Gowa Clinic (“Service” operator, “Gowa Clinic”) establishes and discloses the following Personal Information Processing Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to promptly and smoothly handle complaints related thereto.
○ This Personal Information Processing Policy is effective as of March 1, 2026.

Article 1 (Purpose of Processing Personal Information)

Gowa Clinic processes personal information for the following purposes. Personal information being processed shall not be used for any purpose other than the stated purposes, and when the purpose of processing changes, necessary measures will be taken in accordance with Article 18 of the Personal Information Protection Act, including obtaining separate consent.

1. Complaint Processing
Personal information is processed for the purpose of identifying the identity of the complainant, confirming the nature of the complaint, contacting and notifying for fact-finding purposes, and notifying the results of processing.

2. Provision of Goods or Services
Personal information is processed for the purpose of providing medical services, reservation management, consultation, sending contracts and invoices, providing contents, personal authentication, and payment and settlement of fees.

3. Use in Marketing and Advertising
Personal information is processed for the purpose of providing new and customized services, providing event and advertising information and providing opportunities to participate, and confirming the effectiveness of services.

Article 2 (Period of Processing and Retention of Personal Information)

① Gowa Clinic processes and retains personal information within the period of retention and use of personal information according to relevant laws or the period of retention and use of personal information that was consented to when collecting personal information from the data subject.

② The processing and retention period for each personal information is as follows:

1. Provision of Goods or Services
• The relevant personal information shall be retained and used for the above-mentioned purpose for up to <5 years> from the date of consent to collection and use.
• Reason for Retention: Management of payment and service provision records
• Relevant Laws: Records on payment and supply of goods and services: 5 years / Records on contracts or withdrawal of offers: 5 years

2. Complaint Processing
• The relevant personal information shall be retained and used for the above-mentioned purpose for up to <3 years> from the date of consent to collection and use.
• Reason for Retention: Management of complaint records
• Relevant Laws: Records on consumer complaints or dispute resolution: 3 years

3. Use in Marketing and Advertising
• The relevant personal information shall be retained and used for the above-mentioned purpose for up to <1 year> from the date of consent to collection and use.
• Reason for Retention: Use in marketing and advertising
• Relevant Laws: Records on display/advertising: 6 months

Article 3 (Items of Personal Information Processed)

Gowa Clinic processes the following personal information items:

1. Provision of Goods or Services
• Required Items: Mobile phone number, name, date of birth, gender
• Optional Items: Credit card information, bank account information

2. Complaint Processing
• Required Items: Mobile phone number
• Optional Items: Email address

3. Use in Marketing and Advertising
• Optional Items: Mobile phone number, email address

Article 4 (Regarding Personal Information Processing for Children Under 14 Years Old)

① When collecting personal information about children under 14 years of age, Gowa Clinic obtains the consent of the legal representative and collects only the minimum necessary personal information.
• Required Items: Name of legal representative, relationship, contact information

Article 5 (Regarding Provision of Personal Information to Third Parties)

① Gowa Clinic processes personal information only within the scope specified in Article 1 and provides personal information to third parties only when it falls under Article 17 or 18 of the Personal Information Protection Act.

② Personal information is provided to third parties as follows:

• Boostree
Recipient: Boostree Partners Corp.
Purpose of Use: Homepage reservation management and medical records management
Retention Period: Until the end of contract

• Vegas CRM
Recipient: TNH Co., Ltd.
Purpose of Use: Medical records management
Retention Period: 5 years after contract termination

• Kakao
Recipient: Kakao Corp.
Purpose of Use: Sending notification talks
Retention Period: In accordance with Kakao policy

Article 6 (Regarding Entrustment of Personal Information Processing)

① Gowa Clinic entrusts personal information processing tasks as follows to facilitate smooth personal information management:

• Trustee Name: Boostree Partners Corp.
• Entrusted Tasks: Homepage service and reservation management

Article 7 (Procedures and Methods for Destruction of Personal Information)

① When personal information is no longer necessary due to the expiration of the retention period or achievement of the purpose of processing, Gowa Clinic destroys the relevant personal information without delay.

② The procedures and methods for destruction of personal information are as follows:

1. Destruction Procedure: Personal information for which a reason for destruction has occurred is selected and destroyed upon approval by the Personal Information Protection Officer.
2. Destruction Method: For information in electronic file form, technical methods that cannot reproduce the records are used.

Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise)

A data subject may exercise the right to request access to, correction of, deletion of, or suspension of processing of personal information at any time.

Article 9 (Measures to Ensure Safety of Personal Information)

Gowa Clinic takes the following measures to ensure the safety of personal information:

1. Administrative Measures: Establishment of internal management plans and employee training
2. Technical Measures: Management of access authority and operation of access control systems
3. Physical Measures: Control of access to computer rooms and data storage rooms

Article 10 (Personal Information Protection Officer)

▶ Personal Information Protection Officer
• Name: Kang Hyun-wook
• Title: Medical Director
• Contact: 02-591-7776

Article 11 (Request for Access to Personal Information)

▶ Personal Information Protection Department
• Manager: Kang Hyun-wook
• Contact: 02-591-7776

Article 12 (Remedies for Infringement of Rights)

A data subject may inquire with the following organizations to receive remedies for infringement of personal information:

1. Personal Information Dispute Resolution Committee: 1833-6972 (without area code)
2. Personal Information Infringement Report Center: 118 (without area code)
3. Supreme Prosecutors’ Office: 1301 (without area code)
4. Police Agency: 182 (without area code)

Article 13 (Amendment to Personal Information Processing Policy)

① This Personal Information Processing Policy is effective as of March 1, 2026.