Privacy Policy and Cookie Notice
Effective date: 12 October 2026
1. Introduction
YEPIDA Clinic (“we”, “us”) complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy explains how we handle the personal information of people who use our blog, yepida-blog.com (the “Blog”). It applies to the Blog and to the information we receive through the consultation channels that the Blog’s buttons open (WhatsApp, LINE, WeChat and phone). Our clinic website (yepida.kr) is covered by its own privacy policy.
2. Who we are
| Name | YEPIDA Clinic (예피다의원) |
|---|---|
| Representative | 김홍석 |
| Address | 6F ICT TOWER, 624 Gangnam-daero, Gangnam-gu (Sinsa-dong), Seoul, Republic of Korea |
| Business registration no. | 234-38-01532 |
| Phone | +82-2-6952-2586 |
| Websites | yepida.kr (clinic), yepida-blog.com (Blog) |
3. What we collect, how, and why
The Blog does not ask you for your name or contact details through sign-up, comments or forms. We process the following information.
| Category | Information | How it is collected | Purpose | Basis |
|---|---|---|---|---|
| (1) Usage statistics (only if you consent) | Cookie identifiers (_ga, _ga_<ID>), pages viewed, time on page, scrolling, clicks on consultation and map buttons, device and browser information, approximate location derived from your IP address, referring page, UTM campaign information | Google Analytics 4 via Google Tag Manager | Understanding how the Blog is used and improving content | Your consent |
| (2) Ad measurement and ads to past visitors (only if you consent) | Cookie identifier (_fbp), page views, a reading event after 60 seconds, consultation-button clicks, technical information sent by your browser (such as IP address) | Meta Pixel | Measuring our ads and showing our ads to Blog visitors on Facebook and Instagram (personalised advertising) | Your consent |
| (3) Delivering the Blog and security (always) | IP address, security cookies (such as __cf_bm), request information (time of access, requested URL, browser information, etc.) | Processed automatically by Cloudflare (CDN and security) and Gabia (hosting) | Delivering the Blog and keeping it secure, including blocking malicious traffic and bots | [ ] |
| (4) Consultations (when you message us) | Name or nickname, messenger account ID, phone number (when you use WhatsApp or phone), message contents and photos you send. If you choose to share it, information about your health (skin condition, treatment history, photos) — see Section 4 | You contact us directly via WhatsApp, LINE, WeChat or phone using the buttons on the Blog | Answering your enquiry and helping you book an appointment | Steps taken at your request before entering into a contract and/or your consent; separate consent for health information |
| (5) Your cookie choice | Your consent choice | Stored in your browser’s localStorage (key: “yepida_consent”); it is not sent to our server | Remembering your choice so the banner is not shown repeatedly | Necessary to respect your choice |
| (6) Maps | Cookies set by the map provider and information sent by your browser (such as IP address) | Embedded Google Maps (English, Japanese and Traditional Chinese pages) and AMap (Simplified Chinese pages) | Showing the clinic’s location | [ ] |
Before you give consent, Google Analytics may send cookieless “consent denied” signals under Google Consent Mode v2. These signals do not contain cookie identifiers, but because of how browsers communicate, technical information such as your IP address may reach Google.
4. Health information (sensitive information)
If you send us information about your health during a consultation — such as your skin condition, treatment history or photos — this may be sensitive information. At the start of a consultation we ask for your separate consent to process sensitive information, and we ask you not to send health information or photos until you have consented. You can still ask general questions (location, opening hours, how to book) without giving this consent.
We do not publish consultation contents on the Blog, so your sensitive information is not made public through the Blog.
5. How long we keep information
| Information | Retention period |
|---|---|
| Google Analytics 4 usage statistics | Deleted automatically 14 months after collection (Google Analytics data retention setting) |
| Meta Pixel data | According to Meta’s policy [ ] |
| Information processed by Cloudflare and Gabia | According to each provider’s policy [ ] |
| Consultation records (messages, photos, etc.) | 3 years from the last contact, unless a longer period is required by law |
| If you become a patient after a consultation | The medical-record retention periods set by the Medical Service Act of Korea and related laws |
| Your cookie choice | Until you delete it in your browser or change your cookie settings |
6. Cookie notice
6.1 Cookie banner and consent
When you first visit the Blog, a cookie banner appears. Analytics and advertising cookies are set only if you click “Accept”. You can use the Blog without accepting. You can change or withdraw your consent at any time by clicking “Cookie settings” in the site footer, which re-opens the banner. Withdrawal does not affect processing carried out before you withdrew.
6.2 Cookies and similar technologies we use
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
| _ga | Analytics (consent required) | Distinguishes visitors | 2 years | |
| _ga_<ID> | Analytics (consent required) | Keeps session state | 2 years | |
| _fbp | Meta | Advertising (consent required) | Identifies the browser for ad measurement and ads to past visitors | 90 days |
| __cf_bm and similar | Cloudflare | Strictly necessary (security) | Distinguishes bots and malicious traffic | 30 minutes |
| yepida_consent (localStorage) | YEPIDA Clinic | Strictly necessary (functional) | Stores your cookie choice | Until deleted |
| Map provider cookies | Google (Google Maps), AMap/Alibaba | Third party | Displaying maps and the provider’s own purposes | According to each provider’s policy |
6.3 How to refuse cookies
- Do not accept on the cookie banner, or withdraw consent via the “Cookie settings” link.
- Block or delete cookies in your browser settings (for example: Chrome — Settings > Privacy and security > Third-party cookies; Safari — Settings > Privacy; Edge — Settings > Cookies and site permissions).
- If you block strictly necessary cookies, parts of the Blog may not display correctly.
7. Personalised advertising
| Behavioural information collected | Page views, reading for 60 seconds or more, consultation-button clicks |
|---|---|
| How | Collected automatically by the Meta Pixel if you consent |
| Purpose | Measuring our ads and showing our ads to Blog visitors on Facebook and Instagram |
| Who collects and processes it | Meta Platforms |
| Retention | See Section 5 |
| How to refuse | Refuse or withdraw via the cookie banner or “Cookie settings”. You can also manage personalised ads in your Facebook and Instagram ad settings. |
8. Service providers that process data for us
| Provider | Service |
|---|---|
| IDES Partners Co., Ltd. (Republic of Korea) — Representative: Kim Dong-hoon; 9F Hyundai Tower, 423 Teheran-ro, Gangnam-gu, Seoul; Business registration no. 549-88-03494; Contact: [email protected] | Clinic management support (MSO): blog operation and content production; website analytics (GA4, GTM); advertising and Meta Pixel management; responding to chat consultations (WhatsApp, LINE, WeChat); booking management and customer service; [other tasks] |
| Gabia (Republic of Korea) | Blog hosting (server operation) |
| Cloudflare, Inc. (USA) | Content delivery (CDN) and security |
| Google LLC (USA) | Usage analytics (Google Analytics 4, Google Tag Manager) |
9. Disclosure to third parties
We do not provide your personal information to third parties, except where permitted by the Personal Information Protection Act of Korea, such as where the law specifically requires it.
10. International transfers
When you use the Blog or our consultation channels, your personal information may be transferred abroad or processed on servers of overseas providers, as set out below. Transfers take place over the network when you access the Blog or send a message.
| Recipient (contact) | Country | Information | Purpose | When and how | Retention | How to refuse and effect of refusal |
|---|---|---|---|---|---|---|
| Google LLC [contact: ] | USA | Items in Section 3 (1); IP address etc. when a map is displayed | Usage analytics; map display | When you use the Blog after consenting / when a map is displayed; network transmission | 14 months (analytics); maps according to Google’s policy | Refuse on the cookie banner. You can still use the Blog. |
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. [contact: ] | USA / Ireland | Items in Section 3 (2) | Ad measurement; personalised advertising | When you use the Blog after consenting; network transmission | According to Meta’s policy [ ] | Refuse on the cookie banner. You can still use the Blog. |
| Cloudflare, Inc. [contact: ] | USA (via data centres worldwide) | Items in Section 3 (3) | Content delivery; security | Each time you access the Blog; network transmission | According to Cloudflare’s policy [ ] | This is necessary to use the Blog; to refuse, please do not use the Blog. |
| WhatsApp (Meta) [contact: ] | USA and other countries | Items in Section 3 (4) | Sending and receiving consultation messages | When you message us on WhatsApp | Section 5 (consultation records) | You can use another channel (e.g. phone). |
| LY Corporation [contact: ] | Japan | Items in Section 3 (4) | Sending and receiving consultation messages (LINE official account @001iwwnm) | When you message us on LINE | Section 5 (consultation records) | You can use another channel. |
| Tencent [contact: ] | China | Items in Section 3 (4) | Sending and receiving consultation messages (WeChat ID yepida_clinic) | When you message us on WeChat | Section 5 (consultation records) | You can use another channel. |
| AMap (Alibaba Group) [contact: ] | China | Items in Section 3 (6) (IP address, cookies etc. when the map is displayed) | Map display (Simplified Chinese pages) | When the map is displayed; network transmission | According to AMap’s policy | [ ] |
11. Destruction of personal information
When the retention period ends or the purpose has been achieved, we destroy personal information without delay. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated. Where the law requires us to keep information, we store it separately from other personal information. Google Analytics data is deleted automatically by Google after the configured period.
12. Your rights
You may at any time:
- request access to your personal information;
- request correction of inaccurate information;
- request deletion;
- request suspension of processing;
- withdraw your consent — you can withdraw cookie consent at any time via the “Cookie settings” link in the site footer.
To exercise your rights, contact our privacy officer (Section 15) by email, phone or in writing. We will act within the period set by applicable law. You may also exercise your rights through a legal representative or an authorised person. Requests may be limited where the law provides grounds to do so. Analytics data linked only to a cookie identifier does not allow us to identify you, so we may be unable to locate it for access or deletion requests; in that case we will guide you to withdraw consent and delete cookies in your browser.
13. Security measures
We take the following measures to keep personal information secure:
- Administrative measures: keeping the number of staff who handle personal information to a minimum, access and management procedures, and regular security training
- Technical measures: firewalls and other security equipment, designated system users with passwords that are changed regularly, HTTPS (SSL) encryption across the Blog, and Cloudflare security services
- Physical measures: the Blog server runs in the data centre of our hosting provider (Gabia)
14. Children
The Blog is not intended for children under 14 (Republic of Korea) or for people under 16 (European Union). We do not knowingly collect their personal information, and if we learn that we have, we delete it without delay.
15. Privacy officer
| Name | Kim Hong-seok |
|---|---|
| Position | Lead Director (Medical Department) / Privacy contact: Park Mi-ri (Consultation Team) |
| [email protected] | |
| Phone | +82-2-6952-2586 |
Please contact the privacy officer for questions, complaints or remedies related to personal information.
16. Complaints and remedies
If you need to report or seek advice about a privacy infringement, you may contact the following Korean bodies:
- Personal Information Infringement Report Center (operated by KISA): 118 (in Korea), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors’ Office: 1301 (in Korea), www.spo.go.kr
- Korean National Police Agency: 182 (in Korea), ecrm.police.go.kr
If you live outside Korea, you may also complain to the data protection authority where you live (see Section 17).
17. Additional information by region
17.1 European Economic Area and United Kingdom
- Legal bases: analytics and advertising cookies — consent (Art. 6(1)(a) GDPR); security processing by Cloudflare — legitimate interests (Art. 6(1)(f)); answering consultations — steps taken at your request before entering into a contract (Art. 6(1)(b)); health information — explicit consent (Art. 9(2)(a)).
- Your rights: access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent.
- Complaints: you may lodge a complaint with the supervisory authority in the country where you live or work.
- International transfers: the Republic of Korea is covered by adequacy decisions of the European Commission and the United Kingdom. Basis for transfers to other countries: [ ]
17.2 Japan
- Through Google Analytics and the Meta Pixel, information relating to you such as cookie identifiers (personally referable information) may be provided to Google and Meta. This happens only if you accept on the cookie banner.
- Where personal information is provided to a third party in a foreign country, information on that country’s personal information protection system is available in materials published by Japan’s Personal Information Protection Commission, and we will provide it on request to our privacy officer.
- Complaints: Personal Information Protection Commission of Japan.
17.3 Mainland China
- If you consult us via WeChat, the information you send is received and processed by us in the Republic of Korea. At the start of a consultation we ask for your separate consent to the processing of sensitive personal information (health information, photos) and to processing outside mainland China.
- Your rights: access and copy, correction and supplementation, deletion, restriction or refusal of processing, explanation of our personal information processing rules, and withdrawal of consent.
17.4 Taiwan
- Your rights: inquire and review, obtain copies, supplement or correct, request that collection, processing or use stop, and request deletion.
17.5 Hong Kong
- You may request access to and correction of your personal data.
- Complaints: Office of the Privacy Commissioner for Personal Data (PCPD).
18. Changes to this policy
If we change this policy, we will announce it on the Blog at least 7 days before the change takes effect, or at least 30 days before for changes that significantly affect your rights.
Effective date: 12 October 2026