Consent to Receive Marketing Information

1. Purpose of Collection and Use

We collect and use your personal information for the following marketing purposes:

• Delivery of newsletters, service updates, and platform announcements
• Notification of events, promotions, and special offers
• Provision of personalized content and service recommendations
• Conducting satisfaction surveys and service improvement research
• Sharing information about new features, partner hospitals, and healthcare services available through the AetherHeal platform

2. Categories of Personal Information Collected

The following categories of personal information may be collected and used for marketing purposes:

We do not collect or use sensitive medical information for marketing purposes.

3. Communication Channels

Marketing information may be delivered through one or more of the following channels:

• Email (newsletters, service announcements, promotional offers)
• SMS / MMS (event notifications, time-sensitive promotions)
• Push Notifications (in-app or browser-based alerts)
• Messaging Platforms (KakaoTalk, WhatsApp, or equivalent services)

You may select or modify your preferred channels at any time through your account settings or by contacting us directly.

4. Retention Period

Your personal information collected for marketing purposes will be retained and used until you withdraw your consent or terminate your account, whichever occurs first.

Upon withdrawal of consent, your marketing-related personal information will be promptly destroyed or de-identified, except where retention is required by applicable law:

• Act on Consumer Protection in Electronic Commerce: Records of contracts, subscription withdrawal, payment, and supply of goods — up to 5 years
• Protection of Communications Secrets Act: Log-in records — up to 3 months

5. Right to Refuse and Consequences

Your consent is entirely voluntary. You may decline to provide consent for the receipt of marketing information without any restriction on your ability to use the core services of the AetherHeal platform. Refusal to consent will only result in the non-delivery of promotional and marketing communications.

6. Withdrawal of Consent (Opt-Out)

You may withdraw your consent at any time, free of charge, through any of the following methods:

• Unsubscribe link included in every marketing email
• Account Settings on the AetherHeal platform (aetherheal.com)
• Direct request via email to privacy@aetherheal.com

Upon receipt of your withdrawal request:

• Cessation of marketing communications: We will stop all marketing transmissions without delay in accordance with Korean law.
• Deletion of marketing-related personal data: Your personal information held solely for marketing purposes will be erased or de-identified within 30 days of your request, in accordance with GDPR Article 17. Where legal retention obligations apply (see Section 4), the relevant data will be retained separately and used only for the legally mandated purpose.

We will confirm the processing of your request via the contact method you have provided.

7. Third-Party Sharing

AetherHeal does not share your personal information with third parties for their independent marketing purposes without obtaining your separate, specific consent. In the event such sharing becomes necessary, we will provide advance notice specifying:

• The identity of the third-party recipient
• The purpose of the information sharing
• The categories of information to be shared
• The retention period applicable to the third party

8. Automated Decision-Making and Profiling

AetherHeal may use automated systems, including artificial intelligence, to analyze your service usage patterns and preferences in order to deliver personalized marketing content (profiling).

In such cases:

• You will be informed of the use of automated decision-making and the general logic involved.
• You have the right to object to profiling for marketing purposes at any time.
• You have the right to request human review of any decision made solely by automated means that produces legal or similarly significant effects on you (GDPR Article 22).

To exercise these rights, please contact us at privacy@aetherheal.com.

9. International Data Transfers

As AetherHeal serves users across multiple jurisdictions, your personal information may be transferred to and processed in countries outside your country of residence. In such cases, we ensure that adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Compliance with PIPA cross-border transfer requirements (Articles 28-2 and 28-3)
• Technical and organizational measures to protect data integrity and confidentiality

10. Rights of Data Subjects

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request rectification of inaccurate or incomplete information
• Deletion: Request erasure of your personal information, subject to legal retention obligations
• Restriction: Request limitation of processing in certain circumstances
• Portability: Request transfer of your data in a structured, machine-readable format (EU/EEA residents)
• Objection: Object to processing based on legitimate interests, including profiling (EU/EEA residents)

To exercise any of these rights, please contact us at privacy@aetherheal.com.

11. Age Restriction

The AetherHeal platform and its marketing services are intended for individuals aged 14 years or older. We do not knowingly collect personal information from anyone under the age of 14. If we become aware that personal information has been collected from a person under 14 without verified parental or legal guardian consent, we will take immediate steps to delete such information in accordance with PIPA Article 22 and GDPR Article 8.

12. Consent Logging

For regulatory compliance and your protection, we maintain a record of your consent, including:

• Date and time of consent
• Method of consent (web form, checkbox, etc.)
• Version of this consent document at the time of agreement
• IP address or device identifier

These records are retained for the duration of your use of the platform and for a minimum of 3 years following withdrawal or account termination, in accordance with applicable record-keeping obligations.

13. Amendments

AetherHeal reserves the right to amend this consent document to reflect changes in applicable law, regulatory guidance, or our services. In the event of any amendment:

• We will notify you via email or platform notification at least 7 days prior to the effective date of the changes.
• Material changes — including changes to the purpose of data collection, the categories of information collected, or the introduction of third-party sharing — will require your renewed consent (re-consent). Continued use of the platform alone does not constitute acceptance of material changes.
• Non-material changes — such as corrections of typographical errors, formatting adjustments, or updates to contact information — will take effect upon notification without requiring re-consent.

All prior versions of this document will be archived and made available upon request.

14. Dispute Resolution and Remedies

If you believe your personal information has been mishandled, you may seek resolution through the following channels:

Republic of Korea:

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972
• Korea Internet & Security Agency (KISA) Privacy Report Center: privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office Cyber Investigation Division: +82-2-3480-3573
• National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182

European Economic Area (EEA) Residents:

You have the right to lodge a complaint with the Supervisory Authority of your country of residence in accordance with GDPR Article 77. A list of EU Data Protection Authorities is available at edpb.europa.eu.

15. Personal Information Protection Officer

In accordance with PIPA Article 31, the following individual has been designated as the Personal Information Protection Officer responsible for overseeing all matters related to personal information processing:

For users in the European Economic Area, Dr. Jee Hoon Ju also serves as the designated point of contact for data protection inquiries under GDPR.

16. Governing Law and Language

This document is governed by and construed in accordance with the laws of the Republic of Korea. For users residing in the European Economic Area, the provisions of the GDPR shall apply in addition to Korean law where they afford greater protection.

This consent document is provided in both Korean and English. In the event of any discrepancy or conflict between the Korean and English versions, the Korean version shall prevail.

17. Contact Information

For inquiries regarding this consent document or your personal information, please contact: