Privacy Policy

Effective date: February 14, 2023

Introduction

Need approaches its collection, use, and sharing of your Personal Information with tremendous respect and care.

Please read our Privacy Policy (“Privacy Policy”). By accessing or using the Services provided by Need Korea LLC (“we”, “us”, and/or “our”), you understand that your Personal Information will be treated in the ways described herein. We have tried to make the Privacy Policy simple to understand, but if you ever have any questions, you may contact us at the address listed below.

This Privacy Policy provides you with specific details about how we collect, use, disclose and store your Personal Information, which includes your Personal Health Information, when you use the Need Services or otherwise interact with us. This Privacy Policy reflects the requirements of the law of the Republic of Korea, and our own commitments to privacy.

Data Controller

You should be aware that Need Korea LLC is the data controller of the Personal Information collected by and provided to us.

Our Commitments

We commit to treating your Personal Information lawfully and fairly; to not processing it in an inappropriate manner or beyond the purposes for which we collected it; to work with you in ensuring the accuracy of your Personal Information; to secure your data to avoid the risk of infringing upon your rights; to inform you of our privacy practices and of your rights with respect to your Personal Information held by us; to use processes such as anonymization and pseudonymization wherever reasonably practicable in order to further protect your privacy; to comply with all applicable privacy laws; and to destroy your Personal Information when it is no longer necessary for the purposes for which it was collected.

Definitions

The following definitions apply to this Privacy Policy:

Personal Health Information - Any Personal Information related to your health or healthcare, including information that relates to your physical or mental health and healthcare including health history, the provision of healthcare to you, and screening assessments.

Personal Information - Any information about an identifiable individual, including any “personal information” as regulated under the Personal Information Protection Act and any other applicable data privacy laws. Personal Information includes the Policyholder App account profile and Personal Health Information.

Policyholder App - The “Need” app provided by Need to individuals who have purchased a health insurance policy that includes the Need Services.

Services - The Policyholder App and the Need website, and all of the tools and services offered within the Policyholder Apps or website, including, but not limited to, assessments, recommendations, and customer support. The Services facilitate the availability to you of  general recommendations regarding cancer screening based on international guidelines as well as provide you access to a support team if you have any questions.

You - An individual who uses, or registers to use, our Services (“you”).

Collection and Use of Personal Information

Overview

We collect Personal Information to establish and maintain a relationship with you, to provide you our Services, to develop and enhance our products and services, and to maintain and improve the security and functionality of the Need website and Policyholder App. To the extent permissible under applicable laws, we may also use any of your Personal Information necessary to enforce our agreements, terms and policies, to comply with legal obligations, and for safety or security purposes.

We receive your Personal Information from three main sources: You, when you provide it to us directly in the Policyholder App or via other means; Your Use of the App, when you use the Policyholder App, we collect information about how you use the Policyholder App, information about the device you use to access the Policyholder App, and information from third-party apps you may connect to your account; and Third Parties, such as if you have purchased an insurance policy that offers the Need Services.    

We do not accept registrations for the Service by, and will not knowingly collect Personal Information of, individuals under the age of 15.

Details

We collect and use the following categories of Personal Information from you directly and for the purposes specified:

Name and Contact Information. We may collect information when you create an account or use our Services, such as first and last name, birthdate, gender, email address, postal address, phone number, and other similar contact data. We collect this category of information to establish and maintain a relationship with you and to provide you with access to the Services you request.

Credentials. We may collect passwords, password hints, and similar security information used for authentication and account access if you create an online account. We collect this information for security, authentication, and verification purposes.

Your Communications with Us. We may collect Personal Information, such as email address, phone number, or mailing address, along with the content of your communications, including, in some instances, Personal Health Information, when you request information about our Services, request customer or technical support, or otherwise communicate with us.

Personal Health Information. We may collect your Personal Health Information for the purpose of providing you the Services you request, including in-app assessments to provide information for you to discuss with your healthcare provider in planning your healthcare.

We collect the following categories of Personal Information when you use the Policyholder App or our website and for the purposes specified:

Automatic Data Collection. We may collect certain information automatically when you use our Services, such as your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, unique identifiers, browser or device information (see below), location information (data processed within your smartphone, or approximate location derived from IP address), and Internet service provider. Your UserID, which is a number assigned to your account for internal purposes, may also be collected automatically when you use the Services. This information is used to maintain and improve the security, performance and functionality of the Need website and Policyholder App. Some automatically collected Personal Information may be combined with other information to help improve the Services we offer.

Data From Connected Applications. We may collect Personal Information from third-party applications if you have connected your Need account with those applications for the purpose of providing you the service or tool you have requested. For example, if you choose to connect your Apple Health app to your account in the Policyholder App, we will collect the data from that application and use it to provide you the Services you request, including analyzing the Personal Information to better provide you the Services. Such data may include “behavioral data”, such as information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use that application.

Usage Information. We may also collect information regarding your use of our Services, such as information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services. This information is collected for the purposes of developing and enhancing our products and services, including to understand what Services you may be interested in, as well as for administrative purposes. We also use this information for security purposes and to improve the functionality of the Need Policyholder App and website.

Device Information. Certain limited technical data is required for the Policyholder App to function on your device. The information we collect includes information about your device and operating system, such as the type of device hardware and operating system, unique device identifier, IP address, language settings, and the date and time the Policyholder App accesses our servers. This information is used for the purposes of delivering content appropriate for your device’s capabilities, for delivering push notifications and helping to ensure a secure experience and to detect anomalous behavior in order to protect Personal Information from unauthorized access. In addition, in the event the Policyholder App crashes on your mobile device, we may receive information about your mobile device model software version and device carrier, which allows us to identify and fix bugs and otherwise improve the performance of the Policyholder App.

We collect the following categories of Personal Information from third parties for the purposes specified:

Insurance-Related Information. We collect information related to your health insurance policy from your health insurance provider. This information may include contact information, policy information, credit information, claims submitted, risk assessments, and other Personal Information insurance providers have used in their decision to provide you a policy or provide coverage under your policy.      

We may also use your Personal Information in the following other ways:

Consent. We may use your Personal Information for other purposes with your additional consent.          

Contract. We may use your Personal Information where this is unavoidably necessary, for the purpose of entering into and performing a contract that we have with you.    

Cookies

Our website and Policyholder App use cookies. Cookies are small text files that are saved on your device when you visit our website that help us in particular to provide you with a good experience when you browse our website and also allow us to improve it. Cookies may contain information about your use of our website or enable us to recognize you and your device the next time you visit our website.

There are various ways to configure and manage cookies. You can deactivate Need or third-party cookies using your browser settings.

For example, the following hyperlinks tell you how to disable the use of cookies in some browsers and/or how to delete cookies:

• Chrome: https://support.google.com/chrome/answer/95647?hl=en‍
• Microsoft Edge:  https://support.microsoft.com/en-gb/help/4468242/microsoft-edge-browsing-data-and-privacy

Sharing and Disclosure of Personal Information

Overview

We may share Personal Information with those who assist in the provision of Services to you or to us.

We will not disclose your Personal Information for any purpose other than what has been outlined in this Privacy Policy or as permitted under applicable law, unless we obtain your express consent. We disclose only the limited amount of Personal Information necessary to meet these purposes.

We may share your Personal Information with our service providers, which are contracted by us to perform services or functions on our behalf where they require the information to assist us in serving you or us. In all instances in which we share your Personal Information with third parties providing services to us (or on our behalf to you), we use contractual controls to protect this information and limit its use to what is necessary for the service provider to perform the service or the third party to provide a service to you. Further details are set out in the Entrustment section below.

We may share your Personal Information with third parties as permitted and in the manner required by law. Further details are set out in the Third-Party Provision section below.    

Details‍

Entrustment

Whenever we share information outside of Korea, we ensure that the transfer complies with applicable laws so that your Personal Information is adequately protected.

The following are recipients of all categories Personal Information in the Privacy Policy, their location, the purpose of the transfer, the retention period by the recipient, and the timing and method of transfer to entities outside of Korea:

• Google Cloud Services in Korea, which provides data storage services, and which retains data as long as necessary to provide the Services or until the end of the contract.
• Need Inc. in the U.S.A. (Privacy Officer, privacy@getneed.com), which provides administrative and customer support, and the data is retained as long as necessary to provide the support, and is transferred at the time of transmission of information and through the network whenever a service is used that requires transfer.
• Channel.io in Korea. (Privacy Officer, Contact: privacy@channel.io, Phone: +82.2.1644.4052), which provides a customer support platform, and which retains the data as long as necessary to provide you the Need Services or until end of contract, and is transferred at the time of transmission of information and through the network whenever a service is used that requires transfer.
• Typeform, S.L. in Spain (Contact details for Data Protection Officer: gdpr@typeform.com), which provides customer support forms, and which retains the data as long as necessary to provide you the Need Services or until end of contract, and is transferred at the time of transmission of information and through the network whenever a service is used that requires transfer.
• Consultants, global, to provide the Services, and who retain the data as long as is necessary to provide you the Need Services, and the data is transferred at the time of transmission, when the Consultant accesses the Personal Information through Need-supplied apps or websites.

We may entrust Personal Information to service providers specified above, for the following purposes:

Service Providers. We may share Personal Information with our suppliers, agents or other organizations or individuals who are contracted to perform services or functions on our behalf, where they require the information to assist us in serving you. For example, we may use service providers for internal administrative purposes, e.g., a customer service platform, to host our website and to store and dispose of information on our behalf. In addition, we may use service providers for our internal processes (such as internal communications platforms and customer support platforms). We strive to minimize the amount of Personal Information that we share with our service providers and partners and ensure that appropriate contractual clauses restrict what they are able to access or do with the Personal Information.

Third-party data provision

Third-Party Partners. We may provide, where permitted by law and/or with your further consent, your Personal Information to third-party partners who may be conducting research, clinical trials, or studies, or may be developing healthcare-related software, programs, or products. We may provide your Personal Information to third-party partners that have products or services that may be of interest to you. If we do, we will add their names to this Privacy Policy.

Disclosures required or permitted by law or regulation. We may disclose Personal Information to the extent necessary where we are required or permitted under applicable law, such as in the event of an emergency that threatens the life, health or security of an individual. We or our service providers will also share Personal Information with law enforcement, courts, other government agencies or other parties if we are required to do so to meet our legal and regulatory requirements in the jurisdictions in which we or our service providers operate; for example, we are required to provide records to law enforcement in response to a valid court order.

Business Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of service to another provider, your Personal Information may be transferred to a successor or affiliate as part of that transaction along with other assets, subject to all requirements under applicable laws.                        

Retention and Destruction

In general, we retain Personal Information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy or in a separate consent we have obtained from you or as required to meet legal or regulatory requirements.    

Personal Information may be retained for a period of time mandated by law, including as specified below:

Act on Consumer Protection in Electronic Commerce

• Records relating to your cancellation of, or payment for, a transaction, and our supply of a good/service: 5 years
• Records of handling of complaint, or dispute: 3 years

Protection of Communications Secrets Act  

• Records/logs of your visits to our website: 3 months

When we destroy your Personal Information, we will take commercially reasonable and technically feasible measures to ensure it is permanently deleted.

We delete Personal Information stored in the form of electronic files by using technical methods that render it impossible to restore the data. Personal information printed on paper is shredded or incinerated. Other types of Personal Information, if any, are permanently destroyed, in accordance with any applicable requirements under law.

Safeguards

We understand that data security is a critical issue and we are committed to safeguarding the Personal Information in our custody or control. We have implemented a comprehensive information security program in accordance with applicable law that includes written policies and procedures, and security controls, as well as reasonable administrative, technical and physical safeguards, in an effort to protect against unauthorized access, use, loss, modification, and disclosure of Personal Information in our custody or control as follows:    

1. Organizational measures: Establishment and implementation of internal management plans, provision of regular employee training, etc.
2. Technical measures: Management of access rights to the Personal Information processing systems, installation of access control systems, encryption of uniquely identifiable information, etc., installation of security programs.
3. Physical measures: Access control of IT rooms, data storage rooms, etc.
   

Please keep in mind that no internet or email transmission is ever fully secure or error free and no security system is impenetrable. We cannot fully guarantee the confidentiality of any information that you provide to us but we can assure you that we will use reasonable and appropriate security controls, reflective of the sensitive nature of Personal Health Information.

It is important for you to play an active role in the protection and safeguarding of your Personal Information, and to guard your privacy when you are online. If the Policyholder App or our website contains links to other websites, apps, or platforms, this Privacy Policy does not govern those websites. You should read their privacy policies and make an informed decision about whether you want to use them or their services.‍

Your Rights‍

Access: You have the right of access to your Personal Information. For any Personal Information that is not available to you directly in your account, you may request access by contacting us at the address below. ‍

Correction: You have the right to correct incorrect Personal Information. For any Personal Information that you cannot directly correct in your account, you may request correction by contacting us at the address below. ‍

Deletion: You may request deletion of your Personal Information. For any Personal Information that you cannot directly delete in your account, you may request deletion by contacting us at the address below. ‍

Suspension of Processing: You have the right to request that we stop processing your Personal Information. To make such a request, you may contact us at the address below.

We rely on you to ensure that the Personal Information in your account is accurate, complete and up-to-date.

Please be aware that we will take reasonable steps, as permissible under law, to verify your or your legal representative’s identity before providing you with access to your Personal Information or making corrections or deletions to it. In addition, your right to access, correct, or delete your Personal Information is subject to certain legal restrictions.

You and your legal representative/guardian may make requests by contacting us at the address listed in the next section.‍

Department in Charge of the Protection of Personal Data

Please contact us at the address below if:

• you have any questions related to the collection, use or disclosure of your Personal Information;
• you need to report any privacy or security violations, including any suspected or actual unauthorized access, use, disclosure or loss of Personal Information;
• you wish to withdraw your consent to the collection, use or disclosure of Personal Information;
• you wish to access, update, and/or correct inaccuracies in your Personal Information;
• you have any questions or comments about this Privacy Policy; or
• you otherwise have a question or complaint about the manner in which we or our service providers treat your Personal Information, including our policies and practices with respect to the use of service providers outside of the Republic of Korea.

Need has designated a chief privacy officer, to oversee processing of Personal Information and for purposes of addressing requests and issues regarding such processing. Need’s chief privacy officer is the following:

• Name: Katherine Tassi
• Department: Data Protection and Privacy
• Email: privacy@getneed.com

Changes to the Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to our practices. Any notices regarding modifications to this Privacy Policy will be in written form and provided to you on the Policyholder App and on our website.

If any changes to this Privacy Policy are significant, we will provide a more prominent notice (including email notification, if appropriate).

We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices and to contact us if you have any questions or concerns.