Privacy Policy

Linkive Co., Ltd. (the "Company") establishes and publishes this Privacy Policy in order to protect the personal information of data subjects who use VisionHubKorea (the "Service"), an ophthalmology and eye health information website operated by the Company, and to handle any concerns relating to personal information promptly and smoothly.

• Operator: Linkive Co., Ltd. (주식회사 링카이브)
• Representative: Soohwan Kim
• Address: Room D75, 6F, 350 Hannuri-daero, Sejong-si, Republic of Korea
• Privacy contact: linkive@linkive.co.kr
• Telephone: +82-70-8080-3748

Summary of What the Service Does and Does Not Collect

The Service is currently an informational website. It publishes articles on eye health and does not operate any feature that asks visitors to submit personal information.

The Company does not currently collect any of the following.

1. Inquiry, consultation, appointment or medical institution connection forms
2. Comments or any other content submitted by visitors
3. Newsletter or email subscriptions
4. Health information, medical records, medical images or any other sensitive information
5. Passport numbers, alien registration numbers or other unique identification information
6. Payment or card information
7. Member accounts, log-in credentials or profile information

What the Company does process is limited to information generated automatically when a page is loaded, website analytics, and information a visitor voluntarily includes in an email sent to the Company. The details are set out under "Purposes of Processing Personal Information" and "Categories of Personal Information Processed" below.

If the Company later introduces a form, subscription, comment feature or any other means of collecting personal information, it will amend this Privacy Policy and complete the required consent process before that feature goes live.

Purposes of Processing Personal Information

The Company processes the minimum personal information necessary for the following purposes. Personal information processed is not used for purposes other than those below, and where the purpose of use changes, the Company takes the necessary measures, including obtaining separate consent as required by applicable law.

1. Providing and operating informational content on ophthalmology and eye health
2. Analyzing website visits and usage, acquisition channels and content performance
3. Measuring website performance under real-world conditions, identifying errors and improving service quality
4. Reviewing search visibility and search performance
5. Applying the regional consent defaults that determine whether analytics cookies are set
6. Service security, incident response, prevention of misuse and analysis of access records
7. Responding to inquiries and requests sent to the Company by email
8. Handling requests to exercise data subject rights, and complaints
9. Fulfilling obligations under applicable law and responding to investigations and disputes

The Company is not a medical institution and does not provide treatment, diagnosis, examination, prescription, surgery or any other medical practice. The content of the Service is general information and does not substitute for consultation with a medical professional.

Categories of Personal Information Processed

Information generated automatically during website use

The table below lists each tool or function used to operate the website, together with the items it may process and the purpose of that processing.

Whether Google Analytics cookies are set depends on the visitor's region. The details are set out under "Automatic Collection Devices and Cookies" below.

Google Search Console reports aggregated search statistics and does not identify individual visitors.

The Company does not transmit information that directly identifies a visitor — such as name, email address, telephone number or health information — to Google Analytics or Google Search Console.

Vercel Speed Insights does not use cookies or personal identifiers and does not identify visitors individually. The performance metrics it collects are reported only in aggregate form.

Vercel Speed Insights is not governed by Google Consent Mode. Consent Mode controls Google tags only, so performance measurement through Speed Insights continues to operate in regions where analytics cookies are declined, including the European Economic Area. Because it uses no cookies or personal identifiers, no information identifying a visitor is processed.

Vercel Web Analytics is not currently enabled. If the Company decides to enable it, it will amend this Privacy Policy beforehand.

Information contained in emails sent to the Company

Where a visitor sends an email to the Company, the Company processes the email address, the name or organization if stated, and the contents of the message and any attachments, in order to review and respond to the inquiry and to handle complaints and disputes.

The Company does not ask senders for health information or identification documents. Visitors should not include health information, medical records or identification details in an email.

Information processed when a data subject exercises their rights

The table below sets out each category of information involved, the items processed and the purpose.

Legal Bases for Processing

The Company processes personal information on the following bases.

1. The consent of the data subject, where analytics cookies are set and the visitor has not declined them through browser settings
2. The legitimate interests of the Company, for website provision, security, error prevention and aggregated analysis within permitted limits, where those interests clearly override the rights of the data subject
3. Measures taken at the data subject's request, for responding to an email inquiry
4. Compliance with obligations under applicable law
5. Where processing is urgently necessary to protect the life, body or property interests of the data subject or a third party

No analytics cookies are set for visitors in the European Economic Area, the United Kingdom, Switzerland and their respective territories. Consent defaults to denied in those regions, and visits there are counted in aggregate without cookies or identifiers. In other regions, analytics cookies are set when the website loads, and visitors may decline them through their browser settings. Advertising signals are denied in every region.

Methods of Collection

The Company collects personal information by the following means.

1. Access records, cookies and analytics information generated automatically in the course of using the website
2. Emails sent to the Company by a visitor
3. Requests to exercise data subject rights, submitted by email, telephone or in writing

The Company does not purchase personal information from third parties and does not receive personal information from third parties for marketing purposes.

Retention and Use Periods

The Company destroys personal information without delay once the purpose of collection and use has been achieved. However, where there is a retention obligation under applicable law or a need to retain information for dispute handling, information is retained for the periods below. Each row names a processing activity and gives the period for which the related information is kept.

Where a different retention period is stated at the point of collection, that period applies.

Retention Required by Applicable Law

Where the Company carries out a transaction or activity to which a statutory retention obligation applies, it retains the relevant records for the period prescribed by applicable law. This includes records on consumer complaints and dispute handling, records on labeling and advertising, website access records and other communication confirmation data, and transaction and supporting records under tax law.

The Company does not currently process payment, contract or subscription records through the Service.

Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties.

The Company may provide personal information without consent, to the extent permitted by applicable law, in the following cases.

1. Where there is a special provision in a statute or where provision is necessary to fulfil a statutory obligation
2. Where an investigative or supervisory authority makes a request in accordance with lawful procedures
3. Where provision is urgently necessary to protect the life, body or property interests of the data subject or a third party

If the Company later introduces a feature that provides personal information to a third party, it will separately notify the recipient, the purpose, the items provided and the retention period, and obtain the required consent beforehand.

Entrustment of Personal Information Processing

To operate the website, the Company entrusts the processing of personal information to the processors listed below. Each row names a processor, followed by the work entrusted to it, the items it processes and the retention period.

Where the Company adds a new processor or changes the entrusted work, it discloses this through this Privacy Policy.

When entering into an entrustment agreement, the Company includes in the contract the matters necessary for the protection of personal information — including a prohibition on processing for purposes other than the entrusted purpose, technical and administrative safeguards, restrictions on sub-entrustment, management and supervision, and liability for damages — and manages and supervises the processor's handling of personal information.

Overseas Transfer of Personal Information

In the course of using website hosting and visit analytics services, the Company allows personal information to be processed and stored outside Korea. Each row below names a recipient and its privacy contact, followed by the country of transfer, the items transferred, the purpose and method of transfer, and the retention period.

A data subject may notify the Privacy Officer of an objection to overseas transfer. Visitors may prevent the transfer of Google Analytics information by blocking cookies in their browser settings. In the European Economic Area, the United Kingdom, Switzerland and their respective territories, analytics cookies are not set by default.

In relation to overseas transfer, the Company puts in place safeguards for the protection of personal information and measures necessary for complaint handling and dispute resolution, and reflects matters concerning personal information safeguards in its agreements with recipients.

Sensitive Information and Unique Identification Information

The Company does not process sensitive information such as health information, medical records, medical images or diagnosis details, and does not process unique identification information such as passport numbers or alien registration numbers.

Visitors should not send health information or identification documents to the Company. Where such information is received unsolicited, the Company destroys it without delay unless retention is required to respond to the sender's request.

If the Company later introduces a feature that requires the processing of sensitive information or unique identification information, it will amend this Privacy Policy and obtain consent that is separate from, and distinguished from, consent to the processing of general personal information.

Automatic Collection Devices and Cookies

The Company uses cookies and similar technologies to operate the website and analyze its use.

Types of cookies

Each row below names a cookie or technology, followed by its category, its provider, its purpose and its default retention period.

The Company does not use advertising cookies, retargeting tags or third-party marketing trackers.

Regional consent defaults

1. The Service uses Google Consent Mode. In the European Economic Area, the United Kingdom, Switzerland and their respective territories, analytics storage defaults to denied, so no analytics cookies or identifiers are set. Visits from those regions are counted only in aggregate, without cookies.
2. In other regions, analytics cookies are set when the website loads.
3. Advertising storage, advertising user data and advertising personalization are denied in every region without exception. The Service does not operate advertising.
4. Visitors in every region may block or delete cookies through their browser settings, as described below.
5. The Company does not currently present a cookie consent banner. If a banner is introduced, this Privacy Policy will be amended before it is deployed.

Refusal through browser settings

Visitors may delete or block cookies through their web browser settings.

• Chrome: Settings → Privacy and security → Third-party cookies, or Delete browsing data
• Edge: Settings → Cookies and site permissions → Manage cookies and site data
• Safari: Settings → Privacy → Manage website data
• Firefox: Settings → Privacy & Security → Cookies and Site Data

Visitors who block cookies can read all of the website's content without restriction. Only visit analytics are affected.

Processing of Online Behavioral Information

To analyze the use of the website, the Company processes online behavioral information as set out below. Each row names an aspect of that processing and gives the corresponding details.

The Company does not use online behavioral information to infer sensitive characteristics such as disease, medical history or surgical history, and does not provide personalized medical advertising.

Google Analytics advertising personalization features and Google Ads integration are not used. If such features are introduced in future, this Privacy Policy will be amended in advance.

Procedures and Methods of Destruction

1. The Company destroys personal information without delay once grounds for destruction arise, such as the expiry of the retention period or the achievement of the purpose of processing.
2. Where personal information must continue to be retained under applicable law, it is stored separately from other information.
3. Electronic files are deleted by secure means that make recovery or reconstruction difficult.
4. Paper documents are destroyed by shredding or incineration.
5. Personal information stored in external services is deleted using that service's deletion function or by requesting deletion from the processor.

Rights of Data Subjects and Legal Representatives, and How to Exercise Them

A data subject may exercise the following rights against the Company at any time.

1. Requesting confirmation of whether personal information is processed, and access to it
2. Requesting correction or deletion of personal information
3. Requesting suspension of the processing of personal information
4. Withdrawing consent by blocking or deleting cookies in the browser
5. Making inquiries about, and objecting to, the overseas transfer of personal information
6. Raising an objection concerning the processing of personal information
7. Requesting the transmission of personal information where recognized under applicable law

Rights may be exercised by contacting the Privacy Officer by email, telephone or in writing. The Company verifies that the requester is the data subject or a duly authorized agent and then handles the request in accordance with the procedures prescribed by applicable law.

The Company does not make automated decisions that produce legal effects concerning data subjects.

Right to Refuse Consent

A data subject may refuse analytics cookies, and the related overseas transfer, through browser settings. In the European Economic Area, the United Kingdom, Switzerland and their respective territories, those cookies are not set by default.

Refusing cookies does not restrict access to any of the website's content. Only visit and content performance analytics are affected.

Users in the European Economic Area, the United Kingdom and Similar Jurisdictions

Where the relevant law applies to visitors in the European Economic Area, the United Kingdom or jurisdictions with similar data protection laws, the following additional provisions apply.

Legal bases for processing

1. Consent: analytics cookies. In these jurisdictions, however, the regional default is set to denied, so no such cookies are in fact set
2. Legitimate interests: website provision, security, error prevention, response to rights infringement, and aggregated analysis within permitted limits
3. Steps taken at the data subject's request: responding to an email inquiry
4. Legal obligations: tax, accounting, cooperation with investigations and compliance with applicable law
5. Protection of vital interests: where there is an urgent risk to life or physical safety

The Company does not process special categories of personal data, including health data. If it introduces a feature that requires such processing, it will do so only on the basis of explicit consent or another lawful basis recognized under applicable law, after amending this Privacy Policy.

Visitor rights

Depending on the applicable law, visitors may have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and lodging a complaint with a supervisory authority.

Overseas transfer under EEA and UK law

Where personal information is transferred outside the European Economic Area or the United Kingdom, the Company works to put in place standard contractual clauses, an adequacy decision, contractual safeguards or another transfer basis recognized under applicable law.

Contact and supervisory authorities

Data protection rights may be exercised by contacting the Privacy Officer. Visitors may lodge a complaint with the data protection supervisory authority of their country of residence or of the place where the infringement occurred.

If an obligation to appoint a representative in the European Union or the United Kingdom arises under applicable law, the Company will appoint such a representative and add the details to this Privacy Policy.

Users in California, United States

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to the Company, the following additional provisions apply.

Categories of personal information that may be processed

1. Identifiers: IP address, cookie identifiers, and the email address of a person who contacts the Company
2. Internet or other electronic network activity information: pages visited, sessions, clicks, referrer, device and browser information
3. Approximate geolocation information: location at country and region level

The Company does not collect sensitive personal information, biometric information, precise geolocation, financial account information or government identification numbers through the Service.

Sources of personal information

The Company collects personal information from the visitor's interaction with the website, through cookies, logs and analytics tools, and from emails sent to the Company.

Sale and sharing

The Company does not sell personal information for monetary consideration and does not share personal information for the purpose of cross-context behavioral advertising.

Rights of California visitors

Depending on the applicable law, visitors may have the following rights.

1. The right to know what personal information is collected, used and disclosed
2. The right to obtain a copy of their personal information
3. The right to request correction of inaccurate personal information
4. The right to request deletion of personal information
5. The right to opt out of the sale or sharing of personal information
6. The right to request that the use and disclosure of sensitive personal information be limited
7. The right not to be discriminated against for exercising these rights
8. The right to submit a request through an authorized agent

Where applicable, the Company treats a browser Global Privacy Control signal as a request to opt out of the sale or sharing of personal information.

Exercising rights

California visitors may exercise their rights through the Privacy Officer contact details set out below. The Company verifies identity using the minimum information necessary to process the request.

Children's Personal Information

The Service is intended for adults as a rule and does not knowingly collect the personal information of children.

Where it becomes necessary to process the personal information of a child under 14 years of age, the Company obtains the consent of the child's legal representative and processes the minimum information necessary to verify that representative.

In relation to California visitors, the Company does not knowingly sell the personal information of visitors under 16 years of age or share it for cross-context behavioral advertising.

Where the Company confirms that a child's personal information has been collected without valid consent, it deletes that information without delay.

Measures to Secure Personal Information

To prevent the loss, theft, leakage, forgery, alteration or damage of personal information, the Company implements the following measures.

1. Minimizing the number of staff who process personal information and their access rights
2. Establishing and operating internal management procedures for the protection of personal information
3. Applying encryption in transit and secure means of access
4. Access control over personal information and authentication credentials
5. Prevention of, and response to, malicious programs, hacking and abnormal access
6. Retention of access records and prevention of their forgery or alteration
7. Contractual safeguards, management and supervision in respect of processors
8. Operating procedures for responding to and recovering from personal information breaches
9. Training for staff who process personal information

Where the Company becomes aware of a personal information breach or similar incident, it takes the measures required by applicable law, notifies affected data subjects of the categories of information affected, the circumstances, the steps they may take and the Company's response, and reports the incident to the Personal Information Protection Commission or the relevant specialized agency where mandatory reporting applies.

Privacy Officer and Point of Contact for Access Requests

The Company designates the following Privacy Officer to oversee matters relating to the processing of personal information and to handle inquiries, complaints and remedies concerning personal information.

Privacy Officer

• Name: Soohwan Kim
• Position: Chief Executive Officer
• Operator: Linkive Co., Ltd. (주식회사 링카이브)
• Address: Room D75, 6F, 350 Hannuri-daero, Sejong-si, Republic of Korea
• Telephone: +82-70-8080-3748
• Email: linkive@linkive.co.kr

Point of contact for access requests and complaints

• Department: Personal Information Protection
• Contact person: Soohwan Kim
• Telephone: +82-70-8080-3748
• Email: linkive@linkive.co.kr

Remedies for Infringement of Rights

Data subjects may contact the following organizations for consultation or remedies concerning the infringement of personal information rights.

1. Privacy Infringement Report Center (개인정보침해신고센터): 118 (within Korea, no area code)
2. Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972
3. Supreme Prosecutors' Office (대검찰청): 1301 (within Korea, no area code)
4. National Police Agency (경찰청): 182 (within Korea, no area code)
5. Central Administrative Appeals Commission (중앙행정심판위원회): 110 (within Korea, no area code)

These organizations are separate from the Company. Requests for access, correction, deletion, suspension of processing, withdrawal of consent and complaint handling in respect of the Company's processing of personal information may first be made to the Company's Privacy Officer.

Publication and Amendment of This Policy

The Company publishes this Privacy Policy at the foot of the VisionHubKorea website or on a linked screen so that data subjects can review it easily.

The Company may amend this Privacy Policy in response to changes in applicable law, website features, methods of processing personal information, analytics tools or external services.

Where this Privacy Policy is amended, the Company announces the effective date and the principal changes through the website before that date. Where a change materially affects the rights of data subjects — including the introduction of any new means of collecting personal information — notice is given with sufficient lead time.

Previous versions are managed so that they can be reviewed through a separate revision history or archive page.

Revision History

Each row below gives a version number, followed by its announcement date, effective date and a summary of the change.