Last Updated: August 4, 2026
1. Introduction
KRACE is a platform operated by RnPT Inc., a company incorporated under the laws of the Republic of Korea ("KRACE," "we," "us," or "our").
KRACE provides coordination services across healthcare, wellness, and related lifestyle services — connecting users with independent service partners in Korea and beyond.
This Privacy Policy explains how we collect, use, store, and share your personal information when you use the KRACE platform (website, mobile application, and related services, collectively the "Platform"). It applies to all users of the Platform.
This Privacy Policy is governed by the Personal Information Protection Act of Korea ("PIPA") and related regulations. By using the Platform, you acknowledge that your personal information will be processed in accordance with Korean law and this Privacy Policy.
2. How Your Information Flows
KRACE operates as an intermediary coordination platform between you and independent Service Providers:
You → KRACE Platform → Service Provider
(Healthcare / Wellness / Lifestyle / Travel / Other)
- You → KRACE: You provide personal and preference information when registering, completing a Service Preference Form, or making a booking.
- KRACE → Service Provider: Your information is transmitted to the Service Provider you select only upon your booking confirmation or your explicit separate consent. We do not share your information with any Service Provider before you initiate a booking.
- Service Provider: Once your information is shared with a Service Provider, that provider acts as an independent data controller for information processed in connection with delivering their service. KRACE is not responsible for how Service Providers handle information after it has been shared. We recommend reviewing your Service Provider's own privacy policy.
3. Definitions
"Service Provider" means any independent third-party provider accessible through the Platform, including but not limited to healthcare institutions and clinics; wellness and aesthetic service providers; travel and accommodation partners; cultural experience and lifestyle partners; interpretation and concierge providers; and any other partners offering services through KRACE.
"Service Preference Form" means any questionnaire, intake form, or preference survey submitted through the Platform to facilitate service matching and booking coordination, regardless of service category.
"Sensitive Information" means personal information designated as sensitive under Article 23 of PIPA, including health-related information and other categories requiring enhanced protection under Korean law.
4. Information We Collect
4.1 Information You Provide Directly
Account and Identity Information
- Name, email address, phone number, date of birth, nationality, preferred language
- Account credentials (stored in encrypted form)
Service Preference and Booking Information
- Service Preference Form responses: preferred service category, location, language, provider characteristics, scheduling preferences, and other criteria you choose to provide
- Booking details: date, time, selected Service Provider, service type, special requests
Service-Specific Information (provided voluntarily)
- For health-related services: health concerns, conditions, allergies, or medications you choose to disclose
- For travel-related services: travel dates, destination preferences, accommodation requirements
- For other services: relevant preferences applicable to your booking
Payment Information
- Transaction amount, currency, payment method type (e.g., card brand, last 4 digits)
- Full payment card details are processed exclusively by certified third-party payment processors in accordance with PCI-DSS standards. KRACE does not store full payment card details and does not act as a financial institution.
Communications
- Messages, inquiries, and support communications through the Platform
- Reviews and feedback you submit
Visa and Documentation Support (where you request visa support)
- Passport, travel documents, or other supporting documents required to prepare a visa application, collected only when you request visa support
4.2 Information Collected Automatically
- Device information: type, operating system, browser type and version, browser time zone (used to display appointment times and send notifications in your local time)
- Usage data: pages visited, features used, search queries, booking history
- Log data: IP address, access times, referring URLs
- Approximate location based on IP address
- Cookie and tracking data (see Section 10)
4.3 Information from Third Parties
- Social login providers (e.g., Google, Apple) if used for registration
- Payment processors: transaction confirmation and status
- Service Providers: booking confirmation, completion status, and service feedback
5. Sensitive Information
Health-related information and other categories designated as sensitive under PIPA Article 23 require explicit separate consent and enhanced protection.
KRACE collects sensitive information only to the extent voluntarily provided by you in connection with a specific booking. All sensitive information is:
- collected only with your explicit separate consent;
- used solely to facilitate the specific booking or coordination for which it was provided;
- not used for advertising, profiling, or any commercial purpose beyond service delivery;
- protected with enhanced access controls and encryption; and
- shared only with the specific Service Provider you select, upon booking confirmation or explicit advance consent.
6. Legal Basis for Processing
All personal information is collected and used on the following legal bases under PIPA:
- Account creation and management — Performance of a contract (PIPA)
- Booking processing and confirmation — Performance of a contract (PIPA)
- AI-assisted service matching — Consent of the data subject (PIPA)
- Payment facilitation — Performance of a contract (PIPA)
- Coordination and support services — Performance of a contract (PIPA)
- Service communications — Performance of a contract (PIPA)
- Sharing with chosen Service Provider — Consent of the data subject (PIPA)
- Processing of sensitive information (e.g., health data such as allergies) — Separate explicit consent of the data subject (PIPA Art. 23)
- Platform improvement and security — Legitimate interests of the controller (PIPA)
- Marketing communications — Consent of the data subject — separate and optional (PIPA)
- Legal compliance — Compliance with a legal obligation (PIPA)
7. Information Sharing and Disclosure
7.1 Sharing Principle
Personal information is shared with third parties only as described below and in accordance with PIPA. KRACE does not sell, rent, or trade your personal information.
7.2 Service Providers
Upon booking confirmation, we share the information necessary to deliver your service with the Service Provider you have selected:
- Healthcare / Medical — Name, contact details, date of birth, appointment details, language preference, voluntarily disclosed health information
- Wellness / Aesthetic — Name, contact details, appointment details, service preferences
- Travel / Accommodation — Name, contact details, travel dates, preferences; supporting documents only where you request visa support
- Lifestyle / Cultural — Name, contact details, booking details, relevant preferences
- Interpretation / Concierge — Name, appointment details, language preference, general purpose of visit
Each Service Provider acts as an independent data controller for information processed in connection with their service. Third-party sharing is conducted in accordance with PIPA Art. 17 and subject to your prior consent.
7.3 Payment Processors
Transaction information is shared with certified third-party payment processors operating under PCI-DSS compliance. KRACE does not store full payment card details and does not act as a financial institution.
7.4 Coordination Partners
Where interpretation or concierge services are arranged through KRACE, limited appointment information is shared with the assigned partner under contractual confidentiality obligations.
7.5 Processing Agents
We entrust certain data processing operations to third-party vendors in accordance with PIPA Art. 26. These parties process data only on KRACE's behalf and are all located within the Republic of Korea. Other vendors listed in §7.6 are located overseas and are subject to the overseas transfer provisions in that section:
- Amazon Web Services, Inc. (AWS) — Seoul Region
- Entrusted Task — Cloud infrastructure and data storage
- Retention — Per Section 11 of this Policy
- KakaoTalk notification message sending agent
- Entrusted Task — Delivery of operational notifications via KakaoTalk BizMessage
- Retention — Until message delivery completion; logs per Section 11
The names and contact details of current processing agents are available upon request by contacting support@kracecare.com.
KRACE operates with team members located in the United States who access booking and patient information — limited to assigned cases — for coordination and support purposes. In the course of this work, limited information may be processed or temporarily retained on their devices as necessary to provide the service. Such access is restricted to what is necessary for their tasks and is subject to confidentiality obligations.
7.6 Overseas Data Transfers
The following transfers of personal information to overseas recipients occur in connection with Platform operations. These transfers are conducted in accordance with PIPA Art. 28-8 through appropriate contractual safeguards:
- Google LLC
- Data Transferred — Cookie identifiers, IP address, usage data
- Country — USA
- Purpose — Analytics, advertising
- Transfer Timing — During service use
- Retention — Per Section 11
- Google LLC
- Data Transferred — Email address, message content (no health information)
- Country — USA
- Purpose — Email delivery (SMTP)
- Transfer Timing — When emails are sent
- Retention — Per Section 11
- Meta Platforms Inc.
- Data Transferred — Cookie identifiers, IP address, ad interaction data
- Country — USA
- Purpose — Ad targeting and conversion tracking
- Transfer Timing — During service use
- Retention — Per Section 11
- PayPal Holdings, Inc.
- Data Transferred — Name, email, payment and transaction information
- Country — USA
- Purpose — Payment processing and fraud prevention
- Transfer Timing — At time of payment or refund
- Retention — 5 years from transaction date (Electronic Financial Transactions Act)
The following transfers are current as of the Last Updated date. Where infrastructure changes result in new overseas transfers, KRACE will update this Policy and obtain renewed consent where required by PIPA Art. 28-8.
Method of transfer: Personal information is transmitted electronically to these recipients through encrypted network connections (TLS) via their service integrations or APIs.
Your right to refuse overseas transfer: You may refuse the overseas transfer of your personal information.
- Transfers to Google and Meta for analytics and advertising can be declined at any time through cookie settings (see Section 10), without affecting your ability to use core Platform features.
- Transfer to Google for email delivery is necessary to send you service and transactional messages. You may limit these by managing your notification preferences, though certain essential service messages are required to use the Platform.
- Transfer to PayPal is essential to process payments and refunds. If you refuse this transfer, bookings that require payment cannot be completed. You may avoid this transfer by not making a payment through the Platform.
The effect of refusing an essential transfer (such as payment processing) is that the related service cannot be provided. The names and contact details of the overseas recipients above are available upon request at support@kracecare.com.
7.7 Legal Disclosure
We may disclose information where required by Korean law, court order, or competent authority in accordance with PIPA Art. 18, Section 1, Item 2, or to protect the rights, safety, or property of KRACE, its users, or the public.
7.8 Business Transfers
In the event of a merger, acquisition, or asset sale, your information may be transferred to a successor entity. We will provide advance notice and obtain any required consents in accordance with applicable law.
7.9 User Content
KRACE may remove, moderate, or anonymize user-submitted content (including reviews) to comply with legal requirements, protect safety, or maintain Platform integrity.
8. Service-Specific Data Responsibility
KRACE's role is limited to coordination and referral. Legal responsibility for the performance of any medical procedure or clinical decision rests solely with the licensed medical institution and treating professional, in accordance with the Medical Service Act of Korea. KRACE's coordination services, including AI-assisted matching and concierge support, do not constitute medical advice or clinical recommendation.
For healthcare-related services: Health-related information is shared with your chosen healthcare provider upon booking confirmation. That provider acts as an independent data controller subject to the Medical Service Act of Korea and PIPA. KRACE is not a healthcare provider or medical institution. Health-related information provided through KRACE is handled in accordance with Korean data protection law and this Privacy Policy.
For all other services: Relevant booking and preference information is shared with your chosen Service Provider, who is independently responsible for their own data practices.
We recommend reviewing the privacy policy of your chosen Service Provider before confirming any booking.
9. AI-Assisted Matching
KRACE may use AI-assisted matching to suggest Service Providers based on preferences you submit in the Service Preference Form. This applies across all service categories on the Platform.
Suggestions are generated algorithmically based solely on your stated preferences. AI-assisted matching does not constitute professional advice or guarantee service outcomes. The final selection of any Service Provider is made solely by you.
In accordance with PIPA Art. 37-2, you have the right to request human review of any AI-generated matching result. To exercise this right, contact support@kracecare.com.
10. Cookies and Tracking
KRACE uses cookies and similar tracking technologies to operate the Platform and to deliver advertising and analytics services.
- Essential
- Purpose — Platform operation, security, session management
- Items Collected — Session ID, security token
- Examples — Login session, security tokens
- Can be declined? — No
- Functional
- Purpose — Language settings, user preferences
- Items Collected — Language preference, display settings
- Examples — Language selection, display preferences
- Can be declined? — Yes
- Analytics
- Purpose — Usage analysis, performance measurement
- Items Collected — IP address, page views, device info
- Examples — Google Analytics (GA4), Google Search Console
- Can be declined? — Yes
- Marketing
- Purpose — Ad targeting, conversion tracking, remarketing
- Items Collected — IP address, browsing behavior, ad interaction
- Examples — Google Ads, Meta Pixel
- Can be declined? — Yes
Third-Party Advertising and Analytics Services
KRACE uses third-party services for analytics, advertising, and platform operations, including services provided by Google and Meta. These providers may collect usage data, device information, and interaction data through cookies and similar technologies when you use the Platform.
These providers operate under their own privacy policies. KRACE does not control how these providers use data collected through their services.
To opt out of interest-based advertising:
For all other cookie preferences, use our cookie settings or your browser settings.
Your Cookie Choices
When you first visit the Platform, you will be presented with a cookie consent notice. Analytics and marketing cookies are activated only after you provide explicit consent. You may update your preferences at any time through the Platform's settings or your browser settings. Declining non-essential cookies will not affect your ability to use core Platform functionality.
11. Data Retention
Personal information is retained only for as long as necessary to fulfill the purpose of collection and is destroyed without delay upon expiration of the applicable retention period, in accordance with PIPA Art. 21.
- Account information
- Retention Period — Until account deletion; destroyed within 5 business days of deletion request
- Legal Basis — PIPA Art. 21
- Booking and transaction records
- Retention Period — 5 years from transaction date
- Legal Basis — Act on Consumer Protection in Electronic Commerce, Art. 6
- Consumer complaint and dispute records
- Retention Period — 3 years
- Legal Basis — Act on Consumer Protection in Electronic Commerce, Art. 6
- Payment records
- Retention Period — 5 years from transaction date
- Legal Basis — Act on Consumer Protection in Electronic Commerce, Art. 6
- Display and advertisement records
- Retention Period — 6 months
- Legal Basis — Act on Consumer Protection in Electronic Commerce, Art. 6
- Sensitive information (health-related)
- Retention Period — Deleted within 7 days of transmission to the selected Service Provider, except where retention is required for dispute resolution or legal compliance (not exceeding 1 year)
- Legal Basis — PIPA Art. 21; Art. 23
- Marketing consent records
- Retention Period — Record of consent retained for 1 year after withdrawal for compliance verification
- Legal Basis — PIPA Art. 22
- System access records (personnel access to personal information processing systems)
- Retention Period — 2 years
- Legal Basis — Standards for Ensuring the Safety of Personal Information (PIPC Notification)
- User service access logs (login, IP, access times)
- Retention Period — 3 months
- Legal Basis — Framework Act on Telecommunications; internal policy
- Usage data (automatically collected)
- Retention Period — 1 year (anonymized thereafter)
- Legal Basis — Internal policy
Regarding Sensitive Information: Health-related and other sensitive information is deleted within 7 days of transmission to your selected Service Provider, or upon consent withdrawal, whichever occurs first, except where a limited retention period is required for dispute resolution or legal compliance (not exceeding 1 year). Medical record-keeping obligations under the Medical Service Act apply to healthcare providers, not to KRACE.
Post-deletion: Where immediate destruction is not technically feasible (e.g., backup systems), data is isolated from active processing and securely purged within 30 days.
12. Your Rights
In accordance with PIPA, you have the following rights:
- Right of Access (PIPA Art. 35): Request access to personal information held by KRACE
- Right of Correction (PIPA Art. 36): Request correction of inaccurate or incomplete information
- Right of Deletion (PIPA Art. 36): Request deletion, subject to legal retention requirements
- Right to Suspend Processing (PIPA Art. 37): Request suspension of processing in certain circumstances
- Right to Withdraw Consent: Withdraw consent for optional processing at any time
To exercise any of these rights, contact: support@kracecare.com
We will respond within 10 days as required under PIPA Art. 38. Identity verification may be required. Rights may also be exercised through a legal representative or authorized agent.
If you believe your rights have been infringed, you may file a complaint with the Personal Information Protection Commission of Korea at www.pipc.go.kr or by calling 182 (Korea, toll-free).
Users located in other jurisdictions may contact us at support@kracecare.com. We will respond in accordance with applicable law to the extent it applies to KRACE's operations.
13. Children's Privacy
The Platform is not directed at children under 14. In accordance with PIPA Art. 22, we do not knowingly collect personal information from children under 14 without verifiable consent from a legal guardian. If you believe we have inadvertently collected such information, contact support@kracecare.com and we will promptly delete it.
14. Security
We implement technical and organizational safeguards in accordance with PIPA Art. 29, including:
- Encryption of personal information in transit (TLS) and at rest
- Access controls and authentication management
- Regular security assessments and vulnerability management
- Physical security measures for systems processing personal information
In the event of a personal data breach, KRACE will notify the Personal Information Protection Commission and affected users without undue delay in accordance with PIPA Art. 34, with information on the nature of the breach, categories of data affected, and recommended protective measures.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or operational practices. Where required by applicable law or where changes materially affect your rights or how your information is used, we will provide advance notice via email or in-app notice before taking effect. Non-material changes will be posted on this page with an updated "Last Updated" date. Continued use of the Platform after any change takes effect constitutes your acceptance of the updated policy.
16. Language and Governing Version
This Privacy Policy has been drafted, and shall be construed, in the English language. Any translation of this Privacy Policy is provided solely for reference and convenience. In the event of any inconsistency between the English version and any translated version, the English version shall always prevail.
17. Governing Law and Contact
This Privacy Policy is governed by the laws of the Republic of Korea. Any disputes arising in connection with this Privacy Policy shall be subject to the non-exclusive jurisdiction of the competent courts of the Republic of Korea.
- Company — RnPT Inc.
- Business Registration No. — 394-81-02917
- Privacy Officer — Jiho Baek
- Address — 20 Pangyo-ro 289beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do 13488, Republic of Korea
- Contact — support@kracecare.com
- Website — www.kracecare.com