4. Matters regarding provision of personal information to third parties ① ‘HappyMedion’ provides personal information to third parties only in cases that fall under Articles 17 and 18 of the Personal Information Protection Act, including the consent of the information subject and special provisions of the law. ② ‘HappyMedion’ provides personal information to third parties as follows. One). <Each individual hospital where users request inquiries/consultations/reservations> - Person receiving personal information: Each individual hospital designated by the user - Purpose of use of personal information of the recipient: To respond to user inquiries/consultations/reservation requests, to provide services such as hospital reservations, etc. - Retention of recipient. Period of use: Varies by individual hospital 5. Rights and obligations of information subjects and legal representatives and methods of exercising them. Users can exercise the following rights as subjects of personal information. ① The information subject may exercise the following rights related to personal information protection against ‘HappyMedion’ at any time. One). Request to view personal information 2). Request for correction if there is an error, etc. 3). Request for deletion 4). Request to stop processing 6. Destruction of personal information HappyMedion, in principle, destroys the personal information without delay when the purpose of processing personal information has been achieved. The procedures, deadlines and methods for destruction are as follows. - Destruction procedures The information entered by the user is transferred to a separate database after the purpose is achieved (separate documents in the case of paper) and stored for a certain period of time or immediately destroyed in accordance with internal policies and other relevant laws. At this time, personal information transferred to the DB will not be used for any other purpose unless required by law. - Destruction period In principle, the company destroys users' personal information without delay upon withdrawal of membership. If the personal information retention period has expired, the user's personal information will be retained within 5 days from the end of the retention period, and if the personal information has become unnecessary due to the achievement of the purpose of processing the personal information, abolition of the relevant service, or termination of business, etc. Personal information will be destroyed within 5 days from the date the processing is deemed unnecessary. However, if the law imposes an obligation to retain information for a certain period of time, personal information will be safely stored for that period. The cases where laws stipulate the storage of information for a certain period of time are as follows. -Act on Consumer Protection in Electronic Commerce, etc. Records on contracts or cancellation of subscription, etc.: Retained for 5 years Records of payment and supply of goods, etc.: kept for 5 years Records of consumer complaints or dispute resolution: kept for 3 years -Basic Act on Electronic Documents and Electronic Transactions Records of distribution of electronic documents through public electronic addresses: kept for 10 years -Communication Secret Protection Act Login history: 3 months 7. Rights and exercise methods of users and legal representatives -Users can view, edit, or delete their personal information at any time at ‘Home > My page > My information’, and can request to view their personal information. -Users may request suspension of processing of personal information at any time, and may reject requests for suspension of processing in cases where there are special provisions in the law. -Users may withdraw their consent to the collection and use of personal information at any time through ‘withdrawal of membership’. -For children under the age of 14, the legal representative has the right to view, modify and delete the child's personal information, suspend processing, and withdraw consent to collection and use. -If a user requests correction of an error in personal information, the personal information will not be used or provided until the correction is completed. Additionally, if incorrect personal information has already been provided to a third party, we will notify the third party of the result of the correction without delay so that the correction can be made. 8. Matters related to installation/operation and refusal of automatic personal information collection devices ① ‘HappyMedion’ uses ‘cookies’ to store usage information and retrieve it from time to time in order to provide individually customized services. ② Cookies are a small amount of information that the server (https) used to run the website sends to the user's computer browser and are sometimes stored on the hard disk of the user's PC computer. go. Purpose of use of cookies: They are used to provide optimized information to users by identifying visitation and usage patterns, popular search terms, secure access, etc. for each service and website visited by the user. me. Installation, operation and refusal of cookies: You can refuse the storage of cookies through option settings in the Tools>Internet Options>Personal Information menu at the top of your web browser. all. If you refuse to store cookies, you may have difficulty using customized services. 9. Written by Personal Information Protection Manager ① ‘HappyMedion’ is responsible for the overall management of personal information processing, and designates a personal information protection manager as follows to handle complaints and provide relief for damage from information subjects related to personal information processing. ▶ Personal information protection officer Name: Heungjun Kim Position: Representative Position: CEO Contact: +82-02-568-0885, happymedion@naver.com, Fax +82-02-568-0885 ※ You will be connected to the personal information protection department. ② Information subjects may inquire about all personal information protection-related inquiries, complaint handling, damage relief, etc. that arise while using the services (or business) of ‘HappyMedion’ to the personal information protection manager and responsible department. 'HappyMedion' will respond and process inquiries from information subjects without delay.

10. Changes to personal information processing policy ① This personal information processing policy is effective from the effective date. If there are additions, deletions, or modifications in accordance with laws and policies, we will notify you through a notice at least 7 days prior to the change. 11. The technical, administrative and physical measures necessary to ensure the security of personal information in accordance with the Personal Information Protection Act are stipulated as follows. One). Conduct periodic self-audits - We conduct regular (quarterly) audits to ensure the safety of our handling of personal information. 2) Minimize and train personnel handling personal information. Limit staff handling personal information to those in charge and take measures to minimize personal information. 3). Establishment and implementation of an internal management plan We have established and are implementing an internal management plan for the safe handling of personal information. 4) HappyMedion's technical measures against hacking include installing a security program to prevent personal information leakage and damage due to hacking or computer viruses, regularly updating and inspecting the system, and installing the system in a location where external access is controlled. Installation, physical monitoring and blocking. 5) Encryption of personal information Personal information is encrypted, stored and managed so that only you can know it. Sensitive data is protected with separate security features, such as file encryption and data transfer, and use of the file lock function. 6). Storage of access records and prevention of forgery and falsification Access records of the personal information processing system are maintained and managed for at least 6 months. We use security features to prevent forgery, theft, and loss of access logs. 7). Restricting access to personal information We take necessary measures to control access to personal information by granting access to, modifying, or deleting database systems that handle personal information. We also use an intrusion prevention system to control unauthorized access from outside. Notification date: Nov. 23, 2023 Effective date: Dec. 01, 2023