Privacy Policy

BONROI ("we", "us") operates a medical concierge platform, healwith, that helps international patients access medical care in the Republic of Korea. healwith is not a medical institution and does not provide diagnosis or treatment.

This Policy is primarily governed by the Korean Personal Information Protection Act (PIPA), the Medical Service Act, and the Act on Support for Overseas Expansion of Healthcare Systems and Attraction of International Patients. Where applicable, it also reflects the requirements of your country of residence (e.g., EU GDPR, Kazakhstan Law 94-V, Russian Federal Law 152-FZ, etc.). Jurisdiction-specific notices are provided in dedicated sections below.

We treat the personal information of all users with care, regardless of nationality or residence, and handle it in accordance with applicable laws.

Trade name: BONROI (service: healwith)

Entity type: Sole proprietorship

Representative: Kang Ju-Young

Business Registration Number: 463-35-00902

International Patient Facilitator Registration Number: A-2026-01-02-06761 (valid 2026-03-11 ~ 2029-03-10, issued by the Mayor of Seoul)

Registered address: Room 613, 385 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea

Contact: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

Email: admin@healwith.co.kr

Business hours: Mon-Fri 09:00-18:00 KST (excluding Korean public holidays)

【Mandatory】

· Name, date of birth, gender, nationality, passport number (for visa and hospital registration)

· Contact details (email, phone, messenger ID)

· Residential address (stay-support purposes)

· Guardian/companion information (for minor or elderly patients)

【Sensitive Data — Separate Consent】

· Diagnosis, medical history, current symptoms, medications

· Medical certificates, test results, imaging (X-ray, CT, MRI, etc.)

· Health insurance and travel insurance information

· Disability status (for accessibility support)

【Automatically Collected】

· IP address, cookies, session logs, service usage records

· Device information (OS, browser, model), approximate geolocation (country-level; precise location only with consent)

· Mobile app push notification device token (only if you enable notifications in the app)

【When Using Telemedicine (Video Consultation)】

· Audio and video: transmitted in real time only during the call; we do not record it (the recording feature is currently disabled; if introduced, we will obtain prior consent and amend this Policy).

· Captions and translated text: stored as consultation records in encrypted form. Captions are generated only when you turn them on.

· To generate captions, spoken audio is sent to the processors listed in Section 9 for transcription and translation (if browser-based transcription is used, it may also be sent to your browser vendor).

【Payment-Related】

· We do not collect any treatment or service fees from users, and we do not collect or store payment credentials such as card numbers. Treatment costs are paid by the user directly to the medical institution.

a. Member identification and authentication

b. Hospital matching, appointment booking, visa and stay support

c. Provision of consent-based medical information to healthcare providers

d. Interpretation, transportation, and accommodation services

e. Treatment cost estimates and settlement support (we do not collect treatment payments from users)

f. Customer support and dispute resolution

g. Service quality improvement, statistical analysis, security incident response

h. Compliance with legal obligations

i. Sending notifications about appointments, consultations, and case progress (email, and app push if you enable it)

healwith processes "health-related information" which constitutes Sensitive Data under PIPA §23 and a Special Category of personal data under GDPR Article 9. Such data is collected and used only with your explicit, separate consent.

Sensitive data is used solely for hospital matching and appropriate care coordination, and is shared with healthcare providers only within the scope of your consent.

You have the right to withhold consent for processing of sensitive data; doing so may restrict your ability to use medical matching services.

We delete personal data without delay once the purpose of collection has been fulfilled, except where required to be retained by law.

【Statutory Retention】

· Contract/withdrawal records: 5 years (Act on Consumer Protection in E-Commerce §6)

· Consumer complaints/dispute records: 3 years

· Login records: 3 months (Protection of Communications Secrets Act §15-2)

· Medical records held by hospitals: 10 years (Medical Service Act §22). Note: originals are created and maintained by the hospital, and healwith does not retain copies of them. However, test documents and imaging files (CT, MRI, etc.) that you, or an agency acting for you, submit directly to healwith for consultation are stored by us, for the period set out under the service-purpose retention list below.

【Service-Based Retention】 (Storage limitation principle — PIPA §21, GDPR Art.5(1)(e): retained only as long as necessary for the purpose)

· Account information: retained while membership remains active. When you withdraw, your login and contact details (name, phone number, email) are deleted immediately. You can withdraw yourself from the Account & Privacy screen in the service.

· Long-dormant accounts: we do not automatically delete accounts for inactivity. The rule that required this (the personal data validity period system) was abolished on 15 September 2023, leaving dormancy policy to each operator, and cancer care spans diagnosis, treatment and aftercare over several years, so a period of inactivity does not reliably mean the relationship has ended. You may withdraw at any time, and we will give prior notice if we introduce a dormancy policy.

· Sensitive health data: retained for as long as necessary to provide the service, including pre-consultation, treatment, and aftercare. Upon withdrawal or withdrawal of consent, the name, phone number and email attached to that data are deleted immediately so that you can no longer be identified from it. However, care records already sent to a hospital and the test documents you uploaded remain for the periods listed under Statutory Retention above, and your name may appear inside those documents. They are destroyed without delay once the retention period ends. Note: in this Policy, 'service completion' means the end of the relationship with the user including aftercare, not a one-off treatment.

· Test documents and imaging files (including CT/MRI image files): retained for 3 years from the end of the relationship, then destroyed. This matches the retention period for consumer complaint and dispute records (Act on Consumer Protection in Electronic Commerce §6) and is the period needed to respond to a follow-up or re-referral request after the consultation. Original imaging is separately retained by the treating hospital under the Medical Service Act.

· Inquiries that did not lead to a consultation: where you submitted an inquiry but no consultation or treatment followed, there is no end-of-relationship date, so we destroy the data 3 years after the last activity such as your last contact or document submission. If you contact us again within that period, we can continue from where the inquiry left off.

· Telemedicine captions and conversation records: stored encrypted; deleted at the end of the relationship with the user or upon a deletion request

· Marketing consent data: until withdrawal

Based on your consent, we share personal data with the following third parties:

【Healthcare Providers】

· Recipients: Korean hospitals and clinics selected and consented by you

· Purpose: Medical consultation, appointment, treatment planning

· Items: Name, date of birth, contact, passport number, diagnosis, symptoms, medical records

· Retention: Per each provider's legal obligations (typically 10 years)

【Visa Agencies】

· Recipients: Partner visa agencies (with consent)

· Items: Passport copy, invitation letter, travel schedule

· Purpose: Medical visa application (C-3-3, G-1)

【Overseas Patient-Referring Agencies】

· Recipients: The local agency that referred you (limited to the agency that referred that specific user)

· Purpose: Delivery of specialist opinions and treatment guidance in the local language, interpretation, and pre/post-care communication

· Items: Name, contact, diagnosis/symptoms, specialist opinion, treatment and schedule guidance

· Destination country: The user's country of residence (e.g., Kazakhstan, Russia)

· Retention: Per each agency's own privacy policy

· Note: Agencies are not our processors; they act as independent controllers processing personal data for their own purposes.

【Insurance Companies】

· Recipients: Travel/international insurance partners (with consent)

· Purpose: Claims support

You may refuse third-party disclosure, subject to service limitations.

By the nature of our service — helping overseas patients access Korean healthcare — we transfer personal data from your country of residence to the Republic of Korea. Certain operational data may also be transferred to other jurisdictions.

【Recipients & Jurisdictions】

· Korean partner hospitals (for medical purposes)

· Cloud infrastructure: Vercel Inc. (USA), Supabase Inc. (USA — data stored in the Seoul (ap-northeast-2) region)

· Social login authentication: Google LLC (USA), Apple Inc. (USA) — when you use those sign-in options

· Analytics: Google Ireland Ltd. (GA4, Ireland)

· Advertising measurement: Meta Platforms Ireland Ltd. (Meta Pixel, Ireland; only if you choose «Accept All» for cookies)

· Web analytics: Yandex LLC (Yandex Metrica, Russia; only if you choose «Accept All» for cookies)

· Email delivery: Resend Inc. (USA)

· Telemedicine video calls: LiveKit Inc. (USA)

· Error monitoring: Functional Software, Inc. (Sentry, US company — data stored in the EU (Germany) region)

· AI chatbot, translation, and telemedicine caption transcription: Google LLC (Gemini API, USA — when you use these features)

· App push notifications: Google LLC (Firebase Cloud Messaging, USA — when you enable notifications in the app)

· Messenger consultations (when you contact us through that messenger): Telegram FZ-LLC (Telegram, UAE) · WhatsApp LLC (Meta, USA — when WhatsApp messages are received into healwith's system) · Kapso, Inc. (WhatsApp message relay, USA — operations support: Kapso SpA, Chile)

· Overseas patient-referring agency (patient's country of residence, e.g., Kazakhstan, Russia): delivery of specialist opinions and treatment guidance, and pre/post-care support — governed by the third-party disclosure in Section 7; the agency is not our processor but an independent controller acting for its own purposes

【Purposes & Items】

· Hospitals: Same as Section 7

· Cloud/Analytics: Account information, logs, cookie identifiers

· Analytics and ad measurement (GA4 · Yandex Metrica · Meta Pixel): visit statistics and advertising performance measurement — cookie identifiers, pages visited, device and browser information. Sent only if you choose «Accept All» for cookies

· Messengers (Telegram FZ-LLC · WhatsApp LLC · Kapso, Inc.): responding to messenger consultations — message content, phone number or messenger account identifier, profile name, photos and documents you send

· Email delivery (Resend): sending notices — email address, email content

· Remote consultation video calls (LiveKit): running video consultations — call video and audio (relayed in real time)

· AI chatbot, translation, subtitles (Google Gemini API): generating replies, translations and subtitles — conversation text, audio to be transcribed

· Error logging (Sentry): analysing service errors — error details, device and browser information

· App push notifications (Firebase Cloud Messaging): sending notifications — device notification token, notification content

· Social login (Google · Apple): login authentication — account identifier, email address

【When and How】 Data is transferred at the time you use the relevant feature (when messages or requests are sent and received), over encrypted connections (HTTPS/TLS).

【Retention】 Per each recipient's policy and contractual terms. For messengers:

· WhatsApp LLC: undelivered messages are kept for up to 30 days for redelivery, then deleted

· Kapso, Inc.: kept while healwith uses Kapso; deleted when you request deletion (backups are removed in the normal rotation). If healwith stops using Kapso, the data is deleted within 30–90 days.

【Recipient Contacts (privacy inquiries)】

· Vercel Inc.: privacy@vercel.com · Supabase Inc.: privacy@supabase.com

· Google LLC / Google Ireland Ltd.: https://support.google.com/policies?p=privpol_privts · Apple Inc.: https://www.apple.com/legal/privacy/contact/

· Meta Platforms Ireland Ltd.: https://www.facebook.com/privacy/policy · Yandex LLC: https://yandex.com/legal/confidential/

· Resend Inc.: support@resend.com · LiveKit Inc.: privacy@livekit.io · Functional Software, Inc. (Sentry): compliance@sentry.io

· Telegram FZ-LLC: in-app “Settings > Ask a Question” or https://edpo.com/telegram-gdpr-data-request/ · WhatsApp LLC: contact form at https://www.whatsapp.com/legal/privacy-policy · Kapso, Inc.: legal@kap.so

· You may also contact healwith and we will forward your request to the recipient: admin@healwith.co.kr

【Your Rights】 You may refuse the transfer, but as transfers are essential to the service, refusal will prevent use of the service. However, transfers related to messengers (Telegram, WhatsApp) do not occur if you use our website consultation (web chat or inquiry form) instead.

【Safeguards】

· EU→Korea transfers: Pursuant to the European Commission's adequacy decision for Korea of December 2021 (Decision 2022/254), such transfers may take place without separate SCCs, provided the data is processed in Korea under PIPC supervision.

· Other transfers: We secure the recipient's data protection obligations through Standard Contractual Clauses or equivalent contractual and technical safeguards (encryption, pseudonymization).

· Regarding Kazakhstan: Please refer to the localization obligation provisions in Section 16.

We entrust the following processors with personal data processing under contract:

· Supabase Inc. — Database hosting (USA — data stored in the Seoul (ap-northeast-2) region)

· Vercel Inc. — Web application hosting (USA)

· Google LLC — Authentication (OAuth), analytics, maps (USA/Ireland)

· Meta Platforms Ireland Ltd. — Meta Pixel advertising measurement (with «Accept All» cookies, Ireland)

· Yandex LLC — Yandex Metrica web analytics (with «Accept All» cookies, Russia)

· Apple Inc. — Sign in with Apple authentication (USA)

· Resend Inc. — Notification and informational email delivery (USA)

· LiveKit Inc. — Telemedicine video calls (USA)

· Functional Software, Inc. (Sentry) — Service error monitoring and diagnostics (data in the EU (Germany) region)

· Google LLC (Gemini API) — AI chatbot responses, translation, and telemedicine caption transcription (when you use these features, USA)

· Google LLC (Firebase Cloud Messaging) — App push notification delivery (when you enable notifications in the app, USA)

· WhatsApp LLC (Meta) — Sending and receiving WhatsApp messages (USA — kept for up to 30 days for redelivery)

· Kapso, Inc. — WhatsApp message relay (USA — operations support: Kapso SpA, Chile)

Contracts require processors to observe data protection obligations, prohibition on use beyond stated purposes, and technical/organizational safeguards. We audit processors regularly.

You may exercise the following rights:

· Request the status of processing and suspension of processing (PIPA §35, §37)

· Access to your personal data (§35)

· Correction and deletion of your personal data (§36)

· Withdrawal of consent (§37)

· Right to object to automated decisions (§37-2)

· Right to claim compensation for damages (§39)

You may exercise these rights by contacting admin@healwith.co.kr or the Data Protection Officer (DPO) under Section 14 of this Policy. We respond within 10 days.

You may also file a report or apply for dispute mediation with the Personal Information Protection Commission of the Republic of Korea:

· Personal Information Protection Commission: 182 (no area code), www.privacy.go.kr

· Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr

healwith may receive concierge requests involving minor patients (e.g., pediatric cancer). In such cases, we require verified consent from a legal guardian (parent/caretaker).

Legal guardians may at any time request access, correction, deletion, or suspension of processing of the minor's personal data. We respond without delay.

We implement the following safeguards:

· Administrative: DPO appointment, periodic training, least-privilege access

· Technical: Encryption (TLS 1.3 in transit, AES-256 at rest), intrusion prevention, security patch management

· Physical: Access control to data processing areas

· Incident response: Notification to authorities and data subjects within 72 hours of a breach

We use cookies for session management, language preferences, security, and analytics.

You may disable cookies via browser settings. See our Cookie Policy for details.

In the mobile app we use essential items only; analytics cookies are not used.

【Mobile App Permissions (Network Act §22-2)】

· Camera (optional): video consultation, photographing medical certificates and test results

· Microphone (optional): video consultation audio

· Notifications (optional): appointment, consultation, and case progress alerts

· Photos and files (optional): uploading and saving medical certificates and test results

No permission is mandatory. You can use the app without granting any of the above; only the related feature is limited. Permissions can be changed at any time in your device settings.

If you delete the app, the notification device token is no longer valid and is cleared from our servers.

Name: Kang Ju-Young

Title: Representative (concurrent — per Korean PIPA §31 and GDPR Art 37)

Email: admin@healwith.co.kr

Phone: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

You may contact the DPO directly for any privacy-related inquiry, complaint, or remedy request. We respond within 10 business days.

The Company uses an AI-based matching algorithm to recommend suitable healthcare providers to you. This may constitute an "automated decision" under Article 37-2 of the Personal Information Protection Act.

【Automated Processing Items】

· Matching of medical departments based on symptoms and diagnosis

· Hospital ranking recommendations based on past treatment cases and language-support availability

· Automatic generation of packages suited to your stay period and budget

【Your Rights】

· Request an explanation of the outcome of an automated decision

· Refuse an automated decision and request review by a human

· Submit the above requests to admin@healwith.co.kr or the DPO contact in Section 14

Please always obtain the judgment of medical professionals for any final medical decision. AI recommendations are for reference only and do not constitute diagnosis or treatment.

This section provides additional disclosures under the Republic of Kazakhstan Law on Personal Data and Its Protection (No. 94-V, 2013, as amended in 2015 and 2022) and related implementing regulations.

【Explicit Consent to Cross-Border Transfer (Article 16)】

Given the nature of this service in helping overseas patients access Korean healthcare, your personal data is transferred to the Republic of Korea. Article 16 of the Kazakhstan law permits cross-border transfer based on the data subject's explicit written consent. When applying to use the service, you explicitly consent to the following through this Policy's cross-border transfer provisions and a separate consent checkbox:

· Recipient country: Republic of Korea

· Recipients: Korean partner hospitals selected by you, and cloud service providers (Vercel Inc., Supabase Inc.)

· Items transferred: The collected items in Section 3 and the sensitive data in Section 5

· Purpose of transfer: Provision of medical concierge services

【Notice on Local Storage (Article 12)】

Article 12 of the Kazakhstan law requires the primary storage of Kazakhstani citizens' personal data within Kazakhstan's territory. The Company currently operates the service on the legal basis of the explicit consent mechanism under Article 16 above, and, as the service grows, will review the introduction of a local primary-storage structure through Kazakhstan-based cloud partners (such as QazCloud or Yandex Cloud Kazakhstan). Any material change will be promptly announced through an update to this Policy.

【Separate Consent for Sensitive (Medical) Data (Articles 8, 9)】

Under Kazakhstan law, sensitive data requires consent obtained in a manner verifiable in writing or by electronic signature (EDS, integrated with eGov). The Company records electronic checkbox-based consent together with a timestamp, IP address, and user identifier to secure evidentiary value equivalent to a written form. Oral consent is not collected.

【Official Languages】

This Policy is provided concurrently in Kazakh (the state language) and Russian (an official language). You may select your preferred language; in the event of any discrepancy in interpretation between translations, the Korean version shall govern for legal effect in the Republic of Korea.

【Supervisory Authorities】

· Committee on Information Security (Комитет по информационной безопасности, under the KNB)

· Ministry of Digital Development, Innovations and Aerospace Industry (Министерство цифрового развития, инноваций и аэрокосмической промышленности)

【Reports and Disputes】

You may contact us at the address in Section 20 of this Policy, or bring proceedings before the courts or supervisory authority of your place of residence.

Where GDPR applies, the following rights are guaranteed:

· Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and regarding automated decision-making (Art. 22).

· Special category data (health, Art. 9) is processed only based on explicit consent.

· International transfers (Art. 44-49) rely on Standard Contractual Clauses where applicable.

· You may lodge a complaint with your national DPA.

· EU Representative: [To be designated under Art. 27 if targeting EU market]

Russian Federal Law 152-FZ requires initial collection of personal data of Russian citizens within Russian territory.

healwith is separately evaluating compliance with this requirement. By using the service, Russian residents acknowledge and explicitly consent to these terms.

Supervisory authority: Roskomnadzor (Роскомнадзор).

Material changes will be notified via our service notice and email at least 7 days prior to effect (30 days for adverse changes).

However, where our actual processing is unchanged and we are correcting a description that did not match it, we publish the correction immediately so that inaccurate wording is not left up, and we state what was corrected in the summary below.

Current version: 2.6.2 (effective 2026-10-13). Previous version 2.6.1 (2026-10-09).

Summary of changes in 2.6.2: Yandex Metrica (Yandex LLC, Russia) and Meta Pixel (Meta Platforms Ireland Ltd., Ireland), which were already used when you choose «Accept All» for cookies, have been added to the overseas transfer list in §8 and the processor list in §9 (a correction of an omission, applied immediately). The English spelling of the representative and data protection officer is unified as «Kang Ju-Young» (spelling only).

Summary of changes in 2.6.1: §8 (overseas transfer) now lists the purpose and items for each feature (messengers, email, video calls, AI, error logging, push notifications, social login), when and how data is transferred, messenger retention periods (WhatsApp, Kapso), recipient contacts, and that messenger transfers do not occur if you use our website consultation instead. Processing is unchanged; this fills in the explanation required by law (Korean PIPA §28-8), so it applies immediately.

Summary of changes in 2.6.0: (1) §8 now lists the overseas transfer for our existing Telegram consultations (Telegram FZ-LLC, UAE) — a correction of an omission, effective immediately. (2) To receive WhatsApp messages into our system, WhatsApp LLC (Meta, USA) and Kapso, Inc. (USA) were added to §8 and §9. This applies from the effective date so that WhatsApp inquiries can be received right away.

Summary of changes in 2.5.0: §6 now states that test documents and imaging files (CT, MRI, etc.) are retained for 3 years after the end of the relationship, and makes clear that healwith stores those materials. Originals of medical records created by hospitals are still not held by healwith.

Summary of changes in 2.4.0: (1) deletion on withdrawal corrected from 'within 30 days' to 'immediately'; (2) the 'automatic deletion of accounts after 3 years of inactivity' item was removed (the rule it rested on, the personal data validity period system, was abolished on 15 September 2023, leaving dormancy policy to each operator, and 3 years is shorter than statutory retention such as 5 years for contracts and payments and 10 years for medical records, so it could not be applied; you may withdraw yourself at any time); (3) what is kept and what is deleted on withdrawal is now described as it actually works.

Privacy and general inquiries: admin@healwith.co.kr

Address: Room 613, 385 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea

Phone: +82-10-4772-1075 (international) · 070-7500-7795 (domestic)

Business hours: Mon-Fri 09:00-18:00 KST