Privacy Policy

This Policy applies to the website (maumscan.com) and the mobile apps (Android and iOS). The Service complies with the laws of the Republic of Korea, including the Personal Information Protection Act (PIPA). Additional information is provided for users in the European Union (EU) and the United Kingdom under the GDPR (Section 14), and for users in certain U.S. states under consumer health data laws (Section 15).

Payment method details such as card numbers are processed directly by Google Play, the App Store and Paddle; the Service does not store them.

If you include another person's contact details in your safety plan, please inform that person and obtain their consent before entering them.

• Identifying members, login and account management
• Generating Mindy's counseling responses, mind analysis, psychological test results and interpretations, and providing the emotion diary and reports
• Pointing you to sources of help when crisis signals appear
• Processing subscriptions and payments, managing usage limits, and handling refunds and other disputes
• Sending notices and notifications (app push notifications only if you allow them on your device)
• Preventing fraudulent use and security incidents, fixing service errors, and usage statistics

Counseling content is not used for advertising or targeted advertising, and it is never sold.

Information that can reveal your mental or emotional state, such as counseling conversations, mind analysis, psychological test results and your emotion diary, is sensitive information (information concerning health) under the Personal Information Protection Act (PIPA), Article 23. The Service obtains your separate consent, distinct from any other consent, before processing this information.

• Purpose: counseling responses, mind analysis and test interpretation, and providing records and reports
• Items: the "Counseling and records (sensitive information)" items in Section 2
• Retention: until you delete your account or withdraw consent (Section 6)
• You may refuse consent. If you do, you will not be able to use the counseling, analysis and record features, but you can continue to use psychology content, the glossary and similar features.

Mindy's replies, mind analysis (assessment of psychological state and severity), test interpretations and reports are generated by an automated language-processing system, not by a human. These results are not a medical diagnosis or treatment, and they are not used to make decisions that have legal effects on you.

You may request an explanation of, or object to, any automated result (see the contact details in Section 12).

Information whose retention period has expired or whose purpose has been fulfilled is destroyed without delay using methods that make it unrecoverable.

The Service does not sell or provide your personal information to third parties, except in the following cases:

• International payments on the web: Paddle (Paddle.com Market Ltd, United Kingdom), as merchant of record, processes the payment as the seller. Items provided: email address, member identifier, purchased product. Retention: Paddle's statutory retention period
• Where you have given prior consent
• Where required by law, or where an investigative authority requests it following procedures set out by law
• Where there is an imminent danger to the life or physical safety of you or another person and the law permits disclosure

The Service entrusts processing to the companies below, some of which process information outside the Republic of Korea (Personal Information Protection Act (PIPA), Article 28-8). Information is transferred over encrypted connections (HTTPS) each time you use the Service.

If you do not want your information transferred abroad, you may refuse consent or delete your account. However, because counseling and analysis are provided only through the companies above, you will not be able to use those features in that case.

Currently, authorized operator staff may view counseling records for service operation and safety review. Every access is logged with the viewer and the time, and records are not used for any other purpose. When a crisis signal is detected, the relevant message is also stored for review.

The Service plans to end operator access at its official launch; when it does, we will revise this Policy and notify you.

• Staying logged in: login tokens are kept in browser storage (localStorage) and deleted when you log out.
• Language preference cookie (1 year), and a browser identifier to prevent abuse of the trial
• Visit statistics: Google Analytics and Google Tag Manager cookies
• Advertising: Coupang Partners ads appear on some content pages (psychology content, personality types, glossary, etc.), and advertiser cookies may be used. No ads are shown on counseling, analysis or test result screens.

You can refuse or delete cookies in your browser settings. Refusing cookies does not prevent you from using the Service, but some features, such as staying logged in, may be limited. The apps do not collect the advertising identifier (advertising ID).

The Service does not accept sign-ups from children under 14. In the EU and the UK, you may not use the Service if you are under the age of digital consent set by your country of residence (13 to 16); in the United States, if you are under 13. If we learn that information has been collected from someone under the applicable age, we will delete it without delay.

• Access to, correction and deletion of your personal information, suspension of processing, and withdrawal of consent
• Requesting an explanation of, and refusing, automated decisions (Personal Information Protection Act (PIPA), Article 37-2)
• Account deletion: you can do this directly in the app settings or on the account deletion screen on the web; when you delete your account, your counseling records and other data are deleted immediately.
• Other requests: send them to maunscancom@gmail.com and we will inform you of the outcome within 10 days.

You may also exercise your rights through a legal representative or an authorized agent; in that case, documents proving the authorization are required.

• Encrypted communication (HTTPS) end to end and one-way encryption of passwords
• Database operated in the Republic of Korea (Seoul) region with access rights kept to a minimum
• Management of login token expiry and reissuance, and a log-out-of-all-devices feature
• Hiding app content in the recent-apps preview (Android) and a privacy reminder when a screenshot is taken
• Retention of logs of administrator access and significant changes

Controller: the operator named in Section 1. EU representative (GDPR Article 27): To be provided upon registration

• Legal bases: performance of a contract (providing member services, Article 6(1)(b)), explicit consent (mental health information, Article 9(2)(a)), legitimate interests (security and fraud prevention, Article 6(1)(f)), and legal obligation (retention of payment records, Article 6(1)(c))
• International transfers: information is stored on servers in the Republic of Korea. The Republic of Korea has received adequacy decisions from the European Commission (2021) and the UK government (2022). Transfers to U.S. companies rely on those companies' Standard Contractual Clauses (SCCs) or their certification under the EU-U.S. Data Privacy Framework.
• Rights: access, rectification, erasure, restriction of processing, portability (receiving a copy of your data), objection, withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal), and the right not to be subject to a decision based solely on automated processing
• If you have a complaint, you may lodge it with the data protection supervisory authority in your country of residence.

This notice is provided under consumer health data laws, including Washington's My Health My Data Act and the laws of Nevada and Connecticut.

• Consumer health data we collect: counseling conversations, mind analysis and severity, psychological test results, emotion diary and check-ins (mood, sleep, etc.), safety plan
• How it is collected: entered directly by you, or generated by the Service based on what you enter
• Purposes: limited to the purposes of providing the Service described in Section 3
• Who we share it with: the processors listed in Section 8 (only to provide the Service). We do not sell it or use it for advertising.
• We obtain your consent before collecting or sharing it, and you may withdraw consent at any time.
• Rights: to confirm what data has been collected and shared and with whom, to delete it, and to withdraw consent — maunscancom@gmail.com. If your request is denied, you may appeal, and Washington residents may file a complaint with the state Attorney General's Office.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office: www.spo.go.kr / 1301
• Korean National Police Agency: ecrm.police.go.kr / 182

If we change this Policy, we will announce it through a service notice at least 7 days before it takes effect (30 days for changes that are unfavorable to you or significant). If the scope of sensitive information processing expands, we will ask for your consent again.