Privacy Policy

1. Data Controller

The Data Controller (개인정보처리자) responsible for your personal data is:

DoctorsInKorea.com is fully owned and operated by Hayya Med Artificial Intelligence. All data processing activities comply with Korea's Personal Information Protection Act (PIPA).

1a. Privacy Officer (개인정보보호책임자)

Hayya Med Artificial Intelligence has designated a Privacy Officer responsible for overseeing our compliance with Korea's PIPA and advising on data protection matters.

You may contact the Privacy Officer directly for any questions regarding the processing of your personal data or to exercise your rights under PIPA.

2. Data We Collect

Identity & Contact Data

• Full name, phone number, and email address
• Nationality and preferred language
• Age group (required for age-restricted services)

Health & Booking Data Sensitive

• Symptoms or health concerns entered when using the AI assistant or searching for a doctor
• Selected specialty, clinic, and doctor
• Appointment history, booking status, and cancellations
• Insurance provider details

Technical Data

• IP address, browser type, and device information
• Pages visited, session duration, and interaction logs
• Cookie identifiers (see Section 10)

Payment Data

• Transaction amounts and booking reference numbers
• Card details are processed exclusively by our payment processor and are never stored on our servers

3. Legal Basis for Processing

We process your data on the following legal bases under Korea's PIPA:

To withdraw consent, email data@hayyamed.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. How We Use Your Data

We use your data solely for:

• Matching you with relevant doctors, clinics, and specialists in Korea
• Processing and confirming your appointment bookings
• Sending appointment reminders and confirmations via SMS and email
• Operating the Hayya Med AI assistant to provide symptom-guided healthcare navigation
• Verifying insurance compatibility with healthcare providers
• Processing payments for bookings where applicable
• Improving platform accuracy, AI model quality, and user experience
• Complying with legal obligations and responding to lawful requests from Korean authorities

We do not use your data for advertising profiling. We do not sell your data to any third party under any circumstances.

5. Third-Party Processors

We engage the following sub-processors. Each is bound by a data processing agreement:

6. Cross-Border Data Transfers

Your personal data may be transferred to and processed in the United Statesby the sub-processors listed in Section 5, as cloud infrastructure is global in nature. Cross-border transfer of personal information is conducted in accordance with PIPA's requirements for overseas transfer of personal data.

We ensure appropriate contractual safeguards are in place with each processor — including data processing agreements — requiring them to protect your data to a standard consistent with Korea's PIPA.

For information on the specific safeguards in place, contact data@hayyamed.com.

7. Data Retention

We retain your data only as long as necessary:

After the retention period, data is securely deleted or permanently anonymised.

8. Your Rights Under Korea's PIPA

Under Korea's PIPA you have the following rights:

Submit requests to data@hayyamed.com. We will respond within 10 days as required under PIPA.

9. Data Security

We implement the following technical and organisational security measures:

• TLS encryption for all data in transit
• Row-level security (RLS) on all database tables, enforced by Supabase
• Multi-tenant isolation — no data is accessible across clinic accounts
• Role-based access controls with audit logging for all staff data access
• Regular security reviews of all third-party processors
• No storage of payment card numbers on our infrastructure

In the event of a data breach that poses a risk to your rights, we will notify you and, where required by law, the Personal Information Protection Commission (PIPC) without undue delay.

10. Cookies

We use two categories of cookies:

We do not use advertising, tracking, or profiling cookies. We do not share cookie data with advertising networks.

11. Children's Privacy

Our platform is intended for individuals aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe your child's data has been submitted without your consent, contact data@hayyamed.com and we will delete it promptly.

For paediatric bookings, data must be submitted by a parent or legal guardian who provides explicit consent on behalf of the minor, consistent with PIPA's requirements for processing children's data.

12. Changes to This Policy

When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered users by email at least 14 days before changes take effect
• Where required by PIPA, seek renewed consent for any new processing of sensitive data

Continued use of the platform after the effective date of a revised policy constitutes acceptance of the changes.