Privacy Policy
Notice of revision — This Privacy Policy takes effect on October 5, 2026. This revision fully discloses the services we use to handle inquiries (our service providers) and the details of overseas transfers, and corrects the content to match how personal information is actually processed. You can review the changes in the before-and-after comparison under 15. Changes to This Privacy Policy.
In accordance with Korea's Personal Information Protection Act (PIPA) and other relevant laws, the Company establishes and discloses this Privacy Policy as follows in order to protect the personal information and the rights and interests of data subjects and to handle related complaints smoothly. This Policy applies to the website cellogram.co.kr operated by the Company (including the alternate domain clearmed.co.kr; the "Site") and to inquiries made through the Site. This Policy was written in Korean, and if a translation differs from the Korean version, the Korean version prevails.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent, in accordance with PIPA Article 18.
- Responding to inquiries and business consultations — answering inquiries received through the inquiry form or by email, providing the product information and academic materials you request, discussing quotations and terms of business, and managing inquiry history.
- Site operation and security — providing the Site, preventing misuse of the inquiry form (spam and excessive requests), and checking for errors.
- Convenience features — suggesting a display language and automatically selecting the country in the inquiry form based on the estimated country of access.
- Usage statistics (if you consent to cookies) — improving the Site by analyzing visit statistics.
The Company does not send advertising information without the data subject's separate consent.
2. Items of Personal Information We Process
2-1. Information you enter directly in the inquiry form
| Type | Items |
|---|---|
| Required | Organization (clinic or company name), name, email, contact number (phone), inquiry message |
| If applicable | Country — for international distribution partner inquiries (preselected based on your access location; you can change it) |
| Optional | Role, monthly case volume, company type, main product categories, request type — you can submit an inquiry without entering these |
| Recorded automatically | Inquiry type, display language, date and time of submission |
If you contact us directly by email, we process the email address and name you send us and the content of your email.
2-2. Information processed automatically when you use the Site
| Items | Purpose of use | Basis for processing |
|---|---|---|
| Access logs — IP address, date and time of access, requested page, browser and device information (User-Agent), referring address | Providing and securing the Site (processed by our hosting provider, Vercel) | PIPA Article 15(1)(6) (legitimate interests) |
| Country, region and city estimated from your IP address | Suggesting a display language and automatically selecting the country in the inquiry form (not stored) | Article 15(1)(6) of the same Act |
| IP address (when you submit an inquiry) | Blocking excessive requests — processed only in server memory in 10-minute windows and not stored | Article 15(1)(6) of the same Act |
| Google Analytics identifiers; records of visits, page navigation and events | Usage statistics | Consent of the data subject (cookie banner) |
The Site loads public script files needed to display its pages from external content delivery networks (jsDelivr, unpkg), and in this process your IP address and browser information may be transmitted to those services. The Company does not receive or store this information.
The Company does not process sensitive information under PIPA Article 23 or unique identifying information under Article 24. Please do not include such information in your inquiry.
3. Processing and Retention Periods
The Company processes and retains personal information within the retention period prescribed by law or the retention period notified to the data subject.
| Information | Retention period |
|---|---|
| Information from inquiry form and email inquiries | 3 years after we finish responding to the inquiry (deleted without delay if you request deletion before then) |
| Access logs | Not separately stored by the Company; deleted after the log retention period of our hosting provider (Vercel) (1 hour for server runtime logs; for security-related records, the minimum period under Vercel's policy) |
| Estimated access location; IP address used to block excessive requests | Not stored (used only while the request is being processed) |
| Google Analytics | Cookies up to 2 years; analytics data up to 14 months (Google signals data up to 26 months) |
If a transaction takes place, contract and transaction records are kept separately for the periods prescribed by relevant laws such as the Commercial Act and the Framework Act on National Taxes.
4. Provision of Personal Information to Third Parties
The Company processes the personal information of data subjects only within the scope of Section 1 (Purposes of Processing) of this Privacy Policy and does not provide it to third parties without the data subject's prior consent.
However, the following cases are exceptions:
- Where separate consent is obtained from the data subject
- Where there are special provisions in laws
- Where the data subject or their legal representative is unable to express their intention, or prior consent cannot be obtained because their address is unknown or for similar reasons, and the provision is clearly deemed necessary to protect the life, body or property of the data subject or a third party from imminent danger
- Where an investigative agency requests it for investigative purposes in accordance with the process and methods prescribed by law
5. Outsourcing of Processing and Overseas Transfers
5-1. Outsourcing of processing
To respond to inquiries smoothly and operate the Site, the Company outsources personal information processing tasks as set out below. Through outsourcing contracts, such as each service provider's data processing agreement, the Company stipulates, among other things, a prohibition on processing for purposes other than the outsourced tasks, security measures and restrictions on further outsourcing, and it manages and supervises the service providers to ensure that they process personal information securely.
| Service provider | Outsourced tasks |
|---|---|
| Vercel Inc. | Site hosting, running the server functions that receive inquiries, processing access logs |
| Plus Five Five, Inc. (Resend) | Forwarding the content of inquiry form submissions to the Company's email |
| Google Asia Pacific Pte. Ltd. (Google Workspace) | Operating the Company's business email (receiving inquiries and storing replies) |
| Notion Labs, Inc. | Storing and managing records of received inquiries |
| HubSpot Asia Pte. Ltd. (HubSpot) | Managing inquiry and consultation history (customer relationship management system) |
| Google LLC (Google Analytics) | Analyzing Site usage statistics (if you consent to cookies) |
5-2. Overseas transfers
All of the service providers above process and store personal information outside Korea (in the United States and elsewhere). For the outsourced processing and storage needed to respond to inquiries, the Company discloses the matters below in this Privacy Policy and makes the transfers in accordance with PIPA Article 28-8(1)(3). Transfers to Google Analytics take place only if you consent through the cookie banner.
| Recipient (contact) | Country | Items transferred | Timing and method of transfer | Purpose of use / Retention and use period |
|---|---|---|---|---|
| Vercel Inc. (privacy@vercel.com) | United States | Access logs, inquiry form information | Encrypted transmission (HTTPS) when you access the Site or submit an inquiry | Site hosting and processing of received inquiries / Access logs: 1 hour for server runtime logs and, for security-related records, the minimum period under Vercel's policy; inquiry information is not retained after forwarding |
| Plus Five Five, Inc. — Resend (privacy@resend.com) | United States | Inquiry form information | Encrypted transmission (HTTPS) when you submit an inquiry | Forwarding to the Company's email / Sent content and logs deleted after 30 days |
| Google Asia Pacific Pte. Ltd. — Google Workspace (googlekrsupport@google.com) | United States and other countries where Google data centers are located | Inquiry form information, content of email inquiries | Encrypted transmission when inquiry emails are received | Storage of business email / 3 years after we finish responding to the inquiry |
| Notion Labs, Inc. (team@makenotion.com) | United States | Inquiry form information | Encrypted transmission (HTTPS) when you submit an inquiry | Management of inquiry records / 3 years after we finish responding to the inquiry |
| HubSpot Asia Pte. Ltd. — HubSpot (privacy@hubspot.com) | United States | Name, email, contact number, organization, inquiry message, optional items | Encrypted transmission (HTTPS) when you submit an inquiry | Management of inquiry and consultation history / 3 years after we finish responding to the inquiry |
| Google LLC — Google Analytics (googlekrsupport@google.com) | United States and other countries where Google data centers are located | Google Analytics identifiers, usage records | Encrypted transmission when you use the Site after consenting to cookies | Usage statistics / Analytics data up to 14 months (Google signals data up to 26 months) |
How to refuse overseas transfers and the consequences of refusal — If you do not submit the inquiry form, your inquiry information is not transferred. However, because the transfers above are outsourced processing and storage necessary to respond to inquiries, if you refuse them it will be difficult for us to respond to inquiries made through the inquiry form or by email. You can request deletion of information you have already submitted by writing to contact@clearmed.co.kr. You can refuse transfers to Google Analytics by selecting "Reject non-essential" in the cookie banner, or by withdrawing your consent at any time via "Cookie settings" at the bottom of the Site; refusing does not restrict your use of the Site.
6. Rights and Obligations of Data Subjects and How to Exercise Them
Data subjects may exercise the following rights with respect to the Company at any time:
- Request access to personal information (PIPA Article 35)
- Request correction or deletion (Article 36)
- Request suspension of processing and withdraw consent (Article 37)
- Request transmission (Article 35-2) — where the information is subject to transmission requests under the law
You can exercise these rights by sending a request to the Chief Privacy Officer named in Section 11 by email (contact@clearmed.co.kr) or in writing, and the Company will act on it without delay (within 10 days). If a request is restricted or refused under the law, we will inform you of the reason.
If you request correction or deletion, the Company will not use or provide the personal information concerned until it has completed the action.
You may also exercise your rights through a representative, such as your legal representative or a person you have authorized; in this case, a power of attorney must also be submitted.
Data subjects located outside Korea may also exercise their rights under the laws of their country of residence; if you make a request using the methods above, we will handle it in accordance with the applicable laws.
7. Process and Methods for Destroying Personal Information
When personal information is no longer needed because the retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay (within 5 days).
Destruction process
We identify inquiry records whose retention period has expired and delete the records stored in the Company's email and with each service provider (Notion, HubSpot, etc.). Information that must be preserved under other laws is stored separately from other information for the period prescribed by those laws and then destroyed.
Destruction methods
- Electronic files: deleted so that they cannot be recovered (including permanent deletion from the trash)
- Printed materials: shredded or incinerated
8. Measures to Ensure the Security of Personal Information
In accordance with PIPA Article 29, the Company takes the following measures:
- Administrative measures — limiting the people who handle personal information to the minimum necessary, such as the Representative
- Technical measures — encryption in transit (HTTPS), management of access rights to the accounts for outsourced services, and, on the server that receives inquiries, restriction of allowed origins, request rate limiting and spam blocking
- Physical measures — the Company does not operate its own servers and relies on the physical security systems of its service providers' data centers
9. Automated Decisions
The Company does not make decisions that significantly affect the rights or obligations of data subjects using fully automated systems (including artificial intelligence technology). Every inquiry is reviewed and answered by a person.
10. Installation, Operation and Refusal of Automatic Collection Tools (Cookies, etc.)
The Site stores the following information in your browser. Essential items are stored only on your device and are not collected by the Company. Analytics cookies are set only if you select "Accept all" in the cookie banner.
| Category · Name | Purpose | Storage location · Period |
|---|---|---|
| Essential · cellogramCookieConsent | Remembering your cookie choice | Browser storage · 12 months (we will ask you again after that) |
| Essential · cellogram-lang, cellogram-lang-choice | Remembering your display language choice | Browser storage · until deleted |
| Essential · cellogram-geo, cg-film-paused | Temporarily remembering the estimated country of access and whether a video is paused | Browser session storage · until you close the window |
| Analytics (optional) · _ga, _ga_<ID> | Google Analytics visitor identification and usage statistics | Cookie · up to 2 years |
How to refuse
- Cookie banner — select "Reject non-essential" in the banner that appears on your first visit
- Cookie settings — change your choice at any time via "Cookie settings" at the bottom of the Site
- Browser settings — you can block or delete cookies and site data in major browsers:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy → Cookies and website data
- Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Blocking Google Analytics — Google Analytics Opt-out Browser Add-on
Refusing analytics cookies does not restrict your ability to view information on the Site or submit inquiries.
11. Chief Privacy Officer
The Company has designated the following Chief Privacy Officer to take overall charge of personal information processing and to handle data subjects' complaints and provide redress for damage (under PIPA Article 31, the Representative holds this role).
Chief Privacy Officer
Name: Ahn Hyun Su (CEO)
Email: contact@clearmed.co.kr
Address: B1 171, 524 Bongeunsa-ro, Gangnam-gu, Seoul, Republic of Korea
You may direct inquiries, complaints and requests for redress relating to personal information protection to the Chief Privacy Officer, and the Company will respond to and address them without delay.
12. Remedies for Infringement of Rights
To obtain redress for infringement of their personal information, data subjects may apply for dispute resolution or consultation to bodies such as the Personal Information Dispute Mediation Committee and the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA). For other reports of or consultations on personal information infringement, please contact the agencies below.
- Personal Information Dispute Mediation Committee — 1833-6972 (no area code needed within Korea) / www.kopico.go.kr
- Personal Information Infringement Report Center (KISA) — 118 (no area code needed within Korea) / privacy.kisa.or.kr
- Cybercrime Investigation Unit, Supreme Prosecutors' Office — 1301 (no area code needed within Korea) / www.spo.go.kr
- Cyber Investigation Bureau, Korean National Police Agency — 182 (no area code needed within Korea) / ecrm.police.go.kr
13. Responsibility of the Representative
Pursuant to PIPA Article 30-3, the Company's Representative (Ahn Hyun Su), as the person ultimately responsible for the secure processing of personal information and the protection of data subjects' rights, takes overall management measures, including providing the personnel and budget needed to protect personal information.
14. Children Under 14 / Data Subjects Under 16
The Site is intended for professionals and adults, and the Company does not collect personal information from children under the age of 14. If we become aware that personal information of a child under 14 has been collected, we will destroy it without delay.
Taking foreign laws into account, the Company also does not knowingly collect personal information from data subjects under the age of 16, and if such information is identified, we will destroy it without delay.
15. Changes to This Privacy Policy
If the Company changes this Privacy Policy, it will post the changes and their effective date on this page starting 7 days before they take effect (30 days before for changes that are unfavorable to data subjects or otherwise significant) and will provide notice with a before-and-after comparison. Previous versions of this Privacy Policy are available on request.
Revision history
- Effective October 5, 2026 (announced September 28, 2026) — this revision
- Effective May 25, 2026 — first established
Before-and-after comparison for this revision
| Section | Before | After |
|---|---|---|
| 1. Purposes of processing | Responding to inquiries and follow-up sales and consultations; providing medical device and cosmetics information and clinical data; sending advertising information (optional consent) | Responding to inquiries and business consultations; Site operation and security; convenience features; usage statistics (with consent). Purpose of sending advertising information removed |
| 2. Items processed | Country/region listed as required; website URL and consent to receive advertising listed as optional | Corrected to match the actual inquiry form fields (5 optional items added, website URL removed). Automatically processed information (estimated access location, IP address used to block excessive requests) and the basis for processing added |
| 3. Retention periods | Access logs 3 months (Protection of Communications Secrets Act); analytics cookies up to 26 months; information on consent to receive advertising | Access logs follow the hosting provider's retention period; estimated location and IP address used for blocking are not stored; analytics cookies up to 2 years and analytics data up to 14 months |
| 5. Outsourcing and overseas transfers | Vercel, Google (Analytics, Fonts), NAVER | Vercel, Resend, Google (Workspace, Analytics), Notion, HubSpot. Items, timing, method, retention period and how to refuse overseas transfers disclosed. NAVER and Google Fonts, to which nothing is actually outsourced, removed |
| 6. Exercise of rights | Requests in writing, by email, by phone, etc.; withdrawal of consent to receive advertising | Requests by email or in writing; request to suspend processing and withdrawal of consent; information on the rights of data subjects outside Korea added |
| 7–8. Destruction and security measures | Destruction after moving data to a separate database; internal management plan, antivirus software, etc. | Deletion by storage location (email, service providers); corrected to the protective measures actually in place |
| 10. Cookies | Cookies for session IDs and keeping users logged in | The items actually stored (cookie choice, language setting, etc.) and how to change them via "Cookie settings" |
| 12–13. Remedies and responsibility of the Representative | Information on administrative appeals against public institutions; list of responsibilities of the business owner and representative | Inapplicable information on administrative appeals removed; revised to match the wording of PIPA Article 30-3 |
| 15. Changes | Posted in the Site's announcements | Posted on this page, with a before-and-after comparison and revision history |
| Other | "Draft" and "attorney review recommended" wording | Removed (final version). Provision that the Korean version prevails added |