ParkinON
The Company collects the following personal information to provide the Service.
| Category | Items Collected | Collection Method |
|---|---|---|
| Required | Social account information (nickname, email), Kakao profile image URL, name, birth year, gender, role (patient/caregiver) | Kakao/Google/Apple social login, direct input |
| Optional | Parkinson's diagnosis year, relationship, cohabitation status | Direct input |
| While using the Service (including health/sensitive information) |
Medication records, body state/mood/sleep/constipation records, exercise records, motion measurement values (digital biomarkers such as finger-tapping and reaction speed), medical visit records (hospital name, physician name, visit date, visit notes), appointments (scheduled hospital, physician, appointment date), diary entries (text, photos, voice recordings), voice recordings for alarms (family-voice reminder sounds), videos/photos, posts and comments | Direct input and upload |
| Automatically collected | Device information (OS, app version), service usage records, access IP address | Automatic collection |
Note: Health information under "While using the Service" constitutes sensitive information under Article 23 of Korea's Personal Information Protection Act and is processed only with separate consent as described in Article 6-2. Access IP addresses are collected for PC web login authentication and fraud prevention.
This Service is intended for patients and caregivers aged 14 or older. The Company restricts sign-up by children under 14 by verifying birth year at registration, and does not collect personal information from children under 14. If it is confirmed that a child under 14 has registered, the Company will delete the relevant account and personal information without delay.
The Company retains personal information for as long as the User uses the Service.
| Item | Retention Period |
|---|---|
| Member information | Until account withdrawal |
| Medication and health records (body state, mood, sleep, constipation) | Until account withdrawal (deleted immediately upon withdrawal) |
| Medical visit records and appointments | Until account withdrawal (deleted immediately) |
| Motion measurement values (digital biomarkers) | Until account withdrawal (deleted immediately) |
| Diary entries (text, photos, voice) | Until account withdrawal or User deletion |
| Voice recordings for alarms | Until account withdrawal or User deletion However, if a paid subscription ends, they are deleted automatically 6 months after the end date |
| Photo records | Until account withdrawal or User deletion |
| Video records | Until account withdrawal or User deletion (destroyed without delay upon withdrawal) |
| Original prescription/medical-record images (for OCR analysis) | Not stored — used temporarily for OCR analysis only, then destroyed immediately (not retained on any server, database, R2 storage, or device) |
| Posts and comments | Until deletion request or account withdrawal |
| Service usage records and access IP | 3 months |
※ Voice recordings for alarms (family-voice reminder sounds) are a paid subscription feature. When a subscription ends, the purpose of retention no longer applies because the feature cannot be used; however, so that you can use them again if you resubscribe, they are retained for 6 months and then deleted automatically. You may also delete them yourself at any time before then.
Note: If a User changes their role (patient ↔ caregiver), the health records recorded under the previous role (patient) — medication intake, body state, mood, sleep, constipation, exercise, diary, movement measurements, medical records/appointments, and related photos, videos, and audio — are destroyed without delay upon the User's request and two-step confirmation. This destruction cannot be undone.
However, where retention is required under applicable law, information will be retained for the required period.
The Company does not, in principle, provide Users' personal information to external parties. However, the following are exceptions:
In addition, because this Service is designed for patient-caregiver linked care, a caregiver and patient linked within the same family group may mutually view and share each other's health records (medication, body state, exercise, medical visits, motion measurements, etc.) and enter records on each other's behalf. This is an inherent function of the family-linking feature that Users request directly, and is provided for the purpose of delivering the Service — it does not constitute provision of personal information to an external third party. Disabling family linking stops this mutual access, sharing, and proxy input.
| Processor | Country | Outsourced Task |
|---|---|---|
| Supabase Inc. | United States | Database and authentication services |
| Cloudflare, Inc. | United States | Video/photo/voice file storage |
| Anthropic PBC | United States | Text recognition (OCR) analysis of prescription/medical-record images (Claude API). Transmitted images are used solely for analysis and are not stored or retained |
| Google LLC (Firebase Cloud Messaging) | United States | Sending push notifications |
| Expo (650 Industries, Inc.) | United States | Issuing and delivering push notification tokens |
| Kakao Corp. | South Korea | Social login authentication |
| Google LLC | United States | Social login authentication |
| Apple Inc. | United States | Social login authentication (iOS) |
| Google LLC (AdMob) | United States | Serving non-personalized banner advertisements (no health data is provided) |
| RevenueCat, Inc. | United States | Managing in-app subscription payment status |
Note: Details of transfers to overseas-based processors are provided in Article 5-2.
To provide the Service, the Company transfers (outsources processing of, or stores) personal information overseas as follows. Under Article 28-8 of Korea's Personal Information Protection Act, Users consent to this international transfer and may decline.
| Recipient | Country | Items Transferred | Timing/Method | Purpose | Retention Period |
|---|---|---|---|---|---|
| Supabase Inc. | United States | Account information, health records, and other service data | Transmitted over the network during Service use | Data storage and authentication | Until account withdrawal |
| Cloudflare, Inc. | United States | Video, photo, and voice files | Transmitted over the network upon upload | Media file storage | Until account withdrawal (destroyed without delay upon withdrawal; see Article 3) |
| Anthropic PBC | United States | Prescription/medical-record images | Transmitted over the network when a User uploads a prescription/medical-record photo and requests automatic recognition | Automatic extraction of medication information (drug name, dosage, time of administration, etc.) via text recognition (OCR) | Until analysis is complete (transmitted images are not stored and are destroyed immediately after analysis); of the results, no personally identifying information is stored — only medication information is retained |
| Google LLC (AdMob) | United States | Advertising identifier (non-personalized), device/app information | Transmitted over the network when requesting a banner ad | Serving non-personalized banner advertisements (no health data is transmitted) | Per the advertising SDK's own policy (the Company does not separately retain this information) |
| RevenueCat, Inc. | United States | Subscription purchase/renewal status, app store payment identifier | Transmitted over the network upon subscription purchase or renewal | Verifying subscription tier (free/premium) and applying the corresponding premium benefits | For the period required under applicable law after subscription cancellation |
Users may decline this international transfer. However, because the personal information above is essential to providing the Service's core functions, declining consent may restrict account registration and use of the related features (data storage, media upload, automatic prescription/medical-record recognition, etc.).
The Company collects sensitive personal information such as health status and medication records. This information is used solely for providing the Service and is encrypted and stored securely.
To provide automatic recognition (OCR) of prescription/medical-record photos, the Company transmits the relevant images to Anthropic PBC (United States). Transmitted images are used solely for OCR analysis and are not stored on any server, database, file storage (R2), or device — they are destroyed immediately after analysis. Of the analysis results, personally identifying information such as the patient's name is not stored; only medication information (drug name, dosage, time of administration, etc.) is stored.
In accordance with Article 23 of the Personal Information Protection Act, the Company processes sensitive information such as health-related data separately from other personal information, and only after obtaining separate consent from the data subject.
| Item Processed | Purpose of Processing | Retention Period |
|---|---|---|
| Parkinson's diagnosis information (diagnosis year, etc.), medication records, symptom/body-state/mood/sleep/constipation records, medical visit records and appointments, motion measurement values (digital biomarkers) | Providing the Service, including medication management, symptom/medication-effect tracking, appointment management, and family-linked care | Until account withdrawal (deleted immediately upon withdrawal) |
The above sensitive information is used solely for the purpose of providing the Service and is encrypted and stored securely. Users may decline consent to the processing of sensitive information; however, doing so will restrict use of ParkinON's core features.
Users may exercise the following rights at any time:
Rights may be exercised through the in-Service settings screen or via the email address below. We respond without undue delay and within one month of receiving a request. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
If you are located in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) and equivalent local laws apply to you, and the Company acts as the data controller for the personal data described in this policy.
Legal bases for processing. We rely on the following bases under Articles 6 and 9 of the GDPR:
| Processing | Legal basis |
|---|---|
| Account creation and providing the Service (medication reminders, records, family link) | Performance of a contract — Art. 6(1)(b) |
| Health data: medication, body state, mood, sleep, constipation, exercise, diary, visit records | Your explicit consent — Art. 9(2)(a). This is special category data and is processed only after you give separate consent in the app. |
| Non-personalised advertising and the storing of / access to information on your device for that purpose | Your consent — Art. 6(1)(a), collected through a Google-certified consent message (CMP) the first time ads can be shown |
| Service security, abuse prevention, and keeping the Service running | Our legitimate interests — Art. 6(1)(f) |
| Records kept because Korean law requires it | Legal obligation — Art. 6(1)(c) |
Your rights. In addition to the rights in Article 7, you have the right to data portability, the right to object to processing based on legitimate interests, and the right not to be subject to a decision based solely on automated processing. ParkinON does not carry out automated decision-making or profiling that produces legal effects.
Withdrawing advertising consent. You can review or change your advertising consent at any time in the app: My Info → Ad privacy options. If you withdraw consent, personalised advertising stops; the app remains fully usable.
International transfers. Your data is stored and processed outside the EEA, including in the Republic of Korea and the United States, by the processors listed in Articles 5 and 5-2. Transfers are made on the basis of your consent and, where applicable, the European Commission's Standard Contractual Clauses. The Republic of Korea has received an adequacy decision from the European Commission (2021).
Complaints. If you believe your data has been handled unlawfully, you may lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA, the authority of your country of residence.
Contact. For any request under this Article, email [email protected]. We do not currently have an EU representative under Art. 27 of the GDPR; all requests are handled directly by the Company at that address.
The Service may automatically collect device information (OS, app version), service usage records, and access IP addresses for app operation purposes. Access IP addresses are collected and used for PC web login authentication and fraud prevention; other automatically collected information is used solely for service improvement and error analysis.
The Service may display banner advertisements from third-party advertising networks (e.g., Google AdMob) to Users on the free plan. Advertisements are served on a non-personalized basis by default, and the Company does not provide any health-related data (medication, symptom, or activity records) to advertising SDKs for targeting purposes. Users may reset or limit their device's advertising identifier through their device's operating-system settings. Subscribing to the Premium Plan removes in-app advertisements.
This Privacy Policy may be revised in response to changes in law or policy, and Users will be notified of any changes through an in-Service notice.
Personal Information Protection Officer
Title: Representative
Company: ourmine Co., Ltd.
Email: [email protected]
Inquiries regarding personal information, including requests for access, correction, deletion, or suspension of processing, may be sent to the email address above and will be answered promptly.
Effective Date: July 15, 2026