Pickabeau Privacy Policy

The Company processes personal information for the following purposes and does not use it for any purpose other than these. If the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

• ① A face photo may constitute sensitive information under Article 23 of the Personal Information Protection Act, so the Company obtains the user's separate consent on the Service screen before receiving the photo. A face photo is used only for the processing purposes above and is not used for advertising or promotional purposes.
• ② When collecting the above personal information, the Company informs the user of the items collected and the purposes through the Service screen or a separate consent screen and obtains consent.

The Company processes and retains personal information within the retention period required by law or the retention period to which the user has consented, and destroys it without delay once the period has elapsed or the purpose has been achieved.

• Notwithstanding the table above, in the following cases the information is retained until the period set out in each item.
• • (a) Where an investigation or inquiry due to a violation of relevant laws and regulations is in progress: until that investigation or inquiry ends
  • (b) Where a claim or debt relationship arising from use of the Service remains: until that claim or debt relationship is settled
  • (c) Records on labeling and advertising under the Act on the Consumer Protection in Electronic Commerce: 6 months
  • (d) Records on contracts or withdrawal of offers, payment of charges and supply of goods, etc. under the same Act: 5 years
  • (e) Records on consumer complaints or dispute resolution under the same Act: 3 years
  • (f) Records on website visits (log records, access location tracking data) under the Protection of Communications Secrets Act: 3 months

• ① The Company processes users' personal information only within the scope stated in Article 1, and provides it to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the user's consent or special provisions of law.
• ② The Company provides personal information as follows only where the user has consented to provision to a third party when requesting a consultation with a partner medical institution. The user may refuse consent, and if the user refuses, connection to a medical institution consultation may be restricted.

• ③ In the following cases, personal information may be provided without the user's consent in accordance with relevant laws and regulations.
• • (a) Where there are special provisions in law or where it is unavoidable in order to comply with obligations under laws and regulations
  • (b) Where it is requested by a state agency such as an investigative agency in accordance with procedures set by relevant laws and regulations

The Company outsources personal information processing tasks as follows in order to provide the Service smoothly, and when entering into an outsourcing contract, it sets out necessary matters so that personal information is managed safely in accordance with relevant laws and regulations and supervises the contractor.

The Company transfers personal information overseas as follows in order to provide the Service. Personal information is transmitted over an encrypted network at the time the Service is used, and each contractor's retention period is until the outsourcing purpose is achieved or the retention period in Article 2.

Users may refuse the overseas transfer. However, if a user refuses, it may be difficult to use services that require the relevant task (payment, receiving emails, image consulting reports, etc.). Please communicate your refusal using the contact information in Article 10.

• ① The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved. For information with a set retention period, such as image consulting and personal color photos, the Company checks daily through an automated procedure and destroys it.
• ② When a member withdraws, the Company deletes the account together with the photos, simulation records, and diagnosis and report records provided by the member. However, information that must be retained under laws and regulations pursuant to Article 2 is stored separately from other information for the relevant period and then destroyed.
• ③ Information in the form of electronic files is permanently deleted by a method that cannot be restored, and information recorded on paper is shredded or incinerated.

• ① Users may at any time request access to, correction of, deletion of, suspension of processing of, and withdrawal of consent to their personal information. Members may withdraw consent and request deletion of personal information through "Withdraw membership" on My Page.
• ② The rights in paragraph ① may be exercised by writing, telephone, email or the like to the contact in Article 10, and the Company shall take action without delay (within 10 days from the date of receiving the request) and notify the result. If the period is unavoidably extended, the Company shall notify the reason and the period together.
• ③ The rights in paragraph ① may be exercised through an agent such as a legal representative or a person who has been given authority. In this case, a power of attorney in the form of Attachment Form No. 11 of the Notice on Methods of Processing Personal Information must be submitted.
• ④ Requests for access to personal information and suspension of its processing may be restricted under Article 35 (4) and Article 37 (2) of the Personal Information Protection Act, and deletion cannot be requested for personal information designated as a collection target by other laws.
• ⑤ The Company verifies whether the person requesting the exercise of rights is the data subject or a legitimate agent.

• ① Technical measures: encryption of personal information in transit (HTTPS), encrypted storage of passwords, access control for the database and file storage
• ② Administrative measures: limiting personal information handlers to the minimum number of people necessary for work, regular training for personal information handlers
• ③ Users are also asked to take care that their passwords and the like are not exposed to third parties.

• ① The Company uses cookies and similar technologies for Service usage statistics and measuring advertising performance.
• ② The tools used by the Company are as follows.

• ③ The Company does not use sensitive behavioral information, such as a user's health status, for personalized advertising, and does not transmit face photos to advertising tools.
• ④ Users may refuse or delete cookie storage in their web browser settings (for example: Chrome Settings → Privacy and security → Third-party cookies; Safari Settings → Privacy). On mobile devices, the use of the advertising identifier can be limited in the device settings. Refusing cookie storage does not restrict use of the Service.

The Company has designated a Chief Privacy Officer and a responsible department as follows to oversee matters relating to personal information processing and to handle user complaints and provide remedies for damage. For inquiries, access requests, complaint handling and the like relating to personal information that arise while using the Service, please contact the following and we will respond without delay.

To obtain relief for an infringement of personal information, users may apply to the following organizations for dispute resolution, consultation and the like.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972 (no area code)
• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (no area code)
• Supreme Prosecutors' Office: www.spo.go.kr / 1301 (no area code)
• National Police Agency: ecrm.police.go.kr / 182 (no area code)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (access), Article 36 (correction and deletion) or Article 37 (suspension of processing, etc.) of the Personal Information Protection Act may file an administrative appeal under the Administrative Appeals Act (Central Administrative Appeals Commission, www.simpan.go.kr).

• ① The Company may anonymize (statistically process) the personal information collected under Article 1 so that individuals can no longer be identified, and use it for the purpose of developing and improving the quality of the Service.
• ② Anonymization means processing so that, taking time, cost, technology and the like reasonably into account, an individual can no longer be identified even if other information is used, and anonymized information is not subject to the Personal Information Protection Act pursuant to Article 58-2 of that Act.

• ① Where content is added, deleted or modified, the Company will announce it through the Service screen from 7 days before it takes effect, and will announce important changes affecting users' rights, such as the items collected or the purposes of use, from 30 days before it takes effect.
• ② The previous Privacy Policy (effective January 1, 2025) is replaced by this Policy.