Privacy Policy

1. Purposes of Processing

Kaihan Therapeutics (“we”, “us”) processes personal data for the following purposes. If a purpose changes, we will obtain consent where required by the Korean Personal Information Protection Act (PIPA) and, for Thai users, the Thai Personal Data Protection Act (PDPA).

  • Inquiries: confirming and replying to product and partnership inquiries
  • Partner and Agent Portal: account registration, verification of identity and affiliation, login, order intake and processing, delivery and settlement
  • Clinic and customer management: contract performance, supply and after-sales support, compliance with legal obligations

2. Personal Data We Process

  • Contact form: name, company or clinic name, email, phone number, message
  • Portal registration and orders: name, organization, job title, email, phone number, business details, delivery address, order history, login ID and encrypted password
  • Collected automatically: IP address, access time, browser and device information, usage logs

We do not collect national ID numbers or sensitive data.

3. Retention Periods

We keep personal data only for the period required by law or agreed with you.

  • Inquiries: 1 year after the inquiry is resolved
  • Portal account data: until account closure or end of the business relationship
  • Contract, order and payment records: 5 years (Korean E-Commerce Act)
  • Access logs: 3 months (Korean Protection of Communications Secrets Act)

Where other laws require longer retention, we keep the data for that period.

4. Provision to Third Parties

We do not provide personal data to third parties without your consent or a legal basis. To fulfil an order, we may share the minimum data needed (recipient name, delivery address, phone number) with the responsible agent or supply partner, and we will tell you in advance.

5. Processors and Service Providers

  • Website hosting and servers: Cafe24 Corp.
  • Business email and collaboration: Naver Works (NAVER Cloud)
  • Web fonts: Google Fonts (Google LLC)

Our contracts with processors require compliance with data protection law, no use beyond the stated purpose, and security safeguards. We supervise our processors and will update this policy when they change.

6. Cross-Border Transfers

We operate Thailand distribution jointly with our Thai partner, and portal order data may be transferred abroad as follows.

  • Recipient: Thai HQ Co., Ltd. (Thailand)
  • Data: name, organization, contact details, delivery address, order history
  • Purpose: order intake, delivery and after-sales support in Thailand
  • Method: transmission over the network when you use the portal
  • Retention: as stated in Section 3
  • Refusal: you may refuse the transfer, but ordering services in Thailand may then be unavailable.

Personal data of users in Thailand is also protected under the Thai PDPA. You may exercise your PDPA rights of access, rectification, erasure, restriction and objection by contacting the officer below.

7. Destruction of Data

When the retention period ends or the purpose is fulfilled, we destroy personal data without delay. Electronic files are permanently deleted by irrecoverable means, and paper records are shredded or incinerated. Data that must be retained by law is stored separately.

8. Your Rights

You may at any time request access, correction, deletion, suspension of processing, or withdrawal of consent. Email the officer below and we will act without delay. Requests may also be made through an agent. Some requests may be limited where the law requires.

9. Cookies

Our website does not use advertising or analytics cookies. We use only essential cookies for login and security. You can block cookies in your browser, but portal login may then not work.

10. Security Measures

  • Encrypted password storage
  • Encryption in transit (HTTPS)
  • Least-privilege access and protection of administrator accounts
  • Regular software updates and security checks

11. Privacy Officer

  • Officer: Hans Jung
  • Email: hans@kaihantherapeutics.com

Please contact the officer for questions, complaints or remedies. We reply within 10 business days.

12. Remedies for Infringement

If you believe your rights have been infringed, you may contact:

  • Korea Internet and Security Agency (KISA) Privacy Report Center: privacy.kisa.or.kr / 118
  • Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
  • Supreme Prosecutors Office Cyber Crime Division: spo.go.kr / 1301
  • Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182
  • For users in Thailand: the Personal Data Protection Committee (PDPC), pdpc.or.th

13. Changes to This Policy

We may revise this policy for legal, policy or service changes. We will announce changes on this website at least 7 days in advance.

14. Effective Date

This policy is effective from October 12, 2026.