The Integrated Management System of Global Healthcare Invitational Training (hereinafter referred to as 'System') is operated and managed by the Korea Foundation for International Healthcare, the National Health Insurance Service, the Health Insurance Review and Assessment Service, the Korea Health Industry Development Institute, and the Korea Human Resources Development Institute for Health and Welfare.

In order to protect the personal information of the information subject in accordance with the article 30 of the Personal Information Protection Act and to ensure that any grievances related to such information can be dealt with promptly and smoothly, the following personal information processing policy has been established and disclosed.

Personal information processed shall not be used for other purposes, and if the purpose of use is changed, the necessary measures will be implemented, such as obtaining separate consent pursuant to the article 18 of the Personal Information Protection Act.

The processing purpose of the personal information dealt with by the system, the period of processing and retention, and the items of personal information processed are as follows:

• ① In principle, this system processes the personal information of the information subject within the scope specified for the purpose of collecting and using it. Except the following conditions, the personal information of the informant subject shall not be processed beyond its original purpose or provided to a third party without a prior consent of the informant subject.
  • A. In case of receiving a separate consent from the information subject,
  • B. In case that there is a special provision in the law,
  • C. In case that the information subject or his/her legal representative is in a state of being unable to express opinion or give a prior consent due to reasons including, but not limited to, an unknown address but providing information clearly is deemed necessary for the urgent benefit of the life, body or property of the information subject or a third party,
  • D. In case that personal information is provided in a form that a particular individual is not recognizable for statistical and academic research purposes,
  • E. In case that it is not possible to carry out the duties prescribed by other laws unless personal information is used for other purposes or provided to a third party, and it has been reviewed and resolved by the protection committee,
  • F. In case that it is necessary to provide information to foreign or international organizations for the implementation of treaties or other international agreements,
  • G. In case that it is necessary for investigating a crime and raising and maintaining an indictment,
  • H. In case that it is necessary for the court to carry out its trial,
  • I. In case that it is necessary for the execution of punishment, supervision, or protective measures.
• ② This system provides personal information to third parties as follows:

  Provision of personal information to a third party table

  Recipient	Purpose of provision	Basis for provision	Provided items		Retention and utilization period
  Korea Foundation for International Healthcare, National Health Insurance Service, Health Insurance Review and Assessment Service, Korea Health Industry Development Institute, Korea Human Resources Development Institute for Health and Welfare, and Office for Government Policy Coordination	Check the education history of the trainees and provide the relevant education, utilization as statistical data for healthcare invitational training	Consent of the information subject	Personal information	[Basic information for trainees] Name, gender, date of birth, address (home), international telephone code (home), telephone number (home), international telephone code (office), telephone number (workplace), international telephone code (mobile), phone number (mobile), e-mail, dietary requirements, operating organization (inviting organization), certified picture [Organization information] Type of organization, department, position (title), address of organization, type of organization [School information] Name of school, period of degree acquisition, major and degree [Information on other programs] Program name conducted by other institution(s) program, country name, duration of stay [Career information] Name of the institution, office, position [Recommender’s Information] Name, affiliation, position (title) [Application Information]	Until the withdrawal of members
  			Sensitive information	Passport number
  			Personally identifiable information	[Application Information]
  Training & education institution	Trainee information required for training	Consent of the information subject	Personal information	[Application Information]	Until the end of training

• ① This system consigns processing tasks of personal information as follows:
• ② In case of consigning personal information processing, KOFIH clearly stipulates compliance with the laws relating to the personal information protection, prohibition of personal information provision to a third party, and liability, and more in the consignment contract, and keeps the details of the contract in writing. In addition, KOFIH will also notify consignors of any changes to the company through the Personal Information Processing Policy.

  Consignment of processing of personal information table

  No.	Consignment purpose	Contents of the consigned tasks	Consignor	Period of consignment
  1	Business agency	Support for the operation of the training project of the Korea Foundation for International Healthcare (Entry/departure management for trainees)	JM Administrative Agent Office	2019.12.31
  2	Business agency	Support for the operation of the training project of the Korea Heath Industry Promotion Institute (Entry/departure management for trainees)	Min Communications Corp.	2019.11.30
  3	Business agency	Support for the operation of the training project of the Korea Heath Industry Promotion Institute (Operation of the language ability assessment of trainees)	YBM Corp.	2019.11.30
  4	Business agency	Integrated operation and management of IMSOHIT	-	-

• ① Information subject may exercise his/her right to access, correct, delete, and suspend personal information in this system at any time.
• ② The rights pursuant to the paragraph 1 may be exercised through document, e-mail and fax in accordance with the Form No. 8 in the Annex of the Enforcement Rule of the Personal Information Protection Act, and KOFIH will take corresponding measures without delay.
• ③ If the information subject requests correction or deletion of personal information errors, the personal information shall not be used or provided until the correction or deletion is completed.
• ④ The rights pursuant to the paragraph 1 may be exercised through the legal representative or delegated person of the information subject. In this case, a letter of attorney shall be submitted according to the Form No. 11 of the Enforcement Rule of the Personal Information Protection Act.
• ⑤ The person in charge of receiving and processing the request for accessing, correcting, deleting, and suspending personal information are as follows:

  The person in charge of receiving and processing the request for accessing, correcting, deleting, and suspending personal information table

  Responsible department	Person in charge	Contact number	E-mail	Fax
  Management Planning Department of the Korea Foundation for International Healthcare	Noh Gook-rae, Manager	02-3396-9836	grnoh@kofih.org	02-356-3104
  	Jung Jae-woong, Assistant manager	02-3396-9839	jwjung@kofih.org

• ⑥ Identification procedure of information subjects

  There is a procedure for verifying that the information subject is the right person when exercising the rights to request to access, modify, delete and suspend personal information etc.

• ① In principle, the system destroys the personal information without delay if the retention period has expired or the purpose of processing has been achieved. However, this is not the case if it is to be preserved in accordance with other laws. Procedure, date and method of destruction are as follows.
• ② The procedure and method of destruction are as follows:
  • A. Destruction procedure

    The information entered by the user is destroyed without delay under the internal policy and the responsibility of the personal information protection officer after attaining the purpose.

  • B. Destruction date

    Users' personal information is destroyed immediately from the end of the retention period in the event that the retention period of personal information has expired, and from the date when the personal information is recognized unnecessary in the event that the personal information becomes unnecessary. For instance, the purpose of processing personal information is achieved, the service concerned is abolished and the training is completed.

  • C. Destruction Method

    Personal information stored in an electronic file format is managed and supervised to prevent it from restoration and reproduction after deletion, using a technical method that cannot reproduce records.

In accordance with the article 29 of the Personal Information Protection Act, the following technical, administrative and physical measures are taken to secure safety:

• A. Establishing and implementing an internal management plan

  An internal management plan is established and implemented in accordance with the article 29 of the Personal Information Protection Act.

• B. Education of persons handling personal information

  KOFIH provides personal information protection education to persons handling personal information

• C. Restricting access to personal information

  Access to personal information is controlled through granting, changing or canceling access to the database system that processes personal information, and unauthorized access from the outside is controlled using the intrusion prevention system.

• D. Storage of access records and prevention of forgery

  Access records to the personal information processing system are kept and managed for at least 6 months and are safely managed to prevent loss.

• E. Encryption of personal information

  Personal information of users is encrypted, stored, and managed.

• F. Technical measures against hacking, etc.

  To prevent personal information leakage or damage caused by hacking or computer viruses, KOFIH installs security programs, updates and inspects them periodically, installs systems in areas where access is restricted from outside, and monitors and blocks them technically and physically.

• G. Control access to unauthorized persons

  The personal information system where personal information is stored is kept separately and access is restricted.

The information subject may inquire the following institutions for damage relief and counseling for personal information infringement. The following organizations are separate from the system operating organization. In case the information subject is not satisfied with own personal information complaint handling results and damage relief results provided by the system, or more assistance is needed, please contact the following institutions:

• A. Personal Information Violation Report Center (operated by Korea Internet & Security Agency)
  • 1) Responsibilities: Report of personal information violation and request counseling
  • 2) Website: privacy.kisa.or.kr
  • 3) Phone: (Without dialing code) 118
• B. Personal Information Dispute Mediation Committee
  • 1) responsibilities: Applying for personal information dispute settlement, collective dispute mediation (civil resolution)
  • 2) Website: www.kopico.go.kr
  • 3) Phone: (Without dialing code) 1833-6972
• C. Cyber Crime Investigation Center of the Supreme Prosecutors' Office
  • 1) Website: www.spo.go.kr
  • 2) Phone: (Without dialing code) 1301
• D. Cyber Security Bureau of the National Police Agency
  • 1) Website: cyberbureau.police.go.kr
  • 2) Telephone: (Without dialing an area code) 182

• ① In order to protect personal information and handle complaints regarding personal information, this system designates the person responsible for personal information protection and the person in charge of practical affairs as follows (personal information protection officer according to the paragraph 1 of the article 31 of the Personal Information Protection Act):

  Responsible person and person in charge for personal information protection

  Responsible person and person in charge for personal information protection table

  Person responsible for personal information protection		Person in charge of practical affairs
  Name and title	Ryu Ho-kyun, Director General, Division of Management Innovation, Korea Foundation for International Healthcare	Department and person in charge	Noh Gook-rae Department of Management and Planning Jung Jae-woong Department of Management and Planning
  Phone	02-3396-9708	Phone	02-3396-9836 02-3396-9839
  E-mail	hgryu@kofih.org	E-mail	grnoh@kofih.org jwjung@kofih.org
  Fax	02-356-3104	Fax	02-356-3104

  Offices and departments

  Offices and departments table

  Personal information file name	Organization in charge	Department in charge	Phone
  Training program information and trainee membership information	Korea Foundation for International Healthcare	Dr. LEE Jong-wook Fellowship Department	02-3396-9812~8
  	National Health Insurance Service	Global Cooperation Office	033-736-2927
  	Health Insurance Review and Assessment Service	International cooperation department	033-739-1703,1707
  	Korea Health Industry Development Institute	International Medical Training Team of International Medical Planning Office	043-713-8115,8026
  	Korea Human Resources Development Institute for Health and Welfare	Global Cooperation Center	043-710-9261

The system collects IP addresses to prevent abnormal access of users and does not use cookies, which store and frequently recall the use information of information subjects.

This Personal Information Processing Policy is effective from August 1, 2019. The previous Personal Information Processing Policy can be found below.