Privacy Policy

2. Purpose of using personal data

• Generating and displaying facial asymmetry biomechanics analysis reports
• Retaining analysis report records for logged-in users and providing "My Reports"
• Receiving consultation bookings and making contact
• Improving the service through statistical analysis by age group, gender, and the like
• IP-based usage limits and maintaining service stability and security
• Event and benefit notices (only if the user has consented to receive marketing information; see 2-1 below)

2-1. Receipt of marketing information (optional)

At the time of registration (consent), the Service obtains consent to receive [Optional] marketing and event information separately from the required items. There are no restrictions on use of the Service if the user does not consent.

This consent is for event and benefit notices, and the Service may send event and benefit notices only if the user has consented. Such notices will not be sent to users who have not consented or who have withdrawn their consent.

Users may withdraw their consent at any time by changing the setting to 'Do not receive' under 'My Information > Settings > Receive Marketing Information,' and may change it back to 'Receive' again. Withdrawal of consent does not affect use of the Service.

3. Third parties (processing entrustment) and overseas transfer

For the smooth provision of the Service, the Service outsources the processing of personal information to the providers below. Among these, transmission to AI analysis providers (OpenAI·Anthropic) constitutes an overseas transfer, and the details are set out in 3-1 below.

• OpenAI — analysis processing of facial photos and entered information (image analysis and report generation)
• Anthropic — fallback analysis processing when primary analysis fails
• Google — social login (authentication) processing
• Apple — Apple sign-in (authentication)
• Google (Google Analytics·Tag Manager) — analysis of service usage statistics using cookies
• Toss Payments — processing approval and cancellation of credit payments
• Cloudflare — network transmission and security processing along the service access path

3-1. Overseas transfer of personal information

For the provision of analysis features, the following personal information is transferred to overseas AI analysis providers. The Service obtains consent to overseas transfer at the time of registration (consent), separately from consent to the collection and use of personal information.

• Recipient of transfer: OpenAI OpCo, LLC (generation of analysis reports and correction simulation images), Anthropic, PBC (alternative analysis when the primary analysis fails)
• Country of transfer: United States
• Items transferred: facial photos (front-facing photo, and open-mouth photo if taken), year of birth and gender (if entered), responses to the self-assessment questionnaire, facial measurements measured from the photos
• Timing and method of transfer: Transmitted via encrypted communications (HTTPS) when analysis is requested
• Purpose of use: Generation of a facial asymmetry analysis report (including correction simulation images)
• Retention and use period: In accordance with each provider’s API data retention policy
• Users may refuse to consent to overseas transfer. However, because the transfer is necessary for AI analysis, if users refuse, they cannot use AI analysis and cannot start using the Service.

3-2. Provision to franchisees (branches) — only where consent has been given

Only when the user has given separate consent may staff of the relevant affiliated store (branch) view the user's analysis report and the facial photo included in it. This consent is separate from consent to use the service in general, and not giving it will not restrict use of the service in any way.

Consent is given by directly approving it in 'My info > Branch connection' or by indicating consent in person at the store. Consent received at the store is stored together with the information of the staff member who recorded it.

The user may disconnect at any time in 'My info > Branch connection', and the relevant branch's access will be blocked immediately upon disconnection. Records of branch staff viewing the user's report (viewer and time) are stored separately, and the user may request those records through the contact channel.

The user's registration of a branch's 'sign-up code' relates to attribution of payment records and is unrelated to the above consent to view. Registration of the code alone does not allow the branch to view the user's report.

3-3. Notice for International Users — Processing Locations and Overseas Transfers

The service is operated by Physiocode Inc. of the Republic of Korea. The database and facial photo storage reside on servers managed directly by the service operator in the Republic of Korea.

If you use the service outside the Republic of Korea, your personal information is transferred to and processed in the Republic of Korea, and among the providers listed in Section 3 above, it is also processed in the United States and elsewhere through OpenAI and Anthropic (analysis), Google (sign-in and usage statistics), Apple (sign-in), and Cloudflare (network transmission). Toss Payments is a payment provider in the Republic of Korea.

The personal information protection laws of these countries may differ from those of your country of residence. You may request information about the safeguards applied to overseas transfers through the contact point below.

4. Retention and destruction of personal data

Collected information is stored in a database managed by the service operator, and facial photos are stored in a photo repository (object storage) managed by the service operator. Photos used for analysis are stored as part of the results report and may be displayed again through shared links and 'Past reports'.

If a user requests deletion or the retention purpose has been achieved, the relevant information will be destroyed without delay, except where separate retention is required by applicable laws. Logged-in users may delete their own reports directly in 'Progress > Past reports', and any stored photos will also be deleted. Other requests should be submitted to the contact below.

Logged-in users may delete their account directly in 'My info > Settings > Data management · Account deletion'. If you delete your account, analysis reports and photos, photo and exercise records, profile, remaining credit balance, and expert appointment requests will also be deleted.

However, pursuant to the 「Act on Consumer Protection in Electronic Commerce, Etc.」, records concerning payment and the supply of goods, etc. (order, payment, and credit transaction history) are retained for 5 years. Promotion code usage history is retained solely to prevent reuse of the same code. These records do not include names, email addresses, or photos.

Analysis reports, facial photos, and photo history are retained until you delete them yourself or delete your account, and are not automatically deleted before then.

To reuse results when the same photo is submitted again, we temporarily store the analysis result text and corrective simulation image together with a hash value calculated from the photo (a value that cannot be reversed back into the original photo) instead of the original photo, for up to 90 days. This temporary copy is not linked to your account; it is deleted when you delete the relevant report or your account, and even otherwise, it is automatically deleted 90 days after it was created.

5. Your rights

You may request access to, correction of, deletion of, or suspension of the processing of your personal data at any time. Requests are received through the contact below, and the service will take the necessary measures without delay.

Where the law of your country of residence (e.g., the EU General Data Protection Regulation (GDPR)) so provides, you also have the following rights.

• Access: the right to request your information that the service processes and a copy of it
• Correction: the right to correct inaccurate information — you can correct profile information directly under 'My Info'
• Deletion: You can delete reports under 'Analysis > Past Reports,' and your entire account under 'My Info > Settings > Data Management · Delete Account' (excluding the legally required retention records in Section 4 above)
• Restriction and objection: the right to restrict the processing of your information, or to object to processing based on legitimate interests
• Portability: the right to receive the information you provided in a structured, machine-readable format — you may request this through the contact point below
• Withdrawal of consent: You may withdraw consent-based processing at any time. You can change marketing communications under 'My Info > Settings > Receive Marketing Information,' and you can withdraw required consents, including facial photo analysis, by deleting your account or by requesting it through the contact point below (if you withdraw, you will not be able to use the analysis feature). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Lodging a complaint: the right to lodge a complaint with the Personal Information Protection Commission of the Republic of Korea or the data protection supervisory authority of your country of residence (EU, UK, etc.)

5-1. Legal Bases for Processing (EU/EEA/UK Users)

• Analysis of facial photos, facial measurements, and self-assessment questionnaire answers, and report generation: your explicit consent (as it may constitute sensitive health- or biometric-related information)
• Account operation, credit issuance and use, payment processing, and report retention: performance of our contract with you
• Retention of payment and transaction records: compliance with legal obligations
• IP-based usage-count limits, fraud prevention, and security maintenance: our legitimate interest in operating the service securely
• Usage statistics using cookies (Google Analytics): in the EU/EEA, UK, and Switzerland, your consent (we do not use statistics cookies before you consent, and you can allow or decline them in the notice at the bottom of the screen); in other regions, our legitimate interest in improving the service — you can decline by blocking cookies in your browser settings or using the Google Analytics Opt-out Add-on
• Marketing and event communications: your consent

5-2. Notice Regarding Facial Photos and Facial Measurements

What we collect: the facial photos you upload or take, and measurements such as left–right symmetry calculated from the landmark points of the face in the photo. Under the laws of some jurisdictions (e.g., Illinois, Texas, and Washington, and California, USA), this information may constitute biometric information or sensitive personal information.

Purpose of use: used only to create and show you your own facial asymmetry analysis report (including the corrective simulation image). It is not used for facial recognition or identity verification or identification. We use the file's hash value only to check whether the same photo file has been submitted again; we do not use facial features to find or match individuals.

Disclosure: We do not sell or rent this information, and we do not provide it for advertising purposes. Other than transmitting it to the analysis providers in Section 3 above for report generation, and its being visible to merchants you have separately consented to (3-2) and to viewers of links you yourself share, we do not provide it to third parties.

Retention and destruction: As stated in Section 4 above, we retain the information until you delete the report or your account, and upon deletion we destroy the stored photos and measurements, as well as the temporary copies in Section 4, without delay. We respond to destruction requests made through the contact point in the same manner.

5-3. Additional Notice for Residents of California, USA and Other Jurisdictions

The categories, sources, purposes of use, and recipients of the personal information the service collects are as stated in Sections 1–3 above. Sensitive personal information, such as facial photos and measurements and self-assessment questionnaire answers, is used only to provide the service you request.

The service does not sell personal information and does not share it for targeted advertising (cross-context behavioral advertising). The service uses Google Analytics for usage statistics, but does not send facial photos, report content, analysis results, email, or the like, and does not load this tool on report screens. The service does not use advertising platform tracking tags.

You may request access to (including notice of what has been collected), correction of, and deletion of your information, and you will not be treated unfavorably for exercising your rights. You can make requests using the methods in Section 5 above or through the contact point below, and the service may verify your account email or similar to confirm your identity.

6. Measures to ensure the security of personal data

• Encryption in transit (HTTPS) applied
• Authentication-based access control for administrator functions
• Minimizing personal data processing and managing access privileges

7. Children and Users Under 18

The service is intended for users aged 18 and over, and those under 18 may not use it. At the step before analysis that asks your age, those under 18 cannot be selected.

The service does not knowingly collect personal information from children under 18, and in particular under 14 (13 in the United States). If we learn that information from a user under 18 has been collected, we delete it without delay. Guardians may request deletion through the contact point below.

8. Changes to this policy and inquiries

This policy may change in accordance with laws and service policies, and any changes will be announced through the service screen.

Chief Privacy Officer: Jeong Yong-in (Representative, PhysioCode Co., Ltd.)

Privacy-related inquiries and requests to exercise rights: contact@physiocode.co