Privacy Policy

Version 1.0.1 • sha256:e9ffc6135319

Privacy Policy

Version: 1.0.0

Effective date: 2026-04-11

Authoritative language: Korean. In case of conflict, the Korean version governs.

Data Protection Officer (CPO): Kang In Wook / privacy@concourse.to / 070-4577-7512

⚠️ This is a draft document. Final review by a Korean medical law and data protection attorney is required before production use. The STRUCTURE of this document (sections, cross-border table, CPO block, intermediary disclaimer, retention periods) reflects PIPA §30 and GDPR Art. 13 requirements.

1. Information We Collect

Concourse Inc. ("Concourse", "we", "our") collects the following categories of information:

1.1 Required data

•Account information: name, email, phone number, nationality, password (hashed)

•Payment information: billing address, PortOne payment token (no full card number stored)

•Usage data: access logs, device information, IP address, cookies

1.2 Sensitive medical data (PIPA §23)

Concourse processes the following sensitive medical data for cross-border dental care matching. Separate explicit consent is required.

•Dental condition and subjective symptoms

•Dental treatment history

•X-ray, CBCT, panoramic imaging

•Intraoral photos

•Medical history, current medications, allergies

1.3 Users under 14

Personal data of users under 14 is collected only with verifiable parental/guardian consent (PIPA §22(6)).

2. Purposes

1.Cross-border patient solicitation intermediation — matching with Korean dental clinics, quote delivery, booking facilitation

2.Service fee billing, settlement, and refunds

3.Concierge services — airport pickup, accommodation guidance, visit coordination

4.Patient-clinic communication via in-app chat

5.Platform safety — fraud prevention, dispute resolution, legal obligations

3. Retention

Category	Period	Basis
Account data	Until account deletion	User consent
Medical images (X-ray, intraoral)	10 years	Korean Medical Act §22, §23
Treatment records	10 years	Korean Medical Act §22
Payment & transaction records	5 years	E-commerce Act §6
Dispute resolution records	3 years	E-commerce Act §6
Access & audit logs	3 years	PIPA Enforcement Decree §48-2
Marketing records	6 months	E-commerce Act §6

After the retention period expires, data is auto-destroyed (encryption key destruction + DB soft delete → physical deletion). Destruction events are written to the audit log.

4. Data Sharing

Concourse does not share personal data with third parties except as follows:

•Matched Korean dental clinics: sensitive medical data necessary for consultation, quoting, and treatment

•Legal obligations (law enforcement warrants, court orders)

•With explicit prior user consent

5. Cross-Border Data Transfer

Concourse transfers personal data to the following non-Korean processors. Separate consent is required under PIPA §28-8.

Processor	Country	Purpose	Data Categories
Railway (PaaS)	미국 / United States	Application + database hosting	All application data (encrypted at rest)
Cloudinary	미국 / United States	Image storage + delivery	Medical images (X-rays, dental photos) — AES-256-GCM encrypted
Resend	미국 / United States	Transactional email delivery	Email address, name, transaction details
Sentry	미국 / United States	Error monitoring (PII scrubbed)	Error payloads, stack traces (no medical content after Phase 5 scrubbing)
DeepL	독일 / Germany (EU)	Chat message translation	Chat message text (ephemeral)

•Transfer method: Real-time transfers over encrypted channels (TLS 1.2 or higher).

•Processor contacts: Available on each processor's official website; Concourse will provide on request.

•Right to refuse: You may refuse cross-border transfer. However, because core services (payments, email, translation) all go through US-based processors, refusing blocks account creation. Existing users may withdraw cross-border consent at any time via "My Data > Withdraw Consent"; some services (email alerts, international payments, auto-translation) will stop.

6. Data Subject Rights

You may exercise the following rights at any time (PIPA §35-39, GDPR Art. 15-22):

1.Right of access — view the personal data we hold about you

2.Right to rectification — correct inaccurate information

3.Right to erasure — request deletion (subject to statutory retention for medical records)

4.Right to restrict processing — pause processing for specific purposes

5.Right to data portability — export in machine-readable format (JSON, PDF)

Exercise these rights via the in-app "My Data" menu or by emailing privacy@concourse.to. We will respond within 30 days (GDPR) or 10 days (PIPA).

7. Security Measures

•Encryption: AES-256-GCM for sensitive data at rest; TLS 1.2+ for data in transit

•Access control: Role-based access, medical files visible only to the patient and matched doctor

•Audit logging: PHI read events retained for 3 years (PIPA §29, Enforcement Decree §48-2)

•Regular security reviews: Quarterly internal security audits

•Designated Data Protection Officer: Kang In Wook

8. Data Breach Notification

In the event of a personal data breach, Concourse will:

•Within 24 hours: Detect, assess scope, notify the CPO

•Within 72 hours: Notify the Personal Information Protection Commission and KISA (PIPA §34)

•Without undue delay: Notify affected users (categories affected, time, response, contact)

•Public disclosure: Post notice on the website

9. Cookies

Concourse uses cookies and similar storage technologies to maintain your session. Essential cookies cannot be refused; analytics cookies can be opted out in settings.

10. Data Protection Officer

•Name: Kang In Wook

•Email: privacy@concourse.to

•Phone: 070-4577-7512

You may also report complaints to:

•Personal Information Infringement Report Center (privacy.kisa.or.kr, 118)

•Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972)

11. Changes to this Policy

Material changes will be announced in-app and via email at least 7 days before they take effect. Continued use after the effective date constitutes acceptance.

Effective date: 2026-04-11