Banpoleeum Plastic Surgery Privacy Policy ◆ In accordance with Article 30 of the Personal Information Protection Act, Banpoleeum Plastic Surgery establishes and discloses the following personal information processing guidelines in order to protect the personal information of data subjects (customers) and to handle related grievances promptly and smoothly. 1. Purpose of Collecting and Using Personal Information □ The company uses the collected personal information for the following purposes. ο Performance of contracts related to service provision and delivery of content accompanying such services ο Identity verification, personal identification, prevention of fraudulent use by improper members and unauthorized use, complaint handling, and delivery of notices in connection with service use ο Use for marketing and advertising, including providing events and promotional information and participation opportunities, providing services and placing advertisements based on demographic characteristics, measuring access frequency, and compiling service usage statistics ο Verifying the identity of complainants, confirming complaints, contacting/notifying for fact-finding, and notifying processing results 2. Items of Personal Information Collected □ We collect the following personal information for membership registration, consultation, service applications, etc. ο Collected items: name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, service usage records ο Optional items: branch, areas of interest, selected event items, registration path, mailing and SMS service subscription status ο Retention period: semi-permanent until a separate opt-out or membership withdrawal is requested ο Collection method: website (membership registration, consultation board, reservation board, simple login, etc.) 3. Retention and Use Period of Personal Information ① Banpoleeum Plastic Surgery processes and retains personal information within the retention/use period consented to at the time of collection from the data subject, or within the retention/use period stipulated by law. ② Specific processing and retention periods are as follows. ο Customer registration and management: until termination of the service agreement; however, where credit/debt relationships remain, until such relationships are settled ο Records of contracts, withdrawal of subscription, payment, and supply of goods in e-commerce: 5 years ο When collected for diagnosis and treatment: in accordance with the Medical Service Act ο Even when the purpose of collection or provision has been achieved, personal information may be retained where there is a need to preserve it under the Commercial Act or other laws 4. Provision of Personal Information to Third Parties Banpoleeum Plastic Surgery does not provide personal information to third parties except where the separate consent of the data subject is obtained or where special legal provisions apply, such as cases falling under Article 17 of the Personal Information Protection Act. 5. Rights and Obligations of the Data Subject and How to Exercise Them The data subject may exercise the following personal information protection rights against Banpoleeum Plastic Surgery at any time. ① Request to access personal information ② Request for correction in case of errors ③ Request for deletion ④ Request to suspend processing Such requests may be made in writing, by email, or by fax, etc. in accordance with Form No. 8 attached to the Enforcement Rule of the Personal Information Protection Act, and Banpoleeum Plastic Surgery will take action without delay. Where the data subject requests correction or deletion of errors in personal information, the relevant personal information will not be used or provided until the correction or deletion is completed. Rights may be exercised through a legal representative of the data subject or an agent such as a duly authorized delegate. In this case, a power of attorney in the form of Form No. 11 attached to the Enforcement Rule of the Personal Information Protection Act must be submitted. 6. Personal Information Items Processed — Banpoleeum Plastic Surgery processes the following personal information items. ο Collected items: name, date of birth, login ID, password, mobile phone number, email address, access logs, cookies, service usage records ο Optional items: branch, areas of interest, selected event items, registration path, mailing and SMS service subscription status 7. Destruction of Personal Information ① As a principle, Banpoleeum Plastic Surgery destroys the relevant personal information without delay once the purpose of processing has been achieved. The procedures, deadlines, and methods of destruction are as follows. When the retention period has elapsed, the personal information is destroyed within 5 days from the end of the retention period; when the personal information becomes unnecessary due to achievement of the processing purpose, discontinuation of the service, closure of business, etc., it is destroyed within 5 days from the date it is deemed unnecessary. ② Banpoleeum Plastic Surgery destroys personal information by the following methods. ο Electronic files: file deletion, disk formatting, or technical methods that render records unrecoverable ο Paper documents: shredding or incineration 8. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices To provide users with customized services, Banpoleeum Plastic Surgery operates "cookies" and similar devices that frequently store and retrieve user information. ο Cookies are used to analyze access frequency and visit duration, identify user preferences and interests, track activity, and measure event participation and visit counts, thereby providing personalized services ο Users may, by configuring options in their web browser, allow all cookies, be prompted each time a cookie is stored, or refuse the storage of all cookies 9. Measures to Ensure the Safety of Personal Information In accordance with Article 29 of the Personal Information Protection Act, Banpoleeum Plastic Surgery takes the following technical, administrative, and physical measures necessary to ensure safety. ο Conducting regular internal audits We conduct internal audits regularly (once a year) to ensure safety related to personal information handling. ο Minimizing and training staff who handle personal information We designate staff who handle personal information, limit them to those in charge, and minimize the number to manage personal information. ο Establishment and implementation of an internal management plan We establish and implement an internal management plan for the safe processing of personal information. ο Technical countermeasures against hacking, etc. To prevent leakage and damage of personal information due to hacking, computer viruses, etc., we install security programs, perform periodic updates and inspections, install systems in areas with controlled external access, and monitor and block them technically and physically. ο Encryption of personal information Users' passwords are encrypted and stored/managed so that only the individual can know them, and important data is protected using separate security functions such as encrypting files and transmitted data or using file-locking features. ο Restriction of access to personal information We take necessary measures to control access to personal information by granting, changing, and revoking access rights to the database system that processes personal information, and we control unauthorized external access using an intrusion prevention system. 10. Personal Information Protection Officer Banpoleeum Plastic Surgery takes overall responsibility for tasks related to personal information processing, and designates a Personal Information Protection Officer as below to handle complaints and damage relief from data subjects related to personal information processing. 11. Handling in Case of Non-consent Users (data subjects) have the right to refuse consent to the collection and use of personal information. However, if consent is not given, the provision of related services may be restricted. 13. This privacy policy is effective from February 9, 2026.

Patient Rights A. Right to Receive Medical Care Patients have the right to receive appropriate health and medical services to protect their health. This right shall not be infringed on grounds such as gender, age, religion, social status, or economic situation, and medical personnel may not refuse treatment without justifiable reason. B. Right to Know and Right to Self-determination Patients have the right to receive sufficient explanations from their attending physician, nurse, etc. regarding their condition, treatment methods, expected outcomes (including side effects), and treatment costs, to ask detailed questions, and to decide for themselves whether to consent to a treatment method. C. Right to Confidentiality Patients are entitled to protection of physical and health-related confidentiality related to their treatment, and medical personnel and institutions may not disclose or release medical information and secrets without the patient's consent, except in cases prescribed by law such as criminal investigations. D. Right to Remedy for Damages Where life, physical, or financial damage occurs due to infringement of rights, patients have the right to receive appropriate remedy. In such cases, you may request consultation and relief from the Korea Medical Dispute Mediation and Arbitration Agency (02-6210-0114, www.k-medi.or.kr). Patient Responsibilities A. Duty of Trust and Respect Toward Medical Personnel The relationship between patient and medical personnel is based on trust, and patients must accurately inform medical personnel of their health-related information. B. Duty Not to Receive Treatment by Improper Means Patients must verify their identity before treatment and may not receive treatment by false or improper means, such as receiving treatment under another person's name.