Privacy Policy

1. What we collect

Clinics Korea receives aggregate website analytics and may record fixed funnel-stage and route categories plus allowlisted source, medium, campaign, content-label and treatment-category values. The contact page may record only that a visitor clicked to open an email or copy the address, together with the fixed source category “website” or “LinkedIn”; it does not receive the email message. The checkup and contact pages may likewise record only that a visitor clicked to open WhatsApp, together with a fixed care-track and surface label; the draft text is never read. Arbitrary query text, email contents and prompts are not used as analytics event properties. The booking form collects name, treatment interest and the selected contact method with either an email address or a WhatsApp number. Travel dates and a message are optional. These details are submitted only after the visitor reviews and accepts the separate consent notices. Student-support patient intake remains paused. Partner reviews collect institution details and business-contact information.

The homepage contact buttons may record a WhatsApp or LINE link click, or the opening of the WeChat QR window, with fixed channel, surface and interface-language labels. These events do not include the contact URL, QR token, phone number, profile name or message content. A click or QR view is contact intent only, not a received enquiry or confirmed appointment.

The Global Partner page prepares a business-introduction email in the visitor's own email application. Clinics Korea does not receive or store the fields typed on that page before the visitor sends the email. The page instructs visitors not to include patient or health information.

A MediBridge account collects the login email, display name, organisation name, aggregate channel counts and self-reported commission amounts needed to provide the performance workspace. When a performance entry is created, changed or deleted, limited audit metadata records the entry identifier, organisation identifier, actor account identifier, action, timestamp and database transaction identifier. The audit record does not contain the entry's patient data or deleted performance values. Do not enter a patient's name, contact details, passport or identification number, medical information, images or any other patient-level information in that workspace.

2. How we use it

We measure which public pages and source channels lead to received appointment requests using a limited attribution record. Browser session storage retains the first public landing path, an allowlisted source label and the latest known guide path; query strings and message contents are excluded. When a request is accepted and attribution storage is enabled, those fields are linked to its internal submission UUID and first attribution-record timestamp. This is pseudonymous request-linked information, not an anonymous record, and is not a record of a confirmed appointment.

We use aggregate route and email-intent information to understand which pages help visitors reach a booking next step and where the public journey needs improvement. If a visitor sends an email, its contents are used to answer that enquiry and explain the current coordination step. If the patient form is enabled, submitted details are used only to coordinate that request under the displayed consents. We use submitted student-support or partner information only to respond to that request. MediBridge account and aggregate performance data is used to authenticate the account and provide its workspace. We do not sell personal information and do not use health information for marketing.

3. Sharing and processors

Supabase also processes the limited request-attribution record described above so Clinics Korea can produce path-level request counts. That separate record contains no name, contact details, treatment choice, health notes or clinic status. Access is restricted to authorised server-side services and database operators; it is not publicly readable. The internal submission UUID is not sent to Google Analytics or included in the weekly aggregate report.

Booking requests are stored through the configured Google Apps Script and Sheets service and delivered using Resend. With the separate clinic-sharing consent, the submitted details are sent to Aurea Clinic at aureaclinic.co.kr@gmail.com, where Google Gmail processes the message. An operational copy is also sent to Clinics Korea at ceo@clinics-korea.com solely to coordinate the request. Visitors who select email also receive an email receipt. Visitors who select WhatsApp receive an on-screen request number; the website does not automatically send them a WhatsApp message or a confirmation email. The selected contact details are included in the clinic notification. The contact page opens the visitor's own email application and does not submit that email through the website. The WhatsApp enquiry link opens the visitor's own WhatsApp application with an editable draft; the website does not send it, and WhatsApp Ireland Limited (Meta) processes any message the visitor chooses to send from their own account.

The homepage WhatsApp and LINE buttons link to the supplied contact or friend-add page. The WeChat window displays a locally hosted friend-add QR image for Kangwoo Cho, the Clinics Korea enquiry contact. These buttons do not send a message or create a website patient record. If you choose to add the contact or send a message, the relevant messaging service handles that interaction under its own terms and privacy notice; Clinics Korea receives the messages you choose to send to its contact. Use these channels for general questions only, not medical records, photos or identity documents.

Vercel hosts this website and provides aggregate web analytics. Supabase provides authentication and database processing for MediBridge account profiles and aggregate performance records. Google Analytics 4 uses cookies to measure page visits and fixed interaction events, including contact-page visits, email and chat intent and booking submission outcomes when the form is available. We exclude query strings, fragments, form contents and receipt identifiers from our GA4 events, and disable Google signals and advertising personalization. A submission-success event means a request was received, not that an appointment was confirmed. Configured Google Workspace and email-delivery services may process student-support and partner enquiries. Those forms identify what is collected before submission.

4. Embedded TikTok media

When an approved TikTok video appears on the homepage, the player is served directly by TikTok. Loading or playing it may send your IP address, device and browser information, referrer and interaction data to TikTok and may allow TikTok to use cookies or similar technologies under its own privacy policy. You can use the original-post link instead if the embedded player is unavailable or blocked.

5. Retention and deletion

The request-attribution record is covered by the booking request's retention period of up to three years, unless a longer period is required by law. Authorised operators handle access and deletion requests through the contact page, locating the associated record by the internal submission UUID and removing it when the corresponding request is deleted, unless retention is legally required. This is an operator-managed process, not an automated retention job. The browser-session attribution values remain within that tab's session storage until the browser clears the session or you clear site storage.

Clinics Korea does not create a patient record when you only view the booking or contact page, open the email or WhatsApp draft or copy the address. If you send the email, the message remains in the sender's and recipient's email systems and may be retained for up to three years for response, coordination, customer-service and legal purposes, then deleted unless a longer period is required by law. If the patient form is enabled, submitted booking-request records may be retained for up to three years as stated in the form consent. Student-support and partner-enquiry records are retained for up to three years for response, customer-service and legal purposes, then deleted. You may request access, correction or deletion at any time through the contact page.

MediBridge stores the account email, display name, organisation name, aggregate channel counts, self-reported commission amounts and the limited audit metadata described above in Supabase. Performance entries can be deleted with the available workspace controls. Their metadata-only audit records may remain after that deletion to protect workspace integrity and investigate misuse; they are deleted or de-identified when no longer reasonably needed for those purposes, subject to any retention required by law. Use the contact page to request access, correction, account deletion or deletion of remaining MediBridge data. These self-reported, unverified records are not settlement evidence. Creating an account does not approve a Clinics Korea partnership, assign patients or promise commission payments.

Existing records in this site's former browser-local workspace are not transferred automatically. An import is attempted only after the signed-in user reviews the notice and explicitly chooses to import them. A failed import leaves the browser-local source records in place.

MediBridge는 계정 이메일, 표시 이름, 조직명, 채널별 집계 수치, 사용자가 입력한 수수료액과 제한된 감사 메타데이터를 Supabase에 저장합니다. 실적을 생성·수정·삭제하면 실적 ID, 조직 ID, 작업 계정 ID, 작업 종류, 시각과 데이터베이스 거래 ID가 기록되며, 환자 정보나 삭제된 실적 값은 감사 기록에 포함되지 않습니다. 실적 기록은 작업공간에서 제공하는 삭제 기능으로 지울 수 있지만, 감사 기록은 작업공간의 무결성 보호와 오용 조사에 합리적으로 필요한 동안 남을 수 있고 그 목적이 끝나면 삭제하거나 식별할 수 없게 처리합니다. 법령상 보관 의무가 있는 경우를 제외하고 계정과 그 밖의 MediBridge 데이터의 열람·정정·삭제는 연락 페이지를 통해 요청할 수 있습니다. 이 기록은 자가 입력·미검증 참고자료이며 정산 증빙이 아닙니다. 계정 생성은 Clinics Korea 제휴 승인, 환자 배정 또는 수수료 지급을 의미하지 않습니다.

이전에 브라우저에 저장한 기록은 자동으로 서버에 전송되지 않습니다. 로그인한 사용자가 안내를 확인하고 가져오기를 명시적으로 선택한 경우에만 계정 작업공간으로 가져오기를 시도하며, 가져오기에 실패하면 브라우저의 원본 기록은 그대로 남습니다.

6. Sensitive information and minors

The booking form asks for a treatment interest and allows optional notes under separate consent. Share only the minimum information needed to coordinate your request. Do not submit passport, resident-registration or student ID numbers, payment-card details, medical records, diagnoses, prescriptions, medication lists, images or another person's information through a Clinics Korea form, email or WhatsApp message. If you are under 14, do not send an enquiry yourself; ask a parent or legal guardian to use the contact page.

7. International processing

Supabase processes the limited booking-request attribution record, as well as MediBridge data, through the configured project's hosting infrastructure and subprocessors. This processing does not replace the separate services used to store and deliver the full booking request.

Clinics Korea operates from the Republic of Korea. Vercel may process connection and aggregate analytics data through its global hosting infrastructure, and Supabase may process MediBridge authentication and database data through its configured hosting infrastructure and subprocessors. A phone call is handled by your carrier and the clinic; email is handled by the sender's and recipient's providers; a WhatsApp message is handled by WhatsApp Ireland Limited (Meta) on its own infrastructure outside Korea. Student-support, partner and any enabled patient forms should be used only after reviewing their collection and sharing notices.

8. Contact

Personal Information Protection Officer: Cho Kang-woo (Representative) — ceo@clinics-korea.com

Clinics Korea (클리닉스코리아) · Representative: Cho Kang-woo · Business registration no. 232-26-02492
3F Room 69, 5 Seongmisan-ro 19-gil, Mapo-gu, Seoul, Republic of Korea

If you are not satisfied with our response, you may contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) or the Korea Internet & Security Agency privacy report centre (privacy.kisa.or.kr, 118).