AetherHeal Privacy Policy

1. Scope and Role of AetherHeal

AetherHeal is a physician-led decision support platform that facilitates the connection between international patients and licensed healthcare providers in South Korea. AetherHeal is not a medical provider, hospital, or clinic. We do not render medical diagnoses, treatments, or advice. All medical services are independently provided by partner medical institutions.

This Privacy Policy applies to all personal data processed by AetherHeal in connection with our platform and coordination services.

2. Personal Data We Collect

2.1 Information You Provide Directly

When you register for an account, submit a consultation request, or otherwise interact with our platform, we may collect:

• Full name
• Nationality
• Date of birth
• Gender
• Phone number (including country code)
• Email address
• Messenger account information (e.g., WhatsApp, LINE, WeChat, Telegram, KakaoTalk)
• Passport or travel document information (for travel and visa coordination)
• Booking preferences and appointment details
• Consultation requests and related details (e.g., procedure types, desired treatment areas)
• Photographs, medical history, medical records, or documents you upload for consultation purposes

2.2 Information Collected During Platform Use

When you access or use our platform, we may automatically collect:

• Login credentials and account activity
• Device information (device type, operating system, unique device identifiers)
• IP address
• Browser type and version
• Access logs and timestamps
• Pages viewed and usage patterns
• Communication history with AetherHeal support or coordination teams

2.3 Payment-Related Information

All payment transactions are processed through third-party payment service providers. AetherHeal does not directly collect or store full credit card numbers or banking credentials. We may receive limited payment confirmation data (e.g., transaction ID, payment status, last four digits of card number) to manage booking and deposit records.

3. Purposes of Processing

We process your personal data for the following purposes:

• Creating and managing your AetherHeal account
• Facilitating consultation requests between you and partner medical institutions
• Coordinating appointments, travel logistics, and accommodation arrangements
• Communicating with you regarding your inquiries, bookings, and service updates
• Structuring, summarizing, translating, and quality-checking information you submit for coordination and administrative support, including through AI-assisted tools subject to human review where appropriate
• Providing travel coordination support (e.g., airport pickup, visa documentation assistance)
• Processing deposits, refunds, and related financial transactions
• Responding to customer inquiries and support requests
• Monitoring platform operations, workflow status, and security events to prevent fraud, unauthorized access, missed handoffs, or service failures
• Complying with applicable laws and regulations, including South Korean personal information protection laws

Where permitted by applicable law, we may use internal systems or contracted service providers that include AI-assisted processing features to help organize case materials, generate draft summaries, support translation, or detect operational exceptions. These tools are used to support coordination and administrative workflows and are not used to provide medical diagnosis, treatment, prescriptions, emergency triage, or autonomous final provider selection.

4. Third-Party Disclosure

4.1 Provision to Partner Medical Institutions

To facilitate your consultation and treatment, we may share relevant portions of your personal data with licensed partner medical institutions in South Korea. This may include:

• Name, date of birth, gender, nationality
• Consultation details, photographs, and medical history you have provided
• Appointment and scheduling information

These institutions are independent data controllers responsible for their own handling of your data under applicable medical and privacy laws.

4.2 Provision to Coordination Partners

We may share limited personal data with trusted service partners to support your experience, including:

• Payment processors (for deposit and refund handling)
• Communication service vendors (for messaging and notification delivery)
• Translation, document-processing, or AI-assisted workflow service providers acting on our behalf under contractual controls
• Travel and accommodation coordination partners
• IT infrastructure and cloud hosting providers

4.3 Legal Basis

Data sharing with third parties is conducted based on your consent, the performance of a contract with you, our legitimate interests, or compliance with legal obligations, as applicable under the Personal Information Protection Act (PIPA) of South Korea and other relevant regulations.

4.4 No Sale of Personal Data

AetherHeal does not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

5. Cross-Border Transfer

As an international decision support platform, your personal data may be transferred to and processed in countries outside your country of residence, including South Korea.

5.1 Overseas Transfer to Partners

Your data may be transferred to partner medical institutions and coordination partners located in South Korea or other jurisdictions as necessary to provide our services.

5.2 Overseas Outsourcing to Service Providers

We may outsource certain processing activities (e.g., cloud hosting, data analytics, translation support, customer support tools, or AI-assisted document and workflow processing) to service providers located outside South Korea. Such providers are contractually required to protect your data in accordance with applicable laws.

5.3 Items Potentially Transferred

Personal data transferred may include any of the categories listed in Section 2 above, depending on the nature of the service being provided.

5.4 Purpose

Cross-border transfers are made solely for the purposes described in Section 3 of this Privacy Policy.

5.5 Retention Period

Data transferred overseas is retained for the same period as described in Section 7 of this Privacy Policy.

5.6 Safeguards

We implement appropriate safeguards, including contractual data protection clauses, encryption, and access controls, to protect your data during cross-border transfers.

6. Entrustment of Processing

AetherHeal may entrust certain personal data processing activities to third-party service providers (e.g., cloud hosting, customer communication tools, analytics platforms). In such cases, we enter into data processing agreements that require the entrusted parties to:

• Process data only for the designated purposes
• Implement technical and organizational security measures
• Not re-entrust data to additional parties without our consent
• Return or destroy data upon completion of the entrusted task

Where an entrusted provider offers AI-assisted processing features, we require that such processing remain limited to our documented instructions and applicable law. We do not authorize entrusted processors to use your personal data to provide you with medical diagnosis or treatment, and any AI-assisted output used in our coordination workflows remains subject to human oversight where required by the workflow.

7. Retention and Deletion

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. When your data is no longer needed, we will securely delete or anonymize it.

Specific retention periods may include:

• Account and consultation records: retained for the duration of your account and up to 3 years after account closure, unless longer retention is required by law
• Payment and transaction records: retained as required under applicable tax and commercial laws (typically 5 years)
• Communication records: retained for up to 3 years for service improvement and dispute resolution
• Access and usage logs: retained for up to 1 year for security and fraud prevention purposes

Upon expiration of the retention period, your data will be promptly destroyed in a manner that prevents recovery.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: You may request access to the personal data we hold about you.
• Right of Correction: You may request correction of inaccurate or incomplete personal data.
• Right of Deletion: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Suspend Processing: You may request that we suspend certain processing activities related to your data.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal.

To exercise any of these rights, please contact us using the information provided in Section 11 below. We will respond to your request within a reasonable time frame, in compliance with applicable laws.

9. Security

AetherHeal implements reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit and at rest
• Access controls and authentication mechanisms
• Regular security assessments and monitoring, including automated monitoring tools for suspicious access or service anomalies
• Employee training on data protection

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by posting the updated policy on our platform and updating the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at: