Privacy Policy

VERI-TENSION (the "Clinic") establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act and other applicable laws, in order to protect users' personal information and to handle related concerns promptly.

1. Purposes of processing

Membership registration and management: confirming intent to join, identifying and authenticating members, managing member information, social login
Identity verification: sending and checking verification codes by email or mobile phone when signing up or making a reservation
Online reservation service: receiving, confirming, changing and cancelling treatment reservations; reservation notices (email, app push notifications, notification inbox); handling requests
Reservation management: registering reservation information in the clinic's reservation/customer management (CRM) system to manage visits and treatment schedules
Marketing communications: event and benefit information (app push notifications, email) for members who have consented
Service operation and improvement: usage statistics, prevention of misuse, responding to customer enquiries

2. Personal information processed

At sign-up

Required: name (first and last name), email address, password (stored encrypted), mobile phone number, nationality
Optional: date of birth, gender, consent to marketing communications
When using social login (Google, Apple, Kakao or other methods offered on the website/app): email address, name and mobile phone number (where provided) received from that service

When making a reservation

Required: name, mobile phone number, email address, reserved treatment/product, reservation date and time, member identifier and nationality
Optional: requests
Generated while processing the reservation: reservation status (received, confirmed, cancelled, visited), product and price information at the time of reservation, language used, country identified from the mobile phone number

Automatically generated or collected during use of the service

Device information for app push notifications: push token, device identifier, platform, device model, operating system and app version, language setting
Session information for staying logged in (cookies), notification delivery and read records
Website usage and access information (cookies and analytics tools; see section 9)

3. Retention and use period

Member information: retained until you delete your account; on deletion, the account, member information, device information and notification history are deleted.
Reservation records: retained to provide the reservation service and to handle reservation enquiries and disputes; after account deletion they are kept separately from the member account and destroyed once the purpose has been achieved.
Notification history: read notifications are deleted automatically after 30 days, unread notifications after 90 days.
App push device information: device information not used for 90 days is deleted automatically.
Identity verification codes: expire 5 minutes after they are sent.
Marketing consent: used until withdrawal or account deletion; the record of consent and withdrawal is kept for handling disputes.
Where applicable laws require retention for a certain period, information is kept for the period set by those laws.

4. Destruction of personal information

When personal information is no longer needed, for example because the retention period has passed or the purpose has been achieved, it is destroyed without delay. Electronic files are deleted using methods that prevent recovery, and other records are shredded or incinerated.

5. Entrustment of personal information processing

To provide its services smoothly, the Clinic entrusts the following personal information processing tasks to the parties below.

Entrusted party	Entrusted work
주식회사 우빅	Development, operation and maintenance of the website and online reservation system; support for processing member and reservation information
주식회사 위버케어 (닥터팔레트, DoctorPalette)	Registration and management of online reservation information in the CRM, reservation intake and schedule management, and operation of the customer management system

When entrusting personal information processing, the Clinic ensures that personal information is not processed for any purpose other than the entrusted work, sets out the matters necessary for its safe management, and supervises how the entrusted parties handle personal information.

In addition, the following external services are used in operating the service, and the personal information needed for each service is processed in the course of doing so.

Email delivery service: email address, message content — verification codes, reservation notices, notifications
App push notification services (Apple and Google push services): push token, notification content — app notifications
SMS/KakaoTalk notification delivery service (when in operation): mobile phone number, message content — identity verification codes
Database, authentication, file storage and web hosting services: storing and processing data to operate the service
Bot protection service (Cloudflare Turnstile): access information — preventing automated misuse

The Clinic takes the measures required by applicable laws so that personal information is processed safely when external services are used. Details such as the names of each service provider are available on request through the contact details below.

6. Provision to third parties

The Clinic processes users' personal information only within the scope stated in section 1 and does not provide it to third parties except with the user's separate consent or where specifically required by law.

Cases in which personal information processing is entrusted to a contractor in order to provide the service are described in section 5 (Entrustment of personal information processing).

7. Rights of data subjects and how to exercise them

Access and correction: you can view and edit your member information under Profile Settings in My Page.
Deletion (account deletion): you can delete your account using the account deletion function in My Page.
Withdrawal of marketing consent: you can withdraw at any time under Profile Settings in My Page.
Other requests: contact us using the details below and we will act without delay.

Users are responsible for registering and maintaining accurate information and must not use another person's personal information.

8. Security measures

Passwords are stored using irreversible encryption, and credentials used to connect to external services are stored encrypted.
All communications are encrypted (HTTPS).
Access to personal information is limited to administrators who need it for their work and is managed by role.
Identity verification procedures and automated-abuse prevention are applied.

9. Cookies and automatic collection

Essential cookies are used to keep you logged in and, where guest identity verification is offered, to keep the verified state. Blocking these cookies prevents login and reservations.
Analytics and advertising tools may run through Google Tag Manager to measure service usage and advertising performance, and cookies and access information may be collected in the process. You can refuse cookies in your browser settings.
A cookie-free traffic measurement tool is used to measure website performance.

10. Contact for personal information matters

For enquiries about personal information processing, requests for access, correction or deletion, and complaints, please contact:

VERI-TENSION (Representative: JUN WOO KIM)
Address: 서울특별시 강남구 테헤란로1길 10, 세경빌딩 지하1층, 2층, 4층
Phone: 02-2088-1008
Email: info@veritension.com

Reports or consultations about personal information infringements can also be made to the Personal Information Infringement Report Center (118, no area code) or the Personal Information Dispute Mediation Committee (1833-6972) in Korea.

11. Changes to this Privacy Policy

Additions, deletions or amendments to this Privacy Policy are announced on the website.

12. Effective date

This Privacy Policy applies from 2026-10-20.