Privacy Policy

SkinCube is a service for institutions such as medical institutions and beauty shops to measure Subjects’ skin condition with a measurement device and manage the results. The party responsible for personal information differs depending on the type of information.

Informing Subjects that their face photos and measurement results are stored, obtaining any necessary consent, and responding to Subjects’ requests for access or deletion are primarily the institution’s responsibility. The Company supports the institution in these matters at its request.

※The Company does not collect Subjects’ names, contact details or addresses. Do not enter personally identifiable information (such as names or contact details) in free-text fields such as the memo field.

The Service has no electronic payment function, so it does not process payment information, and it does not offer social login.

• Issuing accounts, verifying identity, keeping you logged in, and sending password setup and reset emails
• Storing and viewing measurement results, generating reports (on screen and PDF), reviewing trends, and exporting data
• Analyzing face photos and providing AI cosmetic recommendations
• Access control by institution and role, and managing device registration and connections
• Responding to inquiries, A/S, and Service-related notices
• Preventing misuse, maintaining security, handling disputes, and fulfilling legal obligations
• Auditing, by recording and reviewing who downloaded files containing personal information and when
• Statistical analysis to improve Service quality (limited to information processed so that individuals cannot be identified)

Information that must be retained under applicable laws is kept separately for the period those laws require.

The Company does not sell or provide the personal information of Users and Subjects to third parties. Exceptions are where the data subject has consented, where there is a legal basis, or where an investigative agency requests it through lawful procedures.

Within the Service, access is divided by institution.

• Each institution can see only the Subjects and measurement results registered to that institution.
• A parent institution (provider institution) also cannot see the measurement data of its sub-institutions; it can only manage their sub-institutions, accounts, devices and report settings.
• An Institution Admin can view their own institution’s activity log (who downloaded or deleted what data and when), and the Company’s operations staff can view all records.
• The Company’s operations staff access data only to the extent necessary for operating the Service, responding to incidents and providing support.

To operate the Service, we use the following external services. Names, contact details, chart IDs and face photos are not sent to AI services.

Measurement data is stored and processed on servers operated by the Company. Face analysis and PDF report generation also take place within the Company’s servers, and no separate external cloud storage is used. We use an external weather service (OpenWeather) to obtain the weather at the time of measurement, but the query is fixed to the Seoul area, so no information or location of Users or Subjects is sent.

If a processor or the processed content changes, we will update this Policy without delay. When we entrust processing, we verify and manage matters such as the ban on processing beyond the purpose, security safeguards and restrictions on sub-processing, in accordance with the Personal Information Protection Act.

• Taking a face photo is optional and can be skipped.
• A photo is stored temporarily on the device and then uploaded to the Company’s server when the measurement is saved. If the device is offline, it is uploaded once the connection is restored.
• On the server, an analysis program operated by the Company analyzes pores, wrinkles, pigmentation and dark circles. Photos are not sent to external AI services.
• Photos and analysis images can be viewed only by Users with access permission, through time-limited signed addresses, or through a valid shared link. Face image downloads include only analysis images, not original photos.
• Photos remaining on the device are kept for up to 30 days and then deleted automatically, or deleted immediately by Settings > Reset device. Institutions must reset the device and ask support to unlink it from the institution before transferring, returning or disposing of it, and reset data cannot be recovered.

• Users with measurement permission can share a report with a QR code or link. By default the link expires after 24 hours; if the Institution Admin turns on “permanent sharing”, it does not expire.
• Anyone who knows the link can view the report and save it as a PDF without logging in. The Company does not verify who opens a link, so the audience must be decided within the scope explained to the Subject.
• A shared report shows the chart ID, gender, birth year and age, institution name, measurement results, face analysis images, cosmetic recommendations and the institution’s notice. The ID and name of the staff member (User) who ran the measurement are not shown.
• If a link is leaked, the Institution Admin can turn off permanent sharing or reissue the link, and the previous link stops working immediately.

Data subjects may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, and may withdraw their consent.

• Users: You can check your information and change your password in your profile. You can withdraw yourself by choosing “Withdraw account” on the My Account screen and confirming your password; for other requests, or to have a staff member’s account withdrawn, contact support. The last Institution Admin of an institution cannot withdraw until another Institution Admin has been assigned.
• Subjects: Please make your request to the institution that performed the measurement. The institution corrects Subject information or deletes measurement records on the Service screens, and the Company supports anything the institution cannot do itself, such as correcting measured values. If you contact the Company directly, we will pass your request on to that institution.

Requests can be made by email, phone or in writing, and the Company will notify you of the action taken within 10 days of receiving the request. A legal representative or an authorized agent may also make a request on your behalf. If a request is restricted under applicable law, we will tell you the reason.

※When you withdraw, your name, email, phone number and login ID are deleted, you can no longer log in, and this cannot be undone. However, the Subjects and measurement data you registered or measured are not deleted. These are the institution’s records, and the author is shown only as “Withdrawn user” or “-”.

When the retention period has passed or the purpose of processing has been achieved and the personal information is no longer needed, we destroy it without delay. Electronic files are deleted in a way that cannot be recovered, and information remaining in backups disappears according to the rotation cycle in Article 4. Information that must continue to be retained under applicable laws is stored separately from other information.

• Passwords are stored encrypted in a way that cannot be decrypted.
• All communication is encrypted with HTTPS. The token that keeps you logged in is held in a secure cookie (HttpOnly) that scripts cannot read, and the access token is valid for only a short time (15 minutes).
• Access permissions are divided by institution and role, and files such as face photos are provided only after a permission check.
• If password reset requests fail several times, further attempts are blocked for a period of time, and the number of login requests is also limited.
• Access records are kept, and downloads of files containing personal information, deletions of measurement records and withdrawals are recorded in the activity log and reviewed. Servers and databases are backed up regularly.
• The number of staff who handle personal information is kept to a minimum, and their access permissions are managed.

However, transmission over the internet and electronic storage cannot be guaranteed to be 100% secure. If a personal information breach is confirmed, we will notify you without delay in accordance with applicable laws and take the necessary measures.

The Service stores in your browser only the minimum information needed for login and the display language. We do not use cookies or scripts for advertising, behavioral analytics or third-party tracking.

You can delete or block cookies and storage in your browser settings. However, if you block them, you may have difficulty using the Service, for example logging in.

Service accounts are issued only to institution staff, and the Service is not intended for children under 14 to become Users themselves. When a Subject is under 14, it is the institution’s responsibility to inform the legal representative and obtain their consent.

The Company has designated a Privacy Officer as below to oversee the handling of personal information and to deal with inquiries, complaints and remedies from data subjects.

Company name

HuNBiome Co., Ltd.

Representative

안용주

Privacy Officer

안용주

Business registration no.

324-81-01938

Address

1311, Gasan Urbanwork I, 135, Gasan digital 2-ro, Geumcheon-gu, Seoul, Republic of Korea

Email

skincube@hunbiome.com

Phone

02-861-1210

Business hours

Weekdays 08:00–17:00 (KST)

The organizations below are separate from the Company. If you are not satisfied with the Company’s own handling of your case, or need further help, please contact them.

This Policy applies from the effective date shown at the top of the page. When we change it, we will announce the change on the Service screen from 7 days before it takes effect, and from 30 days before for changes that materially affect data subjects’ rights. If you need a previous version, please contact support.