Privacy Policy

BONROI ("we", "us") operates a medical concierge platform, healwith, that helps international patients access medical care in the Republic of Korea. healwith is not a medical institution and does not provide diagnosis or treatment.

This Policy is primarily governed by the Korean Personal Information Protection Act (PIPA), the Medical Service Act, and the Act on Support for Overseas Expansion of Healthcare Systems and Attraction of International Patients. Where applicable, it also reflects the requirements of your country of residence (e.g., EU GDPR, Kazakhstan Law 94-V, Russian Federal Law 152-FZ, etc.). Jurisdiction-specific notices are provided in dedicated sections below.

We treat the personal information of all users with care, regardless of nationality or residence, and handle it in accordance with applicable laws.

Trade name: BONROI (service: healwith)

Entity type: Sole proprietorship

Representative: Kang Ju-Young

Business Registration Number: 463-35-00902

International Patient Facilitator Registration Number: A-2026-01-02-06761 (valid 2026-03-11 ~ 2029-03-10, issued by the Mayor of Seoul)

Registered address: Room 613, 385 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea

Contact: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

Email: admin@healwith.co.kr

Business hours: Mon-Fri 09:00-18:00 KST (excluding Korean public holidays)

【Mandatory】

· Name, date of birth, gender, nationality

· Contact details (email, phone, messenger ID)

· Residential address (stay-support purposes)

· Guardian/companion information (for minor or elderly patients)

· Face photo: only if you ask us to apply for your K-ETA (Korea Electronic Travel Authorization)

· Booking information: desired arrival, departure and admission dates, preferred hospital (branch), room type and length of stay, and who the request is for (yourself, a family member or a friend). When a family member or friend applies for you, we record, using the server clock, the time the applicant confirmed that they obtained your consent; if the patient is under 14 we record whether a legal representative confirmed.

· Your answer about residence in Korea (whether you hold a Korean alien registration or Korean national health insurance): used only to decide whether we can accept the request; it is not stored.

· Pre-consent inquiry record (when you contacted us first on a messenger but have not yet consented to AI consultation): messenger account identifier or phone number, name (stored encrypted), language, advertising source, inquiry type label (ready to book · price inquiry · checkup inquiry · program inquiry · greeting only · other · has details), time of last contact, scheduled deletion and follow-up times, and the replies our coordinator sent at this stage. The body of the message you sent is not stored in our consultation records (database) at this stage. Messages may remain in the chat history on the coordinator's work phone, and processing by the messenger providers and the relay is as described in §8. Pre-consent WhatsApp inquiries are fetched from the relay (Kapso) only when a coordinator opens them and are shown on screen only; they are not stored in our database, server logs or cache, and only a record of who opened which inquiry and when (without the message text) is kept.

· Record of your consent to the Terms of Service and this Privacy Policy: the versions you agreed to, the time of consent and how you signed up (email, Google or Apple)

【Optional Items】

· Whether you agreed to receive service news and notices by email (optional checkbox on the sign-up screen)

【Unique Identifiers — Separate Consent (PIPA §24)】

· Passport number and passport copy (photo page): only if you provide them, for hospital admission and registration documents and invitation letters, and, if you ask us to, for your K-ETA application or a Confirmation of Visa Issuance application (submitted to the Ministry of Justice). They are never sent to AI services.

【Sensitive Data — Separate Consent】

· Diagnosis, medical history, current symptoms, medications

· Medical certificates, test results, imaging (X-ray, CT, MRI, etc.)

· Health insurance and travel insurance information

· Disability status (for accessibility support)

· Post-return follow-up record: follow-up status (in progress, completed, stopped), reason for stopping (lost contact, transferred to a local hospital, refusal by you or your family, death, other), date of last contact, and a note staff leave while contacting you (stored encrypted). Staff record this while contacting you to ask how you are doing; it is not shown on your screen, and we will show it to you if you ask to see it.

【Automatically Collected】

· IP address, cookies, session logs, service usage records

· Device information (OS, browser, model), approximate geolocation (country-level; precise location only with consent)

· Mobile app push notification device token (only if you enable notifications in the app)

【When Using Telemedicine (Video Consultation)】

· Audio and video: transmitted in real time only during the call; we do not record it (the recording feature is currently disabled; if introduced, we will obtain prior consent and amend this Policy).

· Captions and translated text: stored as consultation records in encrypted form. Captions are generated only when you turn them on.

· To generate captions, spoken audio is sent to the processors listed in Section 9 for transcription and translation (if browser-based transcription is used, it may also be sent to your browser vendor).

【Payment-Related】

· We do not collect any treatment or service fees from users, and we do not collect or store payment credentials such as card numbers. Treatment costs are paid by the user directly to the medical institution.

a. Member identification and authentication

b. Hospital matching, appointment booking, visa and stay support

c. Provision of consent-based medical information to healthcare providers

d. Interpretation, transportation, and accommodation services

e. Treatment cost estimates and settlement support (we do not collect treatment payments from users)

f. Customer support and dispute resolution

g. Service quality improvement, statistical analysis, security incident response

h. Compliance with legal obligations

i. Sending notifications about appointments, consultations, and case progress (email, and app push if you enable it)

j. Post-return follow-up contact and progress records, and follow-up count statistics

k. Coordinating consultation schedules around your planned stay in Korea (desired arrival, departure and admission dates, preferred hospital and room), confirming consent when someone applies on your behalf, and confirming a legal representative when the patient is under 14

l. Verifying your identity when you open a progress link (link plus date of birth) to view your progress without logging in; when opened with the link alone, a link is valid for 90 days from the day it is issued (you can keep viewing it while logged in)

m. Deciding the order in which to respond to inquiries sent before consent, the coordinator's replies, and one follow-up message offering to continue; the text you sent is used only temporarily on our server to determine the inquiry type, is not stored, and is not sent to overseas AI

n. Sending healwith service news and notices by email, only if you have given optional consent. Declining has no effect on your use of the service. You can withdraw consent at any time by asking the Privacy Officer named in §14, and each email will state how to unsubscribe

healwith processes "health-related information" which constitutes Sensitive Data under PIPA §23 and a Special Category of personal data under GDPR Article 9. Such data is collected and used only with your explicit, separate consent.

Sensitive data is used solely for hospital matching, appropriate care coordination, and post-return follow-up contact and progress records, and is shared with healthcare providers only within the scope of your consent.

You have the right to withhold consent for processing of sensitive data; doing so may restrict your ability to use medical matching services.

We delete personal data without delay once the purpose of collection has been fulfilled, except where required to be retained by law.

【Statutory Retention】

· Contract/withdrawal records: 5 years (Act on Consumer Protection in E-Commerce §6)

· Consumer complaints/dispute records: 3 years

· Login records: 3 months (Protection of Communications Secrets Act §15-2)

· Medical records held by hospitals: 10 years (Medical Service Act §22). Note: originals are created and maintained by the hospital, and healwith does not retain copies of them. However, test documents and imaging files (CT, MRI, etc.) that you, or an agency acting for you, submit directly to healwith for consultation are stored by us, for the period set out under the service-purpose retention list below.

【Service-Based Retention】 (Storage limitation principle — PIPA §21, GDPR Art.5(1)(e): retained only as long as necessary for the purpose)

· Account information: retained while membership remains active. When you withdraw, your login and contact details (name, phone number, email) are deleted immediately. You can withdraw yourself from the Account & Privacy screen in the service.

· Long-dormant accounts: we do not automatically delete accounts for inactivity. The rule that required this (the personal data validity period system) was abolished on 15 September 2023, leaving dormancy policy to each operator, and cancer care spans diagnosis, treatment and aftercare over several years, so a period of inactivity does not reliably mean the relationship has ended. You may withdraw at any time, and we will give prior notice if we introduce a dormancy policy.

· Sensitive health data: retained for as long as necessary to provide the service, including pre-consultation, treatment, and aftercare. Upon withdrawal or withdrawal of consent, the name, phone number and email attached to that data are deleted immediately. What you wrote yourself in your inquiry, and the test files, imaging and passport copies you uploaded, follow the period in the next item. Note: in this Policy, 'service completion' means the end of the relationship with the user including aftercare, not a one-off treatment.

· What you wrote yourself in your inquiry (the first inquiry note and later explanations), and the test documents and imaging files you uploaded (including CT/MRI image files) and passport copies: while you use the service, they are retained for 3 years from the end of the relationship so that we can respond to a follow-up or re-referral request, then destroyed. If you delete your account, they are kept for 1 year from the deletion date, separated from other data and locked from viewing, then destroyed. Because what you wrote may contain names or contact details that cannot be removed selectively, we keep the whole text locked in the same way. This year exists only to answer disputes or return-visit questions about consultations and hospital referrals made before you left, and none of it is used for anything else (an administrator opens them only at your own request, to handle a dispute, or when required by law, and each access is logged). We have no legal obligation to keep these materials, so if you ask us to destroy them before the year ends, we will do so without delay unless a dispute is in progress. Care documents already sent to a hospital are kept by that hospital under the Medical Service Act §22; please ask the hospital if you want them deleted.

· Inquiries that did not lead to a consultation: where you submitted an inquiry but no consultation or treatment followed, there is no end-of-relationship date, so we destroy the data 3 years after the last activity such as your last contact or document submission. If you contact us again within that period, we can continue from where the inquiry left off. If you delete your account, the one-year rule after deletion in the item above applies.

· Post-return follow-up record: the staff note is kept for 3 years from the end of the relationship while you use the service; if you delete your account, it is locked from viewing for 1 year from the deletion date and then destroyed. The status, reason for stopping and last contact date are kept together with the inquiry, and for an inquiry linked to a member account your name and contact details are erased when you delete your account. These values are used only for follow-up count statistics.

· Telemedicine captions and conversation records: stored encrypted; deleted at the end of the relationship with the user or upon a deletion request

· Messenger (WhatsApp, Telegram) consultation messages and the photos, documents and voice notes you send (including their transcripts): kept for 3 years from the last contact, then destroyed

· Records of inquiries that ended without consent, and the messages the coordinator sent at that stage: like inquiries that did not lead to consultation above, destroyed 3 years after the last contact (your message or the coordinator's). If you contact us again in the meantime, we can continue the consultation

· Marketing consent data: until withdrawal

· Record of consent to the Terms of Service and Privacy Policy: stored with your account and deleted immediately, together with your login account, when you delete your account

Based on your consent, we share personal data with the following third parties:

【Healthcare Providers】

· Recipients: Korean hospitals and clinics selected and consented by you

· Purpose: Medical consultation, appointment, treatment planning

· Items: Name, date of birth, contact, diagnosis, symptoms, medical records (passport number and passport copy only if you have given the separate consent for unique identifiers)

· Retention: Per each provider's legal obligations (typically 10 years)

【Ministry of Justice (Korea Immigration Service)】

· When: if you ask us to apply for your K-ETA (Korea Electronic Travel Authorization), or when we, as your inviting party, apply for a Confirmation of Visa Issuance for medical tourism (your passport only with the separate consent for unique identifiers)

· Items: Passport number and passport copy (personal data page), face photo (K-ETA), name, date of birth, gender, nationality, contact details, purpose and dates of the visit, the items the K-ETA form asks for (occupation, monthly income range, etc.), hospital appointment confirmation (Confirmation of Visa Issuance)

· Purpose: Entry authorization and visa review

· Retention: Per the Ministry of Justice's own rules

· We charge no fee for the K-ETA application and do not bill anything beyond the actual government fee we pay on your behalf. Visa applications to an embassy or consulate are filed by you directly.

【Overseas Patient-Referring Agencies】

· Recipients: The local agency that referred you (limited to the agency that referred that specific user)

· Purpose: Delivery of specialist opinions and treatment guidance in the local language, interpretation, and pre/post-care communication

· Items: Name, contact, diagnosis/symptoms, specialist opinion, treatment and schedule guidance

· Destination country: The user's country of residence (e.g., Kazakhstan, Russia)

· Retention: Per each agency's own privacy policy

· Note: Agencies are not our processors; they act as independent controllers processing personal data for their own purposes.

【Insurance Companies】

· Recipients: Travel/international insurance partners (with consent)

· Purpose: Claims support

You may refuse third-party disclosure, subject to service limitations.

By the nature of our service — helping overseas patients access Korean healthcare — we transfer personal data from your country of residence to the Republic of Korea. Certain operational data may also be transferred to other jurisdictions.

【Recipients & Jurisdictions】

· Korean partner hospitals (for medical purposes)

· Cloud infrastructure: Vercel Inc. (USA), Supabase Inc. (USA — data stored in the Seoul (ap-northeast-2) region)

· Social login authentication: Google LLC (USA), Apple Inc. (USA) — when you use those sign-in options

· Analytics: Google Ireland Ltd. (GA4, Ireland)

· Advertising measurement: Meta Platforms Ireland Ltd. (Meta Pixel, Ireland; only if you choose «Accept All» for cookies)

· Web analytics: Yandex LLC (Yandex Metrica, Russia; only if you choose «Accept All» for cookies)

· Email delivery: Resend Inc. (USA)

· Telemedicine video calls: LiveKit Inc. (USA)

· Error monitoring: Functional Software, Inc. (Sentry, US company — data stored in the EU (Germany) region)

· AI chatbot, translation, telemedicine caption transcription and messenger voice-note transcription: Google LLC (Gemini API, USA — when you use these features or send a voice note by messenger)

· AI chatbot, translation and summaries (text): Anthropic, PBC (Claude API, USA — when you use these features)

· App push notifications: Google LLC (Firebase Cloud Messaging, USA — when you enable notifications in the app)

· Messenger consultations (when you contact us through that messenger): Telegram FZ-LLC (Telegram, UAE) · WhatsApp LLC (Meta, USA — when WhatsApp messages are received into healwith's system) · Kapso, Inc. (WhatsApp message relay, USA — operations support: Kapso SpA, Chile)

· Overseas patient-referring agency (patient's country of residence, e.g., Kazakhstan, Russia): delivery of specialist opinions and treatment guidance, and pre/post-care support — governed by the third-party disclosure in Section 7; the agency is not our processor but an independent controller acting for its own purposes

【Purposes & Items】

· Hospitals: Same as Section 7

· Cloud/Analytics: Account information, logs, cookie identifiers

· Analytics and ad measurement (GA4 · Yandex Metrica · Meta Pixel): visit statistics and advertising performance measurement — cookie identifiers, pages visited, device and browser information. Sent only if you choose «Accept All» for cookies

· Messengers (Telegram FZ-LLC · WhatsApp LLC · Kapso, Inc.): responding to messenger consultations — message content, phone number or messenger account identifier, profile name, photos and documents you send

· Email delivery (Resend): sending notices — email address, email content

· Remote consultation video calls (LiveKit): running video consultations — call video and audio (relayed in real time)

· AI chatbot, translation, subtitles (Google Gemini API): generating replies, translations and subtitles, and transcribing voice notes you send on WhatsApp or Telegram and translating them into Korean (for our coordinators to read) — conversation text, audio to be transcribed (speech in video consultations and messenger voice notes), medical documents you upload (passport copies are never sent)

· AI chatbot, translation, summaries (Anthropic Claude API): generating replies, translations and summaries, and organising uploaded documents — conversation text, medical documents you upload (passport copies are never sent)

· Error logging (Sentry): analysing service errors — error details, device and browser information

· Visit statistics (Vercel Web Analytics): counting page visits and inquiry steps (contact-method screen, messenger button, inquiry submitted, AI chat started) — page address, step name, device, browser and country. It uses no cookies or personal identifiers, so it runs regardless of your cookie settings and is not stored in a form that identifies you

· App push notifications (Firebase Cloud Messaging): sending notifications — device notification token, notification content

· Social login (Google · Apple): login authentication — account identifier, email address

【When and How】 Data is transferred at the time you use the relevant feature (when messages or requests are sent and received), over encrypted connections (HTTPS/TLS).

【Retention】 Per each recipient's policy and contractual terms. For messengers:

· WhatsApp LLC: undelivered messages are kept for up to 30 days for redelivery, then deleted

· Kapso, Inc.: kept while healwith uses Kapso; deleted when you request deletion (backups are removed in the normal rotation). If healwith stops using Kapso, the data is deleted within 30–90 days.

【Recipient Contacts (privacy inquiries)】

· Vercel Inc.: privacy@vercel.com · Supabase Inc.: privacy@supabase.com

· Google LLC / Google Ireland Ltd.: https://support.google.com/policies?p=privpol_privts · Apple Inc.: https://www.apple.com/legal/privacy/contact/

· Anthropic, PBC: https://privacy.claude.com

· Meta Platforms Ireland Ltd.: https://www.facebook.com/privacy/policy · Yandex LLC: https://yandex.com/legal/confidential/

· Resend Inc.: support@resend.com · LiveKit Inc.: privacy@livekit.io · Functional Software, Inc. (Sentry): compliance@sentry.io

· Telegram FZ-LLC: in-app “Settings > Ask a Question” or https://edpo.com/telegram-gdpr-data-request/ · WhatsApp LLC: contact form at https://www.whatsapp.com/legal/privacy-policy · Kapso, Inc.: legal@kap.so

· You may also contact healwith and we will forward your request to the recipient: admin@healwith.co.kr

【Your Rights】 You may refuse the transfer, but as transfers are essential to the service, refusal will prevent use of the service. However, in messenger (Telegram, WhatsApp) consultations you can still receive coordinator support even if you do not consent to AI replies (processed on overseas servers), and you will not be disadvantaged for that. Messages sent before consent are used only for the coordinator’s reply and are not stored in our consultation records (database), but may remain in the chat history on the coordinator’s work phone. If you use our website consultation (web chat or inquiry form) instead of a messenger, no messenger-related transfer occurs.

【Safeguards】

· EU→Korea transfers: Pursuant to the European Commission's adequacy decision for Korea of December 2021 (Decision 2022/254), such transfers may take place without separate SCCs, provided the data is processed in Korea under PIPC supervision.

· Other transfers: We secure the recipient's data protection obligations through Standard Contractual Clauses or equivalent contractual and technical safeguards (encryption, pseudonymization).

· Regarding Kazakhstan: Please refer to the localization obligation provisions in Section 16.

We entrust the following processors with personal data processing under contract:

· Supabase Inc. — Database hosting (USA — data stored in the Seoul (ap-northeast-2) region)

· Vercel Inc. — Web application hosting (USA)

· Google LLC — Authentication (OAuth), analytics, maps (USA/Ireland)

· Meta Platforms Ireland Ltd. — Meta Pixel advertising measurement (with «Accept All» cookies, Ireland)

· Yandex LLC — Yandex Metrica web analytics (with «Accept All» cookies, Russia)

· Apple Inc. — Sign in with Apple authentication (USA)

· Resend Inc. — Notification and informational email delivery (USA)

· LiveKit Inc. — Telemedicine video calls (USA)

· Functional Software, Inc. (Sentry) — Service error monitoring and diagnostics (data in the EU (Germany) region)

· Vercel Inc. — Cookieless visit statistics (Vercel Web Analytics) (USA)

· Google LLC (Gemini API) — AI chatbot responses, translation, telemedicine caption transcription and messenger voice-note transcription (when you use these features or send a voice note by messenger, USA)

· Anthropic, PBC (Claude API) — AI chatbot responses, translation and summaries (when you use these features, USA)

· Google LLC (Firebase Cloud Messaging) — App push notification delivery (when you enable notifications in the app, USA)

· WhatsApp LLC (Meta) — Sending and receiving WhatsApp messages (USA — kept for up to 30 days for redelivery)

· Kapso, Inc. — WhatsApp message relay (USA — operations support: Kapso SpA, Chile)

Contracts require processors to observe data protection obligations, prohibition on use beyond stated purposes, and technical/organizational safeguards. We audit processors regularly.

You may exercise the following rights:

· Request the status of processing and suspension of processing (PIPA §35, §37)

· Access to your personal data (§35)

· Correction and deletion of your personal data (§36)

· Withdrawal of consent (§37)

· Right to object to automated decisions (§37-2)

· Right to claim compensation for damages (§39)

You may exercise these rights by contacting admin@healwith.co.kr or the Data Protection Officer (DPO) under Section 14 of this Policy. We respond within 10 days.

You may also file a report or apply for dispute mediation with the Personal Information Protection Commission of the Republic of Korea:

· Personal Information Protection Commission: 182 (no area code), www.privacy.go.kr

· Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr

healwith may receive concierge requests involving minor patients (e.g., pediatric cancer). In such cases, we require verified consent from a legal guardian (parent/caretaker).

Legal guardians may at any time request access, correction, deletion, or suspension of processing of the minor's personal data. We respond without delay.

We implement the following safeguards:

· Administrative: DPO appointment, periodic training, least-privilege access

· Technical: Encryption (TLS 1.3 in transit, AES-256 at rest), intrusion prevention, security patch management

· Physical: Access control to data processing areas

· Incident response: Notification to authorities and data subjects within 72 hours of a breach

We use cookies for session management, language preferences, security, and analytics.

Cookieless visit statistics (Vercel Web Analytics) run regardless of your cookie settings; they do not identify you and only count page visits and inquiry steps.

You may disable cookies via browser settings. See our Cookie Policy for details.

In the mobile app we use essential items only; analytics cookies are not used.

【Mobile App Permissions (Network Act §22-2)】

· Camera (optional): video consultation, photographing medical certificates and test results

· Microphone (optional): video consultation audio

· Notifications (optional): appointment, consultation, and case progress alerts

· Photos and files (optional): uploading and saving medical certificates and test results

No permission is mandatory. You can use the app without granting any of the above; only the related feature is limited. Permissions can be changed at any time in your device settings.

If you delete the app, the notification device token is no longer valid and is cleared from our servers.

Name: Kang Ju-Young

Title: Representative (concurrent — per Korean PIPA §31 and GDPR Art 37)

Email: admin@healwith.co.kr

Phone: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

You may contact the DPO directly for any privacy-related inquiry, complaint, or remedy request. We respond within 10 business days.

The Company uses an AI-based matching algorithm to recommend suitable healthcare providers to you. This may constitute an "automated decision" under Article 37-2 of the Personal Information Protection Act.

【Automated Processing Items】

· Matching of medical departments based on symptoms and diagnosis

· Hospital ranking recommendations based on past treatment cases and language-support availability

· Automatic generation of packages suited to your stay period and budget

【Your Rights】

· Request an explanation of the outcome of an automated decision

· Refuse an automated decision and request review by a human

· Submit the above requests to admin@healwith.co.kr or the DPO contact in Section 14

Please always obtain the judgment of medical professionals for any final medical decision. AI recommendations are for reference only and do not constitute diagnosis or treatment.

This section provides additional disclosures under the Republic of Kazakhstan Law on Personal Data and Its Protection (No. 94-V, 2013, as amended in 2015 and 2022) and related implementing regulations.

【Explicit Consent to Cross-Border Transfer (Article 16)】

Given the nature of this service in helping overseas patients access Korean healthcare, your personal data is transferred to the Republic of Korea. Article 16 of the Kazakhstan law permits cross-border transfer based on the data subject's explicit written consent. When applying to use the service, you explicitly consent to the following through this Policy's cross-border transfer provisions and a separate consent checkbox:

· Recipient country: Republic of Korea

· Recipients: Korean partner hospitals selected by you, and cloud service providers (Vercel Inc., Supabase Inc.)

· Items transferred: The collected items in Section 3 and the sensitive data in Section 5

· Purpose of transfer: Provision of medical concierge services

【Notice on Local Storage (Article 12)】

Article 12 of the Kazakhstan law requires the primary storage of Kazakhstani citizens' personal data within Kazakhstan's territory. The Company currently operates the service on the legal basis of the explicit consent mechanism under Article 16 above, and, as the service grows, will review the introduction of a local primary-storage structure through Kazakhstan-based cloud partners (such as QazCloud or Yandex Cloud Kazakhstan). Any material change will be promptly announced through an update to this Policy.

【Separate Consent for Sensitive (Medical) Data (Articles 8, 9)】

Under Kazakhstan law, sensitive data requires consent obtained in a manner verifiable in writing or by electronic signature (EDS, integrated with eGov). The Company records electronic checkbox-based consent together with a timestamp, IP address, and user identifier to secure evidentiary value equivalent to a written form. Oral consent is not collected.

【Official Languages】

This Policy is provided concurrently in Kazakh (the state language) and Russian (an official language). You may select your preferred language; in the event of any discrepancy in interpretation between translations, the Korean version shall govern for legal effect in the Republic of Korea.

【Supervisory Authorities】

· Committee on Information Security (Комитет по информационной безопасности, under the KNB)

· Ministry of Digital Development, Innovations and Aerospace Industry (Министерство цифрового развития, инноваций и аэрокосмической промышленности)

【Reports and Disputes】

You may contact us at the address in Section 20 of this Policy, or bring proceedings before the courts or supervisory authority of your place of residence.

Where GDPR applies, the following rights are guaranteed:

· Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and regarding automated decision-making (Art. 22).

· Special category data (health, Art. 9) is processed only based on explicit consent.

· International transfers (Art. 44-49) rely on Standard Contractual Clauses where applicable.

· You may lodge a complaint with your national DPA.

· EU Representative: [To be designated under Art. 27 if targeting EU market]

Russian Federal Law 152-FZ requires initial collection of personal data of Russian citizens within Russian territory.

healwith is separately evaluating compliance with this requirement. By using the service, Russian residents acknowledge and explicitly consent to these terms.

Supervisory authority: Roskomnadzor (Роскомнадзор).

When we change this Policy, we announce the effective date and the changes through our service notice (and by email where needed).

However, where our actual processing is unchanged and we are correcting a description that did not match it, we publish the correction immediately so that inaccurate wording is not left up, and we state what was corrected in the summary below.

Current version: 2.17.0 (effective 2026-11-06). Previous version 2.16.0 (2026-11-06).

Summary of changes in 2.17.0: We no longer automatically delete, 30 days after the last contact, the records of inquiries you sent on a messenger that ended without consent to AI consultation. So that we can continue if you contact us again, §6 now keeps them for 3 years from the last contact and then destroys them, like other inquiries that did not lead to consultation. No new items are collected and nothing new is shared.

Summary of changes in 2.16.0: We now keep a record, stored with your account, that you agreed to the Terms of Service and this Privacy Policy when you signed up (the versions you agreed to, the time of consent and how you signed up), and have added it to the collected items (§3, Mandatory) and retention periods (§6). The record only confirms your consent; no new personal data is collected and nothing is sent to anyone else. It is deleted immediately with your account if you delete it.

Summary of changes in 2.15.0: To match the optional checkbox on the sign-up screen (receiving healwith service news and notices by email), we listed the item collected (§3, Optional Items) and the purpose of use (§4 n). This pairs with removing the wording “medical special offers” from that checkbox. Declining has no effect on your use of the service, and you can withdraw consent at any time. No new information is collected and no new overseas transfer is added.

Summary of changes in 2.14.0: So that coordinators can see and answer inquiries you sent on a messenger before consenting to AI consultation, we listed the record kept at this stage (account identifier or phone number, name, language, advertising source, inquiry type label, time of last contact, scheduled deletion and follow-up times, coordinator replies) in §3, the purposes (deciding response order, one follow-up message offering to continue) in §4, and deletion 30 days after the last contact for inquiries that end without consent in §6 (separate from the 3-year retention after you consent). The body of the message you send is not stored at this stage; it is used only temporarily on our server to determine the inquiry type and is not sent to overseas AI. Messages may remain in the chat history on the coordinator's work phone, and processing by the messenger providers and the relay is as described in §8. We also described in §3 that pre-consent WhatsApp inquiries are fetched from the relay and shown on screen only when a coordinator opens them. Processing after you consent to AI consultation is unchanged.

Summary of changes in 2.13.0: As the first reply on WhatsApp and Telegram changes to “answer first, ask for consent only when AI is used”, we revised the user-rights wording in §8. In messenger consultations you can still receive coordinator support if you do not consent to AI replies (processed on overseas servers), and you will not be disadvantaged. Messages you send before consenting are used only so a coordinator can reply; they are not stored in our consultation records (database). Processing by the messenger providers and the relay is as described in §8, and the messages may remain in the chat history on the coordinator’s work phone. No new information is collected and no new overseas transfer is added; the AI-processing consent is simply requested at the moment AI replies are used.

2.12.0 summary: we described, before the screen opens, the items the new booking request collects. We added the stay plan (desired arrival, departure and admission dates), preferred hospital and room, who the request is for (yourself, a family member or a friend), the time a family member or friend confirmed consent, and the legal-representative confirmation to the collected items (§3) and purposes (§4), and stated that your answer about residence in Korea is used only to decide whether we can accept the request and is not stored. We also described, in the purposes (§4), viewing your progress without logging in through a progress link plus date of birth, and the validity of a link opened on its own (90 days from issue). Because this adds collected items, the stay plan, preferred hospital and room, and who the request is for were added to the consent form (2.5.0).

Summary of changes in 2.11.0: we added the post-return follow-up record that staff make when they contact you after you return home (follow-up status, reason for stopping, date of last contact, staff note) to the collected items (§3) and purposes (§4), and added its retention to §6 (the staff note is locked for 1 year from deletion and then destroyed; the status, reason and date are kept with the inquiry, and your name and contact details are erased when you delete your account). It is not shown on your screen and is provided on request. Because this adds a collected item, the same item was added to the consent form (2.4.0).

Summary of changes in 2.10.0: What you wrote yourself in your inquiry (the first inquiry note and later explanations) may contain names or contact details that cannot be removed selectively, so after you delete your account it is now kept locked from viewing for 1 year from the deletion date and then destroyed, like test files and passport copies (§6). Before, this policy did not say what happens to this text after deletion. This change is not unfavorable to you (it reduces retention and access). The wording «destroyed within 30 days» in Article 17(3) of the Terms of Service was corrected to match.

Summary of changes in 2.9.1: So that our coordinators can read voice notes you send on WhatsApp or Telegram quickly, Google LLC (Gemini API) transcribes them and translates them into Korean; this is now stated in §8 and §9. The transcript is kept like the message itself, for 3 years from the last contact (§6 now also lists how long we keep messenger messages), and this processing stays within what you agreed to for messenger consultations (no new data is collected).

Summary of changes in 2.9.0: (1) The «Visa Agencies» entry in §7 has been corrected to match what we actually do and now reads «Ministry of Justice». We do not use visa agencies; data goes to the Ministry of Justice when you ask us to apply for your K-ETA, or when we apply for a Confirmation of Visa Issuance as your inviting party. The same use has been added to the separate passport consent in §3. (2) Passport numbers have been removed from the items shared with hospitals in §7; your passport is shared only with the separate consent. (3) What happens after account deletion has been corrected (§6): the test files and passport copies you uploaded are not kept because of a «legal retention obligation»; they are locked for 1 year from the deletion date to answer disputes or return-visit questions, then destroyed, and care documents already sent to a hospital are kept by that hospital. As these changes correct the description and limit retention to a set period, they apply from the effective date.

Summary of changes in 2.8.0: Passport numbers and passport copies are no longer part of the general data we collect; we now ask for a separate consent for these unique identifiers (§3). We use your passport only if you provide it, for hospital admission and registration documents and invitation letters, and we never send it to the AI services in §8 (Google Gemini, Anthropic Claude). As this change reduces what we share, it applies from the effective date.

Summary of changes in 2.7.0: Anthropic, PBC (Claude API, USA) has been added to the overseas transfer list in §8 and the processor list in §9 to handle the text work of the AI chatbot, translation and summaries. Caption transcription (audio) in telemedicine calls is still handled by Google LLC (Gemini API), and Google also takes over when Anthropic cannot respond. Neither company uses the content we send to train its models. Google handles the AI chatbot when you use it directly from outside the countries Anthropic supports (such as Russia, Belarus or China), WhatsApp consultations from phone numbers of countries Anthropic does not support, Telegram consultations, and the caption translation shown to overseas participants in telemedicine calls. Other translation, summaries and document organising (work done by our staff and partner medical institutions in Korea, and automated tasks) are handled by Anthropic regardless of your country. In §19 we now announce the effective date and the changes when this Policy changes.

Summary of changes in 2.6.3: The cookieless visit statistics we already use (Vercel Web Analytics, Vercel Inc., USA) are now described in §8, §9 and §13, and inquiry-step counting (contact-method screen, messenger button, inquiry submitted, AI chat started) has been added. As these statistics do not identify individuals, this is treated as a clarification and applies from the effective date.

Summary of changes in 2.6.2: Yandex Metrica (Yandex LLC, Russia) and Meta Pixel (Meta Platforms Ireland Ltd., Ireland), which were already used when you choose «Accept All» for cookies, have been added to the overseas transfer list in §8 and the processor list in §9 (a correction of an omission, applied immediately). The English spelling of the representative and data protection officer is unified as «Kang Ju-Young» (spelling only).

Summary of changes in 2.6.1: §8 (overseas transfer) now lists the purpose and items for each feature (messengers, email, video calls, AI, error logging, push notifications, social login), when and how data is transferred, messenger retention periods (WhatsApp, Kapso), recipient contacts, and that messenger transfers do not occur if you use our website consultation instead. Processing is unchanged; this fills in the explanation required by law (Korean PIPA §28-8), so it applies immediately.

Summary of changes in 2.6.0: (1) §8 now lists the overseas transfer for our existing Telegram consultations (Telegram FZ-LLC, UAE) — a correction of an omission, effective immediately. (2) To receive WhatsApp messages into our system, WhatsApp LLC (Meta, USA) and Kapso, Inc. (USA) were added to §8 and §9. This applies from the effective date so that WhatsApp inquiries can be received right away.

Summary of changes in 2.5.0: §6 now states that test documents and imaging files (CT, MRI, etc.) are retained for 3 years after the end of the relationship, and makes clear that healwith stores those materials. Originals of medical records created by hospitals are still not held by healwith.

Summary of changes in 2.4.0: (1) deletion on withdrawal corrected from 'within 30 days' to 'immediately'; (2) the 'automatic deletion of accounts after 3 years of inactivity' item was removed (the rule it rested on, the personal data validity period system, was abolished on 15 September 2023, leaving dormancy policy to each operator, and 3 years is shorter than statutory retention such as 5 years for contracts and payments and 10 years for medical records, so it could not be applied; you may withdraw yourself at any time); (3) what is kept and what is deleted on withdrawal is now described as it actually works.

Privacy and general inquiries: admin@healwith.co.kr

Address: Room 613, 385 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea

Phone: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

Business hours: Mon-Fri 09:00-18:00 KST