Question 1

Article 1 Purpose of Processing Personal Information

Accepted Answer

THYROSCOPE INC. (hereinafter referred to as “the company”) processes personal information for the following purposes. The personal information being processed will not be used for purposes other than the following purposes. If the purpose of use is changed, necessary measures will be taken, such as obtaining separate consent in accordance with the Personal Information Protection Act.

Signing up for membership service and management: confirming the intention to sign up for membership, identifying and authorizing an individual according to the membership service, maintaining and managing membership, prevention of unauthorized use of the service, various notifications, complaint handling, etc. 
Provided company services include: various services, delivery of a contract, contents and customized service, payment of utilization fee, and collection of credits, etc. 
Provided marketing and advertising: announcement of events, customized advertisements, and advertisements about services.
Improvement of services and development of new services:
Processing pseudonymized information for statistical preparation, scientific research, records preservation for public interest, etc.

Question 2

Article 2 Items of Personal Information to be Processed

Accepted Answer

1.	The company processes the personal information items as follows. 
1)	The information that users shall directly enter when or after signing up for membership of Glandy Application
-	Required: Email address, password, phone number, name, date of birth, gender, nickname, facial photo
-	Optional: profile photo, user’s frequently visited hospital, and doctor in charge
2)	The information that users shall directly enter when or after signing up for membership of Glandoc Website
-	Required: Email address, password, name, patients’ name, patients’ phone number

2.	The company processes the following sensitive information items. 
1)	The information that users shall directly enter when or after signing up for membership of Glandy Application
-	Required: Height, weight, thyroid function test results, hypothyroidism and hyperthyroidism survey results, information on current medications, daily medication intake of specific drugs, history of thyroid disease/treatment, family history of thyroid disease, history of comorbid conditions, family history of comorbid conditions, CAS evaluation, MRD1 measurement, diplopia score, ocular pain score, heart rate, step count, sleep, other exercise information, etc. 
2)	The information that users shall directly enter when or after signing up for membership of Glandoc Website
-	Required: CAS evaluation, MRD1 measurement, diplopia score, ocular pain score, etc.
3)	The information collected through third-party services/devices(hereafter referred to as ‘smartwatches, etc.’) connected to Glandy Application
-	Required: Heart rate, Sleep information

3.	In the process of using the service, the following information may be collected automatically. 
- Access (log-in) time, operating system of the connected device, model of the connected device, language of the connected device, identifier of the connected terminal, and access network information unique only for the Glandy application

4.	The company, in order to handle grievance of users, collects and processes the necessary items of each of the above information, specific items necessary for grievance handling, and the Social Network Service(SNS) nickname set by users (in the case of inquiries through the SNS Channel).

5.	The company may receive personal information of clinical trial participants who use the Glandy application only from clinical trial institutions by filling out a separate consent form.

Question 3

Article 3 Period of Processing and Retention of Personal Information

Accepted Answer

1.	The company processes and retains personal information within the period of retention and use of personal information in accordance with laws and regulations, or the period of personal information retention and use agreed upon when collecting personal information from the data subject. 
2.	The company immediately deletes personal information when it achieves the purpose of collecting personal information or users withdraw membership. However, despite membership withdrawal or loss of eligibility, the information will be retained:
1)	if an investigation is in progress due to violation of relevant laws and regulations, until the end of the investigation; 
2)	if a claim-obligation relationship by the use remains, until the settlement of the claim-obligation relationship;
3)	if the company terminates the service use contract due to violation of the Terms of Use, for one year from the date of termination to prevent re-signing up; 
4)	if a user participates in a clinical trial, for the period described in the subject manual and consent form signed by the user.
3.	Notwithstanding the preceding paragraphs, the company shall retain the information until the end of the relevant period according to the reason that is as follows:
1)	Records on transactions such as contract contents and fulfillment under the Act on the Consumer Protection in Electronic Commerce 
- Records on the contract or subscription withdrawal, the payment, and supply of goods, etc.: 5 years 
- Records on the consumer complaints or dispute settlement: 3 years 
2)	Computer communication and Internet log records, and access location tracking data pursuant to Article 41 of the Protection of Communications Secrets Act: 3 months
3)	Books and documentary evidence related to all transactions regulated by each tax-related Act: 5 years, which is the retention period under the Framework Act on National Taxes
4)	(For clinical trial participants) Records and data on conducting clinical trials: materials related to clinical trials for manufacturing permission and import permission or permission for change: stored for 3 years from the date of permission, other clinical trial-related materials: stored for 3 years from the date of completion of clinical trials

Question 4

Article 4 Provision of Personal Information to Third Parties

Accepted Answer

The company processes the personal information of a data subject only within the scope specified in Article 1, and only provides personal information to third parties with the consent of the data subject or in case that there is specific regulation of the Personal Information Protection Act or other laws.

Question 5

Article 5 Entrustment of Personal Information Processing

Accepted Answer

1.	For the smooth processing of personal information, the company entrusts the processing of personal information to companies such as:
1)	Amazon Web Services, Inc.
- Entrusted operations: Data storage, operation and management of cloud servers
2.	For the smooth processing of personal information, the company entrusts the processing of personal information to overseas companies such as:
2)	Google, Inc.
- Information manager and contact information: googlekrsupport@google.com 
- Purpose of transfer: to implement software functions
- Items of personal information transferred: serial number and model name of mobile device
- Countries to which personal information are transferred: USA
- Date and method of transfer: transmission over the network at the time of use of the service
- Period of use of personal information: consistent with the storage period stipulated in this Privacy Policy
3.	If the change of the entrustment operations or outsourcees, the company shall disclose the change immediately through this Privacy Policy.

Question 6

Article 6 Destruction of Personal Information

Accepted Answer

1.	When personal information becomes unnecessary, such as the expiration of the personal information retention period or the achievement of the purpose of processing, the company shall destroy the personal information without delay. 
2.	If personal information shall be retained in accordance with the laws and regulations described in Article 3 though the retention period of the personal information with the consent of the data subject has elapsed or the purpose of processing has been achieved, the information shall be transferred to a separate database (DB) or stored in a different location. 
3.	The procedure and method of destruction of personal information are as follows. 
1)	Destruction procedure: The company selects the personal information with the reason for destruction and destroys the personal information with the approval by a privacy officer of the company. 
2)	Destruction method: The company destroys personal information recorded and stored in the form of electronic files using technical methods so that the records cannot be reproduced, and personal information recorded and stored in paper documents is destroyed by shredding it with a shredder or incinerating it.

Question 7

Article 7 Matters Concerning Installation, Operation, and Rejection of Devices that Automatically Collect Personal Information

Accepted Answer

In order to improve the quality of the service, the company uses Firebase Analytics, a service provided by Google, Inc. (hereinafter referred to as “Google”) to analyze the activities of users in the service application. If users do not want Google to process their information, they can contact our privacy officer. For more information on Google's processing of information, please visit https://firebase.google.com/docs/analytics

Question 8

Article 8 Use and Provision of Personal Information within the Scope Reasonably Related to the Purpose of Collection

Accepted Answer

The company may use or provide personal information to third parties without the consent of the data subject, considering each of the following criteria within the original purpose of collection and within a reasonable range. 
1)	Whether it is relevant to the purpose of the original collection: to decide based on whether the purpose of the original collection and the purpose of additional use and provision are related to its properties or tendency
2)	Whether there is predictability of further use or provision of personal information considering circumstances of colleting personal information or processing practices: to decide considering the relationship between the personal information controller and a data subject, the level of technology and the speed of its development, and the general circumstances (practices) established over substantial period of time
3)	Whether it unfairly infringes on the interests of the data subject: to decide considering whether the interests of the data subject are actually infringed in relation to the purpose of further use and whether the infringement of the interests is unfair
4)	Whether necessary measures have been taken to ensure safety, such as pseudonymization or encryption: to decide considering whether safeguards are taken based on the possibility of infringement

Question 9

Article 9 Rights, Obligations, and the Exercise of the Right of Data Subjects and Legal Representatives

Accepted Answer

1.	Data subjects can exercise the following rights related to the protection of personal information at any time with respect to the company. 
1)	Request for access to personal information
2)	Request for correction if there is an error, etc.
3)	Request for deletion 
4)	Request to stop processing 
2.	Users may exercise the right pursuant to Paragraph 1 through the use of the relevant menu (menu of personal information confirmation and change, withdrawal) provided by the service, and if there is no such menu, users may conduct it by writing, calling or e-mailing to the company, and the company will take action without delay. 
3.	If a data subject requests correction or deletion of the errors or others in their personal information, the company will not use or provide the personal information until the correction or deletion is completed. 
4.	The exercise of rights pursuant to the clause 1 may be carried out through an agent such as the legal representative of the data subject or a person who has been delegated. In this case, users shall submit a power of attorney to the company. 
5.	Data subjects shall not infringe on the personal information and privacy of the data subject or others being handled by the company in violation of relevant laws such as the Personal Information Protection Act.

Question 10

Article 10 Measures to secure safety of personal information

Accepted Answer

The company takes the following measures to ensure the safety of personal information. 
1)	Technical measures: The personal information of a data subject is protected by a password, and important data is protected by the use of separate security functions such as encrypting files and transmitted data or file locking. The company installs and periodically updates antivirus software to prevent damage caused by computer viruses, and uses a firewall system for each server to prevent external cyber-attack such as hacking. 
2)	Administrative measures: The company has implemented administrative measures such as limiting and minimizing the number of employees handling personal information to the person in charge, conducting regular training on personal information protection obligations, and managing access rights.

Question 11

Article 11 Privacy Officer

Accepted Answer

1.	The company designates a privacy officer as follows in order to be responsible for the handling of personal information and the processing complaints from data subjects related to the processing of personal information and damage relief.
-	Full name: Jaemin Park
-	Position: CEO
-	Contact: +82-52-264-4153
-	Email: jaemin.park@thyroscope.com
2.	Data subjects may contact the privacy officer and the relevant department to ask matters concerning all inquiries related to personal information protection, complaints handling, damage relief and others occurred while using the company’s services. The company will respond to and handle inquiries from data subjects without delay.

Question 12

Article 12 Revision of this Privacy Policy

Accepted Answer

This privacy policy may be revised in accordance with changes in relevant laws and regulations, internal operating policies, etc. Once the policy is revised, the changed contents will be announced through the “Notice” of our service at least 7 days before the revision. However, if there is an important change in the rights of the data subject regarding the collection and use of personal information, the company will notify users at least 30 days in advance.

Question 13

Supplementary Provisions

Accepted Answer

Privacy Policy Version : V2
Effective Date : May 3rd, 2024.

Privacy policy of THYROSCOPE INC.

1. Purpose of processing personal information

2. Items of personal information to be processed

3. Processing and retention period of personal information

4. Provision of personal information to third parties

5. Entrustment of the processing of personal information

6. Destruction of Personal Information

7. Matters concerning the installation, operation, and rejection of devices that automatically collect personal information

8. Use and provision of personal information within the scope reasonably related to the purpose of collection

9. Rights, Obligations, and Methods of Exercise of Information Subject and Legal Representative

10. Measures to ensure the safety of personal information

11. Person in charge of personal information protection

12. Revision of this Personal Information Processing Policy

13. Supplementary provision