DIVA Plastic Surgery Clinic ("the clinic") takes the protection of your personal data very seriously and complies with the Personal Information Protection Act. Through this Privacy Policy the clinic explains for what purposes and in what ways the personal data you provide is used, and what measures are taken to protect it.

Article 1 Purpose of processing personal data
The clinic processes the personal data it collects for purposes such as medical treatment, handling enquiries, website use and the provision of various services, and will obtain prior consent if the purpose of use changes.

a. Website sign-up and account management
We process personal data in order to confirm the intention to join, identify and authenticate members for membership services, give notices, handle grievances and keep records for the resolution of disputes.


b. Handling enquiries and providing customer management services
We process personal data for the following purposes in order to provide a high standard of service.
- Provision of services for diagnosis, treatment and other medical care
- For booking treatment and check-ups, checking bookings and verifying identity for membership services
- To provide test results and personalised information by SMS and e-mail
- To maintain a channel of communication for handling complaints and to announce new services and events
- Provision of distinctive medical and health content
- Data for developing new services, analysing patients and providing personalised services
- For research and clinical trials, medical education and training, contracted testing and treatment statistics
- Collection of consumer hazard information under Article 52 of the Framework Act on Consumers



Article 2 Processing and retention period of personal data
The clinic collects the minimum personal data necessary to provide its services. Sign-up fields are divided into required and optional items, and leaving the optional items blank does not restrict your use of the services.
Personal data file name
Items held
Legal basis
Retention period

Information about website use
- Required: ID, password, name, phone number, e-mail
- Optional: Address
- Automatically collected: IP address, cookies, MAC address, access logs, etc.
Consent of the data subject given when signing up on the website
until account deletion


Information relating to handling enquiries and customer management services
- Required: name, address, phone number
- Optional: e-mail address, health information consented to separately
Consent of the data subject given in writing, by e-mail, by telephone or by fax
5 years


Medical records
- Personal details of the person treated, such as address, name, contact number and resident registration number
- Principal symptoms. Where the doctor deems it necessary, the medical history and family history related to those symptoms
- Diagnosis result or diagnosis name
- Course of treatment (for outpatients, only returning patients whose symptoms, condition or treatment have changed and where the doctor deems it necessary to record the change)
- Details of treatment (injections, medication, procedures, etc.)
- Date and time of treatment
Article 14 of the Enforcement Rule of the Medical Service Act
10 years (extendable if required)

Surgical records
- Patient name
- Procedure name
- Surgical record
- Name of operating surgeon
Article 14 of the Enforcement Rule of the Medical Service Act
10 years (extendable if required)



Article 3 Provision of personal data to third parties (where applicable)
The clinic does not provide personal data to third parties except where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject's consent or under a specific provision of law.



Article 4 Rights and obligations of the data subject and how to exercise them
As a data subject, a user may exercise the following rights.
① A data subject may exercise the following data protection rights against the clinic at any time.

1. Request to access personal data

2. Request for correction of errors

3. Request for deletion

4. Request to suspend processing
② The rights under paragraph 1 may be exercised against the clinic in writing, by e-mail or by fax using Form 8 annexed to the Enforcement Rule of the Personal Information Protection Act, and the clinic will act on them without delay.
③ Where a data subject requests the correction or deletion of erroneous personal data, the clinic will not use or disclose that data until the correction or deletion is complete.
④ The rights under paragraph 1 may be exercised through an agent such as a legal representative or an authorised person. In that case a letter of authority in Form 11 annexed to the Enforcement Rule of the Personal Information Protection Act must be submitted.
※ Personal data that must be retained by law cannot be amended or deleted during the retention period, even on request.



Article 5 Destruction of personal data
Information entered by a user is destroyed immediately once its purpose has been achieved, or after being kept for a set period where other relevant laws so require.
1. Destruction deadline
Where the retention period for personal data has expired, the data is destroyed within five days of the end of that period. Where the data is no longer needed because its purpose has been achieved, the service has been discontinued or the business has ended, it is destroyed within five days of the date on which processing is found to be unnecessary.

2. Method of destruction
Information held as electronic files is destroyed by technical means that make the records irrecoverable.
Personal data printed on paper is destroyed by shredding or incineration.



Article 6 Measures to keep personal data secure
The clinic has put a number of security measures in place as technical safeguards for users' personal data.
All information you provide is protected and managed securely by security equipment such as firewalls.
As organisational measures to protect users' personal data, the clinic has established procedures for accessing and managing that data, keeps the number of staff who handle it to a minimum, and provides ongoing security training. The clinic also designates the users of systems that process personal data, issues them with passwords and renews those passwords regularly.



Article 7 Withdrawing consent and closing your account
You may withdraw at any time the consent you gave on sign-up to the collection, use and provision of your personal data.
If you contact us in writing, by telephone or by fax to close your account, we will destroy your personal data and take the other necessary steps without delay.



Article 8 Data Protection Officer
① The clinic takes overall responsibility for the processing of personal data and has appointed the following Data Protection Officer to handle complaints and provide remedies in relation to that processing.

▶ Data Protection Officer
Name: Kim Jong-myung
Position: Director
Contact: 02-542-7002, diva@diva-ps.com, Fax: 02-542-7705

※ Data protection department direct line: 070-4296-8733
② A data subject may direct any enquiry, complaint or request for remedy relating to data protection that arises while using the clinic's services to the Data Protection Officer or the responsible department. The clinic will respond to and deal with such enquiries without delay.



Article 10 Installation and operation of video recording devices
① The clinic installs and operates video recording devices as set out below.

1. Legal basis and purpose of installing video devices
- Facility safety and fire prevention
- Crime prevention for the safety of our patients


2. Number of devices, locations and areas covered
Number installed:
Locations and areas covered: lobby, corridors, consultation rooms, treatment rooms, etc.


3. Data manager and authorised personnel
To protect your video data and to handle complaints relating to personal video data, we have appointed the following officer.

Data manager
Dr. Kim Jong-myung, Director
02-542-7002

Authorised personnel
Team Leader Kim Se-eun
Patient Support Team 070-4296-8733


4. Recording time, retention period, storage location and handling of video data
Recording time: 24 hours
Retention period: 30 days from the date of recording
Storage location: Patient Support Office


5. How and where to view personal video data
- How to view: contact the video data manager in advance and visit the clinic.
- Where to check: Patient Support Team


7. Action taken on a data subject's request to view video data
You may at any time ask the operator of the video devices to let you view, confirm the existence of, or delete personal video data. This is limited to video data in which you appear and video data that is clearly necessary for the urgent protection of a data subject's life, body or property.
Where a request is made to view, confirm the existence of, or delete personal video data, the clinic will take the necessary action without delay.


8. Measures to keep video data secure
Video data processed by the clinic is kept secure by means such as encryption. As organisational measures to protect personal video data, the clinic grants access rights on a graduated basis and, to prevent forgery or alteration, records and manages the date and time each recording was created together with the purpose, viewer and time of any viewing. Locking devices are also installed so that personal video data is stored securely.


Article 11 Changes to this Privacy Policy
This Privacy Policy was established on 1 August 2015. Where content is added, removed or corrected as a result of changes in law or policy, notice will be given on the website (https://divaps.rebeauty.website/ko/) or through DIVA Plastic Surgery Clinic from seven days before the change takes effect.
- Date announced: 1 August 2015 / Date effective: 1 August 2015