Privacy Policy

1. Scope and Our Role

• The Company is a business-to-business provider of clinical AI software supplied to clinics and physicians on a per-seat subscription basis. The website is primarily for clinics and physicians, partners, and investors.
• This Policy applies only to information the Company processes as the website operator and data controller: inquiry and materials-request information, and website usage analytics.
• The Company's clinical software products are in development and validation and are not yet commercially launched. They are provided to medical institutions under separate agreements, and the Company does not collect patient clinical information through this website. Where clinical information is processed inside a product, the Company acts as a processor on behalf of the medical institution and is governed by that institution's policies and our contract with it. That processing is outside the scope of this website Policy.
• The Company's clinical AI is a tool that supports physician judgment and does not diagnose autonomously. Diagnosis, interpretation, and final decisions are made by the physician.
• This Policy is governed by the laws of the Republic of Korea. For visitors in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) may also apply; relevant points are noted in the sections below.

2. Personal Information We Collect

3. Purposes and Legal Basis

We process personal information for the following purposes and on the following legal bases.

• Responding to inquiries and materials requests, related follow-up communication, and partnership or investment discussions. Basis: your consent, and the conclusion or performance of a contract with you to handle your inquiry (PIPA Article 15(1)).
• Operating and securing the website, diagnosing errors, and compiling usage statistics. Basis: the Company's legitimate interests; for non-essential analytics cookies, your consent.
• Complying with legal obligations and handling disputes. Basis: legal obligation or legitimate interests.

For EEA visitors, the legal bases are consent (GDPR Art. 6(1)(a)), performance of a contract (Art. 6(1)(b)), the Company's legitimate interests (Art. 6(1)(f)), or legal obligation (Art. 6(1)(c)).

Marketing communications are handled under a separate, optional consent governed by our Consent to Receive Marketing Communications notice and are not duplicated here.

4. What We Do Not Collect

• We do not collect patient clinical information, health data, or other sensitive information through this website. Please do not send clinical or sensitive information in your inquiry.
• We do not collect personal information for advertising targeting or behavioral profiling, and we do not provide personal information to third-party advertising networks.
• We do not sell, rent, or trade personal information.
• We do not knowingly collect personal information from children under 14 (see Section 11).

5. Cookies and Web Analytics

We may use cookies that are necessary for the website to function, and analytics cookies to measure usage and performance.

You can refuse or delete cookies through your browser settings. If you refuse necessary cookies, some website features may be limited.

The web analytics tools we use are disclosed in this Policy, and we will update this Policy if those tools change.

6. Sharing and Processors

As a rule, we do not disclose personal information to outside parties. However, we may entrust the following tasks to service providers to the extent necessary to operate the website.

• Website hosting and infrastructure
• Website usage analytics
• Email and communication tools

We enter into agreements with processors that require data protection obligations, restrict use beyond the entrusted task and any re-entrustment, require security measures, and provide for our oversight. The specific list of processors is disclosed in this Policy and updated when it changes.

Except where required by law (such as a lawful request from an investigative authority), we do not provide your personal information to third parties.

7. International Transfer

Some of our processors (such as hosting and analytics) may be located outside Korea, in which case personal information may be transferred to and processed abroad. The items transferred are the automatically collected information and inquiry information in Section 2, to the extent necessary for the relevant service.

The recipient, destination country, and the date and method of transfer will be reflected in this Policy and disclosed once the relevant infrastructure is decided.

We comply with PIPA's requirements for overseas transfers and, where applicable, rely on appropriate safeguards under the GDPR such as an adequacy decision or Standard Contractual Clauses (SCCs).

8. Retention and Destruction

• We retain personal information only for as long as necessary to achieve the purpose of processing, and destroy it without delay once the purpose is achieved or ends.
• Inquiry and materials-request information: retained until the purpose of responding and maintaining the resulting relationship is achieved, then destroyed within 3 years.
• Access and usage logs: retained for security and statistical purposes for 1 year, then destroyed.
• Where a retention obligation exists under applicable law, the information is stored separately for the required period and then destroyed.
• Method of destruction: electronic files are deleted irrecoverably; printed materials are shredded or incinerated.

9. Your Rights and How to Exercise Them

• You may exercise the following rights regarding your personal information: access, correction or deletion, suspension of processing, and withdrawal of consent.
• EEA users may additionally request restriction of processing, data portability, and objection to processing, and have the right to lodge a complaint with a supervisory authority.
• How to exercise: contact us using the details in Section 13. We will respond within the period required by law (under PIPA, access requests are generally handled within 10 days; under the GDPR, generally within one month) and confirm the outcome.
• Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

10. Security

• Encryption of data in transit and at rest
• Access controls and the principle of least privilege
• Retention of access logs and monitoring for abnormal access
• Staff training on data protection
• We operate a security-focused, de-identification-oriented cloud-based architecture.
• We apply reasonable technical and organizational measures, but no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

This website is intended for professional and business users such as clinics and physicians, partners, and investors, and is not directed to children under 14. We do not knowingly collect children's personal information and will destroy it without delay if we become aware of it. For EEA users, the applicable age may be 16 or a lower age set by the relevant member state.

12. Changes to This Policy

We may revise this Policy to reflect changes in law, policy, or our operations. We will post the changes and their effective date on the website, and for material changes we will provide notice by an appropriate means before they take effect.

13. Privacy Officer and Contact

We have designated a Privacy Officer to oversee personal information processing and handle inquiries and complaints from data subjects.

Privacy Officer: Jee Hoon Ju (Representative Director) · [email protected]

For questions about this Policy or our handling of personal information, please contact us using the details below.

Korean users may seek consultation, mediation, or report a violation to: the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Privacy Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cybercrime Division (1301), and the National Police Agency Cyber Bureau (182).

EEA users may lodge a complaint with the data protection supervisory authority in their member state.

Contact