This Privacy Notice explains how AssembleCircle Corporation (“the Company”) processes the personal data of its users, including without limitation, the options that a user selects for the collection, use and disclosure of his or her certain data.

Controller and Contact Information

The service provider and controller of personal data is as follows:

AssembleCircle Corporation (“Company”)

411-ho, 4th floor, 240, Pangyoyeok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea

The DPO of the Company is as follows:

• Officer: Yehyun Kim
• Security Department
• +82-31-697-0433
• admin@assemblecircle.com
• If you have questions about your account in general, how to contact customer service for assistance, questions specifically about this Privacy Notices, or our use of your personal data, cookies or similar technologies, please contact our Data Protection Officer. If you contact us for assistance, we may need to authenticate your identity before fulfilling you request for your safety and ours.

Collection and Use of data

We collect personal data users provide to us which includes:

• To verify of user identity, link SSO, contact to user (for notification of violation of policy and change of terms and conditions), confirm user's intention, and handle of customer complaints; Name, ID, password, nickname, mobile phone number, e-mail address, nationality, foreigner registration number (for foreigners)
• To provide order, payment and delivery services; Name, ID, phone number, nationality, address, e-mail address, bank account information, mobile phone number (when paying by mobile phone), cash receipt information (when applying for a cash receipt), payment information
• To verify of user identity·age, prevent illegal use and operate integrated services such as customized services (ID/PW search and WebCeph service); Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, nationality, occupation, profile or work experience, hospital name, hospital address, hospital contact information, CI/DI, i-PIN authentication result, cellular service provider information, domestic/foreigner information, service usage record, device information
• To handle of customs clearance for products directly delivered overseas; PCCC (Personal Customs Clearance Code)
• To develop new services, provide customized services, conduct marketing, service usage statistics and surveys; gender, date of birth, mobile phone number, e-mail address

Method of collection

The Company collects the personal data of users in the following manner (Article 6(1)(a)):

• Collection through mobile devices with the prior consent of the users

Disclosure of Personal Data

We may disclose users’ personal data for certain purposes and to third parties, as described below:

• Service Providers: We use other companies, agents or contractors ("Service Providers") to perform services on our behalf or to assist us with the provision of services to you. For example, we engage Service Providers to provide marketing, advertising, communications, infrastructure and IT services, to personalize and optimize our service, to process credit card transactions or other payment methods, to provide customer service, to collect debts, to analyze and enhance data (including data about users' interactions with our service), and to process and administer consumer surveys. In the course of providing such services, these Service Providers may have access to your personal data or other information. We do not authorize them to use or disclose your personal data except in connection with providing their services.
• Partners: Users may have a relationship with one or more of our Partners, in which case we may share certain data with them in order to coordinate with them on providing the service to members and providing information about the availability of the service.
• Promotional offers We may offer joint promotions or programs that, in order for your participation, will require us to share your data with third parties. In fulfilling these types of promotions, we may share your name and other data in connection with fulfilling the incentive. Please note that these third parties are responsible for their own privacy practices.
• Protection of The Company and others: The Company and its Service Providers may disclose and otherwise use your personal data and other information where we or they reasonably believe such disclosure is needed to (a) satisfy any applicable law, regulation, legal process, or governmental request, (b) enforce applicable terms of use, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address illegal or suspected illegal activities (including payment fraud), security or technical issues, or (d) protect against harm to the rights, property or safety of The Company, its users or the public, as required or permitted by law.
• Business transfers: In connection with any reorganization, restructuring, merger or sale, or other transfer of assets, we will transfer data, including personal data, provided that the receiving party agrees to respect your personal data in a manner that is consistent with our Privacy Statement.

Whenever in the course of sharing information we transfer personal data to countries outside of the European Economic Area and other regions with comprehensive data protection laws, we will ensure that the information is transferred in accordance with this Privacy Notice and as permitted by the applicable laws on data protection. Personal data transferred (such as name and contact information) may be saved electronically on servers operated by our Service Providers for record keeping purposes and other purposes as set out in this Privacy Notice.

Necessity of personal data

The personal data provided by users is necessary for the service use contract between a user and the Company and the smooth delivery of the services therein. Users are restricted from using the Company’s services unless they give consent to the collection of essential personal data. However, users may refuse to provide optional personal data, and in such case, they will still be able to use the Company’s services except those that require the provision of optional personal data.

Transfers of Personal Data to Third Countries

The Company may transfer users’ personal data to companies located in other countries or other companies for any purpose specified in this Policy. It will take reasonable measures to the companies where the information is transmitted, retained or processed in order to protect the information.

In particular, the Company transfers all personal data provided by the users or automatically collected by the Company to a server located in the United States and re-transfers it to the Republic of Korea. The United States and the Republic of Korea have not received an adequacy decision from the European Commission, and the laws of the United States and the Republic of Korea do not stipulate all the rights of data subjects and principles of information processing as defined by the GDPR. However, the Company fully complies to the GDPR through this Privacy Policy, and users are entitled to all protections based on the GDPR.

Based on the above notice, the Company may transfer users’ personal data to the United States and the Republic of Korea after obtaining explicit consent for transfer of personal data to third countries (Article 49 Paragraph 1 (a)).

Where We Store and Process Your Data

• Images → EU-based Amazon S3 (by member country setting).
• Text-based patient data → PostgreSQL in the United States (Oregon).

International Transfers (GDPR)

Primary bases: SCCs (Art. 46) and, where applicable, EU–U.S. DPF (Art. 45). Explicit consent (Art. 49(1)(a)) may be used as a complementary mechanism. We maintain documented TIAs and apply encryption, KMS key management, least-privilege access, logging/audit, minimization and retention controls.

Users’ rights

Users or their legal representatives, as data subjects, can exercise the following rights regarding the collection, use and disclosure of personal data by the Company:

• Right to withdraw prior consent (Article 7(3))
• Right of access by the data subject (Article 15);
• Right to rectification (Article 16)
• Right to erasure (‘right to be forgotten’) (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated individual decision-making, including profiling (Article 22)
• Right to lodge a complaint with a supervisory authority (Article 77)

In order to exercise any of the foregoing rights, users may use the ‘Edit Profile’ menu on the Company website, make a written request to the Company (or the DPO, representative) using the data subject request form provided by the Company. In such case, the Company shall immediately make actions accordingly: provided, however, that the Company may reject such request if and to the extent there are reasonable grounds prescribed in law or equivalent thereto.

Upon the request from a data subject, the Company must take the following actions:

• To take actions regarding a request only after authenticating the identity of the data subject (or his or her legal representative);
• To ask if a subject requires the information to be provided in writing or whether he or she will accept it in an electronic form;
• To have a standard process for the company to effectively inspect all relevant systems and to communicate with other departments;
• To notify a data subject if there is no information that he or she has requested;
• To formulate reasonable criteria to determine whether to correct or disclose personal data if the personal data requested by a data subject includes the information of other individuals; provided however, such data can be disclosed if the other individuals explicitly give the consent thereto. The company should consider the impact of such disclosure and the possible breach of others’ personal data if no explicit consent is available, in which case, it should document the justification of such disclosure;
• To take actions in accordance with the request of a data subject in such a manner as he or she can understand, including the requirements under Article 15;
• To make no available the transfer system which can be traceable in case of providing a data subject with the information he or she has requested. Such information should be disclosed in a safe electronic means if individually agreed upon with the data subject; or
• To document the actions which have been taken for the request of a data subject.

Also users or their legal representatives have the right to lodge a complaint with a supervisory authority (Article 13(2) and 14(2)(e)).

Security

The Company takes the security of personal data seriously. It has the following security measures to prevent the unauthorized access to, or disclosure, use or change of the personal data (Article 32).

• To formulate countermeasures against hacking
• To install a system in the zone to which the external access is strictly restricted so as to prevent users' personal data from leakage or damage by hacking or computer viruses
• To establish and implement internal management plans
• To conduct regular internal audit (semiannual) to safely process personal data
• To keep minimal the number of employees processing personal data and educate them
• To install and operate access control systems
• To take necessary actions to restrict the access to the personal data, such as the grant, change or termination of the right to access the data base system of personal data processing
• To keep the documents, storage devices, etc. which include personal data in a safe place with a lock
• To designate a physical place of storing personal data to restrict the access by unauthorized persons and to establish and operate such access control procedure
• Enterprise-wide DLP solution installation and operation
• Take measures to prevent forgery or alteration of access records and store and collect log records through the installation of Endpoint Protector, a security program.

Children

Children, as defined in this Privacy Policy, refer to those under 13 or those under minimum age defined between 13 and 16 by relevant law. The relevant jurisdictions in which the Company’s services are provided define the minimum age of children that requires parental consent when processing personal data as follows:

• The United Kingdom: under 13
• Germany: under 16
• France: under 15

Our products and services are intended for use by individuals 17 years of age and older, and those under the age of 17 are not eligible to use any of our service. In principle, the Company does not collect any personal data from children. However, if the Company learns that any personal data of children has been collected through WebCeph application, it will take the appropriate steps to delete this data.

However, if the Company collects, for the provision of its services, any personal data of children, it will comply will comply with the following procedures for the protection of children’s personal data (Article 8):

• To verify if a child is subject to the guardian’s consent and such guardian is authorized, within the scope of reasonable efforts;
• To have the consent from a child’s parent or guardian to collect the child’s personal data or to provide the child with product information and the Company’s services directly;
• To notify parents or guardian of the Company's privacy policy for children, including the items, purpose and disclosure of collected personal data;
• To grant a child’s legal representative the right to access, correct or delete or temporally suspend the processing of, the child’s personal data or the right to withdraw the prior consent of the representative; and
• To limit the collection of personal data to the extent solely required for the participation in online activities

Profiling

The Company may use users’ personal data to create individual or collective profiles (hereinafter referred to as “profiling”) for the purpose of identifying how to provide the users with better services, for example, providing the users with customized content of services by analyzing which aspect of the Company and/or services most attracts users, and the patterns in which users use the services. In addition, the Company uses the personal data for the following purposes: to create user clusters to identify the users’ interest in the Company’s products and/or services; to analyze the market and statistics or; to enhance the Company’s services (all websites, etc.). It may integrate the data provided by all its websites and applications with the users’ personal data provided by Learning Lab. The processing of personal data for profiling is carried out in line with the guarantees and measures specified in applicable law (Article 22).

Data Retention Policy

For the purpose of protecting users’ data, the Company complies with the principle of Data Minimisation where the processing of personal data should be appropriate and limited to the extent solely necessary for the purposes for which the data are processed (Article 5 Paragraph 1 (c)). To this end, the Company abides by the following retention policy:

• All personal data processed by the Company is subject to and protected by the Company’s Members’ retention policy.
• Personal data are retained for no longer than is necessary for the purposes for which the personal data are processed. The Company will immediately destroy the personal data once the user deletes his or her account on WebCeph application. However, the personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (Article 5 Paragraph 1 (e));
• The Company abides by the methods set forth in the ‘Security’ part of this Privacy Policy to delete physical and digital data;
• The Data Protection Officer designates the strict retention period regarding the storage of users’ personal data and does not retain the data more than the period which requires the data. The Company monitors the compliance regarding the data retention on a regular basis and deletes the data, if no longer necessary, in a safe manner (Recital Article 39);
• The company schedules regular review of stored data to determine whether the data is still required;
• The company immediately destroys especially sensitive data including sexual orientation, race, beliefs, health information, etc. and does not retain the data for no longer than is necessary;
• The company forthwith takes the actions set forth in the ‘User’s right’ part of this Privacy Policy if a user exercises his or her right guaranteed by GDPR as a data subject;
• The company is in compliance with relevant regulations such as GDPR, etc. in relation to the retention of users’ personal data;
• The company makes sure that all employees are aware of the data retention policy prescribed in this Privacy Policy and GDPR;
• The company sets this Privacy Policy by documenting a GDPR data retention policy. This Privacy Policy may need to be provided to regulators in the event of an audit or investigation of a complaint of a user or an employee; and
• This Privacy Policy may be used as proof that the company complies with the requirements of GDPR.

Privacy Policy related to the Company’s employees

The Company educates and monitors employees including the HR department that handle personal data of the Company’s employees not only to handle users’ personal data but also employees’ personal data in compliance with the GDPR (Article 39). The Company documents the records that manage all training-related contents for employees (date, time, list of subjects, list of attendees, contents of training, subject of training, role of DPO).

The company delivers this Privacy Policy to its employees, either in hard copy documents or electronically. Employees who process personal data have the right, for example, to request the employer to correct incorrect information regarding that personal data.

Modification of Privacy Policy

The Company has the right to amend or modify this Privacy Policy from time to time, in which case, the Company will make a public notice of it through bulletin board of WebCeph application (or through individual notice in writing or by fax or e-mail) and have the consent of the users if required by relevant law.

Cookies and Internet Advertising

The Company may collect collective impersonal data through ‘cookies’ or ‘web beacons.’

Cookies are substantially small text files to be sent to the browser of the users by the server used for the operation of the Company’s websites and are stored in hard-disks of the users' computers.

Web beacons are a small quantity of code which exists on websites and e-mail. By using web beacons, we can identify whether a user has interacted with certain webs or the contents of email.

These functions are used for evaluating, improving services and customizing user experience so that the Company provides way improved services for the users.

The items of cookies to be collected by the Company and the purpose of such collection are as follows:

• Required cookies: This kind of cookies is indispensably necessary for the users to use the functions of the Company’s website. No services such as shopping cart or electronic bill payment can be provided for a user unless he or she accepts these cookies. These cookies do not collect any data which can be used for marketing or store the sites that the users have visited.
• To retain the data entered in an order form while searching other webpages during the web browser session
• To retain the purchased services for the webpage of products and checkout
• To verify whether a user logs onto the website
• To ensure that a user is connected to a correct service on the v’s website if The Company makes any change in the operation of the Company’s website.
• To connect the users to a certain application or server of the services
• Performance cookies: This kind of cookies collects data of how the users use the Company's website such as the webpages most frequently visited by the users. Such data helps the v optimize its website so that the users can search more conveniently on its website. Such cookies do not collect any data regarding users’ identification. All or any data collected by this kind of cookies is anonymous since the data is collectively processed.
• Web analysis: to provide statistical data on how to use the website;
• Advertisement response fee: to confirm the effect of the Company's advertisement;
• Tracing affiliates; to provide the Company's affiliates with the feedback of anonymous data that one of the visitors to the Company's website has visited an affiliate’s website;
• Error management: to identify errors which have occurred in order to improve the Company's website; or
• Design testing: to test other designs of the Company's website
• Functionality cookies: This kind of cookies is used to store the set-ups so as to provide services and improve the user experience. No data collected by these cookies identifies individual users.
• To store changed set-ups such as layout, text size, basic set-up and colors; or
• To store the survey which has been conducted by the Company and completed by the users
• Target cookies: This kind of cookies is connected with the services provided by a 3rd party such as the buttons of 'likes' and 'share'. The 3rd party recognizes the users’ visit to the Company's website to provide such services.
• To allow social networks connected to such cookies to use the users’ visit information, thus putting the advertisement targeting the users; or
• To provide the users’ visit information for advertisement agencies so that the agencies can suggest the tailored ad which can attract the interest of the users

The users have an option for cookie installation: accepting all cookies, making each cookie confirmed whenever it is saved, or refusing the storage of all cookies: Provided that, such refusal may limit the user from using the parts of services provided by the Company.

The latest update date: September 10, 2025

The Company hereby explains the processing of personal data as follows and seeks your consent to such processing under applicable Articles of GDPR including without limitation the Articles 6.1(a) and 8 thereof. Detailed information regarding each of the following items is notified in the Privacy Notice, so please read the Privacy Notice before agreeing to the following items.

1) Required Items

What items of personal data are transferred	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, nationality, occupation, profile or work experience, hospital name, hospital address, hospital contact information, foreigner registration number, bank account information, cash receipt information, payment information, CI/DI, i-PIN authentication result, cellular service provider information, domestic/foreigner information, service usage record, device information, Information actually collected among personal customs clearance codes
Receiving country	The Republic of Korea
Where, when and how personal data is transferred	When personal data is collected, it will be stored in the cloud service
Who a recipient is	The Company
Why the recipient uses personal data	To manage the personal data of users and their membership and to provide adequate service.
How long the recipient retains and uses personal data	Until termination of provision of cloud service and consignment contract

The Company hereby explains the processing of personal data as follows and seeks your consent to such processing under applicable Articles of GDPR including without limitation the Articles 6.1(a) and 8 thereof. Detailed information regarding each of the following items is notified in the Privacy Notice, so please read the Privacy Notice before agreeing to the following items.

2) Optional Items

1. Nature and scope of the terms and conditions

These terms and conditions describe the relationship between AssembleCircle Corp.(hereinafter referred to as "AssembleCircle") and WebCeph members (hereinafter referred to as 'members') or non-members who use the WebCeph service, and the rights, obligations and necessary matters between the member and AssembleCircle in relation to the use of the WebCeph service provided by the AssembleCircle to members. It is for the purpose of defining.

When you use the WebCeph service or sign up as a member, you are required to confirm or agree to these terms and conditions. These terms and conditions are basically applied to all WebCeph services, but separate terms and operating policies may be applied for each individual service to comply with relevant laws and regulations and to achieve the purpose of each service.

2. WebCeph Service

WebCeph service is an orthodontic orthognathic artificial intelligence cloud platform designed by orthodontists and oral surgeons and developed by orthodontists. You can use the WebCeph service using a device that can connect to the Internet, such as a PC or mobile phone. WebCeph service includes diagnostic data analysis services for orthodontic and orthognathic surgery, and clinical case sharing and discussion platforms for academic purposes. For specific details of individual services, please refer to the WebCeph website.

WebCeph service is a service that assists doctors in diagnosis, medical plan establishment, medical practice, etc. WebCeph Services can help you, however, WebCeph Services is neither a medical institution nor a healthcare provider and does not provide medical advice or diagnosis. In other words, WebCeph service does not function as a substitute for a service that provides expert opinion or professional opinion in any way. AssembleCircle recommends that members establish a medical plan, perform medical treatment, or receive treatment through consultation with a medical professional along with the WebCeph service.

AssembleCircle provides the same service to all members, but the scope of the service provided for each individual service may vary to comply with relevant laws and regulations and to achieve the goal of individual service. For example, some of the WebCeph services may be provided only to members with medical qualifications, and members who wish to use the services may be required to provide evidence of medical qualifications to be provided with the services.

The AssembleCircle may modify, suspend, or terminate some or all the contents of the WebCeph website or WebCeph service for reasons of compliance with related laws and regulations, maintenance and management of services, and business judgment. For example, to perform routine or non-routine maintenance of the WebCeph service, to correct errors, or to perform other changes, we may suspend the WebCeph homepage or some operations of the WebCeph service as needed. In addition, AssembleCircle may stop the operation of the WebCeph service in a certain residential area. If a member violates the terms and conditions and related laws, services may no longer be provided to the member.

he WebCeph service is currently free, but it may be converted to a paid service in some or all of the WebCeph service. If there is a conversion in service payment, partial or whole, we will inform the members regarding the scope and pricing policy of the WebCeph service in advance.

3. Sign Up

1. The intellectual property rights of the content (hereinafter referred to as “content”) created by a member in through the WebCeph service belongs to the member in accordance with the relevant laws and regulations. Intellectual property rights related to WebCeph services (for example, AssembleCircle's trademark, etc.) and intellectual property rights of all materials that are stored, displayed or accessible on the WebCeph homepage are owned or licensed by AssembleCircle. You may modify, copy, reproduce, republish, upload, post, transfer, distribute, sell, license, lease, publicly display or perform, edit, or otherwise modify, copy, reproduce, republish, upload, post, transmit, distribute, sell, publicly display, or otherwise modify, in any way, without the written consent of the Assemblies. Secondary works cannot be produced.
2. In addition, members may view, use, download, and print selected portions of the WebCeph homepage for personal, non-commercial, and informational purposes, without posting WebCeph contents as is.
3. ssemble Circle shall not be held liable for any infringement of intellectual property rights of third parties during the process of creating contents by members, or disputes on intellectual property rights between members arising from members using contents of other members.

4. Types of services and how to use them

1. AssembleCircle provides the following services to its members.
1. Dental diagnostic medical data analysis service
2. Clinical and academic discussion informative service for clinicians and researchers
3. Dentist-patient clinical data and educational data delivery service
4. Educational services in the form of video lectures and text lectures and others
5. All other services provided to members through additional development by AssembleCircle or through partnership agreements with other companies
2. In principle, the service operates 24 hours a day, 365 days a year, unless there is a special obstacle in the business or technology of AssembleCircle.
3. AssembleCircle may determine the availability of some services separately. In this case, we will notify you via e-mail or notice pop-up within the service.

5. Restrictions on service use

1. AssembleCircle may restrict members' use of services in the following cases:
2. In the case of a time when there is a high possibility of a service error related to the financial institutions affiliated with AssembleCircle
3. When it is difficult to provide normal service due to repair, upgrade, inspection, replacement, hacking, etc.
4. In case the service operation is impossible due to force majeure such as natural disaster, war, explosion, terrorism, etc.
5. In case of occurrence of each subparagraph of Article 6 Paragraph 2, etc.
6. If AssembleCircle intends to restrict the use of the service, the reason, date, and period are determined in advance and notified via e-mail or notice pop-up within the service. However, if AssembleCircle recognizes that it is urgently necessary to limit the use of the service, it may post notice after the restriction on the use of the service.
7. AssembleCircle is not responsible for any restrictions on the use of services that are not attributable to AssembleCircle.

6. Cancellation of service use contract

1. A member may terminate or cancel the service use contract by applying for the termination of the use contract in the method determined by AssembleCircle.
2. AssembleCircle may terminate or cancel the service use contract with the member in the case of any of the following reasons:
3. If it is difficult for the member to achieve the purpose of the contract by violating these terms and conditions or related laws
4. When a member falsely fills in important information such as information related to qualifications for service use
5. When a member steals or uses another person's name or payment information
6. When a member uses WebCeph service for illegal purposes
7. When a member interferes with the operation of WebCeph service
8. When a member distributes a virus program or hacks
9. Other cases where AssembleCircle judges objectively that it is necessary to refuse to use the service, etc.
10. When AssembleCircle terminates or cancels the contract of use in accordance with this Article, it may set a reasonable period and grant the member an opportunity to file an objection.
11. AssembleCircle immediately resumes the service if the objection is justified.

7. Intellectual property rights

The intellectual property rights of the content (hereinafter referred to as “content”) created by a member in through the WebCeph service belongs to the member in accordance with the relevant laws and regulations. Intellectual property rights related to WebCeph services (for example, AssembleCircle's trademark, etc.) and intellectual property rights of all materials that are stored, displayed or accessible on the WebCeph homepage are owned or licensed by the AssembleCircle. You may modify, copy, reproduce, republish, upload, post, transfer, distribute, sell, license, lease, publicly display or perform, edit, or otherwise modify, copy, reproduce, republish, upload, post, transmit, distribute, sell, publicly display, or otherwise modify, in any way, without the written consent of the Assemblies. Secondary works cannot be produced.

In addition, members may view, use, download, and print selected portions of the WebCeph homepage for personal, non-commercial, and informational purposes, without posting WebCeph contents as is.

AssembleCircle shall not be held liable for any infringement of intellectual property rights of third parties during the process of creating contents by members, or disputes on intellectual property rights between members arising from members using contents of other members.

8. Data management policy

WebCeph services need to transfer, store, copy, delete, and edit data related to cloud services. In addition, WebCeph needs to index the content to retrieve, protect, and back up data. By using the WebCeph service, members give the AssembleCircle the authority to manage data. When a member provides data to the WebCeph service, the member has the right to use, store, copy, modify, transmit, disclose, explain, publicly post, distribute, or create a secondary work derived from the data on AssembleCircle is considered licensed.

The above license is valid even after the member stops using the WebCeph service or deactivates the account and AssembleCircle can use the above data to improve the WebCeph services or to develop a new WebCeph service through the above license. WebCeph will do its best to provide more convenient and useful services to the members through continuous service improvement, research, and development.

9. Collection of personal information

The company strives to protect the personal information of members as stipulated by relevant laws and regulations. The protection and use of personal information is in accordance with the relevant laws and regulations and the company's personal information processing policy.

The company does not provide personal information without the individual consent of the information subject to third parties, except in cases where the member uses the service and is requested to provide information from an investigative agency or other public institution in violation of related laws.

The company provides information only to the extent necessary for the entrusted company to investigate, also manages and supervises the safe processing of the users' valuable personal information.

The company allows only individuals aged 19 or older to register as members of the WebCeph service. This age restriction applies solely to member registration and does not limit the processing of patient data uploaded by licensed medical professionals in accordance with applicable laws.

10. Personal information entrusted by WebCeph

When a member provides data, etc. to AssembleCircle for the use of the WebCeph service, the member has all legal rights to the personal information (patient information) and the information subject (patient) for entrustment of the personal information (patient information). You must obtain consent.

For example, if you want to collect the personal information (patient information) of the information subject (patient) who uses the hospital or clinic you operate and provide it to the AssembleCircle, you must use the consent form below to provide the above personal information (patient Information) is collected and the consent of the data subject (patient) must be obtained for the above personal information (patient information) to be entrusted to the AssembleCircle.

[Check the consent form included in the member's guide (link)]

If the member's personal information (patient information) consignment provision violates the relevant laws or the terms and conditions of the WebCeph service and the operation policy, the provision of the WebCeph service may be suspended, Personal information (patient information) may be deleted, member's use of the WebCeph service may be restricted or the account may be suspended. AssembleCircle is not responsible for any disputes between the member and the information subject (patient) or damages to the information subject arising from the violation of laws and regulations, etc.

Members who agree to these terms and conditions are deemed to have entrusted personal information processing work to the AssembleCircle in accordance with Article 26 of the Personal Information Protection Act. Please familiarize yourself with the following regarding personal information processing consignment.

• Purpose and scope of commissioned work: AssembleCircle processes personal information (patient information) entrusted by members within the scope of the purpose of providing the service. In any case, AssembleCircle does not process personal information (patient information) beyond the scope of the consignment purpose. The scope of the consignment service is that AssembleCircle obtains consent from the patient to provide personal information to a third party in order to provide an interlocking service between the company's Internet site (https://toosapp.com, hereinafter "Toosapp") Included.
• Consignment period: The AssembleCircle is entrusted with processing of personal information (patient information) during the member's service use period.
• Following consignment on International transfer of personal information (patient information): AssembleCircle transfers and processes personal information (patient information) entrusted by members located outside Korea within the scope of the purpose of providing the service to Korea as follows.

  Trustee (country to which personal information is transferred according to the consignment)	AssembleCircle Corp. (S.Korea)
  Commissioned work	WebCeph service provision and data management
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	Retransfer of information stored in the cloud service when collecting personal information
  Trustee contact information	12 Daewangpangyo-ro 645beon-gil, Bundang-gu, Seongnam-si, Gyeonggi-do (13487)
  Purpose of use and retention period of trustee	Until the member's service ends

• Re-consignment restrictions: The AssembleCircle does not transfer or re-consign all or part of the personal information (patient information) entrusted by the member to a third party, except in the case of obtaining prior consent from the member. A member who agrees to these terms and conditions is deemed to have read the following matters and consented to the re-consignment of the processing of personal information (patient information) as described below.

  Trustee (country)	Amazon Web Services Korea LLC (United States)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Germany)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (United Kingdom)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Australia)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Brazil)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (France)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (India)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (S.Korea)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Japan)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Singapore)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Sweden)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  In addition, as described above, the four countries to which personal information (patient information) is transferred due to re-consignment are the United States, Canada, Germany, and the United Kingdom. The location of the member (the location of the doctor who collected the patient information) will determine which country the personal information of the member will be transferred to. Please refer to the table below for details.

  Countries transferred upon re-entrustment	Country of data subject (patient)
  United States	Bahamas / Belize / Bermuda / Cayman Islands / Costa Rica / Cuba / Dominica / Dominican Republic / El Salvador / Guadeloupe / Guam / Guatemala / Haiti / Honduras / Jamaica / Mexico / Montserrat / Nicaragua / Northern Mariana Islands / Panama / Pitcairn / Puerto Rico / Republic of Korea / Saint Barthelemy / Saint Kitts and Nevis / Saint Lucia / Saint Martin(French part) / Sint Maarten(Dutch part) / Tanzania / Turks and Caicos Islands / United States / United States Minor Outlying Islands / Virgin Islands
  Canada	Canada / Greenland / Saint Pierre and Miquelon
  Germany	Albania / Angola / Armenia / Austria / Azerbaijan / Belgium / Bosnia and Herzegovina / Bulgaria / Cameroon / Central African Republic / Chad / Congo / Congo / Croatia / Cyprus / Czech Republic / Egypt / Equatorial Guinea / Georgia / Germany / Greece / Holy See(Vatican City State) / Hungary / Israel / Italy / Jordan / Lebanon / Libya / Liechtenstein / Luxembourg / Macedonia / Malta / Moldova / Montenegro / Namibia / Netherlands / Niger / Nigeria / Palestine / Poland / Romania / Russian Federation / Rwanda / San Marino / Serbia / Slovakia / Slovenia / South Africa / South Sudan / Sudan / Swaziland / Switzerland / Syrian Arab Republic / Tunisia / Turkey / Uganda / Ukraine / Zambia / Zimbabwe
  United Kingdom	Guernsey / Iceland / Ireland / Isle of Man / Jersey / United Kingdom
  Australia	American Samoa / Antarctica / Australia / Cook Islands / Fiji / French Polynesia / French Southern Territories / Heard Island and McDonald Islands / Kiribati / Marshall Islands / Micronesia, Federated States of / Nauru / New Caledonia / New Zealand / Niue / Norfolk Island / Papua New Guinea / Samoa / Solomon Islands / Tokelau / Tonga / Tuvalu / Vanuatu / Wallis and Futuna
  Brazil	Anguilla / Antigua and Barbuda / Argentina / Aruba / Barbados / Bolivia, Plurinational State of / Bonaire, Sint Eustatius and Saba / Bouvet Island / Brazil / Chile / Colombia / Curacao / Ecuador / Falkland Islands (Malvinas) / French Guiana / Grenada / Guyana / Martinique / Paraguay / Peru / Saint Vincent and the Grenadines / South Georgia and the South Sandwich Islands / Suriname / Trinidad and Tobago / Uruguay / Venezuela, Bolivarian Republic of
  France	Algeria / Andorra / Benin / Burkina Faso / Cape Verde / Cote d'Ivoire / France / Gabon / Gambia / Ghana / Gibraltar / Guinea / Guinea-Bissau / Liberia / Mali / Mauritania / Monaco / Morocco / Portugal / Saint Helena, Ascension and Tristan da Cunha / Sao Tome and Principe / Senegal / Sierra Leone / Spain / Togo / Western Sahara
  India	Afghanistan / Bahrain / Bangladesh / Bhutan / Botswana / British Indian Ocean Territory / Burundi / Comoros / Djibouti / Eritrea/ Ethiopia / India / Iran, Islamic Republic of / Iraq / Kazakhstan / Kenya / Kuwait / Kyrgyzstan / Lesotho / Madagascar / Malawi / Maldives / Mauritius / Mayotte / Mozambique / Nepal / Oman / Pakistan / Qatar / Reunion / Saudi Arabia / Seychelles/ Somalia / Sri Lanka / Tajikistan / Turkmenistan / United Arab Emirates / Uzbekistan / Yemen
  Korea, Republic of	China / Hong Kong / Korea, Democratic People's Republic of / Korea, Republic of / Macao / Mongolia / Taiwan
  Japan	Japan
  Singapore	Brunei Darussalam / Cambodia / Christmas Island / Cocos (Keeling) Islands / Indonesia / Lao People's Democratic Republic / Malaysia / Myanmar / Palau / Philippines / Singapore / Thailand / Timor-Leste / Viet Nam
  Sweden	Aland Islands / Belarus / Denmark / Estonia / Faroe Islands / Finland / Latvia / Lithuania / Norway / Svalbard and Jan Mayen / Sweden

• Measures to ensure the safety of personal information (patient information): AssembleCircle takes technical and managerial measures necessary to ensure the safety of entrusted personal information (patient information) in accordance with the relevant regulations under the Personal Information Protection Act. For details on measures to ensure safety, such as restricting access to personal information (patient information), please refer to the Privacy Policy.
• Matters related to supervision, such as checking the management status of personal information (patient information): For AssembleCircle, the member has access to the status of processing of personal information (patient information) entrusted by the member, access or access status of personal information (patient information), and use for other purposes. You can request confirmation of whether to comply with the provision and re-consignment prohibition, and whether security measures such as encryption are implemented.

11. Processing of anonymous information

Anonymous information refers to information that is no longer recognizable by using any other information given with reasonable time, cost, and technology. Members may provide or disclose anonymous information to AssembleCircle and other members during the process of using the WebCeph service. In this case, the consent of the information subject (patient) in paragraph 7 is not required.

For example, photographs in which it is impossible to identify a patient by any technical means may be considered anonymous information.

AssembleCircle does not guarantee the anonymity of anonymous information provided or disclosed by the member, and all risks due to insufficient anonymization are within the scope of the member's responsibility. Before providing anonymous information, be sure to review the appropriateness of anonymization.

In addition, the anonymous information disclosed by the member in the gallery can be used freely by the AssembleCircle for new service development, etc.

12. Protection and management of personal information

AssembleCircle collects and uses the personal information included in the data entrusted by the member, including the member's personal information, only within the purpose and scope agreed by the member, and does not provide it to third parties other than AssembleCircle without the consent of the member. It is managed safely in accordance with the laws and regulations related to personal information protection.

The subject of the personal information can request the AssembleCircle to view, correct, or delete the personal information at any time, and the member can withdraw his or her consent to provide personal information to the AssembleCircle.

Details on the protection and management of personal information can be found in the Privacy Policy.

13. Member Responsibilities

If the member confirms that he/she is 19 years of age or older, the member should agree that he/she is responsible for checking and complying with these Terms and Conditions when registering as a member. For clarity, this age requirement applies only to member eligibility and not to patient data entrusted to AssembleCircle by members. If a member violates these terms and conditions, the provision of the WebCeph service may be suspended, and the account may be suspended. For example, members should not do the following actions.

1. Falsely entering member information when registering as a member, selling, transferring, lending, or providing your account to others as collateral, permitting its use, or unauthorized use of another person's account
2. Using WebCeph services for false or illegal purposes, impersonating an individual or organization, or falsely stating or falsely describing affiliation with the individual or organization.
3. Harmful, intrusive, or damaging the website for the following purposes : interfering with the operation or access of the WebCeph service, damaging the WebCeph service, hijacking the operation of the WebCeph service, or monitoring the hardware, software, or equipment. Transferring possible viruses, worms, Trojans, time bombs, spyware or other computer code, files, or programs, limiting or prohibiting the ability of others to use WebCeph services.
4. Any act of removing, blurring, or modifying copyright, trademark or other proprietary notices on the WebCeph website.

If a member does not fulfill the obligations under these terms and conditions, even if the AssembleCircle does not immediately claim the rights to the member or delays the enforcement of the rights, this does not mean that AssembleCircle has waived the above rights. If AssembleCircle decides not to exercise the right of AssembleCircle in accordance with the member's failure to fulfill its obligations under these terms and conditions, AssembleCircle will only do this through written work.

14. AssembleCircle's Responsibilities

If you experience damage due to the intentional or negligence of AssembleCircle in the process of using the WebCeph service, AssembleCircle will compensate for your damage in accordance with the relevant laws and regulations. However, AssembleCircle is not responsible for any special or punitive damages that are not normally foreseeable. Even if the above damages are caused by natural disasters or equivalent force majeure, AssembleCircle is not responsible.

AssembleCircle makes no warranties, either express or implied, as to the accuracy, appropriateness, timeliness, completeness, and reliability of the following items.

1. WebCeph service output (simulation result, etc.)
2. Content created by members in the process of using WebCeph service
3. All content included in or delivered through the WebCeph homepage
4. Medical plans established by doctors using WebCeph services and medical actions performed

WebCeph homepage may contain links to third-party websites, including social media websites such as 'Facebook' and 'Twitter', but this is provided solely for the convenience of the members, and AssembleCircle is an external website linked to the website. We do not endorse or endorse the content of social media.

WebCeph homepage may contain links to third-party websites, including social media websites such as 'Facebook' and 'Twitter', but this is provided solely for the convenience of the members, and AssembleCircle is an external website linked to the website. We do not endorse or endorse the content of social media.

You may not use WebCeph Service for any commercial or business purpose, and AssembleCircle has no responsibility for any liability or loss of any kind incurred by you as a result.

15. Member's liability

1. If a member intentionally or negligently violates the provisions of these Terms and Conditions and causes damage to AssembleCircle, the member must compensate the damage suffered by AssembleCircle.
2. In the event that AssembleCircle receives various objections, including claims for damages or lawsuits, from a third party due to illegal acts or violation of these terms and conditions of a member, the member shall indemnify AssembleCircle at his/her own responsibility and expense.

16. Provision of paid services

The basic services of the WebCeph service are provided for free use after watching advertisements, but some services may be provided as paid services. For example, tracing and basic cephalometric analysis functions of dental medical images can be used for free with advertisements, but functions such as analysis without advertisements or time-lapse video generation of treatment progress can only be used with a paid membership.

WebCeph members can apply for a paid service use contract according to the procedure provided by AssembleCircle and use the paid service after AssembleCircle's approval. However, in the following cases, it may not be accepted or the consent may be withheld.

1. If it is not your real name or if you use someone else's name
2. In case false information is entered or the required information requested by AssembleCircle is not provided
3. If it may negatively affect the status or reputation of the service
4. In case the service cannot be provided due to restrictions on the supply of the service provided by the paid service
5. If you are a member who has a history of requesting content that violates these terms and conditions

In principle, WebCeph members use the paid service provided by AssembleCircle after paying the usage fee. The payment method for the fee for the paid services provided by AssembleCircle is based on credit card payment, but there may be differences in the payment method for each paid service. In the case of a service for which regular monthly payment is made, monthly payment is automatically made unless you request cancellation of the regular payment. In the case of a service for which regular yearly payment is made, yearly payment is automatically made unless you request cancellation of the regular payment.

AssembleCircle may periodically request members' personal information that is essential for payment, and WebCeph members must accurately provide personal information requested by AssembleCircle.

17.Cancellation of use of paid services

If you wish to cancel the paid service use contract, WebCeph members can apply for cancellation of the paid service at any time by using the menu provided in the service, and AssembleCircle will process it promptly as stipulated by law.

The cancellation of the paid service use contract is established by the WebCeph member's application for cancellation of the paid service use contract and the approval of AssembleCircle.

If the application for termination of the paid service use contract is established by the approval of AssembleCircle, the termination will be processed after the period of use for the current subscription term is over, and regular payment will no longer occur. Paid service benefits are maintained normally until the last day of the current subscription term.

If you cancel a subscription service (e.g., monthly subscription service, yearly subscription service), you will not receive a refund for the service you have already paid for.

In the case of one-time payment products (e.g., content products, cyber money, etc.) that are not subscription services, you can cancel through WebCeph customer service center within 7 days from the payment date. You must notify WebCeph customer service center (admin@assemblecircle.com) of your intention to cancel by e-mail, and AssembleCircle will refund within 5 business days after confirming the member's request and refund policy of WebCeph. WebCeph members cannot receive a refund for one-time payment products that have passed 7 days from the payment date.

If you want to use the service again after canceling the contract for using the paid service, you can apply for the paid service again using the menu provided in the service.

18. Delivery of opinions and improvements

Members may provide comments or feedbacks for the improvement of WebCeph services at any time through the WebCeph Service Customer Center (admin@AssembleCircle.com).

19. Dispute resolution

The relationship between AssembleCircle and the member in relation to these terms and conditions or the WebCeph service is governed by Korean law. Any dispute arising between the AssembleCircle and the member, any dispute arising out of these terms and conditions or in connection with the WebCeph service will be resolved in accordance with the procedures stipulated in the Korean Civil Procedure Act.

20. Amendment of Terms and Conditions

AssembleCircle may revise these Terms and Conditions within the scope of not violating relevant laws and regulations. If these Terms and Conditions are revised, we will notify you in advance about the reason for the revision and the effective date. You can send your opinion on the revision of the terms from the date the revised terms are posted on the WebCeph website to the effective date.

In the event of a change to the terms and conditions that are unfavorable to the member, the change will be notified on the WebCeph website 30 days before the change date. If your opinion is not communicated to the AssembleCircle by the notified effective date, you are deemed to agree to the revised terms and conditions. If you do not agree to the revised terms and conditions, we may not be able to provide you with WebCeph services subject to the revised terms and conditions.

Recipient (country)	Amazon Web Services Korea LLC(USA)
Transfer purpose	Cloud service
Items of personal information transferred	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, alien registration number, occupation, bio or career, hospital name, hospital address, hospital contact information, bank account information, cash receipt information, payment information, Information actually collected among CI/DI, i-PIN authentication results, telecommunications companies, domestic/foreigner information, service use records, device information, and personal customs clearance codes
Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
Transfer recipient contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
Purpose of use and retention period of the transferee	Until the member's service ends

※The user has the right to refuse consent to transfer personal information abroad as above. However, refusal to consent may limit service provision.

AssembleCircle Corp. (the "Company") takes the personal information of users who use the website operated by the company (https://webceph.com hereinafter "WebCeph") very seriously and has the following privacy policy. This personal information processing policy will be updated when there is a change in laws or guidelines related to personal information and may change according to changes in the company policy. The company's personal information processing policy contains the following contents.

1. Collection and use of personal information
2. Provision of personal information to a third party
3. Consignment of personal information processing and overseas transfer
4. Retention/use period and destruction of user personal information
5. Smartphone app management
6. Operation and rejection of cookies
7. User's rights
8. User's obligations
9. Technical/administrative protection measures for personal information
10. Personal Information Protection Officer
11. Notification obligation

1. Collection and use of personal information

A. The purpose of collecting personal information by the company is to provide optimized and customized services by confirming the user's identity and intention to use the service. When registering as a member for the first time, the Company collects only the minimum information necessary to perform the essential functions of the service, and may additionally collect information necessary for payment, delivery of goods, and refunds according to the use of the service provided by the company.

B. The company does not use personal information for purposes other than collection and use or provide it to a third party without the consent of the user.

C. The company may collect and use personal information for the following purposes. However, if it is inevitable to collect and store resident registration numbers and bank account numbers in accordance with related laws such as the Act on Consumer Protection in E-Commerce Transactions (hereinafter referred to as the ‘Transfer Act'), the Framework Act on National Taxes, and the Electronic Financial Transactions Act, the relevant information may be collected.

purpose	Item	Retention period
Confirmation of identity, SSO linkage, contact for notice of violation of policy and change of terms and conditions, confirmation of identity and handling of customer complaints.	(Required) Name, ID, password, nickname, mobile phone number, e-mail address, country of origin, alien registration number (for foreigners)	Principle: Until membership withdrawal Records on consumer complaints or dispute settlement: 3 years (previous law)
Order, payment and delivery service	(Required) Name, ID, phone number, country, address, email address, bank account information, mobile phone number when paying by mobile phone, cash receipt information when applying for a cash receipt, payment information	Withdrawal of contract or subscription: 5 years (previous commercial law) Records of payment and supply of goods, etc.: 5 years (transfer method) Books and supporting documents for all transactions stipulated by the tax law: 5 years (Basic National Tax Act)
New service development, customized service provision and marketing, service use statistics and surveys	(Optional) Gender, date of birth, mobile phone number, email address	Until membership withdrawal
Integrated service operation such as identification, identity verification, age verification, illegal use prevention, customized service, etc. (ID/PW search and WebCeph service)	(Required) Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country, occupation, bio or career, hospital name, hospital address, hospital contact information, CI/DI, i-PIN authentication result, telecommunication company, my/ Foreigner information, service use record, device information	Principle: Until membership withdrawal Record of fraudulent transaction: 1 year
Handling of customs clearance for products directly delivered overseas	(Required) Personal customs clearance code	Records on import declaration, etc.: 5 years

*Illegal transaction: Refers to a transaction of methods or contents that violate laws and regulations, the terms of service or public order and morals between the company and users, or infringe on the rights or interests of other companies, members, or others.

D. In addition, the following information can be automatically generated and collected, stored, combined, and analyzed during service use or business processing.

• Use history information such as IP address, date of visit, service use record: prevention of illegal use, prevention of unauthorized use, development of new services and provision of customized services, etc.

E. When collecting user's personal information, the company must obtain the consent of the user unless there is a separate basis under laws and regulations, race, place of origin, place of origin, ideology, political orientation, and criminal records that may infringe on the user's basic human rights., Health status, etc., is not collected unless the consent of the user or in accordance with the provisions of laws and regulations.

F. The company allows only individuals aged 19 or older to register as members. This restriction applies only to member registration and does not limit the processing of patient data entrusted by licensed medical professionals in accordance with applicable laws.

G. The company may collect personal information in the following ways.

1. Homepage, mobile application, mobile webpage, written, fax, telephone, customer service inquiry, event application
2. Automatic collection through generated information collection tool

H. When collecting personal information, the company divides the minimum personal information necessary for service provision into 'mandatory consent items' and other personal information into 'optional consent items' and prepares a procedure for individual consent to this. The company does not refuse to provide the service because it does not provide personal information other than the minimum personal information required by the user.

2. Provision of personal information to a third party

A. The company uses the personal information of users within the scope notified in 「Collection and Use of Personal Information」, and does not use the user's personal information beyond the scope without prior consent of the user or provide the user's personal information to a third party. However, the following cases are exceptions.

1. When users have previously consented to disclosure or provision to a third party
2. In accordance with the provisions of the law, request of the investigating agency and the supervisory authority, procedures and methods prescribed by the law for the purpose of investigation.
3. Settlement of fees when necessary

B. In addition, if it is necessary to provide personal information to a third party, personal information may be provided to the third party through legitimate procedures such as obtaining the consent of the user. The Company may provide personal information through legitimate procedures such as obtaining user consent if necessary for the user's transaction execution.

C. Users may disagree with the provision of personal information to a third party, and may withdraw their consent to the provision of personal information to a third party at any time. If you refuse to consent, you can still use the membership service, but the use/provision of related services based on the provision of a third party may be restricted. Any changes to the provision of other personal information to a third party will be notified separately.

3. Consignment on processing of personal information and transfer to overseas

The company entrusts the following tasks in relation to personal information processing and takes necessary measures to ensure that personal information on consignment contracts can be safely managed in accordance with relevant laws and regulations. The company considers the trustee's ability to protect personal information when making a consignment contract.

Trustee (country)	Commissioned work	Items of personal information transferred	Transfer date and transfer method	Trustee contact information	Purpose of use and retention period of trustee
Amazon Web Services Korea LLC(USA)	Cloud service	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, occupation, bio or career, hospital name, hospital address, hospital contact information, alien registration number, bank account information, cash receipt information, payment information, Information actually collected among CI/DI, i-PIN authentication results, telecommunications companies, domestic/foreigner information, service use records, device information, and personal customs clearance codes	When collecting personal information, it is stored in the cloud service	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)	Cloud service provision, until the end of the consignment contract

In addition, the company transfers and processes the user's personal information to Korea as follows.

Recipient (country)	Purpose of transfer	Items of personal information to be transferred	Retention period
AssembleCircle Corp.(Republic of Korea)	WebCeph service provided	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, occupation, bio or career, hospital name, hospital address, hospital contact information, alien registration number, bank account information, cash receipt information, payment information, Information actually collected among CI/DI, i-PIN authentication results, telecommunications companies, domestic/foreigner information, service use records, device information, and personal customs clearance codes	Until membership withdrawal

4. Retention/use period and destruction of user’s personal information

In principle, the Company retains and uses the user's personal information during the agreed period with the user. When the purpose of collection and use is achieved or when a user requests deletion, the company deletes the personal information without delay. However, the following information is retained for the specified period for the following reasons.

A. Reasons for information preservation according to related laws and company policies

If it is necessary to preserve it in accordance with the provisions of related laws such as the Commercial Act, the personal information of the user is kept in accordance with the laws and regulations and is not used for other purposes such as marketing.

Related laws	purpose	Items to be collected	Retention period
Communications Secret Protection Act	Provided upon request by an investigative agency upon receipt of a court warrant	Log record, IP, etc.	3 months
Transference	Records on consumer complaints or dispute settlement	Consumer identification information, dispute handling records, etc.	3 Years
	Records on payment and supply of goods, etc.	Consumer identification information, contract/subscription withdrawal records, etc.	5년
	Records on contract or subscription withdrawal, etc.	National tax evidence, etc.	10 Years
National Tax Basic Law	Calculation of national tax exclusion period	Tax base and tax reporting data, etc.	5 Years
	Calculation of expiring prescription for national tax collection rights, etc.
VAT law	Ledger, tax invoice, import tax invoice, receipt, etc.	Tax base of VAT and reporting data of tax amount, etc.	5 Years
Electronic Financial Transaction Act	Check electronic financial transaction records	Records on electronic financial transactions, information on counterparties, etc.	5 Years

B. The period of retention and use of collected personal information is from the signing of the service use contract (member registration) to the termination of the service use contract (including withdrawal application and direct withdrawal). In addition, upon termination of consent, the company deletes the user's personal information without delay, except for data that is stored for a certain period for the reason of retaining the information specified above and instructs the trustee to delete the personal information if the processing of personal information was entrusted to a third party.

C. In accordance with Article 39-6 of the Personal Information Protection Act, the personal information of users who have not used the company's services for one year will be notified in advance and the personal information will be deleted or stored separately. However, if it is necessary to preserve it in accordance with the provisions of related laws, such as the Protection of Communications Secrets Act and the Consumer Protection Act in Electronic Commerce, etc., the personal information of users is kept for a certain period stipulated by the relevant laws.

D. The company shall notify the user about facts, period of storage and management of personal information by means of WebCeph notices, e-mails, etc. to the user 30 days before the separate storage of personal information described in paragraph C. Inform. To this end, the user must provide/edit the correct contact information to the company.

E. Deletion method

User's personal information is deleted without delay after the purpose of collection and use is achieved. Personal information printed on paper is shredded or incinerated and personal information stored in electronic file format is deleted using technical or physical methods that cannot reproduce the record..

5. Smartphone app management

When using the service through a smartphone app, information is collected or transmitted after notifying the user that the user is accessing terminal information within the scope of obtaining consent for collection and use of personal information and obtaining approval. Just because the user has allowed access to the terminal on the app does not mean that all information related to the permission is immediately collected or transmitted. To use the service, the access right of the smartphone app is required or selectively requested from the user, and the user can change it in the 'Settings' menu afterwards. You can check the details of app permission through the app store.

Even if you delete the app on your smartphone, the user's member account is retained, so if you want to withdraw membership, please use the ‘Membership Withdrawal' function on the WebCeph PC webpage or contact the customer center.

6. Operation and rejection of cookies

A. Purpose of use of cookies

1) The company uses ‘cookies’ that store usage information in order to provide personalized services on the Internet site operated by the company. Cookies are small pieces of information that the website server sends to the user's browser and are stored on the user’s computer hard disk.

2) The company can provide specific customized services that are only possible through the use of cookies.

3) The company may use cookies to identify members and to keep members logged in.

B. Installation/operation and rejection of cookies

1) Users have the option of installing cookies. Therefore, the user can allow/reject all cookies by adjusting the options in the web browser, or check each time a cookie is saved.

- How to specify whether to allow the installation of cookies (for Internet Explorer) is as follows.

• Select [Internet Options] from the [Tools] menu.
• Click the [Personal Information Tab].
• You can set the [Personal Information Processing Level].

2) If you refuse to store cookies, some services provided by the company, such as personalized services, may be difficult to use.

3) For details on customized advertisements, please check the link.

7. User's rights

The rights that a member can exercise include the right to read, the right to correct, the right to delete, the right to suspend processing, and the right to withdraw consent.

A. Right to Reading

- Members can immediately access the member's personal information items and contents in the “Account Management” menu of the website at any time.

- If you wish to view additional personal information, such as the purpose of collection and use of personal information, period of retention and use of personal information, status of provision of personal information to a third party, facts and contents of consent to the processing of personal information, please apply at the application page [link] or send an email to admin@assemblecircle.com.

- In the case of each of the reasons below, access may be restricted or denied.

1. When viewing is prohibited or restricted by law
2. If there is a risk of harming a person’s the life or physical aspects, or when is a risk of unfairly infringing on the property and other interests of a person

- If you request to view the application page [link] or by e-mail, we will respond within 10 days and grant your access to view. However, in unavoidable circumstances, it may be made available for viewing after 10 days with prior notice, and if the viewing is restricted or rejected, the relevant content will be notified within 10 days.

B. Right to Revise

- Members can access the “Account Management” menu of the website at any time and read and correct the personal information items and contents of the member immediately.

- If additional personal information such as the purpose of collection and use of personal information, period of retention and use of personal information, the status of provision of personal information to a third party, the facts and contents of consent to the processing of personal information, etc., please apply from the application page [link] or send an email to admin@assemblecircle.com to request correction.

- If you apply for correction via the application page [link] or e-mail, you will be notified of the correction result within 10 days.

C. Right to erasure

- Members can access the “Account Management” menu of the website at any time and immediately view and delete your personal information items and contents.

- If you have viewed additional personal information such as, the purpose of collection and use of personal information, period of retention, and use of personal information, status of provision of personal information to a third party, facts and contents of consent to the processing of personal information, and would like to delete a content, please apply from the application page [link] or send an email to admin@assemblecircle.com to request deletion.

- Deletion may be rejected for the following reasons.

• When the personal information is specified as the object of collection in other laws

- Even if the personal information requested to be deleted is essential information necessary for the provision of the service, deletion may be restricted, and if such personal information needs to be deleted, please use other methods such as withdrawal of membership.

- If you apply for deletion via the application page [link] or e-mail, you will be notified of the deletion result within 10 days. In addition, if the deletion is rejected, we will notify you of the relevant details within 10 days.

D. Right to stop processing

- Members can apply at any time from the application page [link] or send an email to admin@assemblecircle.com to request to stop the processing of personal information.

- However, if there are any of the following reasons, the suspension of processing may be rejected.

1. If there are special regulations in the law or it is inevitable to comply with legal obligations
2. When there is a risk of harming a person's life or physical aspects, or unreasonable infringement of a person's property and other interests
3. If personal information is not processed, it is difficult to perform the contract, which will lead to failure providing services contracted with the information subject, and the information subject does not clearly state his intention to terminate the contract.

- In the case of requesting suspension of the process through the application page [link] or by e-mail, the result of suspension of the process will be notified within 10 days. In addition, if the suspension of the process is rejected, related details will be notified within 10 days.

E. Right to withdraw consent

- Members can withdraw their consent such as comprehensive collection, use, and provision of personal information at any time through the “Account Management” menu of the website and pressing the “Delete Account” button.

- If there is a separate consent for a separate service within the website, and you wish to withdraw your consent only for that consent, please apply from the application page [link] or send an email to admin@assemblecircle.com. Please send your intention to withdraw your consent. For reference, due to the withdrawal, the service may be limited or you may not be able to use some services.

- If you withdraw your consent, personal information collected under the consent will be deleted without delay. However, in the case of personal information collected based on individual laws without consent, consent may be retained and used for the period specified by the relevant laws and ordinances regardless of the withdrawal of consent and will be deleted immediately after the period stipulated by the relevant laws and regulations is over. In addition, if the company is required to preserve the member's personal information according to separate terms and conditions, the processing may be restricted.

8. User's obligations

Users are obligated to protect their personal information, and there is no liability for the company regarding rental, loss of ID, password, media access, etc. The Company is not responsible for any problems caused by leakage of personal information due to problems on the Internet that the Company cannot control despite considerable caution, such as hacking or technological issues that cannot be blocked.

A. Users must keep their personal information up to date, and the user is responsible for any problems arising from the user's incorrect information input.

B. In the case of a member sign-up that impersonates other people's personal information or stolen ID, etc., during processing payment, the user may lose the user's qualifications and may be punished in accordance with relevant laws and regulations.

C. The user is responsible for maintaining the security of the ID, password, etc., and cannot be transferred or lent to a third party. The user is obligated to cooperate with the periodic change of password for security in accordance with the company's privacy policy.

D. After using the company's services, users must close their login account and close the web browser program.

E. Users must comply with other personal information laws such as the 'Information and Communication Network Utilization Promotion and Information Protection Act', 'Personal Information Protection Act', and 'Resident Registration Act'.

9. Technical/administrative protection measures for personal information

The company is taking the following technical/administrative protection measures to ensure safety so that personal information is not lost, stolen, leaked, altered or damaged in processing of users' personal information.

A. Encryption of personal information

User's password is stored and managed by one-way encryption, and personal information can be checked and changed only by the person who knows the password. Password generation rules have been established and applied to avoid using numbers that are easy for others to guess, such as the user's birthday and phone number. Personal information such as resident registration number, foreigner registration number, bank account number and credit card number are encrypted and stored and managed with a secure encryption algorithm.

B. Countermeasures against hacking, etc.

The company operates an intrusion detection and intrusion prevention system 24 hours a day to prevent leakage of the user's personal information due to intrusion of the company's information and communication network such as hacking. In preparation for an emergency, all intrusion detection systems and intrusion prevention systems are operated in a redundant configuration, and sensitive personal information can be safely transmitted over the network through encrypted communication.

C. Minimization and education of personal information handlers

The company restricts the company's personal information handlers to a minimum, and recognizes the importance of personal information protection through administrative measures such as training for personal information handlers.

D. Operation of a department dedicated to personal information protection

The company operates a department dedicated to personal information protection to efficiently protect personal information of the users and strives to promptly correct any problems by checking on the application of the personal information processing policy and the personal information handler.

E. Establishment and implementation of an internal management plan to safely process personal information

F. Installation and operation of access control devices such as an intrusion prevention system to block illegal access to personal information

G. Measures to prevent forgery or alteration of access records

H. Other protective measures necessary to secure the safety of personal information.

10. Personal Information Protection Officer

The company is doing its best to ensure that users can safely use the company's services. Users can report all personal information protection complaints on the use of services to the dedicated department, and the company will respond promptly and faithfully to users' reports.

[Person in charge of personal information protection]

• Name: Yehyun Kim
• Affiliation: Security Department
• Email: admin@assemblecircle.com
• Phone number: +82-31-697-0499

※ The above contact information is connected to the 'Customer Center for Personal Information Protection'. If you need to report or consult about other personal information infringement, please contact the following organizations.

• Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutors' Office Advanced Crime Investigation Center (www.spo.go.kr/ 02-3480-2000)
• National Police Agency Cyber Bureau (cyberbureau.police.go.kr / 182)

11. Duty of notice

This personal information processing policy may result in addition, deletion, or modification of the contents due to changes in related laws and guidelines or the needs of the company. In this case, we will notify you through the website or e-mail at least 7 days in advance, and if it is difficult to notify in advance, we will notify you without delay. However, if material changes are made, it will be notified at least 30 days in advance, and will be implemented after 30 days, unless otherwise notified. In addition, we may obtain separate consent from customers if necessary, in accordance with relevant laws and regulations.

Announcement Date: February 25, 2026
Effective Date: March 5, 2026

1. Nature and scope of the terms and conditions

These terms and conditions describe the relationship between AssembleCircle Corp.(hereinafter referred to as "AssembleCircle") and WebCeph members (hereinafter referred to as 'members') or non-members who use the WebCeph service, and the rights, obligations and necessary matters between the member and AssembleCircle in relation to the use of the WebCeph service provided by the AssembleCircle to members. It is for the purpose of defining.

When you use the WebCeph service or sign up as a member, you are required to confirm or agree to these terms and conditions. These terms and conditions are basically applied to all WebCeph services, but separate terms and operating policies may be applied for each individual service to comply with relevant laws and regulations and to achieve the purpose of each service.

2. WebCeph Service

WebCeph service is an orthodontic orthognathic artificial intelligence cloud platform designed by orthodontists and oral surgeons and developed by orthodontists. You can use the WebCeph service using a device that can connect to the Internet, such as a PC or mobile phone. WebCeph service includes diagnostic data analysis services for orthodontic and orthognathic surgery, and clinical case sharing and discussion platforms for academic purposes. For specific details of individual services, please refer to the WebCeph website.

WebCeph service is a service that assists doctors in diagnosis, medical plan establishment, medical practice, etc. WebCeph Services can help you, however, WebCeph Services is neither a medical institution nor a healthcare provider and does not provide medical advice or diagnosis. In other words, WebCeph service does not function as a substitute for a service that provides expert opinion or professional opinion in any way. AssembleCircle recommends that members establish a medical plan, perform medical treatment, or receive treatment through consultation with a medical professional along with the WebCeph service.

AssembleCircle provides the same service to all members, but the scope of the service provided for each individual service may vary to comply with relevant laws and regulations and to achieve the goal of individual service. For example, some of the WebCeph services may be provided only to members with medical qualifications, and members who wish to use the services may be required to provide evidence of medical qualifications to be provided with the services.

The AssembleCircle may modify, suspend, or terminate some or all the contents of the WebCeph website or WebCeph service for reasons of compliance with related laws and regulations, maintenance and management of services, and business judgment. For example, to perform routine or non-routine maintenance of the WebCeph service, to correct errors, or to perform other changes, we may suspend the WebCeph homepage or some operations of the WebCeph service as needed. In addition, AssembleCircle may stop the operation of the WebCeph service in a certain residential area. If a member violates the terms and conditions and related laws, services may no longer be provided to the member.

he WebCeph service is currently free, but it may be converted to a paid service in some or all of the WebCeph service. If there is a conversion in service payment, partial or whole, we will inform the members regarding the scope and pricing policy of the WebCeph service in advance.

3. Sign Up

1. The intellectual property rights of the content (hereinafter referred to as “content”) created by a member in through the WebCeph service belongs to the member in accordance with the relevant laws and regulations. Intellectual property rights related to WebCeph services (for example, AssembleCircle's trademark, etc.) and intellectual property rights of all materials that are stored, displayed or accessible on the WebCeph homepage are owned or licensed by AssembleCircle. You may modify, copy, reproduce, republish, upload, post, transfer, distribute, sell, license, lease, publicly display or perform, edit, or otherwise modify, copy, reproduce, republish, upload, post, transmit, distribute, sell, publicly display, or otherwise modify, in any way, without the written consent of the Assemblies. Secondary works cannot be produced.
2. In addition, members may view, use, download, and print selected portions of the WebCeph homepage for personal, non-commercial, and informational purposes, without posting WebCeph contents as is.
3. ssemble Circle shall not be held liable for any infringement of intellectual property rights of third parties during the process of creating contents by members, or disputes on intellectual property rights between members arising from members using contents of other members.

4. Types of services and how to use them

1. AssembleCircle provides the following services to its members.
1. Dental diagnostic medical data analysis service
2. Clinical and academic discussion informative service for clinicians and researchers
3. Dentist-patient clinical data and educational data delivery service
4. Educational services in the form of video lectures and text lectures and others
5. All other services provided to members through additional development by AssembleCircle or through partnership agreements with other companies
2. In principle, the service operates 24 hours a day, 365 days a year, unless there is a special obstacle in the business or technology of AssembleCircle.
3. AssembleCircle may determine the availability of some services separately. In this case, we will notify you via e-mail or notice pop-up within the service.

5. Restrictions on service use

1. AssembleCircle may restrict members' use of services in the following cases:
2. In the case of a time when there is a high possibility of a service error related to the financial institutions affiliated with AssembleCircle
3. When it is difficult to provide normal service due to repair, upgrade, inspection, replacement, hacking, etc.
4. In case the service operation is impossible due to force majeure such as natural disaster, war, explosion, terrorism, etc.
5. In case of occurrence of each subparagraph of Article 6 Paragraph 2, etc.
6. If AssembleCircle intends to restrict the use of the service, the reason, date, and period are determined in advance and notified via e-mail or notice pop-up within the service. However, if AssembleCircle recognizes that it is urgently necessary to limit the use of the service, it may post notice after the restriction on the use of the service.
7. AssembleCircle is not responsible for any restrictions on the use of services that are not attributable to AssembleCircle.

6. Cancellation of service use contract

1. A member may terminate or cancel the service use contract by applying for the termination of the use contract in the method determined by AssembleCircle.
2. AssembleCircle may terminate or cancel the service use contract with the member in the case of any of the following reasons:
3. If it is difficult for the member to achieve the purpose of the contract by violating these terms and conditions or related laws
4. When a member falsely fills in important information such as information related to qualifications for service use
5. When a member steals or uses another person's name or payment information
6. When a member uses WebCeph service for illegal purposes
7. When a member interferes with the operation of WebCeph service
8. When a member distributes a virus program or hacks
9. Other cases where AssembleCircle judges objectively that it is necessary to refuse to use the service, etc.
10. When AssembleCircle terminates or cancels the contract of use in accordance with this Article, it may set a reasonable period and grant the member an opportunity to file an objection.
11. AssembleCircle immediately resumes the service if the objection is justified.

7. Intellectual property rights

The intellectual property rights of the content (hereinafter referred to as “content”) created by a member in through the WebCeph service belongs to the member in accordance with the relevant laws and regulations. Intellectual property rights related to WebCeph services (for example, AssembleCircle's trademark, etc.) and intellectual property rights of all materials that are stored, displayed or accessible on the WebCeph homepage are owned or licensed by the AssembleCircle. You may modify, copy, reproduce, republish, upload, post, transfer, distribute, sell, license, lease, publicly display or perform, edit, or otherwise modify, copy, reproduce, republish, upload, post, transmit, distribute, sell, publicly display, or otherwise modify, in any way, without the written consent of the Assemblies. Secondary works cannot be produced.

In addition, members may view, use, download, and print selected portions of the WebCeph homepage for personal, non-commercial, and informational purposes, without posting WebCeph contents as is.

AssembleCircle shall not be held liable for any infringement of intellectual property rights of third parties during the process of creating contents by members, or disputes on intellectual property rights between members arising from members using contents of other members.

8. Data management policy

WebCeph services need to transfer, store, copy, delete, and edit data related to cloud services. In addition, WebCeph needs to index the content to retrieve, protect, and back up data. By using the WebCeph service, members give the AssembleCircle the authority to manage data. When a member provides data to the WebCeph service, the member has the right to use, store, copy, modify, transmit, disclose, explain, publicly post, distribute, or create a secondary work derived from the data on AssembleCircle is considered licensed.

The above license is valid even after the member stops using the WebCeph service or deactivates the account and AssembleCircle can use the above data to improve the WebCeph services or to develop a new WebCeph service through the above license. WebCeph will do its best to provide more convenient and useful services to the members through continuous service improvement, research, and development.

9. Collection of personal information

The company strives to protect the personal information of members as stipulated by relevant laws and regulations. The protection and use of personal information is in accordance with the relevant laws and regulations and the company's personal information processing policy.

The company does not provide personal information without the individual consent of the information subject to third parties, except in cases where the member uses the service and is requested to provide information from an investigative agency or other public institution in violation of related laws.

The company provides information only to the extent necessary for the entrusted company to investigate, also manages and supervises the safe processing of the users' valuable personal information.

The company allows only individuals aged 19 or older to register as members of the WebCeph service. This age restriction applies solely to member registration and does not limit the processing of patient data uploaded by licensed medical professionals in accordance with applicable laws.

10. Personal information entrusted by WebCeph

When a member provides data, etc. to AssembleCircle for the use of the WebCeph service, the member has all legal rights to the personal information (patient information) and the information subject (patient) for entrustment of the personal information (patient information). You must obtain consent.

For example, if you want to collect the personal information (patient information) of the information subject (patient) who uses the hospital or clinic you operate and provide it to the AssembleCircle, you must use the consent form below to provide the above personal information (patient Information) is collected and the consent of the data subject (patient) must be obtained for the above personal information (patient information) to be entrusted to the AssembleCircle.

[Check the consent form included in the member's guide (link)]

If the member's personal information (patient information) consignment provision violates the relevant laws or the terms and conditions of the WebCeph service and the operation policy, the provision of the WebCeph service may be suspended, Personal information (patient information) may be deleted, member's use of the WebCeph service may be restricted or the account may be suspended. AssembleCircle is not responsible for any disputes between the member and the information subject (patient) or damages to the information subject arising from the violation of laws and regulations, etc.

Members who agree to these terms and conditions are deemed to have entrusted personal information processing work to the AssembleCircle in accordance with Article 26 of the Personal Information Protection Act. Please familiarize yourself with the following regarding personal information processing consignment.

• Purpose and scope of commissioned work: AssembleCircle processes personal information (patient information) entrusted by members within the scope of the purpose of providing the service. In any case, AssembleCircle does not process personal information (patient information) beyond the scope of the consignment purpose. The scope of the consignment service is that AssembleCircle obtains consent from the patient to provide personal information to a third party in order to provide an interlocking service between the company's Internet site (https://toosapp.com, hereinafter "Toosapp") Included.
• Consignment period: The AssembleCircle is entrusted with processing of personal information (patient information) during the member's service use period.
• Following consignment on International transfer of personal information (patient information): AssembleCircle transfers and processes personal information (patient information) entrusted by members located outside Korea within the scope of the purpose of providing the service to Korea as follows.

  Trustee (country to which personal information is transferred according to the consignment)	AssembleCircle Corp. (S.Korea)
  Commissioned work	WebCeph service provision and data management
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	Retransfer of information stored in the cloud service when collecting personal information
  Trustee contact information	411-ho, 4th floor, 240, Pangyoyeok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do (13493)
  Purpose of use and retention period of trustee	Until the member's service ends

• Re-consignment restrictions: The AssembleCircle does not transfer or re-consign all or part of the personal information (patient information) entrusted by the member to a third party, except in the case of obtaining prior consent from the member. A member who agrees to these terms and conditions is deemed to have read the following matters and consented to the re-consignment of the processing of personal information (patient information) as described below.

  Trustee (country)	Amazon Web Services Korea LLC (United States)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Germany)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (United Kingdom)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Australia)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Brazil)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (France)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (India)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (S.Korea)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Japan)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Singapore)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  Trustee (country)	Amazon Web Services Korea LLC (Sweden)
  Consignment work	Cloud service
  Items of personal information transferred	Name, date of birth, gender, race, facial picture, oral picture, X-ray picture, measurement coordinates in medical images (radiation pictures and clinical pictures), diagnosis contents, treatment plan, treatment details
  Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
  Trustee contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
  Purpose of use and retention period of trustee	Cloud service provision, until the end of the consignment contract

  In addition, as described above, the four countries to which personal information (patient information) is transferred due to re-consignment are the United States, Canada, Germany, and the United Kingdom. The location of the member (the location of the doctor who collected the patient information) will determine which country the personal information of the member will be transferred to. Please refer to the table below for details.

  Countries transferred upon re-entrustment	Country of data subject (patient)
  United States	Bahamas / Belize / Bermuda / Cayman Islands / Costa Rica / Cuba / Dominica / Dominican Republic / El Salvador / Guadeloupe / Guam / Guatemala / Haiti / Honduras / Jamaica / Mexico / Montserrat / Nicaragua / Northern Mariana Islands / Panama / Pitcairn / Puerto Rico / Republic of Korea / Saint Barthelemy / Saint Kitts and Nevis / Saint Lucia / Saint Martin(French part) / Sint Maarten(Dutch part) / Tanzania / Turks and Caicos Islands / United States / United States Minor Outlying Islands / Virgin Islands
  Canada	Canada / Greenland / Saint Pierre and Miquelon
  Germany	Albania / Angola / Armenia / Austria / Azerbaijan / Belgium / Bosnia and Herzegovina / Bulgaria / Cameroon / Central African Republic / Chad / Congo / Congo / Croatia / Cyprus / Czech Republic / Egypt / Equatorial Guinea / Georgia / Germany / Greece / Holy See(Vatican City State) / Hungary / Israel / Italy / Jordan / Lebanon / Libya / Liechtenstein / Luxembourg / Macedonia / Malta / Moldova / Montenegro / Namibia / Netherlands / Niger / Nigeria / Palestine / Poland / Romania / Russian Federation / Rwanda / San Marino / Serbia / Slovakia / Slovenia / South Africa / South Sudan / Sudan / Swaziland / Switzerland / Syrian Arab Republic / Tunisia / Turkey / Uganda / Ukraine / Zambia / Zimbabwe
  United Kingdom	Guernsey / Iceland / Ireland / Isle of Man / Jersey / United Kingdom
  Australia	American Samoa / Antarctica / Australia / Cook Islands / Fiji / French Polynesia / French Southern Territories / Heard Island and McDonald Islands / Kiribati / Marshall Islands / Micronesia, Federated States of / Nauru / New Caledonia / New Zealand / Niue / Norfolk Island / Papua New Guinea / Samoa / Solomon Islands / Tokelau / Tonga / Tuvalu / Vanuatu / Wallis and Futuna
  Brazil	Anguilla / Antigua and Barbuda / Argentina / Aruba / Barbados / Bolivia, Plurinational State of / Bonaire, Sint Eustatius and Saba / Bouvet Island / Brazil / Chile / Colombia / Curacao / Ecuador / Falkland Islands (Malvinas) / French Guiana / Grenada / Guyana / Martinique / Paraguay / Peru / Saint Vincent and the Grenadines / South Georgia and the South Sandwich Islands / Suriname / Trinidad and Tobago / Uruguay / Venezuela, Bolivarian Republic of
  France	Algeria / Andorra / Benin / Burkina Faso / Cape Verde / Cote d'Ivoire / France / Gabon / Gambia / Ghana / Gibraltar / Guinea / Guinea-Bissau / Liberia / Mali / Mauritania / Monaco / Morocco / Portugal / Saint Helena, Ascension and Tristan da Cunha / Sao Tome and Principe / Senegal / Sierra Leone / Spain / Togo / Western Sahara
  India	Afghanistan / Bahrain / Bangladesh / Bhutan / Botswana / British Indian Ocean Territory / Burundi / Comoros / Djibouti / Eritrea/ Ethiopia / India / Iran, Islamic Republic of / Iraq / Kazakhstan / Kenya / Kuwait / Kyrgyzstan / Lesotho / Madagascar / Malawi / Maldives / Mauritius / Mayotte / Mozambique / Nepal / Oman / Pakistan / Qatar / Reunion / Saudi Arabia / Seychelles/ Somalia / Sri Lanka / Tajikistan / Turkmenistan / United Arab Emirates / Uzbekistan / Yemen
  Korea, Republic of	China / Hong Kong / Korea, Democratic People's Republic of / Korea, Republic of / Macao / Mongolia / Taiwan
  Japan	Japan
  Singapore	Brunei Darussalam / Cambodia / Christmas Island / Cocos (Keeling) Islands / Indonesia / Lao People's Democratic Republic / Malaysia / Myanmar / Palau / Philippines / Singapore / Thailand / Timor-Leste / Viet Nam
  Sweden	Aland Islands / Belarus / Denmark / Estonia / Faroe Islands / Finland / Latvia / Lithuania / Norway / Svalbard and Jan Mayen / Sweden

• Measures to ensure the safety of personal information (patient information): AssembleCircle takes technical and managerial measures necessary to ensure the safety of entrusted personal information (patient information) in accordance with the relevant regulations under the Personal Information Protection Act. For details on measures to ensure safety, such as restricting access to personal information (patient information), please refer to the Privacy Policy.
• Matters related to supervision, such as checking the management status of personal information (patient information): For AssembleCircle, the member has access to the status of processing of personal information (patient information) entrusted by the member, access or access status of personal information (patient information), and use for other purposes. You can request confirmation of whether to comply with the provision and re-consignment prohibition, and whether security measures such as encryption are implemented.

11. Processing of anonymous information

Anonymous information refers to information that is no longer recognizable by using any other information given with reasonable time, cost, and technology. Members may provide or disclose anonymous information to AssembleCircle and other members during the process of using the WebCeph service. In this case, the consent of the information subject (patient) in paragraph 7 is not required.

For example, photographs in which it is impossible to identify a patient by any technical means may be considered anonymous information.

AssembleCircle does not guarantee the anonymity of anonymous information provided or disclosed by the member, and all risks due to insufficient anonymization are within the scope of the member's responsibility. Before providing anonymous information, be sure to review the appropriateness of anonymization.

In addition, the anonymous information disclosed by the member in the gallery can be used freely by the AssembleCircle for new service development, etc.

12. Protection and management of personal information

AssembleCircle collects and uses the personal information included in the data entrusted by the member, including the member's personal information, only within the purpose and scope agreed by the member, and does not provide it to third parties other than AssembleCircle without the consent of the member. It is managed safely in accordance with the laws and regulations related to personal information protection.

The subject of the personal information can request the AssembleCircle to view, correct, or delete the personal information at any time, and the member can withdraw his or her consent to provide personal information to the AssembleCircle.

Details on the protection and management of personal information can be found in the Privacy Policy.

13. Member Responsibilities

If the member confirms that he/she is 19 years of age or older, the member should agree that he/she is responsible for checking and complying with these Terms and Conditions when registering as a member. For clarity, this age requirement applies only to member eligibility and not to patient data entrusted to AssembleCircle by members. If a member violates these terms and conditions, the provision of the WebCeph service may be suspended, and the account may be suspended. For example, members should not do the following actions.

1. Falsely entering member information when registering as a member, selling, transferring, lending, or providing your account to others as collateral, permitting its use, or unauthorized use of another person's account
2. Using WebCeph services for false or illegal purposes, impersonating an individual or organization, or falsely stating or falsely describing affiliation with the individual or organization.
3. Harmful, intrusive, or damaging the website for the following purposes : interfering with the operation or access of the WebCeph service, damaging the WebCeph service, hijacking the operation of the WebCeph service, or monitoring the hardware, software, or equipment. Transferring possible viruses, worms, Trojans, time bombs, spyware or other computer code, files, or programs, limiting or prohibiting the ability of others to use WebCeph services.
4. Any act of removing, blurring, or modifying copyright, trademark or other proprietary notices on the WebCeph website.

If a member does not fulfill the obligations under these terms and conditions, even if the AssembleCircle does not immediately claim the rights to the member or delays the enforcement of the rights, this does not mean that AssembleCircle has waived the above rights. If AssembleCircle decides not to exercise the right of AssembleCircle in accordance with the member's failure to fulfill its obligations under these terms and conditions, AssembleCircle will only do this through written work.

14. AssembleCircle's Responsibilities

If you experience damage due to the intentional or negligence of AssembleCircle in the process of using the WebCeph service, AssembleCircle will compensate for your damage in accordance with the relevant laws and regulations. However, AssembleCircle is not responsible for any special or punitive damages that are not normally foreseeable. Even if the above damages are caused by natural disasters or equivalent force majeure, AssembleCircle is not responsible.

AssembleCircle makes no warranties, either express or implied, as to the accuracy, appropriateness, timeliness, completeness, and reliability of the following items.

1. WebCeph service output (simulation result, etc.)
2. Content created by members in the process of using WebCeph service
3. All content included in or delivered through the WebCeph homepage
4. Medical plans established by doctors using WebCeph services and medical actions performed

WebCeph homepage may contain links to third-party websites, including social media websites such as 'Facebook' and 'Twitter', but this is provided solely for the convenience of the members, and AssembleCircle is an external website linked to the website. We do not endorse or endorse the content of social media.

WebCeph homepage may contain links to third-party websites, including social media websites such as 'Facebook' and 'Twitter', but this is provided solely for the convenience of the members, and AssembleCircle is an external website linked to the website. We do not endorse or endorse the content of social media.

You may not use WebCeph Service for any commercial or business purpose, and AssembleCircle has no responsibility for any liability or loss of any kind incurred by you as a result.

15. Member's liability

1. If a member intentionally or negligently violates the provisions of these Terms and Conditions and causes damage to AssembleCircle, the member must compensate the damage suffered by AssembleCircle.
2. In the event that AssembleCircle receives various objections, including claims for damages or lawsuits, from a third party due to illegal acts or violation of these terms and conditions of a member, the member shall indemnify AssembleCircle at his/her own responsibility and expense.

16. Provision of paid services

The basic services of the WebCeph service are provided for free use after watching advertisements, but some services may be provided as paid services. For example, tracing and basic cephalometric analysis functions of dental medical images can be used for free with advertisements, but functions such as analysis without advertisements or time-lapse video generation of treatment progress can only be used with a paid membership.

WebCeph members can apply for a paid service use contract according to the procedure provided by AssembleCircle and use the paid service after AssembleCircle's approval. However, in the following cases, it may not be accepted or the consent may be withheld.

1. If it is not your real name or if you use someone else's name
2. In case false information is entered or the required information requested by AssembleCircle is not provided
3. If it may negatively affect the status or reputation of the service
4. In case the service cannot be provided due to restrictions on the supply of the service provided by the paid service
5. If you are a member who has a history of requesting content that violates these terms and conditions

In principle, WebCeph members use the paid service provided by AssembleCircle after paying the usage fee. The payment method for the fee for the paid services provided by AssembleCircle is based on credit card payment, but there may be differences in the payment method for each paid service. In the case of a service for which regular monthly payment is made, monthly payment is automatically made unless you request cancellation of the regular payment. In the case of a service for which regular yearly payment is made, yearly payment is automatically made unless you request cancellation of the regular payment.

AssembleCircle may periodically request members' personal information that is essential for payment, and WebCeph members must accurately provide personal information requested by AssembleCircle.

17.Cancellation of use of paid services

If you wish to cancel the paid service use contract, WebCeph members can apply for cancellation of the paid service at any time by using the menu provided in the service, and AssembleCircle will process it promptly as stipulated by law.

The cancellation of the paid service use contract is established by the WebCeph member's application for cancellation of the paid service use contract and the approval of AssembleCircle.

If the application for termination of the paid service use contract is established by the approval of AssembleCircle, the termination will be processed after the period of use for the current subscription term is over, and regular payment will no longer occur. Paid service benefits are maintained normally until the last day of the current subscription term.

If you cancel a subscription service (e.g., monthly subscription service, yearly subscription service), you will not receive a refund for the service you have already paid for.

In the case of one-time payment products (e.g., content products, cyber money, etc.) that are not subscription services, you can cancel through WebCeph customer service center within 7 days from the payment date. You must notify WebCeph customer service center (admin@assemblecircle.com) of your intention to cancel by e-mail, and AssembleCircle will refund within 5 business days after confirming the member's request and refund policy of WebCeph. WebCeph members cannot receive a refund for one-time payment products that have passed 7 days from the payment date.

If you want to use the service again after canceling the contract for using the paid service, you can apply for the paid service again using the menu provided in the service.

18. Delivery of opinions and improvements

Members may provide comments or feedbacks for the improvement of WebCeph services at any time through the WebCeph Service Customer Center (admin@AssembleCircle.com).

19. Dispute resolution

The relationship between AssembleCircle and the member in relation to these terms and conditions or the WebCeph service is governed by Korean law. Any dispute arising between the AssembleCircle and the member, any dispute arising out of these terms and conditions or in connection with the WebCeph service will be resolved in accordance with the procedures stipulated in the Korean Civil Procedure Act.

20. Amendment of Terms and Conditions

AssembleCircle may revise these Terms and Conditions within the scope of not violating relevant laws and regulations. If these Terms and Conditions are revised, we will notify you in advance about the reason for the revision and the effective date. You can send your opinion on the revision of the terms from the date the revised terms are posted on the WebCeph website to the effective date.

In the event of a change to the terms and conditions that are unfavorable to the member, the change will be notified on the WebCeph website 30 days before the change date. If your opinion is not communicated to the AssembleCircle by the notified effective date, you are deemed to agree to the revised terms and conditions. If you do not agree to the revised terms and conditions, we may not be able to provide you with WebCeph services subject to the revised terms and conditions.

Copyright © AssembCircle. All rights reserved. WebCeph and the WebCeph logo are registered trademarks of AssembleCircle Corp.

Announcement Date: February 25, 2026
Effective Date: March 5, 2026

Purpose of collection and use	Personal information items collected and used	Retention period
Confirmation of identity, SSO linkage, contact for notice of violation of policy and change of terms and conditions, confirmation of identity and handling of customer complaints such as complaints	Name, ID, password, nickname, mobile phone number, email address, country name, alien registration number (for foreigners)	Principle: Until membership withdrawal Records on consumer complaints or dispute settlement: 3 years (Act on Consumer Protection in Electronic Commerce, etc.)
Order, payment and delivery service	Name, ID, phone number, country of origin, address, e-mail address, bank account information, mobile phone number when paying by mobile phone, cash receipt information when applying for a cash receipt, payment information	Payment and supply records of goods, etc.: 5 years (Act on Consumer Protection in Electronic Commerce, etc.) Books and supporting documents for all transactions stipulated by the tax law: 5 years (Basic National Tax Act)
Integrated service operation such as identification, identity verification, age verification, illegal use prevention, customized service, etc. (ID/PW search and WebCeph service)	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, occupation, bio or career, hospital name, hospital address, hospital contact information, CI/DI, i-PIN authentication result, telecommunication company, domestic/foreigner information, Service usage record, device information	Principle: Until membership withdrawal Record of fraudulent transaction: 1 year
Handling of customs clearance for products directly delivered overseas	Personal customs clearance code	Records on import declaration, etc.: 5 years

*Illegal transaction: Refers to a transaction of methods or contents that violate laws and regulations, the terms of service or public order and morals between the company and users, or infringe on the rights or interests of other companies, members, or others.

※This is the minimum amount of personal information necessary to use the Webceph service provided by Assemble Circle, Inc., so you can use the service only if you agree to the relevant items.

Purpose of collection and use	Personal information items collected and used	Retention period
New service development, customized service provision and marketing, service use statistics and surveys	Gender, date of birth, mobile phone number, email address	Until cancellation request or membership withdrawal

※Personal information is necessary to use WebCeph service provided by AssembleCircle more efficiently. You can use the rest of the services except for the service that collects and uses the above personal information even if you refuse to consent to the item.

Trustee (country)	Amazon Web Services Korea LLC (USA)
Consignment work	Cloud service
Items of personal information to be entrusted	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, alien registration number, occupation, bio or career, hospital name, hospital address, hospital contact information, bank account information, cash receipt information, payment information, Information actually collected among CI/DI, i-PIN authentication results, telecommunications companies, domestic/foreigner information, service use records, device information, and personal customs clearance codes
Consignment period	Until the consignment contract ends

※The user has the right to refuse to consent to the provision of personal information to a third party as above. However, refusal to consent may limit service provision.

Recipient (country)	Amazon Web Services Korea LLC(USA)
Transfer purpose	Cloud service
Items of personal information transferred	Name, ID, password, nickname, gender, date of birth, mobile phone number, e-mail address, country of origin, alien registration number, occupation, bio or career, hospital name, hospital address, hospital contact information, bank account information, cash receipt information, payment information, Information actually collected among CI/DI, i-PIN authentication results, telecommunications companies, domestic/foreigner information, service use records, device information, and personal customs clearance codes
Transfer date and transfer method	When collecting personal information, it is stored in the cloud service
Transfer recipient contact information	12F, 508, Nonhyeon-ro, Gangnam-gu, Seoul (GS Tower) (06141)
Purpose of use and retention period of the transferee	Until the member's service ends

※The user has the right to refuse consent to transfer personal information abroad as above. However, refusal to consent may limit service provision.