Article 1 (Establishment and Disclosure of Personal Information Processing Policy)

(1) Neurolines Inc. (“Company”) takes the protection of members' personal information as the top priority in providing the “NeuroCHEM” service (“Service”), and sincerely complies with all laws and regulations related to personal information protection. In addition, we are making efforts to explain the company's privacy policy to members in an easy-to-understand and detailed manner.
This privacy policy applies to all members who use the “NeuroCHEM” service and is posted and disclosed on the website (www.neurochem.io) operated by the company. However, if a separate privacy policy for individual services provided by the company is enacted and implemented, it will be notified that it will be posted on the website of the service.

Article 2 (General Provisions)

(1) Personal information is information about living individuals. It includes information that can identify an individual such as Name, Birth Date, Phone Number, Video (Information that can’t identify an individual with a single piece but can be easily specified when combined with other information).
(2) Member is a person who agrees to the company’s Terms of Service and Privacy Policy and provides personal information, credit information and other information (“Personal information and other”).
(3) The Company complies with related laws such as the Personal Information Protection Act, the Act on Promotion of Information and Communication Network Utilization and Information Protection, and the Act on the Use and Protection of Credit Information for the protection of members' personal information.

Article 3 (Procedure for Consent to Privacy Policy)

The company is going through a procedure for agreeing to the terms of service and privacy policy in the membership registration process. The member conveys his/her consent to the company by directly entering an indication to the effect of ``I agree to this privacy policy'' on the website, etc., and the company considers that the member has read and fully agreed to this privacy policy.

Article 4 (Privacy Policy Change and Notice Obligations)

If there is any addition, deletion, or modification of the contents of this Privacy Policy, the Company will notify you in advance through 'Notice' at least 7 days prior to the revision and notify you individually. However, when there is a significant change in the rights of members, such as changes in the items of personal information to be collected and the purpose of use, we will notify and notify at least 30 days in advance, and if necessary, the member's consent may be obtained again.

Article 5 (Personal Information Processing Purpose)

(1) Company is processing personal information of members for the reasons in the following and do not use it for other purposes. 1. Member Management: Member identification and verification, prevention of fraudulent use, member counseling and complaint reception and handling, notification and announcement delivery to members
2. Provision of Service: Provision of free/paid service, improvement in service quality, development of new service/technology, provision of customized service
3. Marketing and Event Provision: Delivery of advertisement information about the service, event invitation, etc.
4. Paid service fee settlement: Settlement of service charges, payment, refund processing, etc.

Article 6 (Personal Information and Collection Methods)

(1) Company collects and processes minimum personal information needed to use the service provided by the company.
(2) Following is the information collected by the company from the member at the moment of membership registration. - Email (ID), Password, Name, Birth Date, Home Address
- Company (Corporate) Name, Representative Name, Business Location (Address), Business Number, Representative phone number, Name and position of FAX Number administrator, Administrator phone number (3) Following personal information can be collected during the use of charged service. - Credit card information (Name of credit card company, credit card number, expiration date of the card), Bank account payment record (4) Following personal information, etc. can be automatically created and collected. - Access IP information, Cookie, Service usage record, Access record (5) The company receives personal information of members directly from members through the website and/or collects through writing, fax, phone, e-mail, telephone consultation, etc.

Article 7 (Personal Information Consignment Processing)

If there is any addition, deletion, or modification of the contents of this Privacy Policy, the Company will notify you in advance through 'Notice' at least 7 days prior to the revision and notify you individually. However, when there is a significant change in the rights of members, such as changes in the items of personal information to be collected and the purpose of use, we will notify and notify at least 30 days in advance, and if necessary, the member's consent may be obtained again.
(1) The company entrusts the following personal information processing tasks for smooth personal information processing. - Consignee
- Managed work
- Amazon Web Services, Inc/
- Infra management for service provision and analysis (2) In accordance with Article 25 of the Personal Information Protection Act, i) prohibition of processing of personal information other than the purpose of performing consignment tasks, ii) technical and administrative protection measures, iii) restrictions on re-consignment, iv) management and supervision of the consignee, v) liability related matters such as compensation for damage are specified in documents such as contracts, and the supervising whether the consignee manages and process personal information is safely.

Article 8 (Provision of personal information to third party and out of purpose usage)

(1) The company may provide personal information to a third party or use it for other purposes only when it obtains the consent of the member and when provision to a third party is permitted in accordance with related laws according to Articles 17 and 18 of the Personal Information Protection Act.
(2) In the case that the company need provision/sharing of member’s personal information within limited range due to partnership with third part such as business institution or use collected personal information for other purposes,
i) Name of third party receiving personal information,
ii) Purpose of providing personal information,
iii) Parts of personal information provided to the third party,
iv) Possession and usage period of the third party receiving the personal information,
v) The fact that there is right to reject the agreement and in the case that there is disadvantage due to rejection, the content of the disadvantage, the company shall announce on the website and notify members individually 30 days before effective date and get agreement from the member in advance. (3) When company provides member’s personal information to overseas third part, the company should notice matters mentioned in Paragraph 2 to the members and get agreement and make a contract about overseas personal information transfer in accordance with Personal Information Protection Act
(4) Within the scope reasonably related to the original purpose of collection, the Company shall provide personal information without the consent of the member as stipulated in the Enforcement Decree of the Personal Information Protection Act, taking into account whether any disadvantages occur to the member, and whether necessary measures have been taken to ensure safety such as encryption.
(5) It is possible to use personal information for other purposes or provide personal information to the third party without consent of member in accordance with the related legislations in the following situations: 1. When it is needed for utilization fee calculation
2. When the provision is for purposes such as academic study, statistics, etc. and is in a form that cannot identify typical individual
3. When it is needed for crime investigation and prosecution and its maintenance
4. When it is needed for the trial of the court
5. When there is special regulation in the law such as Other Personal Information Protection Act, Act on Real Name Financial Transactions and Confidentiality, Credit Information Use and Protection Act, Framework Act on Telecommunication, Telecommunications Business Act, Local Tax Act, Consumer Protection Act, Bank of Korea Act, and Criminal Procedure Act.

Article 9 (Personal information possession and usage duration)

(1) Company processes and owns personal information within personal information retention/use period following the legislation or retention/use period agreed by the member during personal information collection.
(2) In the case that a member agreed to the Terms of Service and Privacy Policy and registered for the membership, the Company owns the member’s personal information until the member cancels service usage contract or cancels membership. However, Company can own personal information until corresponding reason is terminated in the following cases: 1. When there is an on-going inquiry or investigation regarding violation of related legislation: until the termination of the inquiry/investigation
2. When there is remaining claim-obligation relationship regarding use of website, etc.: until the end of calculation of the claim-obligation relationship (3) Despite Paragraph 2, Company can own personal information for 90 days from the moment of membership cancelation to prevent rejoining of membership of the member and/or injustice use.
(4) Company can own personal information as the following related legislation.
(5) Out-of-purpose usage and/or provision to the third party of personal information is allowed in accordance with related legislation in the following cases.

Holding information	Period of Possession	Relevant statutory provisions
Record about payment and supply of commodities	5 years	Act on the Consumer Protection in Electronic Commerce, etc.
Record about contract or subscription withdrawal	5 years	Act on the Consumer Protection in Electronic Commerce, etc.
Record about customer dissatisfaction or trouble processing	3 years	Act on the Consumer Protection in Electronic Commerce, etc.
History of display advertising	6 month	Act on the Consumer Protection in Electronic Commerce, etc.
Record about electronic transaction	5 years	Electronic Financial Transactions Act
Record about website visit	3 month	Protection of Communications Secrets Act
Record about credit information collection/processing and use	3 years	Credit Information Use and Protection Act

Article 10 (Rights, Obligations, and Methods of Exercise of information subject)

(1) Member can exercise one’s rights regarding personal information protection of the following: 1. Browsing of personal information
2. Demand for correction of personal information due to error, etc.
3. Elimination of personal information
4. Cessation of processing of personal information (2) Members can exercise rights regarding Paragraph 1 through letter, phone call, email, FAX, and other ways. Company manages member’s inquiries without delay.
(3) In the case that a member demanded for correction of error or deletion of personal information, the company does not use or provide that personal information until correction or deletion is done.
(4) Members should not invade privacy of the information subject of the personal information processed by the company or others in violation of related laws such as the Personal Information Protection Act.

Article 11 (Transfer of personal information due to business transfer, etc.)

If the company transfers personal information to another person due to the transfer or merger of all or part of the business, the company must notify the member in advance of the following matters by way of notice, announcement, and other ways.
1. The fact that personal information is being transferred
2. Name (if it’s a corporation, the name of the corporation), address, phone number and other contact information of the person who is receiving personal information
3. Methods and procedures that can be taken if the information subject does not want to transfer personal information

Article 12 (Matters concerning the installation, operation and rejection of automatic personal information collection devices)

(1) The company uses cookie that store and retrieve usage information from time to time in order to provide individual customized services to members.
(2) Cookie is a small amount of information that the server (http) which is used for operation of a website and other purposes sends to a member’s computer browser. It can be stored on a hard disk within a member’s PC computer. 1. Purpose of usage of cookie: It is used to provide optimized information to members by identifying the types of visits and usage, popular search terms, secure access, etc. for each service and site visited by members.
2. Rejection of installation/operation of cookie a. Rejection for saving cookie can be done by clicking Tool > Internet Option > Personal Information Option on the upper part of the web browser.
b. Rejection for saving cookie can be done by clicking Icon > Setting > Advanced > Cookies and other site data on the upper part of Chrome 3. Use of service provided by the company is limited when a member rejects saving cookie.

Article 13 (Destruction of Personal Information)

(1) The company destroys the personal information without delay when the personal information becomes unnecessary, such as the elapse of the personal information retention period or the achievement of the processing purpose.
(2) In case that personal information must be preserved due to different legislation despite the elapse of the personal information retention period agreed by the member or the achievement of the processing purpose, that personal information is moved to a separate database (DB) or preserved in a different storage place.
(3) Following is the process and method of personal information destruction: 1. Destruction Process: The company selects the personal information for which the reason for destruction occurred and destroys the personal information with the approval of the company's personal information protection manager.
2. Destruction Method: The Company destroys personal information recorded and stored in the form of electronic files using technical methods so that the records cannot be reproduced, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.

Article 14 (Effort for Personal Information Protection)

(1) Company puts best effort to protect personal information of members safely, thus, protecting personal information more safely than the level required by the Act on Promotion of Information and Communications Network Utilization and Information Protection and Personal Information Protection Act through the method determined in this article.
(2) Personal information of the member is encrypted. In addition to passwords, unique identification numbers, account numbers, and card numbers that require encryption by law, e-mail addresses and mobile phone numbers are additionally encrypted and stored.
(3) We maintain the number of personal information handlers to a minimum. We manage employees who handle personal information to a minimum, and continue to emphasize that the protection of members' personal information is the most important value through regular and occasional training for personal information handlers.
(4) To prevent leakage and damage of personal information due to hacking or computer viruses, security programs are installed, periodic updates and inspections are performed. Systems are installed in areas where access from the outside is restricted, and technically and physically monitored and blocked.
(5) Documents containing personal information, auxiliary storage media, etc. are stored in a safe place with a locking device.
(6) We have a separate physical storage place where personal information is stored, and access is controlled.

Article 15 (Person in Charge of personal information protection)

(1) The company is responsible for the handling of personal information and appoints the person in charge of personal information protection as follows for the administration of complaints and damage relief of the information subject related to the processing of personal information. 1. Person in Charge of Personal Information Protection ㆍ Name: Manhee KIM
ㆍ Position: CEO
ㆍ Phone Number: +82-10-6671-0706
ㆍ Email: manhee.kim@neurolines.net 2. Personal Information Protection Administrative Department ㆍ Department Name: Service Business
ㆍ Administrator: 박경원
ㆍ Phone Number: +82-10-4338-0843
ㆍ Email: kwpark@neurolines.net (2) Members may contact the person in charge of the personal information protection and/or administrative department for information regarding all personal information protection, complaint management, and damage relief. Company replies and manages member’s inquiries without delay.

Article 16 (Remedy for infringement of rights and interests)

Members can contact the following organizations for damage relief, consultation, etc. for personal information infringement.

Personal Information Infringement Reporting Center (Operated by Korea Internet & Security Agency (KISA))
- Task in Charge: Report and consultation application of personal information infringement
- Website: privacy.kisa.or.kr
- Telephone Number: +82-01-3931-6788
- Phone: (without national number) 118
- Address: (58324) 9, Jinheung-gil, Naju-si, Jeollanam-do, Republic of Korea, 3rd floor Personal Information Infringement Report Center Personal Information Dispute Mediation Committee - Task in Charge: Personal information dispute mediation application, collective dispute mediation (civil settlement)
- Website: www.kopico.go.kr
- Phone: (without national number) 1833-6972
- Address: (03171) 209, Sejong-daero, Jongno-gu, Seoul, Republic of Korea

Supreme Prosecutors’ Office (SPO) Cybercrime Investigation Department: +82-2-3480-3573 (www.spo.go.kr)
Korean National Police Agency Cyber Bureau: 182 (http://cyberbureau.police.go.kr)

Effective Date: Privacy Policy is applied since April 14, 2021