Legal
Privacy Policy
This policy explains how Modical handles personal information submitted through our website, service-request, and consultation-booking services.
Effective October 8, 2026
1. Controller and privacy contact
Controller: MODICAL Co., Ltd. · Representative: ANDRESEN PETER RIISGAARD · Business registration no.: 144-86-03484 · Registered business address: 7F, A7, 25 Euncheon-ro, Gwanak-gu, Seoul, Republic of Korea (Bongcheon-dong, Jeongam Building).
Privacy Officer: JAEHYUN YOOK · Email: contact@modical.co.kr · Telephone: +82 10-4246-6226.
2. Personal information, purposes, basis, and retention
Modical processes only information reasonably necessary for the purpose described below. Depending on the interaction, processing is based on the user's consent, steps requested before entering a contract, performance of a contract, compliance with law, or Modical's legitimate interests where the requirements of the Personal Information Protection Act are met.
| Activity | Information | Purpose and basis | Retention |
|---|---|---|---|
| Website inquiry | Name, email, nationality, whether the user is in Korea, current Korean-visa status, current visa and expiry where provided, preferred contact method and related identifier (phone, KakaoTalk, WeChat, or Instagram), preferred language, and message. | Respond to and follow up on the inquiry. Consent and/or steps requested before a possible service contract. | One year after the inquiry is resolved, unless longer retention is required by law. |
| Information call booking | Name, email, phone number, booking date and time, time zone, call format, answers submitted in Cal.com, location or meeting information, and source/CTA/visa/service context. | Schedule, confirm, deliver, and prepare for the information call; maintain internal source attribution. Requested contract steps and performance; consent where required. | Up to one year after the information call is completed or the booking is closed. Statutory transaction records are kept for the applicable statutory period. |
| Service/package request | Selected service, visa, procedure and package; name, email, nationality, Korea/visa status, current visa and expiry where provided, preferred contact method and related identifier, preferred language, and message. | Assess the request, contact the user, prepare a quotation, and enter into or perform a service agreement. Consent and/or requested contract steps and performance. | If no contract is formed, one year after closure. If applicable, contract/payment/service-supply records are retained for five years, complaint/dispute records for three years, and advertising records for six months. |
| Website operation and security | IP address, browser/device data, timestamps, request and security logs, referring URL, and necessary cookie or session identifiers used by embedded services. | Operate and secure the website, prevent fraud and abuse, diagnose failures, and respond to incidents. Compliance with law and legitimate interests where statutory requirements are met. | Generally up to three months in Modical-controlled operational logs, unless a longer period is required for law, security, or incident response. Processor logs and backups follow the provider schedules described below. |
| Optional website analytics | Cookie or device identifiers, IP-derived location, browser/device information, pages viewed, referring page, timestamps, and interaction events configured in Google Tag Manager. | Measure website use and improve content and navigation. Processed only after the visitor gives consent. | According to the active analytics-tag configuration and generally no longer than 14 months for user-level and event-level analytics controlled by Modical, unless a shorter period is configured. |
3. Sensitive and identification information
Do not submit resident registration numbers, passport copies or numbers, criminal-history information, health information, or other sensitive immigration documents through the general inquiry, service-request, or booking fields. If an agreed paid service requires such information, Modical will identify an approved secure channel and provide any additional notice or obtain any consent required by law before collection.
4. Provision to third parties
Modical does not provide personal information to independent third parties except with the data subject's consent or where another lawful basis permits it. If an agreed lawful service requires personal-data disclosure to an identified recipient, Modical will provide the legally required information about the recipient, purpose, information provided, and retention period before the provision where applicable.
5. Processing entrusted to service providers
| Processor | Entrusted work | Relevant information |
|---|---|---|
| Render Services, Inc. | Website hosting, content delivery, request processing, operational logging, and security. | Website requests, IP/device information, form data while transmitted to Modical's server, and operational/security logs. |
| Plus Five Five, Inc. (Resend) | Delivery of website inquiry, service-request, and booking-notification emails. | Email addresses, message content, submitted form information, booking information, and delivery metadata. |
| Cal.com, Inc. | Appointment scheduling, booking questions, booking management, and source/context attribution. | Booking/contact information, submitted answers, time zone, and source/visa/service context. |
| Google LLC (Google Tag Manager, Google Workspace, Calendar, and Meet where used) | Consent-based analytics tag delivery, business email, calendar management, meeting-link creation, and video consultation. | For analytics: cookie/device identifiers and website-usage events after consent. For communications and bookings: email and message content, name, booking date/time, calendar information, and meeting information necessary for the service. |
6. Overseas transfers
The providers below process or store information outside Korea. For transfers necessary to provide a service requested by the data subject, Modical relies on Article 28-8(1)(3)(a) of the Personal Information Protection Act for overseas entrustment or storage necessary to conclude or perform the requested service, with the required matters disclosed here. Where separate consent is legally required, it will be requested separately.
| Recipient and contact | Country; timing and method | Information, purpose, and retention | How to refuse and effect |
|---|---|---|---|
| Render Services, Inc. · privacy@render.com | United States; encrypted network transfer when the website is accessed or a form is submitted. Static content may be delivered through a global CDN. | Website request and technical data, and form data in transit; hosting, security, and request processing. Retained according to Modical's operational policy and Render's applicable log/backup cycles. | A user may avoid the website and contact Modical by telephone. Refusal prevents use of the website and its online forms. |
| Plus Five Five, Inc. (Resend) · privacy@resend.com | United States; encrypted API transfer when a website form is submitted or a Cal.com webhook creates an internal notification. | Contact and booking details, submitted answers, message content, and source context; delivery of internal email notifications. Resend states that email and log data is ordinarily retained for 30 days, subject to account termination and backup cycles. | A user may refuse by not submitting an online form and may contact Modical by telephone. Refusal prevents the applicable online request from being delivered. |
| Cal.com, Inc. · privacy@cal.com | United States; encrypted transfer when the embedded booking function is opened and used. | Booking/contact details, answers, time zone, and source/visa/service context; scheduling and booking management. Modical will delete booking data when no longer needed and generally within one year after closure, subject to legally required retention and provider backup cycles. | A user may refuse by not using Cal.com and contact Modical by email or telephone to ask about an alternative. Refusal prevents online self-service booking. |
| Google LLC · 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA · Google privacy contact channels | United States and other Google processing locations applicable to the configured services; encrypted transfer after analytics consent or when email, Calendar, or Meet is used. | For analytics: cookie/device identifiers, IP-derived location, browser/device data, pages, referrers, timestamps, and configured interaction events. For services: name, email, message content, consultation date/time, calendar and meeting information. Analytics retention follows the configured tool and is generally no longer than 14 months for Modical-controlled user/event data. Service data follows Modical's Workspace settings and legal obligations. | Analytics can be declined or withdrawn through Cookie Settings without losing core website access. A user may request an available non-Google communication or consultation method; refusing service-related processing may prevent email, invitations, or a Google Meet consultation where no alternative is available. |
Provider information: Render Privacy Policy, Resend Security, Cal.com Privacy Policy, and Google Privacy Policy.
7. Destruction of personal information
When personal information is no longer required, Modical destroys it without undue delay unless retention is required by law. Electronic records are deleted using methods designed to prevent practical recovery, and paper records are shredded or otherwise securely destroyed. Information retained by law is separated or access-controlled and used only for the legally permitted purpose.
8. Rights of data subjects
Subject to applicable law, a data subject or legal representative may request access, correction, deletion, or suspension of processing and may withdraw consent where processing is based on consent. Requests may be sent to the Privacy Officer using the contact details in Section 1. Modical may request reasonable information to verify identity and may restrict or refuse a request only where permitted by law.
9. Cookies and automatically collected information
The hosting provider and embedded Cal.com booking function may process technical request data and use cookies or similar storage necessary for delivery, security, session management, language, and booking functionality. Users can restrict these technologies through browser settings, but doing so may prevent embedded booking features from working correctly.
Google Tag Manager container GTM-TG7BSPL8 is used only after a visitor selects “Allow analytics.” It may load configured analytics tags that measure pages viewed, referrers, device/browser information, approximate IP-derived location, timestamps, and interaction events. Advertising storage, ad-user-data storage, and ad-personalization storage are set to denied by the website.
Visitors may decline optional analytics without losing core website access. They may later change or withdraw their choice using “Cookie Settings” in the footer. Withdrawing consent prevents GTM from loading on subsequent page loads; the applicable provider deletion and retention cycles still apply to information processed before withdrawal.
10. Security safeguards
Modical applies reasonable administrative, technical, and physical safeguards appropriate to the information and risks involved, including access and account controls, secure transmission, provider access restrictions, logging, deletion procedures, and incident-response measures. No internet transmission or storage system can be guaranteed to be completely secure.
11. Privacy complaints and remedies
Privacy requests, questions, and complaints may be submitted to the Privacy Officer listed in Section 1. Data subjects may also seek assistance from the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), or another competent authority.
12. Changes to this policy
This policy may be updated to reflect changes in law, providers, services, or processing activities. The revised version and effective date will be posted on this page, and additional notice or consent will be provided where required by law.