RESERVATION Book an Appointment at WayB Clinic

<Privacy Policy> WAYB Clinic (the “Clinic”) values your privacy and complies with the Personal Information Protection Act of the Republic of Korea. This Privacy Policy explains how we collect and use your personal information and the measures we take to protect it. 1. Personal Information We Collect and How We Collect It 2. Purpose of Collection and Use 3. Retention Period 4. Disposal Procedures and Methods 5. Disclosure and Sharing 6. Processing by Service Providers 7. Rights of Users and Legal Representatives 8. Withdrawal of Consent and Account Cancellation 9. Cookies and Similar Technologies 10. Privacy Officers 11. Security Measures 12. Changes to This Policy 1. Personal Information We Collect and How We Collect It We collect only the minimum personal information necessary to provide our services. Optional information, such as email preferences, is not required to use our services. A. Medical information: name, date of birth, address, contact information, and medical records ※ Certain identifying and medical information must be retained under the Medical Service Act and may not require separate consent. B. Website registration information - Required: name, user ID, password, address, telephone/mobile number, and email address - Optional: date of birth, SMS/email preferences, and areas of interest - Automatically collected: service usage history, access logs, cookies, and IP address C. Collection methods: website, written forms, fax, telephone, online consultation boards, and email 2. Purpose of Collection and Use We use personal information only for the purposes described below. We will obtain prior consent if these purposes change. A. Medical information: medical consultations and treatment, billing, payment, and refunds B. Website information - Required information: online appointment booking and lookup, member services, and online board features such as private consultations and reviews - Optional information: clinic updates and health information by email, surveys, troubleshooting, personalized services, usage statistics, and information about new services We do not collect sensitive information that may infringe on fundamental rights and collect additional information only when voluntarily provided by the user. 3. Retention Period We dispose of personal information without delay once the purpose of collection or use has been fulfilled, except where retention is required by law. A. Medical information: retained according to the medical-record retention periods prescribed by the Medical Service Act B. Website information - Retained until account cancellation or removal, unless applicable law requires longer retention - Consumer complaints and dispute records: 3 years - Credit information collection, processing, and use records: 3 years - Identity verification records: 6 months - Website visit records: 3 months 4. Disposal Procedures and Methods Personal information is disposed of promptly after its purpose has been fulfilled. A. Procedure: information provided for registration or service use is disposed of after the relevant purpose is completed. B. Method: electronic files are permanently deleted using methods that prevent recovery. Paper records are shredded or incinerated. 5. Disclosure and Sharing We do not use or disclose personal information beyond the stated purposes without consent, except as required by law. Exceptions may include: - Submission of medical records to the Health Insurance Review & Assessment Service for National Health Insurance claims - De-identified information used for statistics or academic research - Disclosure to investigative authorities through procedures required by law 6. Processing by Service Providers We may entrust personal information processing to a service provider as necessary to operate our services and require the provider to protect the information in accordance with applicable law. Service provider: YourDev Services: website maintenance, access-log management, administration, and member management Information processed: name, address, and telephone number Retention: until the service agreement ends 7. Rights of Users and Legal Representatives Registration for children under 14 uses a separate form written in plain language and requires consent from a legal representative. We collect only the minimum information needed to verify that consent. A legal representative may request access to, correction of, or deletion of a child’s personal information through the website or by contacting the Privacy Officer in writing, by telephone, or by fax. If correction is requested, the information will not be used or disclosed until it has been corrected. We do not share a child’s information with third parties except as permitted by law. Information that must be retained by law cannot be corrected or deleted during the required retention period. 8. Withdrawal of Consent and Account Cancellation You may withdraw your consent to the collection, use, and disclosure of personal information at any time. You may request account cancellation through My Page on the website or contact the Privacy Officer in writing, by telephone, or by fax. We will take the necessary steps without delay. 9. Cookies and Similar Technologies We use cookies, which are small text files stored on your device, to operate and improve our website. You may configure your browser to accept all cookies, notify you when cookies are set, or reject all cookies. Some services may not function properly if cookies are disabled. 10. Privacy Officers The Clinic has appointed the following Privacy Officers to protect personal information and handle privacy-related inquiries. Names: Haebeom Koo, Jisu Lee Position: Medical Directors Organization: WAYB Clinic Contact: You may report privacy-related concerns arising from use of our services to the Privacy Officers. We will respond promptly. For additional assistance, please contact the relevant Korean authorities below. ･ Personal Information Dispute Mediation Committee (http://www.1336.or.kr / 1336) ･ Privacy Seal Certification Committee (http://www.eprivacy.or.kr / +82-2-580-0533~4) ･ Supreme Prosecutors’ Office Cybercrime Investigation Division (http://www.spo.go.kr / +82-2-3480-3573) ･ Korean National Police Agency Cyber Bureau (http://www.ctrc.go.kr / +82-2-392-0330) 11. Security Measures We maintain technical and administrative safeguards to prevent personal information from being lost, stolen, leaked, altered, or damaged. A. Password protection: passwords are encrypted and managed so that only the user can access them. Identity verification is required when changes are requested through the Privacy Officer. B. Protection against hacking and malware: we back up data, use current security software, encrypt important personal information and network transmissions, and control unauthorized access through security systems. C. Limited staff access and training: access to personal information is limited to authorized personnel, with separate credentials and regular training. The Clinic is not responsible for disclosure caused by the user’s negligence or internet-related circumstances outside the Clinic’s control. 12. Changes to This Policy If this policy changes due to amendments to law, policy, or security technology, the reason and details will be announced on the website at least seven days before the changes take effect. Effective date: February 10, 2026