Privacy notice
This notice explains what this website collects through its consultation form, its emails and its analytics, why, who receives it, where it is stored and how long it is kept. It is written for visitors from every country. We operate from the Republic of Korea, so Korea’s Personal Information Protection Act (PIPA) applies to everything we do, and we also follow the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as California’s. Wherever you live, you have the same rights, described below.
Who we are
Korea Plastic Surgery Reviews publishes information about plastic surgery in Korea and connects international patients with a partner clinic in Seoul. We are not a clinic and we do not give medical advice. The site is operated from the Republic of Korea.
We decide why and how your personal information is used. In GDPR terms, we are the controller of the information you send through this website.
For anything about your personal information, write to [email protected]. That address also reaches our privacy officer, the person responsible for personal information under PIPA, Article 31.
What we collect through the forms
The consultation form asks for the procedures you are considering, your name, your email address and the country you live in. If you choose to, you can also tell us what you would like to change and about any past surgery, when you could travel, how long you can stay in Seoul, a budget range, a messenger app and your ID on it, and whether you need an interpreter.
In the consultation form you can attach up to 6 photos of up to 10 MB each (JPG, PNG, WebP or HEIC). What you write about your health and your photos are sensitive information, so the form accepts them only after you tick the box for sensitive information described below.
The form asks you to confirm that you do not live in Korea and are not covered by Korean national health insurance (NHIS), because we can introduce only international patients to a clinic. If you write that you live in Korea, we answer with information only and do not pass your request to a clinic.
With each request we store the language of the page, the page you sent it from, the page you first landed on, the site that sent you to us and any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term). This shows us which pages lead to requests.
We also keep a record of each consent box: whether you ticked it, which version of the wording you saw and when.
To stop spam, the form can run a Cloudflare Turnstile check, and our server holds your IP address in memory for up to an hour to limit repeated attempts. We do not save your IP address with your request.
How we use your information
To read and answer your request, and to email you about it.
With your consent, to pass your request and photos to our partner clinic so that a surgeon can answer it, as described below.
To keep the site and its forms safe, for example to stop spam and repeated attempts.
To understand how visitors use the site and how our advertising performs, through the analytics described below. Analytics never receives what you type into a form.
To send you occasional guides and updates by email, only if you ticked that box. Every such email lets you stop them.
To meet our legal obligations and to answer your requests about your information.
We do not sell your personal information, and we do not share it for targeted advertising across other sites and apps.
The consents in the forms
One box in the form ticks all the required consents below at once. Open “See what I’m agreeing to” under it to see each consent on its own and untick any of them. The wording below is the wording on the form.
Collection and use (required): “I agree that Korea Plastic Surgery Reviews collects and uses these details to answer my request.”
Transfer (required): “I agree that my details are transferred outside Korea to be stored: my request in a database on a Vultr (The Constant Company, LLC) server in Tokyo, Japan, and any photos with Cloudflare, Inc. in Cloudflare R2 storage. Emails to me are sent through Resend, Inc., and copies of the emails we exchange are kept in our team’s mailbox with Google LLC (Gmail).”
Sharing with the clinic (required for a surgeon’s answer): “I agree that my request and photos are shared with Urban Plastic Surgery in Seoul so a surgeon can answer.”
Where you live and your health insurance (required): “I don’t live in Korea, and I’m not covered by Korean national health insurance (NHIS).”
Sensitive information (needed only if you write about your health or send photos, in the consultation form): “I agree that my photos and health details are handled as sensitive information, seen only by our coordinator and the surgeon.”
Email updates (optional, under “See what I’m agreeing to”; the single box does not tick it): “Send me occasional guides and updates by email. Optional.”
You can refuse any of them. Without the required ones we cannot accept a request through the form, and you can still read everything on the site. Leaving an optional box empty changes nothing else about your request.
Sharing with our partner clinic
Urban Plastic Surgery in Seoul is our partner clinic. With the consent above, we share your request and photos with the clinic so that a surgeon can answer it.
Recipient: Urban Plastic Surgery, Seoul, Republic of Korea. Purpose: a surgeon’s answer to your request, with options and a price range.
What we share: the procedures you are considering, what you told us about them and about any past surgery, your photos, your first name, the country you live in and your travel dates if you gave them. We pass on your email address, phone number or messenger ID only when you tell us you want to talk with the clinic directly.
The clinic handles what it receives as a separate organisation, under its own privacy policy and Korean law, and it decides how long to keep it. You can ask the clinic, or ask us to ask it, to show you or delete what it holds.
You can refuse. Without this consent we cannot get a surgeon’s answer for you. If you live in Korea or have Korean national health insurance, we do not share your request with any clinic.
Our consultation and the introduction to the clinic are free for you. Treatment is billed by the clinic at its own prices.
Where your information is stored, and who handles it for us
Requests are stored in a PostgreSQL database on a server rented from Vultr (The Constant Company, LLC) in Tokyo, Japan.
Photos are stored with Cloudflare, Inc. in a private Cloudflare R2 storage bucket. The bucket is not public. Our staff open a photo through a link that stops working after 5 minutes.
Only our staff with an administrator account can see requests. Opening a photo needs a separate permission, and each opening is logged.
Every request to this website, including the pages you open and the forms you send, passes through the network of Cloudflare, Inc., which delivers the site and protects it from attacks. To do that, Cloudflare handles the technical data that comes with each request, such as your IP address.
When we email you, for example the confirmation with your reference number or a reply from our team, the email is sent through Resend, Inc., an email delivery service. We do not track whether you open our emails or click their links.
The replies our team sends you about your request are stored with your request in the same database, and they are deleted together with it.
Copies of the emails we send you and of the emails you send us are also kept in our team’s mailbox, which is provided by Google LLC (Gmail). Emails you send to [email protected] reach that mailbox through Cloudflare Email Routing.
These companies handle your information only to provide their service to us, under their own terms for business customers. The transfers abroad that this involves are listed in the next section.
Transfers outside Korea and outside your country
Your request is stored outside Korea, and it may be handled in countries other than your own. These are the transfers, as PIPA, Article 28-8 asks us to set out. Each happens over an encrypted connection when you send the form or when we exchange emails with you.
Vultr (The Constant Company, LLC), servers in Tokyo, Japan: everything you send in the form except photos, and our replies. Purpose: storing your request. Kept as long as we keep your request.
Cloudflare, Inc., United States: your photos, in Cloudflare R2 storage, and the technical data of every visit, which passes through its network worldwide. Purpose: storing photos, delivering and protecting the site, the spam check and forwarding emails sent to us. Photos are kept as long as we keep your request.
Resend, Inc., United States: your name, email address and the emails we send you. Purpose: delivering our emails.
Google LLC, United States: copies of the emails we exchange with you, in our team’s mailbox (Gmail), and the analytics data described below. Purpose: our team’s email, and understanding how the site is used.
Japan and the United States may not protect personal information in the same way as the law where you live. We make these transfers with your consent, given in the form (PIPA, Article 28-8, and for visitors from the EU or the UK, explicit consent under GDPR, Article 49(1)(a)).
You can refuse by not ticking the transfer box, but then we cannot accept a request through the form, because the form stores it in these places. You can still read everything on the site, or write to us by email instead.
Analytics
This site uses two analytics tools. Umami is hosted by us. It counts page views and a fixed list of events without cookies and without building profiles across sites.
Google Analytics 4 is provided by Google LLC. We use it to understand how visitors use the site and to measure how our advertising performs. It records the pages you view, how you arrived, your device and browser, and your approximate location, which Google works out from your IP address. It sets cookies named _ga and _ga_<ID>, which expire 24 months after your last visit. The event data is kept for 14 months. Google processes this data in the United States, so using it involves a transfer of data outside your country. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites
Personalized advertising signals are turned off. Google signals and ad personalization are off for this site, and we do not use your visits to build advertising audiences or to show you ads based on them.
We never send names, email addresses, messenger IDs, messages, photos or anything else you type into a form to either tool. Besides page views, they receive events from a fixed list: for example which button was clicked and where it sits on the page, which procedure area a button belongs to, or that a request was sent and whether it can go to a clinic. Google Analytics also records some interactions on its own, such as scrolling and clicks on links to other sites.
Google Analytics runs only on this website’s own address, and our Simplified Chinese pages do not load it.
Legal bases
Korea (PIPA): we ask separately for collection and use (Article 15), sensitive information such as health details and photos (Article 23), sharing with the clinic (Article 17) and transfer abroad (Article 28-8). Email updates are optional and separate.
EU and UK (GDPR): we answer your request at your request and with your consent (Article 6(1)(a) and (b)). Health details and photos are handled only with your explicit consent (Article 9(2)(a)). Keeping the site and forms safe is in our legitimate interest (Article 6(1)(f)). Where the law requires us to keep or give information, we do so to meet that obligation (Article 6(1)(c)).
Analytics cookies are a separate matter. In the European Economic Area, the United Kingdom and Switzerland we set them only with your consent, which you can withdraw at any time with “Cookie settings”. Elsewhere we set them to understand how the site is used and how our advertising performs, and you can turn them off the same way.
You can withdraw any consent at any time. Withdrawing does not undo what was done before it.
How long we keep your information, and deletion
We keep a request for 2 years after the last activity on it: your last message, our last reply or our last update to it. Then we delete it permanently, together with its photos and our replies. This follows PIPA, Article 21, which says personal information is destroyed once it is no longer needed.
You can ask us to delete your request sooner, at any time. We then delete it from the database and its photos from storage.
Copies of our emails with you in our team’s mailbox are deleted at the same time.
What stays after deletion is the record of your consent boxes (which box, which wording, yes or no, and when), with no name, contact details or message, so that we can show what was agreed.
If we keep backup copies of the database, they are overwritten within 30 days, so a deleted request disappears from them within that time.
Analytics data is kept for the periods given under Analytics, and your IP address is held for spam protection for up to an hour.
Your rights
Wherever you live, you can ask us to: show you what we hold about you and give you a copy; correct it; delete it; stop or limit using it; and send it to you or to someone else in a common format. You can also withdraw any consent and object to how we use your information.
To use any of these rights, write to [email protected] or reply to the confirmation email we sent you. Tell us the email address you used in the form so that we can find your request. We reply within 10 days.
We do not make decisions about you by automated means alone. Our team reads every request.
We do not sell your personal information or share it for targeted advertising, so there is nothing to opt out of. Using your rights never changes how we treat your request.
If you think we have handled your information wrongly, please tell us first so that we can put it right. You can also complain to a data protection authority: in Korea, the Personal Information Protection Commission or the privacy hotline of the Korea Internet and Security Agency (118); in the EU or EEA, the authority in your country; in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.
How we protect your information
The site works only over encrypted connections (HTTPS).
Photos are kept in private storage. Our staff open one through a link that stops working after 5 minutes.
Only our staff with an administrator account can see requests, each with the permissions their work needs. Opening photos needs a separate permission, and each opening is logged, as is every permanent deletion.
We do not save your IP address with your request.
Children
Our service is for adults. We do not knowingly accept a request from or about anyone under 18. If we learn that a request came from or concerns someone under 18, we delete it and do not share it with any clinic.
Under PIPA, Article 22-2, handling the details of a child under 14 needs the consent of a parent or guardian, which our forms do not collect.
Changes to this notice
We update this page when what the site does changes. The date at the top shows the last revision.
If a change affects how we use information you have already given us, we ask for your consent again where the law requires it.