Pyunhanga Privacy Policy

Effective date: 2026.09.22 Pyunhanga Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and related laws, and publishes this Privacy Policy to protect data subjects' personal information and handle related grievances promptly. This policy applies commonly to the Pyunhanga account (unified sign-in), the Pyunhanga app (health records), Pyunhanga Map (pharmacy map), and the point service. Services and provider covered by this policy - Provider (developer): Pyunhanga Co., Ltd. (주식회사 편한가) — shown on Google Play as the developer "편한가" and on the App Store as the seller "주식회사 편한가" - Pyunhanga app — listed on Google Play and the App Store as "편한가 - 건강 기록" (English listing: "Pyunhanga: Health Journal"), package com.pyunhanga.record - Pyunhanga Map app — listed on Google Play and the App Store as "편한가 지도 - 약국 찾기", package com.pyunhanga.map - Pyunhanga Map web (map.pyunhanga.com), the Pyunhanga account (unified sign-in), and the point service 1. Information We Process and How It Is Collected ① At sign-up (social login — Kakao, Google, Apple, LINE, WeChat) - Required (received from the social provider): social account identifier (Kakao member number; Google/Apple unique identifier; LINE user ID; WeChat UnionID), sign-up provider - If provided by your social account: email address (may be unavailable, e.g., Apple private relay) - Auto-generated: unified account ID, nickname (auto-generated at sign-up, changeable later) - Apple sign-in only: Apple-issued refresh token (kept and used solely to revoke the Apple connection upon account deletion) ② Information you enter or register yourself - Profile: nickname, bio, profile photo, visibility settings - Health records (Pyunhanga app): condition logs (per-question scores), supplement list and categories, intake history - Step count (Pyunhanga app, optional): only if you separately consent to "Step sync" in the app, we read daily step totals from the steps recorded on your device (Apple Health on iOS; on Android, Google Play services step recording and, if you choose, Health Connect). Raw samples, time-of-day values, location, and routes are not collected. - Community and groups (Pyunhanga app): posts, comments, attached photos, pharmacist consultation questions, likes, group information, in-group sharing settings - Favorites (Pyunhanga Map): favorited pharmacies and products - Support: inquiry content, attached images, reply email (for logged-out inquiries) ③ Information generated or collected while using the services - Push notifications (Pyunhanga app): device push token, OS type, language setting, optional device identifier, notification settings - Sign-in sessions: device label, session creation/expiry information - Access records: IP address, request time and path (server access logs) - Consent history: consent type, version, and time - Report/block history, point credit/adjustment history, AI analysis usage records ④ Location information (Pyunhanga Map) If you have granted the browser's (or in-app webview's) location permission, your current location is used only on your device to show distances, sort nearby pharmacies, and mark your position on the map; it is not transmitted to the Company's servers, and the Company does not collect or store it. Location history and movement paths are not collected. ⑤ What we do not collect - Name, phone number, date of birth, gender, resident registration number - Automatic collection via advertising/behavioral analytics SDKs (no analytics or advertising SDKs are used) - Medicine search/browsing history linked to a personal account 2. Purposes of Processing - Member identification, sign-up confirmation, unified account management (one account for the Pyunhanga app and Pyunhanga Map) - Providing Pyunhanga app features such as health records, community, groups, and pharmacist consultation - Providing step statistics and determining whether group step goals are met (only for members who consented to step sync) - Providing Pyunhanga Map features such as the pharmacy map and favorites, and nearby-pharmacy guidance based on current location - Providing automatic nutrition analysis (AI analysis) of food photos in posts - Crediting and viewing points and preventing improper accrual - Handling reports, protecting users, preventing abuse, and preventing misuse of health-record access (access audit logs) - Responding to inquiries, delivering notices, sending push notifications (per your settings) - Improving the services and analyzing errors 3. Retention Periods ① Upon account deletion, personal information is destroyed as follows. - Social login connection information (including the Apple refresh token and the LINE access token): deleted immediately upon withdrawal (Kakao, Apple, and LINE connections are revoked at that time; WeChat offers no unlink method, so only the connection record held by the Company is deleted) - Pyunhanga app health records, posts, comments, and group data: deleted in bulk within 24 hours after withdrawal - Step count: deleted immediately when you turn off step sync, and upon account withdrawal - Pyunhanga Map favorites: deleted without delay after withdrawal - Point wallet and transaction history: deleted upon withdrawal (remaining points lapse) - Account information (email, nickname, etc.): destroyed after withdrawal processing ② The following are exceptionally retained for the stated periods. - Service access records (sign-ins, etc.): 3 months under the Protection of Communications Secrets Act - Consumer complaint/dispute records (support inquiries, etc.): 3 years under the E-Commerce Consumer Protection Act - Terms/privacy consent history: for proof of consent (dispute response) — 5 years after withdrawal - Report/sanction and operator action history: to prevent abuse through re-registration — 1 year after withdrawal - Health-record access audit logs: to trace misuse of sensitive-information access — 3 years from creation ③ For deleted comments that still have replies from other members, the body and author information are deleted and only a placeholder remains. 4. Provision to Third Parties The Company does not provide personal information to third parties, except in the following cases. ① Sharing you choose yourself (Pyunhanga app) — the items below are private by default and are disclosed only to the stated audience when you turn them on per group and per item. You may withdraw at any time in settings; changes to sharing settings are logged and retained. - To members of your group: supplement list and intake history, condition records (each selected separately) - To the group member you authorized and the answering pharmacist: proxy questions about your health - To all service users: the supplement list on your public profile (if enabled) ② Where required by law or pursuant to legally prescribed procedures such as investigations or trials 5. Outsourcing and Overseas Transfer ① The Company outsources processing as follows. - Amazon Web Services, Inc. (Seoul region ap-northeast-2, South Korea): service infrastructure, database and image file storage ② The following personal information is transferred overseas for processing. - Google LLC (Firebase Cloud Messaging, USA): device push token, notification title/body — for push delivery, retained until delivery is processed - Google LLC (Gemini API, USA): attached photos in posts (food photos) — for automatic nutrition analysis, retained until analysis is processed ③ Outsourcing and transfer contracts stipulate compliance with privacy laws, restrictions on sub-outsourcing, and security measures, under the Company's supervision. You may refuse overseas transfer via the contact in Section 10; in that case, the relevant features (push notifications, AI analysis) may be limited. ④ Direct third-party communication notice: the Pyunhanga Map screen is rendered by your browser communicating directly with NAVER Cloud Corp.'s map servers, and your IP address may be transmitted to that provider in the process. When using social login, each provider's (Kakao, Google, Apple, LINE, WeChat/Tencent) privacy policy also applies. 6. Destruction of Personal Information Personal information is destroyed without delay when grounds arise. Electronic files are permanently deleted using irrecoverable methods; other records are shredded or incinerated. 7. Your Rights and How to Exercise Them ① You may view, edit, and delete your personal information (profile, health records, posts, favorites, etc.) in the app or on the web at any time. ② You may delete your account at any time via [Settings > Delete account] in the app or Pyunhanga Map. ③ In-group health-record sharing, public profile display, push notifications, and step sync can each be turned on and off in settings. ④ Location, photo, camera, and notification permissions can be revoked at any time in your device (browser) settings. ⑤ For other requests (access, correction, deletion, suspension of processing), contact the privacy officer in Section 10; we will act without delay. Rights may also be exercised through a legal representative or an authorized agent. 8. Processing of Sensitive Information (Health Records) ① Health-related records in the Pyunhanga app (condition logs, supplement intake history, etc.) are entered by you, and the Company processes them solely to provide the services. ② Health records are in principle viewable only by you; where the Company (including pharmacists) accesses them within the minimum necessary scope (e.g., consultation answers), every access is logged to prevent misuse. ③ In-group sharing and proxy questions occur only by your explicit choice as described in Section 4-①. ④ Step counts are collected only when you separately consent in the app's "Step sync" screen; you may withdraw consent there at any time, and stored step data is deleted immediately upon withdrawal. The Company does not use step counts for advertising or marketing, nor provide or sell them to third parties. Groups see only whether a step goal was met; the step count itself is never disclosed to other users. 9. Cookies and Similar Technologies ① Pyunhanga Map (web) uses the following cookies. - Sign-in cookie (httpOnly): keeps you signed in; inaccessible to browser scripts. - Language/theme cookies (1 year): remember your preferences. - Visit-statistics deduplication value (localStorage): stored only on your device for 30-minute deduplication of anonymous statistics. ② You may refuse cookies in your browser settings, which may limit features such as sign-in. ③ The Pyunhanga app and Map use no advertising or behavioral-tracking cookies or SDKs and provide no personalized advertising. ④ Visit statistics for pharmacy/product pages store only anonymous aggregate counts not linked to accounts or IPs. 10. Privacy Officer and Grievance Handling - Name: Nam Yunseong - Title: Vice President - Contact: pyunhanga_it@pyunhanga.com You may direct all privacy-related inquiries, complaints, and remedy requests to the contact above; the Company will respond and act without delay. For other reports or counseling you may contact: - Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 in Korea) - Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972) - Supreme Prosecutors' Office Cyber Investigation (spo.go.kr / dial 1301) - Korean National Police Agency Cyber Bureau (ecrm.police.go.kr / dial 182) 11. Security Measures - Encryption in transit (HTTPS) and secure on-device storage of authentication tokens (mobile secure storage; httpOnly cookies on web) - No storage of raw authentication tokens (hash storage) with session expiry and rotation - Private image storage with access controlled via short-lived signed URLs - Minimized access rights; audit logs of operator actions and health-record access - Separation of the account database from service databases 12. Children Under 14 The Company does not collect personal information from children under 14; children under 14 may not sign up. 13. Changes to This Policy Changes to this policy are announced via app and website notices at least 7 days before taking effect (30 days for changes materially affecting your rights). - Announced: 2026-09-22 / Effective: 2026-09-22 (LINE and WeChat added as social login providers) - Previous announcement/effective date: 2026-08-06