이 페이지는 현재 영어로만 제공돼요.
Privacy Policy
Last updated: November 10, 2026
At Travel Korea, operated by Travigeon (“we,” “our,” or “us”), we value your trust. This policy describes how we collect, use, and protect your information when you use our mobile application and website to plan your medical tourism journey in South Korea.
1Introduction
Travel Korea is a platform designed to connect international travelers with medical clinics and tourism experiences in South Korea.We act as a facilitator, not a medical provider. We do not provide medical advice, diagnosis, or treatment. AI-generated clinic suggestions and itineraries are for information only and are not medical advice.
2Information We Collect
We collect information to provide our services, match you with clinics, and generate itineraries. This includes:
Personal Information
- Name, Email Address, and Phone Number (collected only when you voluntarily submit a Consultation Request, create a patient account (email address only) or register as a clinic owner).
- Website forms: if you use the free-consultation form on our website, we collect your email address and the question you write (which may include health information, so please share only what you need to). Before sending, you tick a box to confirm that you are 14 or older and agree to this, and the form can't be sent without it. If you use the partner-clinic form, we collect the clinic name, a work email address and the partnership options you tick. With either form we also note which language version of the website you used (for example English or Korean), so we can reply in that language. These entries are read by our team only, to reply to you by email; they are not shared with clinics. We don't keep your IP address with them (it is used only briefly to limit how often the forms can be sent).
- You don't need an account to browse clinics, save clinics or offers, or get offer alerts. In the latest version of the app, a free patient account (your email address, confirmed with a code) is needed to write a review and to book a clinic offer, and the app asks you to confirm your email when you send a booking request (see “Patient Accounts” below).
Health & Interest Data
- Procedure Interests: Categories of treatments you are interested in (e.g., “Dermatology”, “Rhinoplasty”).
- Travel Preferences: Budget, travel dates, and tourism interests (e.g., “K-Pop”, “Food”).
- Goals: Optional free-text goals you enter in the AI clinic matcher.
- Reviews: If you write a review, it describes your treatment and experience, which is health information (see “Reviews” below).
- Note: We do not ask for medical records or diagnostic images. Please don't include personal medical details in free-text fields beyond what you choose to share in a review.
Consultation Requests
- When you tap Book Consultation (or ask a clinic about a treatment's price) on a participating clinic, we collect your name, email address, phone number (optional), the treatment you select or describe, your travel dates (optional), and an optional message.
- In the latest version of the app, a consultation request can also include the doctor you prefer (or “any available doctor”) and your preferred date and time (Korea time). Before sending, you confirm that you agree to send these details to the clinic, and we record when you agreed.
- The treatment you select and your message may contain health information. The request is stored and shared with the clinic you selected so it can respond to you. A request is not a confirmed appointment: the clinic contacts you to confirm.
- In the latest version of the app, a request sent from your phone is linked to this phone's random app ID (see below) and, when you are signed in, to your patient account, so you can follow it on every phone signed in to your account and review your visit later. When you are signed in, the request uses your account's email address. If you book a clinic offer (this needs a patient account), the offer's title and price are saved with your request, and each account and each phone can book an offer once.
- Visit confirmation: after your appointment, the clinic records in its dashboard whether you visited, did not attend, cancelled, or whether the request was not genuine, and, if you visited, the visit date, the doctor you saw and the treatment. Only a confirmed visit can be reviewed. If you disagree with what the clinic recorded, you can ask us to check; our team decides and may contact you by email.
Patient Accounts
- In the latest version of the app you can create a free patient account with your email address. We email you a 6-digit code to confirm the address is yours; there is no password. You confirm that you are 14 or older and agree that your email is used for sign-in codes and for your account, and we record that agreement.
- We store your email address, an account ID, when the account was created and last signed in, and, for each phone signed in to it, a sign-in record (a scrambled form of the sign-in key, that phone's app ID and app version, and when it was last used). Sign-in codes are stored only in scrambled form, together with a scrambled form of the email address and of the network the request came from, to stop abuse.
- Your account holds your booking requests and reviews, so you can see them, and get notifications about them, on every phone you sign in on. When you sign in on a phone, the requests and reviews sent from that phone that no account owns yet join your account.
- Sign-in emails are sent by Resend (USA) on our behalf.
- A sign-in ends after 180 days without use. Codes expire after 10 minutes and are deleted after 2 days. You can sign out of one phone or of every phone, and delete your account at any time (see Section 7 and our Account deletion page).
- If our team blocked an account for breaking our Review Guidelines and it is then deleted, we keep a scrambled fingerprint of its email address (not the address itself) with the block, so the same email address can't sign up again.
Random App ID for This Phone
- The latest version of the app creates a random ID on your phone, whether or not you use a patient account. Our server stores only a scrambled (hashed) form of it, never the ID itself. It is random, not anonymous: it lets us recognise the same phone again.
- It links, on our servers: booking requests sent from this phone, reviews you write, the patient account signed in on it (while you are signed in), your notification settings and in-app alerts inbox, your consent records, reviewers or clinic replies you chose to hide, reports you send, and, only while offer alerts are on, your saved clinics, saved offers and treatment interests. Because a booking request contains your name and contact details, the ID is connected to them through that request.
- With it we store: the phone platform (iOS/Android), app version, language and region settings, time zone (so notifications arrive in the daytime), the review language you pick, notification choices, the push token and notification permission (if you allow notifications), and when the ID was created and last used.
- To prevent abuse, we store a keyed one-way code of the network a new ID was created from (not your IP address), and we may block an ID that breaks our Review Guidelines.
- If a clinic owner signs in on a phone, that phone's ID is linked to the owner account and its clinic, so the phone can never review that clinic. The link stays after signing out.
- You can delete it at any time with Delete my data (see Section 7).
Reviews
- Only patients whose visit was confirmed (by the clinic, or by our team after a check) can review it, signed in to the patient account the booking request belongs to (on any phone signed in to it). You confirm that the review is your own experience and that you are 14 or older, and we record that agreement.
- Public: your star ratings, your text, the display name you choose (default “TravelKorea patient”), the month of your visit (never the day), the doctor recorded for the visit (only when one was recorded), a “Visit confirmed” label and, only if you choose, your country flag and the treatment you had. Your name, email, phone number, app ID and account are never shown publicly.
- The clinic will know the review is from you. It already has your name and contact details from your booking request, and its dashboard shows which of its booking requests has a review as soon as you send it (even while our team is still checking it).
- Moderation: our team reads every review before it is published and every report about a review or reply. We keep a record of our decisions, reports and blocks.
- Translation: unless you untick it, your review text is sent to OpenAI (USA) to be translated for readers of other languages. Clinic replies are translated in the same way when the clinic allows it (see Section 4).
- You can delete your review at any time in the app. See our Review Guidelines for the full rules.
Offer Alerts (Advertising, Opt-In)
- Offer alerts are advertising push notifications about time-limited clinic offers. They are off unless you turn them on in the app, read the consent text, and confirm you are 14 or older. We record when you agreed (and the version of the text) and confirm it in your alerts inbox.
- They are based only on the clinics and offers you save and the treatment types you choose. We never record your searches or browsing. Those saved items are stored on our server only while offer alerts are on and are deleted when you turn them off.
- At most 1 a day and 3 a week, only between 09:00 and 20:00 your phone's time. Every alert says how to turn them off, and turning them off is recorded and confirmed too.
Location Data
- Precise or approximate location (GPS), only if you choose to share it, to find clinics near you.
- You can disable this in your device settings at any time.
Connection Data
- Server Logs: Our servers log technical request data (such as IP address and device type) for security and troubleshooting.
- Language Cookie: If you pick a language with the website's language switcher, your browser keeps a small cookie (NEXT_LOCALE) holding only that language code, for up to 1 year, so the website opens in that language next time. You can delete it in your browser settings at any time.
- We do not use advertising or tracking SDKs, and we do not track your behavioral usage patterns or screen interactions.
Clinic Owner Accounts
- If you register as a clinic owner, we collect your name, email address, phone number, password, and clinic name. Your password is handled by our authentication provider (Supabase Auth) and stored only in hashed form.
- We also collect the clinic details, treatment information, doctor profiles, and photos of your clinic that you choose to upload. This content is submitted voluntarily and is displayed publicly on your clinic's profile.
- Doctor profiles are public. They can include a doctor's name, photo, role, specialist certificate, focus areas, languages, years of experience, education, licences and memberships, a short biography, and the treatments they perform. If you add a doctor's gender, it is used only to let patients filter doctors and is not shown on the profile. A clinic must have each doctor's permission before listing them, and in the latest version of the app the clinic confirms this for every doctor. Doctors who want their details or photo removed can email us at it@travigeon.com.
- Clinic owners record visit outcomes for consultation requests and can post a public reply to each review of their clinic. Replies are shown with the clinic's name and, unless the owner unticks it, are translated by OpenAI (USA). We keep a record of visit outcomes, replies and reports for moderation.
- If you sign in on a phone, that phone's random app ID is linked to your owner account (see “Random App ID” above).
Push Notifications
- Clinic owners: if you allow notifications, we store your device's push token on your account to alert you about new inquiries, new reviews, offer decisions and account updates. New-inquiry notifications show the treatment the requester asked about and, for a consultation request with a preferred date, that date and time (never the requester's name). The token is removed from your account when you log out (while online) or delete your account.
- Patients: in the latest version of the app, if you allow notifications, we store your phone's push token with its random app ID to send updates about your booking requests and reviews (for example, one request to review your visit a few days after it, or a clinic's reply to your review) to every phone signed in to your account (or, without an account, to the phone the request was sent from) and, only if you turned them on, offer alerts. They are delivered between 08:00 and 21:00 your phone's time (offer alerts 09:00–20:00) and also appear in the app's alerts inbox. You can turn each type off in the app.
- Notifications are delivered through Expo's push service (USA) and Apple Push Notification service on iPhone or Firebase Cloud Messaging (Google) on Android. We keep a short delivery record (the token and a ticket number) for 3 days to remove tokens of uninstalled apps. You can turn notifications off in your device settings at any time.
3How We Use Your Data
- 1Clinic Matching: We rank clinics on our servers using your selected procedures, goals, and preferred area (and your location, if you choose to share it). When AI features are used (in the latest version of the app, only if you allow them), your selected procedures, goals, travel dates, and preferred area are also sent to OpenAI's API to write short clinic summaries (see Section 4). Suggestions are for information only and are not medical advice.
- 2AI Itinerary Generation: Your travel preferences and interests are processed by OpenAI's API to generate personalized travel plans (see Section 4). Generated itineraries are saved so they can be opened from their share link.
- 3Translation: Reviews (unless the reviewer turns translation off), clinic replies (unless the clinic turns it off) and some other text in the service are translated using OpenAI's API (see Section 4).
- 4Consultation Requests: To deliver your request to the clinic you selected, notify the clinic owner so they can respond, and, in the latest version of the app, let you follow the request, confirm whether the visit happened, and review it.
- 5Patient Accounts: To confirm your email address with a code, sign you in, and show your booking requests and reviews, and send notifications about them, on every phone you sign in on.
- 6Reviews: To publish reviews of confirmed visits, check every review and report before acting on it, keep fake, paid and abusive content off the service, and show reviews and clinic replies in the reader's language.
- 7Notifications and Offer Alerts: To send the notifications you allowed, and offer alerts (advertising) only if you opted in, within the limits described in Section 2.
- 8Clinic Owner Accounts: To create and manage your account and clinic listing, review new owner registrations, and send you notifications about inquiries, reviews, offers and your account.
- 9Security: To protect the service and prevent abuse, for example by rate limiting requests using connection data such as IP address, limiting how many new app IDs one network can create and how many sign-in codes are sent, and blocking app IDs and accounts that break our rules.
- 10Website Forms: To reply by email to the question or partner request you sent through our website.
4AI Features (OpenAI)
The AI clinic matcher and AI trip planner use OpenAI's API. In the latest version of the app, we ask for your permission before the AI clinic matcher or trip planner sends anything to OpenAI, and nothing is sent unless you agree. Earlier versions of the app send these inputs when you submit the clinic matcher or trip planner, without asking first; please update the app to get this choice. These tools are now in the app only; the website no longer has them.
What is sent to OpenAI:
- AI clinic matcher: The medical category, the procedures you select, your goals text (if you enter any), your travel timing, your preferred area, and whether you are an international patient.
- AI trip planner: Your trip length, travel dates, budget level, interests, and preferred areas, plus the procedure you select if you include a clinic visit.
- Review translation: The text of your review, unless you untick translation when you write it.
- Reply translation: The text of a clinic's reply to a review, unless the clinic unticks translation.
What is never sent: For the AI clinic matcher and trip planner, your name, email address, phone number, and your device's exact location are never sent to OpenAI. For translation, only the text of the review or reply is sent: never the reviewer's display name, contact details or app ID. Anything written in the text itself (including names) is sent as written, so please don't include personal details you don't want shared.
Turning AI Features Off: In the latest version of the app, you can turn AI features off at any time in the Profile tab (AI features (OpenAI)). While they are off, your clinic matcher and trip planner inputs are not sent to OpenAI. Review translation is a separate choice you make on each review.
If you are a clinic owner, the clinic address you enter may also be sent to OpenAI to convert it to Korean format for map placement. This is your clinic's business address, not your personal contact details.
5Third-Party Services
We use the third-party services below to operate our platform. Service providers that process personal data on our behalf do so only as needed to provide the service and under terms that require them to protect it at least to the standard described in this policy. Embedded content (TikTok, Instagram, OpenStreetMap) loads directly from those services, as described below:
- Supabase: For secure database hosting, file storage (including uploaded photos), and clinic-owner authentication. Hosted on Amazon Web Services (AWS) in Mumbai, India.
- Vercel: For hosting our website and the API used by the app, with servers in Seoul, South Korea.
- OpenAI: For the AI clinic matcher and AI trip planner, translation of reviews and clinic replies (see Section 4 for exactly what is sent), other text translation, and converting clinic addresses for map placement.
- Resend: For sending patient sign-in codes by email (USA). It receives your email address and the code.
- Expo, Apple Push Notification service, and Firebase Cloud Messaging (Google): For delivering push notifications to clinic owners and, if they allow notifications, to patients, using a device push token.
- Naver Maps / NCP Geocoding: For displaying maps and converting clinic addresses into map locations.
- Google Maps (Android) / Apple Maps (iOS): For displaying maps in the app.
- OpenStreetMap: For displaying clinic location maps. The map loads directly from OpenStreetMap, which may receive technical data such as your IP address.
- TikTok and Instagram: For embedded videos in the Trending section. We don't share your personal data with TikTok or Instagram. When you watch an embedded video, it loads directly from that service, which may set its own cookies and receive technical data such as your IP address.
6Data Sharing & International Transfer
Sharing with Clinics: We do not sell your data. We only share your consultation details (name, email, phone number if provided, the treatment you selected, your preferred doctor and preferred date and time if you chose them, your travel dates if provided, the offer you booked if any, and message) with the clinic you choose, when you explicitly request a consultation with it. The clinic receives these details only to respond to your request, under terms that require it to protect them at least to the standard described in this policy. A clinic can see the reviews of its clinic like any reader, but never the reviewer's contact details, app ID or account through them.
Service Providers: We share personal data only with the service providers listed in Section 5 and the clinic you choose, only as needed to provide the service, and under terms that require them to protect it at least to the standard described in this policy.
International Transfer: Your information is processed in countries other than South Korea, transferred over the internet when you use the feature concerned:
| Recipient (country) | What | Why | Contact |
|---|---|---|---|
| Supabase on AWS (India) | Everything we store: requests, reviews, app ID records, patient and owner accounts, photos | Database and file storage | Supabase Pte. Ltd., privacy@supabase.com |
| OpenAI (USA) | AI matcher and trip planner inputs; review and reply text for translation; clinic addresses | AI features and translation (see Section 4) | OpenAI, dsar@openai.com |
| Resend (USA) | Your email address and the sign-in code | Sending patient sign-in emails | Plus Five Five, Inc. (Resend), support@resend.com |
| Expo (USA), Apple (USA), Google Firebase (USA) | Push token, notification title and text | Delivering push notifications | 650 Industries, Inc. (Expo): expo.dev/contact; Apple: apple.com/legal/privacy/contact; Google: firebase.google.com/support |
- Our website and API run on servers in South Korea (Seoul, via Vercel), and clinic inquiries are sent to medical providers in South Korea.
- Each provider keeps the data only as long as needed to provide its service to us, under the protections described above.
- How to avoid a transfer: keep AI features off and untick translation on your review (OpenAI), don't create a patient account (Resend), or don't allow notifications (Expo, Apple, Google). Storage with Supabase is needed for every feature that saves data. Without a patient account you can still browse clinics in the app; sending a booking request (unless we can't email you a code or sign you in on that phone), booking an offer and writing a review need one.
7Data Retention & Deletion
Retention: We keep personal information only as long as needed to provide the service, or as required by law:
| Data | How long |
|---|---|
| Consultation requests | Until you ask us to delete them (or delete them with Delete my data), or the clinic listing is deleted. Deleting your patient account takes them out of the account; the clinic keeps its copy |
| Website form entries (free-consultation and partner-clinic forms) | Until we have replied, then deleted automatically 12 months later; sooner if you ask us to delete them |
| Reviews and clinic replies | Until you delete the review (a reply is deleted with its review) or we remove it |
| Patient account (email address, account ID) | Until you delete the account |
| Sign-in on a phone | Until you sign out, delete the account or use Delete my data on that phone, or after 180 days without use |
| Sign-in codes (scrambled) | 2 days |
| A deleted account our team had blocked | A scrambled fingerprint of its email address and the block, kept so the same email can't sign up again |
| Random app ID record and settings | Until you use Delete my data |
| Alerts inbox (in-app notifications) | 180 days |
| Push delivery records | 3 days |
| Saved clinics, saved offers and treatment interests (server copy) | Only while offer alerts are on |
| Consent records (what you agreed to or withdrew, and when) | While the app ID or account exists, and up to 3 years after Delete my data or account deletion, as proof of consent |
| Moderation records (our decisions on reviews, reports, visit disputes and blocks) | While the review exists, and up to 3 years after |
| Clinic owner accounts | Until the account is deleted |
Delete my data (patients): In the latest version of the app, open Profile > Notifications and tap Delete my data on this phone. This deletes from our servers this phone's random app ID record (with its settings and push token), its alerts inbox, saved clinics, saved offers and treatment interests, the reviewers and clinic replies you hid, its link to any clinic owner account, and every review written from this phone that doesn't belong to a patient account (with the clinic replies, reports and translations attached to them). A review our team had already removed or hidden is the one exception: its text, translations and personal details are deleted, but a record of our decision stays, so that visit cannot be reviewed again. If you also choose Also delete my booking requests, the booking requests sent from this phone that don't belong to a patient account are deleted as well, including from the clinic's dashboard. If you are signed in, this phone is signed out; your account and the requests and reviews that belong to it stay (use Delete account to delete those).
Deleting a Patient Account: In the latest version of the app, open Profile > Account and tap Delete account. This deletes your account and email address, the sign-in on every phone, your account's alerts and consent records (a copy is kept in the deletion record as proof of consent), the sign-in codes sent to your email, and every review you wrote (with the clinic replies, reports and translations attached to them; a review our team had removed or hidden keeps only the record of our decision, as above). Your booking requests leave your account and your phones; the clinic keeps its copy, and you can ask the clinic or us to delete it. If our team had blocked the account, a scrambled fingerprint of its email address is kept with the block (see Section 2). If you can't open the app, see our Account deletion page.
What remains after Delete my data: booking requests you chose to keep and reports you made about other reviews (both no longer linked to the phone), the record of our decision on any review we had removed or hidden (without its text), scrambled sign-in code records (no longer linked to the phone, deleted after 2 days, to stop abuse), and a record that the deletion happened with a copy of your consent history, kept as proof of consent. If our team had blocked this phone's app ID, a minimal record of that app ID and the block (no settings, push token or other details) is also kept, so the block stays in place. Information the clinic already received with a booking request may also be kept by the clinic. Things the app stores only on your phone (such as My requests) are removed when you uninstall the app.
Deleting a Clinic Owner Account: In the app, open the Profile tab, tap Delete Account, and confirm with your password. This permanently deletes your owner account. If you are the only owner of your clinic, the clinic listing, its doctors, procedures, and inquiries, and the photos you uploaded are deleted as well. Exception: if the clinic has patient reviews, the listing is not deleted: it is taken offline (no longer shown publicly) and kept with its doctors, treatments, photos, booking requests and reviews, because the reviews belong to the patients who wrote them. Its pending and running offers are withdrawn. You can ask us to delete it at it@travigeon.com.
Other Requests: To delete a consultation request you submitted from the website or an older version of the app, or an itinerary you saved (please include its share link), or for any other deletion request, please email us at it@travigeon.com.
8Your Rights & Security
You have the right to access, correct, or delete your personal information. Clinic owners and patients can delete their account directly in the app, and patients can also use Delete my data on a phone (see Section 7). For any other request, please contact us at it@travigeon.com.
Withdrawing Consent: You can withdraw your consent at any time:
- AI features: Turn off AI features (OpenAI) in the Profile tab of the latest version of the app.
- Offer alerts: Turn them off in Profile > Notifications. We record the withdrawal, delete your saved items from our server, and confirm it in your alerts inbox.
- Other notifications: Turn off booking and review notifications in Profile > Notifications, or all notifications for the app in your phone's settings.
- Reviews: Delete a review at any time in the app (this also removes its translations).
- Location: Turn off Location for the app in your phone's settings.
- Patient account: Sign out, or delete your account in Profile > Account (see Section 7).
- Everything linked to this phone: Use Delete my data (see Section 7).
- Clinic owner account: Delete your account in the app's Profile tab (see Section 7).
- Everything else: Email us at it@travigeon.com to withdraw your consent, or to ask us to delete consultation requests you submitted or itineraries you saved (please include the itinerary's share link).
Withdrawing consent doesn't affect processing that already happened before you withdrew it.
We implement industry-standard security measures (encryption, secure HTTPS) to protect your data. However, no method of transmission over the internet is 100% secure.
9Children's Privacy
Our service is not directed to children under 14, and we do not knowingly collect personal information from children under 14. Creating a patient account, writing a review, turning on offer alerts and sending a question through the website's free-consultation form require you to confirm that you are 14 or older. If you believe a child under 14 has provided us with personal information, please contact us at it@travigeon.com so we can delete it.
Contact Us
If you have any questions about this Privacy Policy, please contact us:
Company: Travigeon
Email: it@travigeon.com