Privacy Policy
Mediwhale Inc.
LAST UPDATED: September 11, 2026
This Privacy Policy (the “Policy”) explains how Mediwhale Inc. (“Mediwhale,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal data when you visit our websites, submit an inquiry, subscribe to updates, participate in an event or consultation, or use or receive services for which this Policy is presented (collectively, the “Services”).
This Policy is intended to apply globally. Certain jurisdictions impose additional requirements. The Addendum for the United States in Section 11 supplements this Policy for U.S. residents where applicable. If the U.S. Addendum conflicts with this Policy, the U.S. Addendum controls for U.S. residents.
Our role depends on the context
When you interact directly with Mediwhale through our public websites, Contact Us forms, subscriptions, or events, Mediwhale generally determines the purposes and means of that processing. For Dr. Noon services provided through hospitals or other healthcare institutions, the healthcare institution generally determines why patient data is processed and Mediwhale may act as a processor or service provider under the applicable agreement. When we act solely on behalf of a healthcare provider, that provider’s privacy notice and instructions also govern the processing.
CONTENTS
Part I – Global Privacy Policy
- Information We Collect
- How We Use Your Personal Data
- How We Disclose Your Personal Data
- Data Retention and Deletion
- Your Privacy Rights
- Children’s Privacy
- International Data Transfers and Hosting
- How We Protect Personal Data
- Changes to This Privacy Policy
- Contact Us
- Regional Addendum
PART I – GLOBAL PRIVACY POLICY
1. INFORMATION WE COLLECT
We collect personal data that is reasonably necessary for the Services and the purposes described in this Policy. The information we collect depends on how you interact with Mediwhale and which Service is involved.
1.1 Information You Provide to Us
| Interaction | Personal Data | Purpose | Retention |
|---|---|---|---|
| Contact Us / Product Inquiry | Required: full name, email address, and message. Optional: location information such as ZIP code, city, and state. When you submit an inquiry, referral information, campaign parameters, pages visited, and timestamps may also be associated with the submission. | Receive, review, and respond to inquiries about Dr. Noon CVD; provide requested information; investigate and address questions; and conduct appropriate follow-up. | One year after the inquiry is resolved, unless a longer period is required or permitted by applicable law. |
| Email Updates / Newsletter | Email address. | Send news, updates, educational information, and other communications you request. | For as long as you remain subscribed or until the information is no longer needed for this purpose, subject to applicable law and any necessary opt-out records. |
| Event / Solution Consultation | Name, email address, and company; optional job title and phone number where requested. | Arrange solution consultations, meetings, and related follow-up communications. | Through completion of the meeting and follow-up communications, and for one year thereafter. |
1.2 Information We Receive from Healthcare Providers
For certain Dr. Noon services, Mediwhale receives personal data through hospitals or other healthcare providers rather than collecting it directly from the patient. Depending on the Service and customer arrangement, this may include:
- retinal fundus images (fundus photographs);
- gender, age, date of birth, date of hospital visit, and similar clinical or demographic information where provided and permitted;
- diagnostic, risk, analytical, or service output information generated through Dr. Noon, to the extent associated with an identifiable individual; and
- other information that the healthcare provider is authorized to submit for the applicable Service.
Dr. Noon may be used to assess cardiovascular disease risk and, where applicable to the relevant service, certain eye-related conditions. The healthcare provider determines how Dr. Noon results are used in the clinical context.
1.3 Information We Collect Automatically
When you visit our websites or use online Services, we may automatically collect technical and usage information through logs, cookies, and similar technologies. This may include:
- online identifiers, including cookie or client identifiers;
- IP address and related network information;
- browser type, device type, operating system, language settings, screen resolution, and other technical information;
- pages visited, page titles, referring URLs, access times, session information, page-view events, and other website usage information; and
- approximate location information inferred from technical information or location information you choose to provide.
1.4 Cookies, Analytics, and Similar Technologies
We use Cookiebot, a consent management platform provided by Usercentrics A/S, to manage cookie preferences and consent on applicable Mediwhale websites. Strictly necessary technologies, including technologies needed to remember and administer your privacy choices, may operate without consent where permitted by applicable law. In connection with providing consent management services on our behalf, Usercentrics A/S may process consent-related information such as a consent identifier and consent state, the date and time of the choice, the URL where the choice was made, language settings, user-agent or device/browser information, IP address, and geolocation information, as applicable. Where prior consent is required by applicable law, non-essential analytics or marketing technologies are disabled until you grant the relevant consent through the Cookiebot banner or preference center. You may accept, reject, or manage available cookie categories and may later change or withdraw your choices through the cookie settings. Withdrawal applies to future processing and does not affect the lawfulness of processing based on consent before withdrawal. Certain Mediwhale and Dr. Noon websites also use or may enable analytics technologies, including Google Analytics 4 (GA4), depending on the website and deployment. Where GA4 is enabled, Google may receive online identifiers, device and browser information, IP address, page and session information, and other internet or electronic network activity information. Our Cookie Declaration, available through the cookie settings where implemented, provides more current information about the cookies and trackers detected on the relevant website, including their categories, purposes, providers, and retention periods.
2. HOW WE USE YOUR PERSONAL DATA
We use personal data only for purposes that are reasonably necessary and proportionate to the context in which the information was collected, including to:
- provide, operate, maintain, support, secure, and improve the Services;
- perform Dr. Noon processing made available through healthcare providers and provide results back to the applicable provider or customer;
- receive, verify, investigate, and respond to product, customer, privacy, or other inquiries;
- manage email subscriptions, events, solution consultations, meetings, and related communications;
- analyze website traffic, usage, and performance through analytics technologies;
- protect the security, integrity, and availability of our websites, infrastructure, data, and business operations;
- prevent, detect, investigate, and respond to fraud, misuse, security incidents, or other harmful activity;
- comply with applicable legal, regulatory, contractual, and professional obligations and respond to lawful requests from courts, regulators, government authorities, or law enforcement; and
- develop or improve the Services where permitted by applicable law and the relevant agreement. When Mediwhale acts as a processor for healthcare data, development or improvement activities involving that data are performed only to the extent permitted by the controller’s documented instructions, the applicable agreement, or another lawful basis.
2.1 LEGAL BASES, INCLUDING GDPR ARTICLE 6
Where Mediwhale acts as a controller and the EU General Data Protection Regulation (GDPR) applies, we rely on one or more legal bases under Article 6(1) GDPR. Other jurisdictions may recognize equivalent or additional legal grounds. The legal basis depends on the processing activity and our role. Typical bases for direct interactions with Mediwhale include the following:
| Processing Activity | GDPR Legal Basis (where applicable) |
|---|---|
| Contact Us / product inquiry | Steps at your request before entering into a contract (Article 6(1)(b) GDPR), where applicable, and/or our legitimate interests in responding to inquiries and managing business communications (Article 6(1)(f) GDPR). |
| Email updates / newsletter | Your consent (Article 6(1)(a) GDPR), together with applicable electronic-marketing requirements. You may withdraw consent or unsubscribe at any time. |
| Non-essential analytics cookies | Your consent (Article 6(1)(a) GDPR) where consent is required by applicable cookie, ePrivacy, or data protection law. |
| Cookie consent and preference management | Compliance with applicable legal obligations where relevant (Article 6(1)(c) GDPR) and our legitimate interests in administering, documenting, and demonstrating cookie and consent choices (Article 6(1)(f) GDPR). |
| Website security, fraud prevention, and service integrity | Our legitimate interests in protecting the security, integrity, and availability of our Services (Article 6(1)(f) GDPR) and, where applicable, compliance with a legal obligation (Article 6(1)(c) GDPR). |
| Legal and regulatory compliance | Compliance with a legal obligation to which Mediwhale is subject (Article 6(1)(c) GDPR) or another ground provided by applicable law. |
When we rely on legitimate interests under Article 6(1)(f) GDPR, those interests include responding to inquiries, managing business communications, protecting the security and integrity of our Services and systems, and preventing fraud, misuse, and security incidents. We consider the nature of the data, your reasonable expectations, and the potential impact on your rights and freedoms, and we do not rely on this basis where those interests are overridden by your interests or fundamental rights and freedoms.
For Dr. Noon patient data processed on behalf of a hospital or other healthcare provider, Mediwhale generally acts as a processor or service provider. The healthcare provider, as controller where applicable, determines the lawful basis and any additional condition required under applicable law for processing health or other special-category data. Mediwhale processes such data on documented instructions and under the applicable agreement. Where Mediwhale independently determines the purposes and means of processing personal data, we identify and document a valid legal basis and, for health or other special-category data, any additional condition required by applicable law before processing.
3. HOW WE DISCLOSE YOUR PERSONAL DATA
We may disclose personal data when reasonably necessary to provide and support the Services, at the direction of a healthcare provider or user, with authorization where required, or as otherwise permitted by applicable law. Recipient categories may include:
| Recipient Category | Why We May Disclose |
|---|---|
| Healthcare Providers / Customers | Hospitals or other healthcare providers that provide data to Mediwhale, receive Dr. Noon results, or otherwise use the Services. |
| Cloud and Infrastructure Providers | Providers that host, store, secure, or support our systems, including Amazon Web Services (AWS). |
| Analytics Providers | Analytics providers, including Google Analytics where enabled, used to measure website traffic, usage, and performance in accordance with applicable consent and opt-out requirements. |
| Consent Management Providers | Usercentrics A/S, which provides Cookiebot, processes consent and preference information on our behalf to operate the cookie banner, preference center, consent records, and related compliance functionality. |
| Website, IT, and Support Providers | Vendors that support website development and maintenance, cloud operations, monitoring, technical support, communications, or similar business functions. |
| Professional Advisors | Attorneys, accountants, auditors, insurers, consultants, and other professional advisors where reasonably necessary. |
| Government Authorities and Law Enforcement | Regulators, courts, government agencies, and law-enforcement authorities where disclosure is required or permitted by applicable law. |
| Business Transaction Parties | Potential or actual parties to a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction. |
| At Your Direction or With Authorization | Other parties where you, or an authorized healthcare provider acting within its authority, direct or authorize the disclosure. |
4. DATA RETENTION AND DELETION
We retain personal data for no longer than reasonably necessary for the purposes for which it was collected, taking into account applicable legal, contractual, regulatory, security, audit, and dispute-resolution requirements.
| Data / Activity | Retention Approach |
|---|---|
| Dr. Noon data | The period specified in the applicable healthcare-provider agreement or data processing terms and as required or permitted by applicable law. A retention period required by one jurisdiction is not automatically applied to a different jurisdiction. |
| Contact inquiries | One year after the inquiry is resolved, unless longer retention is required or permitted by law. |
| Event / solution consultation | Until completion of the meeting and follow-up communications, plus one year. |
| Email subscriptions | Until you unsubscribe, withdraw any consent on which the communication relies, or the information is no longer needed for the subscription, subject to legally required suppression or compliance records. |
| Website analytics and technical data | For the period reasonably necessary for analytics, performance measurement, security, and related business purposes, based on the relevant configuration, cookie settings, and applicable law. |
| Cookie consent and preference records | For the period reasonably necessary to administer and demonstrate consent choices, based on the Cookiebot configuration and applicable legal, audit, and dispute-resolution requirements. |
| Legal, regulatory, security, or dispute records | For the period reasonably necessary to meet legal obligations, establish or defend claims, resolve disputes, investigate incidents, or enforce agreements. |
When personal data is no longer required, we delete, anonymize, or otherwise dispose of it using methods appropriate to the medium and designed to prevent unauthorized recovery or reconstruction. Where personal data is subject to a healthcare-provider agreement, data processing agreement, or Business Associate Agreement, return or deletion will be handled in accordance with that agreement and applicable law.
5. YOUR PRIVACY RIGHTS
Depending on where you live and subject to applicable exceptions, you may have rights to request information about our processing; access to or a copy of personal data; correction; deletion; restriction or objection; data portability; withdrawal of consent where processing is based on consent; rights concerning certain profiling or automated decision-making; and the right to lodge a complaint with a competent data protection or supervisory authority. Additional rights for U.S. residents are described in the Addendum for the United States.
Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on legitimate interests, you may have the right to object on grounds relating to your particular situation. You may object to direct marketing at any time.
When Mediwhale processes personal data solely on behalf of a healthcare provider, the healthcare provider may be responsible for responding to your request. In that case, we may direct you to the provider or assist the provider as required by the applicable agreement and law.
6. CHILDREN’S PRIVACY
Our public websites are not directed to children, and we do not knowingly collect personal data directly from children through the public websites in circumstances that require parental or guardian authorization without obtaining the required authorization. Minimum age requirements vary by jurisdiction.
Where a healthcare provider submits information relating to a minor through a Service, the provider’s privacy notice, authorizations, contractual terms, and applicable healthcare and data protection laws may govern the processing. Mediwhale processes such information in accordance with the applicable provider arrangement and law.
7. INTERNATIONAL DATA TRANSFERS AND HOSTING
Mediwhale is based in the Republic of Korea and operates in an international environment. Personal data may be processed in countries other than the country where it was collected, depending on the Service, customer arrangement, and service providers involved.
Personal data for EEA Dr. Noon deployments is primarily hosted using AWS infrastructure in Frankfurt, Germany, where the applicable deployment is configured for EEA hosting.
Personal data for U.S. Dr. Noon deployments is primarily hosted using AWS infrastructure in the U.S. East (N. Virginia) region in the United States.
Authorized Mediwhale personnel in the Republic of Korea may remotely access data where necessary to operate, maintain, support, secure, or develop the applicable Service. Where Mediwhale acts as a processor, such access is limited to the controller’s documented instructions and the applicable agreement.
Where required by law, we use recognized transfer mechanisms and appropriate contractual, technical, and organizational safeguards for international processing and transfers. For transfers of personal data from the EEA to the Republic of Korea, we may rely on the European Commission adequacy decision for the Republic of Korea where applicable, or another lawful transfer mechanism where required.
8. HOW WE PROTECT PERSONAL DATA
We implement administrative, technical, and physical safeguards designed to protect personal data from unauthorized access, use, disclosure, alteration, destruction, or accidental loss. Depending on the context, these measures include:
- administrative measures, including internal policies, access minimization, personnel training, and periodic reviews or audits;
- technical measures, including access-right management, access controls, encryption where appropriate, security software, monitoring, and controls designed to protect systems and data; and
- physical measures, including access controls for computer rooms, document-storage areas, and other restricted facilities.
No method of transmission or storage can be guaranteed to be completely secure, but we maintain safeguards designed to reduce privacy and security risks.
9. CHANGES TO THIS PRIVACY POLICY
We may update this Policy from time to time. We will update the “Last Updated” date when changes are made. If a change is material, we will provide notice in a manner appropriate to the Services and applicable legal requirements, such as a prominent notice on our website or other notice where required.
10. CONTACT US
If you have questions, concerns, complaints, or privacy-related requests, you may contact us using the following methods:
| Contact Method | Details |
|---|---|
| Company | Mediwhale Inc. |
| Chief Privacy Officer | Geunyoung Lee |
| g.young@mediwhale.com | |
| Phone | +82-2-6959-8010 |
| 4F, 746 Nonhyeon-ro, Gangnam-gu, Seoul, Republic of Korea | |
| Website Form | Contact Us form available on the applicable Mediwhale or Dr. Noon website |
11. REGIONAL ADDENDUM
The following regional addendum forms part of this Policy where applicable. Additional jurisdiction-specific privacy notices, local representative details, or addenda may be provided separately where required by applicable law:
- Addendum for the United States