Privacy Policy

This Privacy Policy explains how MyDoc Korea ("we", "us") handles personal information when you visit mydockorea.com, contact us, or use our foreign patient facilitation services. We are a foreign patient facilitator registered in the Republic of Korea under the Medical Overseas Expansion Act. We are not a hospital or clinic: medical treatment is provided by independent, licensed medical institutions, which handle your medical records under their own privacy policies.

We process personal information under Korea's Personal Information Protection Act (PIPA). Our services are aimed at international patients who do not live in Korea, mainly from Australia, the United States, Asia and the Middle East. Where the privacy law of your country also applies to us, you have the additional rights described in section 13.

Information processed without your consent (PIPA Art. 22(3)). The contact details in the first row are processed without consent because they are necessary to respond to your request; the government report in the third row is a legal obligation. Everything else — health information, sharing with medical institutions and advertising — is processed only with your consent. You can refuse any consent: refusing advertising has no effect on our service; refusing the health-information or sharing consent means we cannot arrange a medical consultation.

We do not collect passport numbers or other national identification numbers through this website.

Health information is sensitive information under PIPA. We process it only with your separate consent, only to have a medical institution review your case, and we never use it for advertising. We do not publish patients' health information, photos or stories. We do not send the content of your treatment inquiry to our internal chat notifications; it stays in our database and with the medical institution you agree to.

Partner medical institutions in Korea (with your consent)

Government and legal requests

We provide the statistical information in section 3 to the Ministry of Health and Welfare through KHIDI as the law requires, and we disclose personal information to authorities only where a law requires it (PIPA Art. 17(1)2 and 18(2)).

We do not sell personal information.

These providers process personal information on our behalf, only on our instructions and under their data-processing terms (PIPA Art. 26):

When you submit information from outside Korea it is sent to us in the Republic of Korea. Our service providers store or process it in the countries below. These transfers are necessary to provide our service and are disclosed here as PIPA Art. 28-8(1)3 requires; Google analytics and advertising services are used only according to your cookie choice.

How to refuse, and what happens: you can switch off Google analytics and advertising cookies in Cookie Settings, and choose email instead of WhatsApp or another messenger. Hosting, database and email delivery cannot be switched off individually: if you do not want your information transferred to them, please do not submit it, and we will not be able to provide our service.

• Inquiries: 2 years after our last contact; 5 years if we facilitated your treatment.
• Newsletter: until you unsubscribe; opt-out record 12 months; unconfirmed sign-ups 30 days.
• Campaign tracking records: 26 months. Staff access logs: 2 years.
• Records other laws require us to keep (for example tax records of fees under the Framework Act on National Taxes, 5 years) are stored separately and contain no health information.

An automated daily process deletes records whose retention period has ended, within 5 days. Electronic records are deleted so they cannot be restored; paper documents are shredded.

You can ask us to show you, correct, delete or stop processing your personal information, and withdraw any consent at any time (PIPA Art. 35–37). We do not make decisions about you by fully automated means (Art. 37-2).

• Email our privacy officer (section 12) from the address you used with us, or tell us which details identify you.
• We reply within 10 days. If the law requires or allows us to refuse or limit a request, we explain why and how to appeal.
• A legal representative or someone you authorise in writing can make the request for you (Art. 38).
• If we already shared your information with a medical institution, we ask it to delete or correct its copy too; its own medical-record duties may prevent deletion there.
• Unsubscribe from advertising with the link in any email, or by telling us.

Visitors from Australia, the European Economic Area, the United Kingdom and Switzerland only get analytics and advertising cookies after accepting them in our banner; in the EEA, the UK and Switzerland, Google Fonts also waits for that consent. Everyone else gets them by default and can turn them off at any time in Cookie Settings (also linked in the footer of every page).

We use Google Analytics advertising features (Google Signals, remarketing and advertising reports). Google may combine this with data from other sites under its own policy (how Google uses information from sites that use its services). You can also opt out with Google Ads Settings, the Google Analytics opt-out add-on or NAI opt-out.

To block or delete cookies in your browser: Chrome — Settings › Privacy and security › Third-party cookies; Safari — Settings › Privacy; Edge — Settings › Cookies and site permissions; Firefox — Settings › Privacy & Security. Our email provider may record delivery, opens and link clicks of our emails.

• All connections use encryption (HTTPS/TLS with HSTS); our database provider encrypts stored data.
• Only staff who need it can access personal information, through password-protected accounts with hashed passwords, role-based permissions and login-attempt limits.
• Staff access to personal information is logged, the logs are kept 2 years and reviewed monthly.
• We keep health details out of chat notifications and minimise what we collect.

No method of transmission or storage is completely secure. If a breach occurs we will notify you and the authorities as the law requires.

You can also contact these bodies about a privacy problem:

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, 118 (in Korea)
• Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
• Supreme Prosecutors' Office: spo.go.kr, 1301 · Korean National Police Agency cyber bureau: ecrm.police.go.kr, 182

Australia

We handle personal information consistently with the Australian Privacy Principles. Your information is disclosed to recipients in Korea, India, the United States, the United Arab Emirates and the other countries listed in section 7. You may access and correct your information (APPs 12–13). If you have a complaint, contact our privacy officer first; we respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

European Economic Area, United Kingdom and Switzerland

Where the GDPR or UK GDPR applies, our legal bases are: performing your request (Art. 6(1)(b)); your explicit consent for health information (Art. 9(2)(a)); your consent for advertising and cookies (Art. 6(1)(a)); legal obligations (Art. 6(1)(c)); and our legitimate interest in keeping the site secure (Art. 6(1)(f)). The European Commission and the UK have recognised Korea as providing adequate protection; our providers in other countries are bound by standard contractual clauses or equivalent safeguards. You also have the rights to data portability, to object and to complain to your data protection authority.

Japan, China, the UAE and Saudi Arabia

The separate consents on our consultation form cover sensitive (health) information and provision to a medical institution in Korea. Korea's data protection system is the Personal Information Protection Act, supervised by the Personal Information Protection Commission (pipc.go.kr), which provides rights of access, correction, deletion and suspension similar to those in your country.

Our services are only for adults aged 18 or over. We do not knowingly collect personal information from children under 14 (PIPA Art. 22-2) or from anyone under 18; if we learn that we have, we delete it.

We announce changes on this page at least 7 days before they take effect (30 days before, for changes that reduce your rights), and keep previous versions, which are available on request.