Pyunhanga Privacy Policy

Effective date: 2026.11.11 Pyunhanga Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and related laws, and publishes this Privacy Policy to protect data subjects' personal information and handle related grievances promptly. This policy applies commonly to the Pyunhanga account (unified sign-in), the Pyunhanga app (health groups), Pyunhanga Map (pharmacy map), and the point service. Services and provider covered by this policy - Provider (developer): Pyunhanga Co., Ltd. (주식회사 편한가) — shown on Google Play as the developer "편한가" and on the App Store as the seller "주식회사 편한가" - Pyunhanga app — listed on Google Play and the App Store as "편한가 - 건강 모임" (English listing: "Pyunhanga: Health Groups"), package com.pyunhanga.record - Pyunhanga Map app — listed on Google Play and the App Store as "편한가 지도 - 약국 찾기", package com.pyunhanga.map - Pyunhanga Map web (map.pyunhanga.com), the Pyunhanga account (unified sign-in), and the point service 1. Information We Process and How It Is Collected ① At sign-up (social login — Kakao, Google, Apple, LINE, WeChat) - Required (received from the social provider): social account identifier (Kakao member number; Google/Apple unique identifier; LINE user ID; WeChat UnionID), sign-up provider - If provided by your social account: email address (may be unavailable, e.g., Apple private relay) - Auto-generated: unified account ID, nickname (auto-generated at sign-up, changeable later) - Apple sign-in only: Apple-issued refresh token (kept and used solely to revoke the Apple connection upon account deletion) ② Information you enter or register yourself - Profile: nickname, bio, profile photo, visibility settings - Health records (Pyunhanga app): condition logs (per-question scores), supplement list and categories, intake history - Step count (Pyunhanga app, optional): only if you separately consent to "Step sync" in the app, we read daily step totals from the steps recorded on your device (Apple Health on iOS; on Android, Google Play services step recording and, if you choose, Health Connect). Raw samples, time-of-day values, location, and routes are not collected. - Community and groups (Pyunhanga app): posts, comments, attached photos, pharmacist consultation questions, likes, group information, in-group sharing settings - Favorites (Pyunhanga Map): favorited pharmacies and products - Support: inquiry content, attached images, reply email (for logged-out inquiries) ③ Information generated or collected while using the services - Push notifications (Pyunhanga app): device push token, OS type, language setting, optional device identifier, notification settings - Push notifications (Pyunhanga Map app): app installation identifier (a random value created by the app), device push token, OS type, app version, language setting, notification settings (whether informational notifications are on, and the date and time you consented to advertising messages), and your member identifier if signed in — processed per device even when you are not signed in - Usage statistics (Google Analytics): a cookie identifier on the Pyunhanga Map web, an app instance identifier in the Pyunhanga Map app, your member number if signed in (a number assigned by the Company — your email, name and phone number are never sent), screen views and feature usage (e.g. using "Open now", tapping directions or call, receiving or redeeming a coupon), device type, OS, app version and language, and approximate location at country/city level — the member number is used only to follow one user's journey across the web and the app; advertising identifiers (IDFA, Android advertising ID) are not collected - Sign-in sessions: device label, session creation/expiry information - Access records: IP address, request time and path (server access logs) - Consent history: consent type, version, and time - Report/block history, point credit/adjustment history, AI analysis usage records ④ Personal location information (Pyunhanga Map) - Basic features: if you grant the browser's (or app's) location permission, your current location is used only on your device to show distances, sort by distance, and mark your position on the map, and is not transmitted to servers. - Location-based services (signed-in members with separate consent): for nearby pharmacy search and pharmacy visit verification, your current location at the time of each request is received, used only to process that request, not stored, and destroyed immediately. Only statutory records confirming use and provision (without coordinates) under Article 16 of the Location Information Act are automatically kept for at least six months and then destroyed. Location history and movement paths are not collected. For details, see the Pyunhanga Map Terms of Service (Location-Based Service Terms). ⑤ What we do not collect - Name, phone number, date of birth, gender, resident registration number - Advertising identifiers (IDFA, Android advertising ID) and behavioral data for personalized advertising - Medicine search/browsing history linked to a personal account 2. Purposes of Processing - Member identification, sign-up confirmation, unified account management (one account for the Pyunhanga app and Pyunhanga Map) - Providing Pyunhanga app features such as health records, community, groups, and pharmacist consultation - Providing step statistics and determining whether group step goals are met (only for members who consented to step sync) - Providing Pyunhanga Map features such as the pharmacy map and favorites, and nearby-pharmacy guidance based on current location - Providing automatic nutrition analysis (AI analysis) of food photos in posts - Crediting and viewing points and preventing improper accrual - Handling reports, protecting users, preventing abuse, and preventing misuse of health-record access (access audit logs) - Responding to inquiries, delivering notices, sending push notifications (per your settings) - Sending advertising messages such as events and offers by app push (only to devices that consented to advertising messages in the Pyunhanga Map app) - Analyzing service usage statistics (Google Analytics), improving the services and analyzing errors 3. Retention Periods ① Upon account deletion, personal information is destroyed as follows. - Social login connection information (including the Apple refresh token and the LINE access token): deleted immediately upon withdrawal (Kakao, Apple, and LINE connections are revoked at that time; WeChat offers no unlink method, so only the connection record held by the Company is deleted) - Pyunhanga app health records, posts, comments, and group data: deleted in bulk within 24 hours after withdrawal - Step count: deleted immediately when you turn off step sync, and upon account withdrawal - Pyunhanga Map favorites: deleted without delay after withdrawal - Pyunhanga Map app push device information: the link to your member account is removed when you sign out or withdraw (within 1 hour at the latest for withdrawal); per-device information is deleted on the first delivery attempt after the push token expires, e.g. when the app is deleted - Usage statistics (Google Analytics): deleted automatically 14 months after collection. A member number processed while signed in can no longer be matched to any person once the account information is destroyed on withdrawal - Point wallet and transaction history: deleted upon withdrawal (remaining points lapse) - Account information (email, nickname, etc.): destroyed after withdrawal processing ② The following are exceptionally retained for the stated periods. - Service access records (sign-ins, etc.): 3 months under the Protection of Communications Secrets Act - Consumer complaint/dispute records (support inquiries, etc.): 3 years under the E-Commerce Consumer Protection Act - Terms/privacy consent history: for proof of consent (dispute response) — 5 years after withdrawal - Report/sanction and operator action history: to prevent abuse through re-registration — 1 year after withdrawal - Health-record access audit logs: to trace misuse of sensitive-information access — 3 years from creation ③ For deleted comments that still have replies from other members, the body and author information are deleted and only a placeholder remains. 4. Provision to Third Parties The Company does not provide personal information to third parties, except in the following cases. ① Sharing you choose yourself (Pyunhanga app) — the items below are private by default and are disclosed only to the stated audience when you turn them on per group and per item. You may withdraw at any time in settings; changes to sharing settings are logged and retained. - To members of your group: supplement list and intake history, condition records (each selected separately) - To the group member you authorized and the answering pharmacist: proxy questions about your health - To all service users: the supplement list on your public profile (if enabled) ② Where required by law or pursuant to legally prescribed procedures such as investigations or trials 5. Outsourcing and Overseas Transfer ① The Company outsources processing as follows. - Amazon Web Services, Inc. (Seoul region ap-northeast-2, South Korea): service infrastructure, database and image file storage ② The following personal information is transferred overseas for processing. - Google LLC (Firebase Cloud Messaging, USA): device push token, notification title/body — for push delivery, retained until delivery is processed - Google LLC (Google Analytics and Google Analytics for Firebase, USA): cookie and app instance identifiers, your member number if signed in, screen views and feature usage, device, OS, app version and language, approximate location (derived from the IP address; the IP address itself is not stored) — for service usage statistics, transmitted over the network during use, retained for 14 months after collection - Google LLC (Gemini API, USA): attached photos in posts (food photos) — for automatic nutrition analysis, retained until analysis is processed ③ Outsourcing and transfer contracts stipulate compliance with privacy laws, restrictions on sub-outsourcing, and security measures, under the Company's supervision. You may refuse overseas transfer via the contact in Section 10; in that case, the relevant features (push notifications, AI analysis) may be limited. You may refuse usage statistics as described in Section 9. ④ Direct third-party communication notice: the Pyunhanga Map screen is rendered by your browser communicating directly with NAVER Cloud Corp.'s map servers, and your IP address may be transmitted to that provider in the process. When using social login, each provider's (Kakao, Google, Apple, LINE, WeChat/Tencent) privacy policy also applies. 6. Destruction of Personal Information Personal information is destroyed without delay when grounds arise. Electronic files are permanently deleted using irrecoverable methods; other records are shredded or incinerated. 7. Your Rights and How to Exercise Them ① You may view, edit, and delete your personal information (profile, health records, posts, favorites, etc.) in the app or on the web at any time. ② You may delete your account at any time via [Settings > Delete account] in the app or Pyunhanga Map. ③ In-group health-record sharing, public profile display, push notifications, and step sync can each be turned on and off in settings. In the Pyunhanga Map app, informational notifications and consent to advertising messages can each be turned on and off in [Settings > Notifications]; when you consent to or withdraw from advertising messages, the app shows you the result and its date right away. ④ Location, photo, camera, and notification permissions can be revoked at any time in your device (browser) settings. ⑤ For other requests (access, correction, deletion, suspension of processing), contact the privacy officer in Section 10; we will act without delay. Rights may also be exercised through a legal representative or an authorized agent. 8. Processing of Sensitive Information (Health Records) ① Health-related records in the Pyunhanga app (condition logs, supplement intake history, etc.) are entered by you, and the Company processes them solely to provide the services. ② Health records are in principle viewable only by you; where the Company (including pharmacists) accesses them within the minimum necessary scope (e.g., consultation answers), every access is logged to prevent misuse. ③ In-group sharing and proxy questions occur only by your explicit choice as described in Section 4-①. ④ Step counts are collected only when you separately consent in the app's "Step sync" screen; you may withdraw consent there at any time, and stored step data is deleted immediately upon withdrawal. The Company does not use step counts for advertising or marketing, nor provide or sell them to third parties. Groups see only whether a step goal was met; the step count itself is never disclosed to other users. 9. Cookies and Similar Technologies ① Pyunhanga Map (web) uses the following cookies. - Sign-in cookie (httpOnly): keeps you signed in; inaccessible to browser scripts. - Language/theme cookies (1 year): remember your preferences. - Visit-statistics deduplication value (localStorage): stored only on your device for 30-minute deduplication of anonymous statistics. - Google Analytics cookies (_ga etc., kept up to 2 years): for usage statistics. ② You may refuse cookies in your browser settings, which may limit features such as sign-in. ③ Pyunhanga Map uses Google Analytics on the web and Google Analytics for Firebase in the app to analyze usage statistics. If you are signed in, the member number assigned by the Company is sent with this data so that your journey across the web and the app can be analyzed (your email, name and phone number are never sent); advertising identifiers are not collected, and no personalized advertising is provided. On the web you can refuse collection through your browser's cookie settings or the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). The Pyunhanga app (health groups) uses no usage-statistics SDK. ④ Visit statistics for pharmacy/product pages store only anonymous aggregate counts not linked to accounts or IPs. 10. Privacy Officer and Grievance Handling - Name: Nam Yunseong - Title: Vice President - Contact: pyunhanga_official@pyunhanga.com You may direct all privacy-related inquiries, complaints, and remedy requests to the contact above; the Company will respond and act without delay. For other reports or counseling you may contact: - Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 in Korea) - Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972) - Supreme Prosecutors' Office Cyber Investigation (spo.go.kr / dial 1301) - Korean National Police Agency Cyber Bureau (ecrm.police.go.kr / dial 182) 11. Security Measures - Encryption in transit (HTTPS) and secure on-device storage of authentication tokens (mobile secure storage; httpOnly cookies on web) - No storage of raw authentication tokens (hash storage) with session expiry and rotation - Private image storage with access controlled via short-lived signed URLs - Minimized access rights; audit logs of operator actions and health-record access - Separation of the account database from service databases 12. Children Under 14 The Company does not collect personal information from children under 14; children under 14 may not sign up. 13. Changes to This Policy Changes to this policy are announced via app and website notices at least 7 days before taking effect (30 days for changes materially affecting your rights). - Announced: 2026-11-04 / Effective: 2026-11-11 (member number of signed-in members added to Pyunhanga Map usage statistics via Google Analytics) - Previous: 2026-10-23 / 2026-10-30 (Pyunhanga Map app push notifications and consent to advertising messages; Pyunhanga Map usage statistics via Google Analytics added) · 2026-09-22 (LINE and WeChat added as social login providers) · 2026-08-06