title, to the items processed by Google and the timing of transfer, and to how to refuse and its effect

• Effective 2026-10-03 (third revision) — Supplement to the Sentry (error monitoring) notices: from the version deployed on this date, requests the browser sends to Sentry (relayed to Sentry through the /monitoring path on this site) no longer carry this site's cookies, and Section 6 now states this / before that, the browser automatically attached this site's cookies (language setting, your cookie choices, analytics and marketing cookies if you allowed them, and the sign-in cookie if you were signed in) to these requests, and those cookies may have been passed on to Sentry's receiving servers (the error records stored in Sentry that we checked did not contain cookies)

• Effective 2026-10-03 (second revision) — Correction of the Sentry (error monitoring) notices: Section 3: added the retention period for error records (up to 90 days after collection) / Section 4: retention corrected from 30 days to up to 90 days (the previous wording said 30 days, but the actual retention period was 90 days), and browser/device information and a short record of activity leading up to the error added to the items sent / Section 4-1 ①: the items transferred to Sentry and when they are transferred are stated / Section 6: the items contained in an error record corrected to match actual practice (the previous wording listed only IP, URL and stack traces, but browser, operating system, device type and other request-header information, an approximate location derived from the IP address and a short record of activity leading up to the error were also being sent); stated that request bodies and cookie values are not included in the error record; the scope of automatic masking corrected to fields labelled as name, email, contact details, authentication values and the like (the previous wording said sensitive data was masked automatically, but text inside a URL or an error message is not masked) / the per-visit session record that the browser was sending when no error occurred (a random number, start and end time, browser type) is no longer sent as of the version deployed on this date (the previous wording said data was sent only when errors occur, but this record was being sent)

• Effective 2026-10-03 — Section 1: added the items recorded when you raise a complaint or dispute and the legal basis for processing them / Section 2: added the purpose of receiving and handling complaints and disputes and keeping a record of how they were handled / Section 3: added the retention period for complaint and dispute handling records (3 years from the date the case is closed; a case with no progress for 12 months is closed; earlier deletion on request or withdrawal, except records we are legally required to keep)

• Effective 2026-09-29 (second revision) — Section 1: automatic inbox recording of messenger inquiries takes effect for Facebook Messenger (Facebook Page “MyClinic Story”, facebook.com/myclinic.io.kr); the items recorded, their legal basis, the purpose of each item and the handling of messages unrelated to the service are the same as for Instagram / our other Instagram accounts, other Facebook Pages, email and WhatsApp are not yet recorded automatically (this policy will be revised and announced before they are) / the automatic-intake provisions of Sections 2, 3, 4, 4-1 and 5 apply to that Facebook Page from this date / Section 4-1: Facebook Messenger added to the title of ①-1 and to how to refuse and its effect (recipients, items transferred, countries and retention are the same as for Instagram) / Section 4-1 ①-1: the effect of refusal is clarified to apply to the account and Page named in Section 1 / Section 4-1 ③: the country shown for Meta is clarified as “the United States and other countries”

• Effective 2026-09-29 — Section 1: automatic inbox recording of messenger inquiries takes effect for Instagram (@myclinic.story), the advance-notice wording (recording off; collection not begun) is removed, the items always recorded now also include a repeat-inquiry value and an intake processing record (text present, text length, delivery count, processing time and result; no message text), and the legal basis for those items (PIPA Article 15(1)(4), limited to the minimum extent needed to receive an inquiry requested in the course of entering into or performing a service agreement), the purpose of each item and the handling of messages unrelated to the service (such as plain advertising or spam) are stated / our other Instagram accounts, email, Facebook Messenger and WhatsApp are not yet recorded automatically (this policy will be revised and announced before they are) / the automatic-intake provisions of Sections 2, 3, 4, 4-1 and 5 apply to that Instagram account from this date / Section 3: for spam, test and duplicate intake records, “deleted within 30 days of receipt” is corrected to deletion without delay once the retention period (until 30 days after first receipt or the end of the retention period already set, whichever is earlier) ends (so deletion may take place later than 30 days after first receipt) / Section 4: the description of Slack in the list of third-party services is updated to match the changed notifications / Section 4-1: the introduction now also covers receiving and responding to messenger and email inquiries; ① the transfer countries for Google, Vercel and Slack are corrected to follow each provider’s official documents (the United States and other countries), and the retention entry is corrected to distinguish records the Company manages from copies and logs in providers’ systems (without stating deletion timing we have not confirmed for providers); Slack staff notifications are changed to contain only a notice that something needs checking and a link to the admin screen, and the details that notifications sent before that change may contain, and how those notifications are deleted and kept, are stated (correcting the previous wording, which said Slack received only the reference number, channel, time received and a link to the inbox and no contact details, although some notifications contained names, contact details and similar details); ①-1 added the items, purpose, country, contact, retention, and how to refuse and its effect for each provider used for automatic intake of Instagram inquiries (for Google, distinguishing transmission and temporary processing from storage, and stating what new-inquiry Slack notifications contain); ③ clarified that the statement on not providing information to Meta refers to messenger inquiries, and stated that this item describes how messages reach us

• 2026-09-27 advance notice update; collection through automatic recording has not begun — Section 1: added automatic inbox recording of inquiries sent by messenger or email (identifiers, time and attachment type/count always; message text and subject only for messages received after separate health-information consent; no files or links stored; no automatic replies) / Section 2: added the purpose of receiving and replying to such inquiries / Section 3: added the retention period for messenger and email inquiries (12 months from the last customer message or reply; 30 days for spam, test or duplicate; original-channel records handled separately) and the general rules on destruction method, legally required retention and backup deletion / Section 4: added Google Workspace and Slack to third-party services / Section 4-1: ① added Google Workspace Gmail and Slack, ③ added how messenger inquiries reach us (Meta) / Section 5: added the contact for rights requests and consent withdrawal for messenger and email inquiries (the automatic-intake provisions take effect on the date recording begins for each channel; that date will be added to this history as a separate entry)

• Effective 2026-09-25 (second revision) — Section 1 (clinic administrators): removed "payment details" (no clinic fees or payment methods are held) / MyPass sign-up consent (v1.3) items corrected (country of residence removed; preferred language and Korean health-insurance enrollment added) / Section 4 clarified that clinic sharing at booking is based on a separate consent given when requesting the booking

• Effective 2026-09-25 — Sections 1–3 (items collected, purposes, retention) corrected to the current services (MyClinic Plan, instant estimate, MyPass, paid services) / Section 4 clinic-sharing items corrected to the current MyClinic Plan flow / Section 4-1 estimate-chat AI item removed (feature discontinued) / Section 4-1 operations-assistant AI processing item added and its retention wording corrected (questions and replies are not stored)

• Effective 2026-04-12 — previous policy