medihi Privacy Policy
Sungjin HDS Co., Ltd. (the "Company"), which operates the medihi service (the "Service"), values users' personal information and complies with the Personal Information Protection Act and other applicable laws and regulations.
This Privacy Policy applies to the use of services provided by medihi and explains how users' personal information is collected, used, retained, provided, destroyed, and otherwise processed, as well as the rights available to users and how those rights may be exercised.
medihi currently operates primarily as a non-member consultation request and hospital connection service. The Service may also provide hospital-partner application and operation functions and customer-experience management.
If new features such as membership services, reviews, or payments are introduced and the processing of personal information changes, this Privacy Policy will be updated before those changes are applied.
1. Purpose of Processing Personal Information
The Company processes personal information for the following purposes.
| Category | Purpose |
|---|---|
| Consultation and Reservation Requests | Receiving and confirming consultation requests, providing hospital information, connecting users with hospitals selected by the user for consultations and reservations, and providing related notices |
| Consultation, Reservation, Visit Status and Customer Experience Management | Checking consultation, reservation, and visit status; allowing users to confirm their progress; and collecting satisfaction and customer-experience feedback |
| Service Analysis and Improvement | Analyzing service usage and performance, improving content, UI/UX, inquiries, and customer experience, and conducting statistical analysis |
| Marketing and Benefit Information | Providing users who have separately opted in with service news, content and new-service information, events, promotions, and other advertising information |
| Hospital Partner Operations | Receiving, reviewing, registering, and operating hospital-partner applications; providing partnership and service operations; and responding to related inquiries |
| Compliance with Legal Obligations | Compliance with applicable laws and regulations, protection of rights, and dispute handling |
▪️ Customer Experience Satisfaction Surveys and Review Requests
The Company may conduct follow-up checks or satisfaction surveys regarding the progress and experience of consultations, reservations, and visits in order to improve customer experience and service quality.
Information collected through this process is used within the scope necessary for customer-experience management and service-quality improvement.
If reviews or other information are to be publicly displayed in the Service or used for promotion or another separate purpose, the Company will provide any additional notice or obtain any consent required for the actual purpose and scope of use.
2. Personal Information We Process
The Company may process the following personal information in connection with the Service.
| Category | Information Processed | Collection Method |
|---|---|---|
| Consultation Request through the Domestic Inquiry Form | Name, contact number, medical service category, year of birth or age, gender, and region of residence, among the fields actually used in the applicable inquiry form | When the user submits a consultation inquiry form |
| Consultation Request through the Global Inquiry Form | Name, Korean or international phone number, medical service category, inquiry-form language, country or region of residence, residence or stay status in Korea, messenger type and ID, preferred timing for medical services, year of birth or age, gender, and region of residence, among the fields actually used in the applicable inquiry form | When the user completes or uses a consultation inquiry form |
| Post-Consultation Confirmation and CX | Consultation, reservation, and visit status; confirmation timestamps; customer-experience and satisfaction responses; and other information actually collected during the confirmation process | When the user responds to a follow-up confirmation or survey |
| Hospital Partner Application and Operations | Hospital name, contact person name, contact information, email address, hospital address and identifiers, submitted and verification materials, and other information actually required for partner operations | Application forms, email, administrator environments, and other submission methods |
| Automatically Collected Information | IP address, browser and device information, access date and time, usage records, landing/inquiry-form URL, referrer, UTM information, advertising click IDs, cookies, browser_id, events, and service-operation logs | Automatically collected when the Service is used |
The Company does not collect every item above in every inquiry form. Only information necessary for the applicable service and consultation operations is used and collected in the relevant inquiry form.
The medical service category may be set based on the user's access path or selected consultation target, or may be selected directly by the user.
The current MEDIHI consultation inquiry form is not intended to function as a medical questionnaire. It does not collect information designed to directly determine a user's health status, such as symptoms, medical history, diagnoses, treatment history, test results, or medications, as part of the basic consultation inquiry form.
If a future feature requires such information, the Company will conduct the necessary privacy and legal review and implement any required consent process before introducing that feature.
3. Retention and Use Period
The Company destroys personal information without undue delay when the purpose of processing has been achieved or the applicable retention period has expired.
Where separate retention is required by applicable law, the Company retains the relevant information for the period prescribed by law.
| Category | Retention Period | Basis |
|---|---|---|
| Consultation and Reservation Requests and Related Records | 1 year from the consultation or reservation request date | Consultation and reservation connection, customer support, and management of attribution, usage, and operational records associated with the inquiry |
| Pre-Inquiry Visit and Usage Records | 3 months | Service-usage analysis and quality improvement |
| Cookies and Visitor Identifiers | 180 days from the most recent visit | Analysis of repeat visits and service-usage flows |
| Records for Prevention of Abuse and Service Protection | Up to 1 year, depending on the purpose | Prevention of spam and repeated abuse, and protection of the Service |
| Marketing Consent Information | 2 years from the date of consent or until consent is withdrawn | User's optional consent |
| Hospital Partner Application and Operation Information | 1 year after the application or operation ends | Partner-operation history and inquiry handling |
| Information Required to Be Retained by Law | As required by applicable law | Compliance with applicable laws and regulations |
Detailed retention periods for system and security logs are managed under the Company's internal privacy-management standards within the retention periods applicable to the relevant purposes above.
After the applicable retention period expires or the processing purpose is achieved, electronic files are securely deleted so that they are difficult to restore or reproduce, and printed materials are shredded or incinerated.
4. Provision of Personal Information to Third Parties
As a general rule, the Company does not provide users' personal information to external parties.
However, when a user requests a consultation or reservation connection with a specific hospital or clinic through MEDIHI and consents to the provision, the Company may provide personal information as follows.
| Recipient | Purpose | Information Provided | Retention and Use Period |
|---|---|---|---|
| Hospital or clinic selected by the user for consultation or reservation connection | Conducting the requested consultation, contacting the user, providing reservation and visit information, and managing the consultation and reservation process | Personal information actually collected through the applicable inquiry form and necessary for the consultation or reservation process | Until the purpose of provision, such as consultation or reservation, has been achieved |
| Authorities or institutions where provision is required by applicable law | Compliance with legal obligations | Information within the scope prescribed by law | As required by applicable law or until the relevant purpose has been achieved |
Depending on the inquiry-form configuration, information provided to the selected hospital may include the user's name, Korean or international phone number, medical service category, inquiry-form language, country or region of residence, residence or stay status in Korea, messenger type and ID, preferred timing for medical services, year of birth or age, gender, and region of residence.
At the time consent to third-party provision is obtained, the Company identifies the official name of the hospital selected by the user and the personal information actually to be provided.
Where separate retention is required by applicable law, information may be retained for the period prescribed by that law.
5. Outsourcing of Personal Information Processing
The Company entrusts personal information processing as follows in order to provide the Service smoothly.
| Processor | Entrusted Services | Information Processed | Retention and Use Period |
|---|---|---|---|
| Formagrid, Inc. (Airtable) | Storage and management of inquiry, CX, and operational information | Inquiry and contact information, responses, status information, and operational history | For the Company's applicable retention period or until the purpose of the outsourcing has been achieved |
| Softr Platforms GmbH | Provision of hospital administrator screens, access controls, and inquiry viewing and management functions | Hospital administrator account information and hospital-specific inquiry and status information | For the Company's applicable retention period or until the purpose of the outsourcing has been achieved |
| TYPEFORM, S.L. | Provision of customer-experience surveys and collection of survey responses | Inquiry identifier and CX survey responses | For the Company's applicable retention period or until the survey-processing purpose has been achieved |
| Google LLC | Provision of work, web, and data-analysis environments | Approved work, usage, inflow, and analytics information | For the Company's applicable retention period or until the purpose of the outsourcing has been achieved |
| Amazon Web Services, Inc. | Operation of service infrastructure, including servers and databases | Inquiry and service-operation information | For the Company's applicable retention period or until termination of the outsourcing agreement |
| Infobank Co., Ltd. (Bizgo) | Delivery of Alimtalk and text messages, including request-completion and status notifications | Name, contact information, and message information required for delivery | Until message delivery and related processing purposes have been achieved |
The Company does not transfer names, phone numbers, or other direct identifiers of existing inquiry users to Typeform. Typeform processes only the inquiry identifier and customer-experience survey responses.
When entering into outsourcing agreements, the Company specifies the matters necessary to ensure secure processing of personal information in accordance with applicable law and manages and supervises its processors.
Changes to processors or entrusted services will be disclosed through this Privacy Policy or another appropriate method.
▪️ Overseas Transfer and Processing of Personal Information
The following services currently process personal information outside Korea as part of MEDIHI operations.
| Recipient | Country | Information Transferred | Timing and Method | Purpose | Retention and Use Period |
|---|---|---|---|---|---|
| Formagrid, Inc. (Airtable) privacy@airtable.com | United States | Inquiry and contact information, responses, status information, and operational history | Transmitted over encrypted networks when inquiries are created, updated, or synchronized | Storage and management of inquiry, CX, and operational information | For the Company's applicable retention period or until the purpose of the outsourcing has been achieved |
| Softr Platforms GmbH support@softr.io | Germany | Hospital administrator account information and hospital-specific inquiry and status information | Processed over encrypted networks when hospital administrators sign in, view information, or make updates | Provision of the hospital administrator environment and inquiry operations | For the Company's applicable retention period or until the purpose of the outsourcing has been achieved |
| TYPEFORM, S.L. gdpr@typeform.com | United States | Inquiry identifier and CX survey responses | Transmitted over encrypted networks when users participate in and submit a CX survey | Provision of customer-experience surveys and collection of responses | For the Company's applicable retention period or until the survey-processing purpose has been achieved |
The Google Workspace/GCP environment and the AWS environment used by the Company are currently operated in Seoul, Korea and are therefore not included in the overseas-processing table above.
When Softr connects to an external data source such as Airtable, source records may be viewed without being separately copied into Softr's own database. MEDIHI currently uses Softr to view and process inquiry and status information in the hospital administrator environment.
Overseas processing is carried out within the scope of personal-information processing outsourcing and storage permitted under applicable law. Where separate consent is required, the Company will obtain the required consent before the applicable service is used.
Users may contact the Company at medihi@sungjinhds.com or 070-8016-6528 to make inquiries regarding overseas processing or to express an objection. If the relevant overseas processing is necessary to provide a service, use of related functions such as inquiry management or hospital connection may be restricted.
Participation in CX surveys provided through Typeform is optional. Choosing not to participate does not restrict consultation, reservation, or other basic MEDIHI services.
6. Marketing Use and Receipt of Advertising Information
The Company uses personal information for marketing purposes only when a user has separately provided optional consent.
| Item | Details |
|---|---|
| Entity Using the Information | medihi (Sungjin HDS Co., Ltd.) |
| Information Used | Name, contact information, and the contact channel provided for receiving advertising information |
| Purpose | Providing MEDIHI service news and benefits, content and service information, information about new services, events, promotions, and other advertising information |
| Delivery Channels | SMS/LMS and messaging channels actually operated by MEDIHI and capable of delivering advertising information |
| Retention and Use Period | 2 years from the date of consent or until consent is withdrawn |
| How to Withdraw Consent | At any time by contacting 070-8016-6528 or medihi@sungjinhds.com, or by using the opt-out method provided in a received message |
Marketing consent is optional. Refusal to consent does not restrict consultation requests or use of basic MEDIHI services.
Marketing consent for a hospital and marketing consent for MEDIHI are managed independently and are not automatically carried over from one to the other.
MEDIHI currently does not use health or medical information for personalized advertising.
7. Destruction of Personal Information
The Company destroys personal information without undue delay when its retention period expires or the purpose of processing has been achieved.
Where information must be retained for a certain period under applicable law, it is stored separately from other personal information and destroyed when the statutory retention period expires.
① Destruction Procedure
Information provided through consultation requests or other interactions is destroyed after the Company confirms that the purpose of processing has been achieved and the applicable retention period has expired.
Information that must be retained under applicable law is separately retained and destroyed after the applicable legal retention period expires.
② Destruction Method
- Paper documents: shredded or incinerated
- Electronic files: securely deleted using methods designed to make restoration or reproduction difficult
8. Rights of Users and Legal Representatives
Users may exercise rights available under applicable law at any time, including requesting access to, correction or deletion of, suspension of processing of, or withdrawal of consent regarding their personal information.
Requests and inquiries concerning personal information may be submitted through the following channels.
| Item | Details |
|---|---|
| medihi@sungjinhds.com | |
| Phone | 070-8016-6528 |
| Privacy Officer | Kim Jin-young |
Users may also contact the following organizations regarding personal-information infringement:
- Personal Information Dispute Mediation Committee: 1833-6972
- Personal Information Infringement Report Center: 118
9. Cookies and Other Automatically Collected Technologies
The Company may use cookies, browser_id, and other automatically collected technologies to analyze service-usage flows and improve service quality.
① Purpose
- Analysis of visits and service-usage flows
- Understanding content and service usage
- Analysis of inquiry conversion and service performance
- Improvement of UI/UX and service quality
- Prevention of repeated spam and abusive use
browser_id does not directly store raw personal information such as a user's name or phone number and is managed on a rolling basis for 180 days from the user's most recent visit.
If automatically collected information can identify an individual when combined with other information, it is managed in accordance with applicable law and the Company's privacy-management standards.
② How to Refuse Cookies
Users can restrict or refuse the storage of cookies through their web-browser settings.
- Chrome: Settings → Privacy and security → cookie-related settings
- Safari: Settings → Safari → privacy-related settings
- Edge: Settings → Cookies and site permissions
- Firefox: Settings → Privacy & Security
Refusing cookies may restrict certain analytics or customized-screen functions.
10. Measures to Ensure the Security of Personal Information
The Company implements administrative, technical, and physical safeguards required under the Personal Information Protection Act and other applicable laws, including:
- Minimizing and managing access rights to personal information
- Access controls for personal-information processing systems
- Necessary safeguards during transmission and storage
- Retention of access logs and protection against alteration
- Regular security reviews
- Management and supervision of personnel and processors handling personal information
11. Privacy Officer
| Category | Name | Department | Phone | |
|---|---|---|---|---|
| Privacy Officer | Kim Jin-young | Strategic Planning Office | 070-8016-6528 | medihi@sungjinhds.com |
12. Notice of Changes to this Privacy Policy
This Privacy Policy will take effect on October 6, 2026.
If this Privacy Policy is added to, deleted from, or otherwise amended, the Company will provide notice in advance through the Service or by another appropriate method in accordance with applicable law.
Beginning with this revision, the Korean and English Privacy Policies will be managed using the same revision version, effective date, and privacy inquiry contact information.