Privacy Policy

This policy applies to the Ara patient website and its associated development service. The development service is for testing; please avoid entering real medical photographs or unnecessary personal information there.

Use the privacy contact below for questions about this policy, access to your information, corrections, account withdrawal or deletion requests. The same contact can help when you cannot sign in. Hospitals, agencies, social sign-in providers and payment providers may also process information under their own policies; this notice does not replace those policies.

The information involved depends on the features you use and what you choose to provide. A browsing visit does not require the same information as submitting a consultation, making a payment or maintaining an account.

Information can come from forms you complete, files you upload, the sign-in provider you select, payment status notifications and your interactions with the service. Hospitals and agencies involved in your request may create quotes, booking updates and related service records.

A social sign-in provider determines which profile fields it makes available. You do not need to provide the provider's password to Ara. Ara receives the provider identifier and the profile fields allowed by the sign-in flow, rather than access to your social account's entire content.

You can choose not to supply optional information or not to use a feature. A request may not be processed if information necessary to identify your account, communicate with you or arrange the selected service is missing. Marketing preferences are separate from account and transaction messages.

Consultation photographs and health-related details may be sensitive. Share only what is necessary for your request, do not upload another person's information without authority, and avoid including identity documents or unrelated medical records in a general message.

Ara records consent and access information for sensitive attachments and uses access controls for their display. Image processing may remove embedded image metadata, but visible names, faces or text inside a photograph may remain. Check the image before uploading it.

Medical care and clinical records held directly by a hospital are the hospital's responsibility. Removing an Ara account does not itself remove a hospital's medical records. Contact the relevant hospital for questions about those records.

Information needed for a consultation, quote, booking or support request can be made available to the hospital or agency involved in that request and to Ara personnel who handle it. Public profiles and listings are distinct from private consultation material; uploading a consultation photo does not by itself mean it is published as a promotional case.

Service providers may handle information needed to operate the service, including website hosting, database and file storage, email delivery and payments. The payment integration supports Toss Payments and PayPal processing through Toss where that method is offered. Payment providers handle the payment entry and processing flow under their own terms.

If you choose an available social sign-in method, the sign-in exchange involves that provider, such as Google, Kakao, LINE or Meta/Facebook. Availability differs by environment and release. Listing a provider here does not mean every provider is already enabled on the website.

We may retain or disclose relevant information when necessary to respond to a lawful request, address fraud or a security incident, resolve a dispute, or protect the rights and safety of service users. Such use should be limited to the information needed for that purpose.

Ara is used by people in different countries to arrange services in Korea. Information you submit for a Korean hospital or agency can therefore be processed in Korea. Social sign-in, payment, hosting, storage and email services may also process information in countries where those providers operate.

The location and handling of information depend on the service and provider involved in your request. Contact the privacy team for the provider and transfer details relevant to your account. If additional information or consent is required for a particular transfer or optional feature, it must be provided as part of that feature before the transfer takes place.

The website uses cookies and browser state to maintain sign-in, protect the social sign-in flow and remember language preferences. Refusing or clearing these may end your session or prevent sign-in from working. Your browser settings let you manage cookies.

Authentication credentials are handled through server-side session controls; passwords and stored refresh-token credentials are hashed rather than stored as plain-text account passwords or refresh tokens. Access controls and consent checks limit who can access private records and sensitive attachments.

Security measures reduce risk but do not guarantee that every transmission or storage system is free from risk. If you suspect unauthorized access, use the privacy contact below and do not send passwords, verification codes or access tokens in your message.

Account withdrawal, ending a session, removing a social-provider connection and erasing every related record are different actions. Successful withdrawal disables your Ara account, marks your patient profile as withdrawn and revokes service sessions. It is not a promise that every database record, attachment, transaction record or backup is erased immediately.

Retention is assessed by record type and purpose: account and profile information for managing the account; consultation and booking records for completing or resolving the service; payment and refund records for transaction handling and applicable recordkeeping; support and security records for handling requests and investigating misuse. Information no longer needed for these purposes should be deleted or de-identified.

An active booking, unresolved refund, dispute, security investigation or applicable retention obligation can affect the timing and scope of deletion. Where records must be retained, the deletion response should identify the reason and remaining scope rather than describe account deactivation as complete erasure.

A fixed deadline for erasure of all data is not offered in this notice. Use the deletion request process below to ask which records can be removed, which remain necessary, and when your particular request will be completed. Backup copies may remain until the relevant backup retention cycle ends, with access restricted to the appropriate purpose.

You can review available account details in your profile and update editable fields. You can also contact the privacy team to request access, correction, deletion or an explanation of processing and retention, and to raise a privacy concern. We may need proportionate information to establish that the request concerns your account; do not send a password or unnecessary identity documents.

For account withdrawal, sign in and open My account → Delete account. If an ongoing booking or refund prevents withdrawal, contact support to resolve the outstanding service and request separate review of the information you want deleted. See the linked Data Deletion Instructions for the full process and the alternative when you cannot sign in.

Removing Ara from a social provider's connected-app settings can stop that provider connection, but does not by itself submit a request to erase Ara's separate records. Submit an Ara deletion request as well if you want those records reviewed.

External links and services, including hospitals, agencies, social networks and payment providers, have their own privacy practices. Review their notices before providing information directly to them. Ara does not claim to control records held independently by those organizations.

Do not create an account or submit another person's sensitive information unless you have the authority required for the service. If a child has provided information without appropriate authorization, a parent or guardian can contact the privacy team so the situation and removal request can be reviewed.

Updates will be published at this same address with a new revision date. Material changes affecting how information is used should be communicated through the relevant service or consent flow. The revision date identifies the version of this notice; it is not a claim that a new feature or social-login provider is already available.