Privacy Policy
Reference translation: This English text is a courtesy translation provided for reference only. The Korean version is the official, legally binding text, and the Korean version prevails if the two differ. View the Korean original.
At a glance: Advertising disclosures require consent (app and website) / research disclosures of pseudonymized information: see Article 13 / account deletion and retention exceptions: see Articles 4 and 13 / health information stored encrypted / contact privacy@habitushealth.app
1. General
Habitus Health Corporation (the “Company”) establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea to protect the personal information of data subjects and to handle related grievances promptly and smoothly. This policy applies to the mobile application “Mayu” and the website (mayu.ai.kr) provided by the Company. Where processing differs between the app and the website, the relevant article states each separately.
2. Personal Information We Process
| Category | Items |
|---|---|
| Member information (required) | Email (or social account identifier), nickname, date of birth, sex, device information (model, OS, app version, push token) |
| Sensitive information (health; separate consent) | Height, weight, BMI, goal weight and weight records; meal records, photos, and analysis results; exercise records; workout heart rate measured by a connected wearable (Apple Watch or Galaxy Watch) (average and maximum, with the “Consent to Show Heart Rate on Workout Check-in Cards”); type, dose, and administration records of medications; menstrual cycle (optional); fasting records; medical conditions entered by the user; appetite, condition, and adverse-reaction records (when entered); menstrual cycle sharing settings (the items selected for sharing, the identifier of the member the cycle is shared with, the time zone of the sharing member, anniversary dates, and the time sharing started) |
| Location information (optional consent) | GPS location (while recording exercise) · approximate location (to show weather) |
| Marketing (optional consent) | Nickname, app push token |
| Paid subscription (optional) | Subscription status (whether subscribed, product, period) and payment history metadata (payment time, product name, amount, app market order identifier). Payment-method information (card numbers and similar) is processed by the app market operator and is not collected or stored by the Company |
| Ad performance measurement (optional consent) | App install and launch records, whether sign-up was completed, whether a free trial was started, subscription payment amount and currency, a random identifier the measurement tool creates for each app installation, device information (model, OS, app version, language, time zone, carrier, screen size, number of processor cores; the Android app also sends storage capacity), the store the app was installed from, the identifying information of the ad if the app was installed through an ad or opened from an ad link, connecting IP address (see Section 3 of the consent text for the items per recipient) |
| AI coach memory (when you use the coach · can be turned off in the app) | Life circumstances, preferences, and goals the member mentioned in conversations with the AI coach and the action tasks the coach set, and a summary of the member’s habits over the last 4 weeks compiled from their records (retained until the member deletes it, turns the feature off, or deletes their account; action tasks for 4 weeks) |
| Groups (optional use) | Group chat messages and attached photos, cheering posts (destroyed when a member deletes their account, and together with the room when a group room is removed) |
| Community board (public · optional use) | Nickname, avatar display information, posts, comments and photos, attached workout routines and day of meals, progress if the member chooses to show it (week number and rate of change; height, weight and goal weight if the member chooses “Height and weight too”), translations of posts and comments into other languages, cheer, report and block records, records of consent to the community rules (destroyed without delay when the member deletes the post or deletes their account) |
| Automatically collected | Access time, access IP, app usage records (including error logs) |
| Prevention of illegal use (automatic collection) | A device identifier used to check whether the free trial has been used (Android app: a value converted from the device's unique value so that it cannot be reversed · iPhone app: an indicator of whether it has been used, kept by Apple for each device). It is not stored linked to the member account. |
| Health record import (optional; separate consent for health information) | Health screening results (date, institution, test items, values and findings, including weight and waist circumference); consultation and prescription history (date, institution, department, diagnoses and prescribed medications); test documents uploaded by the member (files and extracted values); identity verification information (name, date of birth and mobile phone number). The Company does not receive or retain resident registration numbers. Where a resident registration number is required for identity verification, the integration provider (identity verification agency) processes it directly on its own screen on its own basis under the relevant laws; it is not transferred to the Company and is not part of any work the Company entrusts. Identity verification information is destroyed immediately after the exchange with the integration provider is completed. |
| AI coach conversation input | Messages entered by the member and health records and coach memory needed to answer them (which may include context from imported health records); web search queries (general medical terms only, excluding personal records and sensitive clinical information) |
When a member posts on the community board, the member’s nickname (except for posts made anonymously), text, and photos are disclosed to other members. Progress (week and rate of change) is disclosed on a post only if the member chooses to display it, and height, weight, and target weight only if the member separately consents to “Share height and weight” and chooses “Height and weight too.” The member may change the display to “Off” at any time when writing a post or under My > Settings > Community settings > Progress display, and it is not shown on posts made after that. The display on posts already made can be removed by editing or deleting those posts. The daily meals and workout routines attached to a post, and any health-related content the member writes in posts or photos, such as medications taken or medical conditions, are also disclosed to other members; if the member does not wish to disclose them, the member may choose not to attach or write them and may post anonymously.
When a member uses the menstrual cycle sharing feature, only the items the member selects are displayed to one other member whom the member designates with an invitation code, and they remain displayed until the member turns sharing off. The Company does not create a copy for that display on the other member’s device or account, and the sharing settings are destroyed without delay when sharing is turned off or the member deletes their account.
If the member gives consent to read health app data, the Company reads workouts and the heart rate during them from the health app (Apple Health · Health Connect) only on the member's device to calculate heart-rate zone time. The Company's servers store only daily heart-rate zone time (minutes), workout count, the max heart rate reference value used and the weekly goal; heart rate values and workout sessions themselves are not sent. These values are retained until the member deletes their account and then destroyed without delay, and if consent is withdrawn, the results calculated on the device are deleted immediately.
Weekly heart-rate zone time stored on the server is used as material for the weekly report and AI coach replies, and for that AI processing it is passed to the overseas processor named in Sections 6 and 7. Information read from the health app and values calculated from it are never used for advertising and are not sold.
3. Purposes of Processing
① Member management, such as member registration, identification, and login (including sending a one-time email verification code at sign-up) ② Storage and display of records such as diet, exercise, weight, and medication, and provision of statistics ③ Management of friends and group communities ④ Response to customer inquiries and delivery of notices ⑤ Prevention of illegal use and ensuring service stability ⑥ Non-identifying statistical analysis to improve services ⑦ Sending service guidance and product update emails (you may unsubscribe at any time) ⑧ Ad performance measurement and ad delivery optimization (with optional consent) ⑨ Personalizing AI coach replies (coach memory) ⑩ Operating the community board (displaying posts and comments and translating them for members who use other languages, automatic detection of community rule violations, and handling reports, blocks and posting suspensions)
⑪ Importing health records, extracting values from test documents, storing and displaying records, and providing context for coach replies ⑫ Scientific research and public-interest archiving under Article 13
The legal bases for each purpose are set out below. Health information requires separate consent under Article 23(1) of the Personal Information Protection Act of Korea, in addition to any contractual basis listed below.
| Purpose | Legal basis |
|---|---|
| Processing of member information (required) and automatically collected items (processed without consent) | Article 15(1)(4) of the Personal Information Protection Act of Korea (necessary to perform a contract) |
| Providing registration, records, AI coach and community services | Article 15(1)(4) of the Personal Information Protection Act of Korea (necessary to perform a contract), or Article 15(1)(1) for members who have given consent |
| Processing health information (sensitive information) and importing health records | Separate consent under Article 23(1) of the Personal Information Protection Act of Korea |
| Location-based exercise records and weather | Consent under Articles 18 and 19 of the Act on the Protection and Use of Location Information of Korea (Location-Based Service Terms) |
| Marketing and ad performance measurement | Consent under Article 15(1)(1) of the Personal Information Protection Act of Korea (see Articles 5 and 7 for third-party disclosures and cross-border transfers) |
| Scientific research and public-interest archiving | Pseudonymization under Article 28-2 of the Personal Information Protection Act of Korea (see Article 13) |
4. Retention Period
Personal information is destroyed without delay when a member deletes their account, except that information is retained for the periods required by law, including the Protection of Communications Secrets Act (access records, 3 months) and the Act on the Consumer Protection in Electronic Commerce (where applicable: contract and payment records, 5 years; dispute handling, 3 years; display and advertising, 6 months).
The device identifier used to check whether the free trial has been used is retained for 1 year from the date the free trial started, regardless of member withdrawal, and then destroyed.
Destruction of health records following deletion or withdrawal of consent is covered by Article 8. Retention and deletion exceptions for pseudonymized information are covered by Article 13.
5. Provision to Third Parties
① The Company does not provide personal information collected in the app to third parties except for the advertising disclosures below and research disclosures of pseudonymized information under Article 13. However, only for members who have agreed to ad performance measurement, the Company provides it to Meta Platforms, Inc. and Google LLC as set out in the table below.
| Recipient | Purpose of provision | Items provided | Retention and use period |
|---|---|---|---|
| Meta Platforms, Inc. | Ad performance measurement and ad delivery optimization (including personalized advertising) | The “ad performance measurement” items in Section 2 | Up to 2 years (per the recipient’s Business Tools Terms) |
| Google LLC (iOS app only) | Measurement of app install, sign-up, free trial, and subscription conversions | The “ad performance measurement” items in Section 2 | The retention period set by the Company (14 months) |
This provision applies only to members who have agreed to the “Consent to provision and overseas transfer of personal information for ad performance measurement” (optional), and no information is transmitted for this purpose from the devices of members who have not agreed. Refusing consent does not limit your use of the service.
② However, on the website (mayu.ai.kr), for visitors who have consented to the advertising purpose, behavioral information is transmitted to Meta Platforms, Inc. through the Meta pixel as described in Sections 11 and 12. This constitutes provision to a third party under Article 17 of the Personal Information Protection Act of Korea and a cross-border transfer under Article 28-8 of the same Act; the transfer details are disclosed in Section 7. ③ If any other provision becomes necessary in the future, the Company will disclose the recipient, purpose, items, and retention period, obtain separate consent under Article 17 of the Personal Information Protection Act of Korea, and publish the details in this policy. ④ Sharing activity in friend and group features is the data subject’s own choice to display information to other members within a scope the data subject selects, and does not constitute provision to third parties. ⑤ Display in the menstrual cycle sharing feature is likewise the data subject’s own choice of the items to share and of the member to share them with, displayed to one other member, and does not constitute provision to third parties. The feature operates only after separate consent is obtained on that screen, and the display stops when the data subject turns sharing off.
6. Outsourcing of Processing
The Company outsources personal-information processing as follows under Article 26 of the Personal Information Protection Act of Korea. Outsourcing contracts stipulate compliance with privacy laws, restrictions on re-outsourcing, and security measures, and the Company supervises each processor.
| Processor | Outsourced work |
|---|---|
| Amazon Web Services, Inc. (Seoul region, Korea) | Cloud server operation and data storage, and email delivery (sign-up verification codes, service guidance, and product update emails) · stored in Korea, so this is not a cross-border transfer |
| Google LLC (Firebase) | Sending app push notifications |
| Anthropic, PBC (Claude API) | AI analysis of meal photos, generation of AI coach (Mayu coach) answers, web search tool queries (general medical terms only, excluding personal records and sensitive clinical information), extraction of values from health record documents, and automatic detection of community rule violations in and translation of community posts and comments (the information provided is used only for this processing and is not used for model training · DPA) |
| Open-Meteo (weather forecast API · governed by Swiss law) | Weather lookup on the home screen. Only coordinates rounded to about 1 km are sent; account identifiers, names, and records are not sent (the operator discloses that the access IP and the coordinates may remain in its server logs) |
| Health record integration provider (before a contract is signed) | The provider’s name and outsourced work will be added to this article after a contract is signed. Import using simplified identity authentication will not be offered before then. |
7. Cross-border Transfer
For meal analysis, AI coaching and extraction of values from health record documents using Anthropic in the United States, the Company transfers personal information (including sensitive health information) as described below. Meal photo analysis and AI coach conversations rely on the “Consent to Overseas Transfer of Personal Information” under Article 28-8(1)(1) of the Personal Information Protection Act of Korea, and extraction of values from health record documents and web search tool queries rely on Article 28-8(1)(3), as outsourced processing necessary to perform a contract and disclosed in this policy. Processing sensitive health information requires the separate consent described in Article 3. AWS stores data in its Seoul region in Korea, so that storage is not a cross-border transfer.
| Item | Details |
|---|---|
| Recipient | Anthropic, PBC (Claude API) |
| Contact | privacy@anthropic.com |
| Destination country | United States |
| Time and method of transfer | Sent over a telecommunications network when AI meal analysis or AI coaching is used, or when extraction of values from a health record document is requested |
| Items transferred | Meal photos for AI analysis; AI coach conversation input (which may include health records, coach memory and context from imported health records); health record documents submitted for value extraction; web search tool queries (general medical terms only, excluding personal records and sensitive clinical information) |
| Purpose | AI meal analysis, AI coach replies and web searches, and extraction of values from health record documents |
| Retention and use period | Until the outsourced purpose is fulfilled (destroyed without delay on account deletion or withdrawal of consent) |
| How to refuse and the effect of refusal | No transfer takes place if you do not use the relevant AI features. Members who have given consent may withdraw it under My > Terms and Policies, or request that transfers stop using the contact in Article 14. Refusal may limit access to AI meal analysis, AI coaching and value extraction from health record documents. |
In addition, only for members who have agreed to ad performance measurement, the Company transfers personal information overseas as follows under Article 28-8(1)1 of the Personal Information Protection Act of Korea (see “Consent to provision and overseas transfer of personal information for ad performance measurement”). Refusing or withdrawing consent does not limit your use of the service.
| Item | Meta Platforms, Inc. | Google LLC |
|---|---|---|
| Contact | 1 Meta Way, Menlo Park, CA 94025, USA · help.meta.com/support/privacy | googlekrsupport@google.com |
| Country | United States | United States |
| Time and method | Transmitted over the network when launch after install, sign-up, free trial start, or subscription payment occurs while you use the app | Same (iOS app only) |
| Items transferred | The “ad performance measurement” items in Section 2 | The “ad performance measurement” items in Section 2 |
| Purpose | Ad performance measurement and ad delivery optimization (including personalized advertising) | Measurement of app install, sign-up, free trial, and subscription conversions |
| Retention and use period | Up to 2 years (per the recipient’s Business Tools Terms) | The retention period set by the Company (14 months) |
| How to refuse | Withdraw in My > Terms and Policies > Optional Consent Management | Same |
For visit analysis and personalized advertising on its website (mayu.ai.kr), the Company also transfers personal information abroad as set out below under Article 28-8(1)(1) of the Personal Information Protection Act of Korea, only for visitors who have consented to each purpose. No information is sent before consent because the script is not loaded. Refusing or withdrawing consent does not restrict use of the website.
| Item | Advertising purpose | Analytics purpose |
|---|---|---|
| Recipient | Meta Platforms, Inc. (Contact) 1 Meta Way, Menlo Park, CA 94025, USA · help.meta.com/support/privacy |
Google LLC (Contact) googlekrsupport@google.com |
| Country | United States | United States |
| Time and method | Transmitted over telecommunications networks through the Meta pixel while a consenting visitor uses the website | Transmitted over telecommunications networks through Google Analytics 4 while a consenting visitor uses the website |
| Items transferred | Page view records, app store button click records, cookie identifiers (_fbp, _fbc) | Referral paths and page usage records, cookie identifiers (_ga series) |
| Purpose | Displaying personalized advertising and measuring advertising performance | Analyzing how the website is used |
| Retention and use period | Cookies for up to 3 months; deleted immediately upon withdrawal of consent | Cookies for up to 24 months; deleted immediately upon withdrawal of consent |
| How to refuse, and the effect | Leaving the relevant option unselected or choosing “Decline all” in the cookie banner prevents the transfer. Consent may be withdrawn at any time through “Cookie settings” in the Cookie Policy, and refusing or withdrawing does not restrict use of the website. | |
In addition, to operate the community board (performance of the service contract), the Company discloses in this policy and transfers the text of community posts overseas as set out below under Article 28-8(1)3 of the Personal Information Protection Act of Korea.
| Item | Details |
|---|---|
| Recipient | Anthropic, PBC (Claude API) |
| Contact | privacy@anthropic.com |
| Country | United States |
| Time and method | Transmitted over telecommunications networks when a post or comment is published or edited (automatic detection) and when a member who uses another language taps “See translation” (translation) |
| Items transferred | The text of posts and comments (title, body, comments) · photos, nicknames and the progress line are not sent |
| Purpose | Automatic detection of community rule violations, translation into other languages |
| Retention and use period | Until the purpose of the outsourced work is achieved (only the detection results and translations are kept on the Company servers, and they are destroyed together when the original post is deleted or the member deletes their account) |
| How to refuse | Nothing is transferred if you do not publish posts or comments in the community. If you do not want this transfer, you may choose not to use the community, and this does not limit your use of the rest of the service. |
In addition, for the weather lookup on the home screen (performance of the service contract), the Company discloses in this policy and entrusts processing overseas as set out below under Article 28-8(1)3 of the Personal Information Protection Act of Korea.
| Item | Details |
|---|---|
| Recipient | OpenMeteo GmbH (Open-Meteo weather forecast API) |
| Contact | info@open-meteo.com |
| Country | Switzerland (operator’s location) |
| Time and method | Transmitted over telecommunications networks when the weather on the home screen is looked up |
| Items transferred | Coordinates rounded to about 1 km, access IP |
| Purpose | Weather lookup |
| Retention and use period | Use ends as soon as the lookup response is returned (the operator discloses that the access IP and the coordinates may remain in its server logs and that those logs are deleted after 90 days) |
| How to refuse | If the member does not consent to approximate location or withdraws that consent, nothing is transmitted and only the weather is not displayed. |
The Company also entrusts processing abroad as set out below to send app push notifications (performance of the service contract), relying on Article 28-8(1)(3) of the Personal Information Protection Act of Korea and disclosing the transfer in this policy.
| Item | Details |
|---|---|
| Recipient | Google LLC (Firebase Cloud Messaging) |
| Contact | googlekrsupport@google.com |
| Country | United States |
| Time and method | Transmitted over telecommunications networks when the app registers a notification token and when a notification is sent |
| Items transferred | App push token, notification title and body |
| Purpose | Sending app push notifications |
| Retention and use period | Until the purpose of the outsourcing is achieved (destroyed without delay when the member deletes their account) |
| How to refuse | If the member turns off Mayu notifications in the device settings, no notifications are sent, and this does not restrict use of the rest of the service. |
8. Destruction of Personal Information
① Personal information is destroyed without delay when the retention period expires or the purpose of processing is achieved. ② Electronic files are deleted in a way that makes recovery impossible, and paper documents are shredded or incinerated. Where information is retained under relevant laws, the basis for retention and the retained items are as set out in Article 4.
③ Imported health records, including original files, are destroyed immediately when the member deletes records by source, withdraws the relevant consent or deletes their account. See Article 13 for deletion of pseudonymized information and exceptions.
9. Rights of Data Subjects and Legal Representatives
① Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal information under Articles 35 through 37 of the Personal Information Protection Act of Korea. ② Rights may be exercised through in-service features, in writing, or by email (privacy@habitushealth.app), and the Company notifies the result of its measures within 10 days of receiving the request. ③ The Company accepts only adults (19 or older under Korean law) as members and does not process personal information of children under 14 (see Article 22-2 of the Act).
④ Under Article 28-7 of the Personal Information Protection Act of Korea, rights provisions concerning access, correction, deletion and suspension of processing, among others, do not apply to pseudonymized information. See Article 13 for deletion of records not yet used in research and the handling of pseudonymized information already disclosed.
10. Security Measures
Under Article 29 of the Personal Information Protection Act of Korea and the Standards for Measures to Secure the Safety of Personal Information, the Company establishes and implements an internal management plan, manages tiered access permissions, operates access controls (intrusion blocking and detection), encrypts personal information (passwords and sensitive health information encrypted in storage and in transit), retains access records and prevents their forgery or alteration, prevents malicious programs, and controls physical access.
11. Automatic Collection Tools
① The app does not use web browser cookies. The app may use tools that collect device information and error logs to secure service stability, and the items collected do not exceed the automatically collected items listed in Section 2. On the devices of members who have agreed to ad performance measurement, the ad measurement tools (Meta app SDK, and Google Analytics in the iOS app) transmit the information described in Sections 5 and 7. On the devices of members who have not agreed, these tools do not transmit any information, and members can withdraw consent at any time in My > Terms and Policies. The app counts the first launch after install, reaching the sign-in screen, and sign-in attempts with their outcome (success, failure, cancellation) only as daily totals by device type (iOS, Android). No information that could identify a device or a person is sent or stored for this. ② The website (mayu.ai.kr) uses cookies to analyze visits and measure advertising performance. The tools used, the types of cookies, and their retention periods are disclosed in a table in the Cookie Policy. ③ Analytics cookies and advertising cookies each require separate consent, and the relevant script is not loaded before consent is given. ④ Visitors may select individual purposes or decline all of them in the notice banner shown on their first visit, and may change their choice at any time through “Cookie settings” in the Cookie Policy. Declining all of them does not restrict use of the website. ⑤ Visitors may also refuse or delete stored cookies in their web browser settings.
12. Behavioral Information
① The Company collects and uses behavioral information on its website (mayu.ai.kr) for personalized advertising as set out below. Collection of behavioral information in the app is described in Paragraph ⑥ of this Section.
| Item | Details |
|---|---|
| Behavioral information collected | Website page view records, app store button click records, cookie identifiers (_fbp, _fbc) |
| Collection method | Collected and transmitted automatically through the Meta pixel (Meta Platforms, Inc.) while a visitor uses the website |
| Purpose | Displaying personalized advertising and measuring advertising performance |
| Retention and use period | Cookies for up to 3 months; deleted immediately upon withdrawal of consent |
② Advertising cookies require consent separately from analytics cookies, and the pixel script is not loaded before consent is given, so no information is sent to Meta.
③ Data subjects may refuse collection by leaving “Advertising cookies” unselected or choosing “Decline all” in the notice banner, and may withdraw consent at any time through “Cookie settings” in the Cookie Policy. Stored cookies (_fbp, _fbc) are deleted immediately upon withdrawal, and refusing or withdrawing consent does not restrict use of the Service.
④ The information above is transferred to Meta Platforms, Inc. in the United States. This constitutes provision to a third party under Article 17 of the Personal Information Protection Act of Korea and a cross-border transfer under Article 28-8 of the same Act, and the transfer is disclosed in Section 7.
⑤ The Company does not use sensitive information, such as health records entered in the app, for personalized advertising, and does not combine it with information collected through the pixel.
⑥ (App) Only for members who have agreed to ad performance measurement, the Company collects behavioral information in the app and provides it to Meta Platforms, Inc. and Google LLC.
| Behavioral information collected | Collection method | Purpose | Retention and use period |
|---|---|---|---|
| App install and launch records, whether sign-up was completed, whether a free trial was started, subscription payment amount and currency | The ad measurement tools installed in the app (Meta app SDK, and Google Analytics in the iOS app) send it automatically when the relevant event occurs | Ad performance measurement and ad delivery optimization (Meta: including personalized advertising) | Same as the table in Section 5 |
No information is collected or transmitted from the devices of members who have not agreed, and consent may be withdrawn at any time in My > Terms and Policies > Optional Consent Management. The Company does not collect advertising identifiers (IDFA, advertising ID).
13. Pseudonymized Information
13.1. Purposes
Under Article 28-2 of the Personal Information Protection Act of Korea, the Company processes pseudonymized information without data subjects’ consent for scientific research (research into treatment of obesity and metabolic diseases and lifestyle habits, including publication of papers) and public-interest archiving.
13.2. Members covered
This covers members using the service in the Republic of Korea: members whose device time zone is set to Korea or who have imported health records using Korean identity verification. Records accumulated before this policy takes effect are also included.
13.3. Included and excluded information
Only predefined numeric and coded fields are processed: meal nutrient values (such as calories and protein), weight, medication (name, dose, interval and administration date), exercise, fasting, condition check-ins, screening values, diagnosis codes and prescriptions, sex, age in five-year bands, and height.
Excluded information: photos; free text (notes, conversations and community posts); names, nicknames, email addresses, contact details and device identifiers; and consultations and prescriptions related to psychiatry, sexually transmitted infections or HIV.
13.4. Pseudonymization method
Identifiers are removed and a different random number is assigned for each study. No additional information (mapping table) is created, so the data cannot be linked back to the original member. Dates are represented as “N days after the first record” rather than calendar dates, and age is grouped into five-year bands.
13.5. Disclosures to research partners
Pseudonymized information may be provided to joint research institutions such as universities, hospitals and research institutes. Each time the Company processes pseudonymized information (including disclosures to joint research institutions), the purpose of processing (study name), recipient institution, date and time, items, number of records and details of use are recorded under Article 28-4(3) of the Personal Information Protection Act of Korea. Disclosures are published once a year in the disclosure history table below.
13.6. Safeguards
Access to pseudonymized information is limited to the Company’s representative alone. Download links expire 24 hours after issuance. Processing records are retained for at least three years from the date the pseudonymized information is destroyed.
13.7. Account and record deletion
When a member deletes their account or records, records not yet used in research are deleted as well. Pseudonymized information already used in a paper or provided to a joint research institution remains because it cannot be linked back to the original member.
13.8. Disclosure history
| Study | Institution | Date and time | Items | Number of records |
|---|---|---|---|---|
| No disclosures to date |
14. Privacy Officer
The Company designates and operates a privacy officer under Article 31 of the Personal Information Protection Act of Korea. Responsible department: Privacy & Security Team · Contact: privacy@habitushealth.app · +82-70-8018-8640
15. Remedies for Infringement
You may report to or consult the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Cybercrime Investigation Division of the Supreme Prosecutors’ Office (1301), or the National Police Agency Cyber Investigation Bureau (182, ecrm.police.go.kr). These are Korean authorities.
16. Changes to This Policy
If this policy is added to, deleted from, or amended, notice is given through in-service announcements from 7 days before the effective date (30 days for material changes to data subjects’ rights).
Because this revision materially changes data subjects’ rights, an announcement will be made in the app 30 days before it takes effect.