This is an English reference translation. Healthjangbu is operated from the Republic of Korea and this policy is governed by the Korean Personal Information Protection Act; the Korean text is the binding version and prevails in any discrepancy. Read it at healthjangbu.com/privacy.
Article 1 (What we collect, and how)
We collect the following personal information in order to provide the Service.
Required
At sign-up: email address and name (collected automatically when you sign in with Google or Kakao)
When verifying a trainer's identity: legal name and mobile number
While using the Service: usage records, access logs, IP address, device information
Legal name and mobile number are collected under Article 15(1)4 of the Personal Information Protection Act (performance of a contract with the data subject). The purpose, the items and the retention period are stated on the screen where they are collected. Because this information is needed to perform the contract, access to the Service may be restricted if it is not provided.
Optional
Gym name, profile photo
Client information entered by the trainer (the trainer controls this data)
Client name, sex, age, body metrics (weight, body fat, muscle mass, height), workout records, session photos and videos
Records the client enters: pain logs (area and 0-10 intensity), meal logs (photos and notes), body and InBody photos
How we collect it: sign-up, identity verification, ordinary use of the Service, and customer enquiries
Article 2 (Why we collect and use it)
Providing and running the Service: managing clients, creating and sending session notes
Identity verification: verifying trainers by mobile number and preventing misuse
Service notifications: sending necessary operational messages by SMS or KakaoTalk
Improving the Service: analysing usage statistics and raising quality
Customer support: answering enquiries and delivering announcements
Billing: processing payment for the paid service
AI session notes: generating AI coaching notes from workout records
Marketing messages (optional): only where you have separately agreed to receive them; you can withdraw that consent at any time in Settings
Article 3 (How long we keep it)
We keep it until you close your account, and destroy it without delay thereafter.
Except where law requires longer retention:
Records of contracts and withdrawal of purchase under the Electronic Commerce Act: 5 years
Records of payment and supply of goods: 5 years
Records of consumer complaints or dispute handling: 3 years
Access logs: 3 months (Protection of Communications Secrets Act)
Article 4 (Disclosure to third parties)
As a rule we do not disclose your personal information to third parties. The exceptions are:
where you have consented in advance;
where disclosure is required by law.
Article 5 (Processors and transfers abroad)
Domestic processors: we entrust processing of personal information as follows in order to provide the Service.
Infobank Corp.: sending SMS and KakaoTalk messages (items: name, mobile number / retained until the engagement ends)
Toss Payments Inc.: domestic subscription payment processing and card data custody (items: payment method details, payment history / retained until the engagement ends)
Transfers abroad (processing): the following work, which is essential to providing the Service, is entrusted to overseas providers, and personal information is transferred abroad over the network in the course of it (Personal Information Protection Act, Article 28-8(1)3).
Supabase Inc. (United States): database hosting and storage — the items in Article 1 / until the engagement ends
BunnyWay d.o.o. (Slovenia): session video storage and streaming — videos recorded during sessions / until the engagement ends
Functional Software, Inc. (Sentry) (United States): error diagnostics — request URL, browser and device information, and error details captured when an error occurs / 90 days
Anthropic PBC (United States): processing for AI session-note generation — workout records / until processing completes
Vercel Inc. (United States): web hosting — access records / until the engagement ends
Google LLC (United States): social login authentication — email address, name / until the engagement ends
Resend (Plus Five Five, Inc.) (United States): sending verification and notice emails — email address, delivery records / until the engagement ends
Lemon Squeezy (Sold Through Link, LLC) (United States): merchant of record for subscriptions billed in US dollars — email address, billing address, payment method details, tax identification number / until the engagement ends
You may refuse these transfers by contacting the privacy officer named in Article 8. They are, however, essential to providing the Service, so refusing may restrict your use of it.
Transfers abroad (advertising measurement — not essential to providing the Service)
Meta Platforms Ireland Limited (Ireland): advertising measurement and personalised advertising — the behavioural data listed in Article 11 (pages visited, time of visit, actions such as completing sign-up, browser and device information, cookie identifiers) / retained from collection in line with Meta's retention policy
That advertising transfer is not essential to providing the Service, and you can refuse it by the methods in Article 11. Refusing places no restriction whatsoever on your use of the Service.
Article 6 (Destruction)
We destroy personal information without delay once the retention period passes or the purpose is fulfilled.
Electronic files: permanently deleted by a method that cannot be reversed
Paper documents: shredded or incinerated
Article 7 (Your rights)
You may view and correct your personal information at any time.
You may request deletion of your personal information by closing your account.
You may withdraw your consent to the collection and use of your personal information.
Consent to marketing messages can be withdrawn at any time in Settings in the dashboard, and the result is shown on screen.
This policy applies from its effective date. Changes are announced within the Service or on a notice screen. Earlier versions — which are kept in the Korean they were issued in — can be read here.
When a client uses the “Share to Instagram Stories” feature on a session-note page, the shared image contains:
their given name (without the family name)
the workout from that session
any achievement they chose to share (for example total volume or a personal best)
their trainer's display name
Sharing only ever happens through the client's own explicit action — tapping the share button. Neither the trainer nor anyone else can share a client's information on their behalf.
The shared image is downloaded to the client's device and is not stored on our servers. The fact that the share button was tapped is counted anonymously for service statistics.
Article 11 (Automatic collection tools: what we run, and how to refuse)
We run cookies and an advertising measurement tool (a pixel) to measure advertising performance and improve the Service.
1. The tools we run, and why
Meta Pixel (Meta Platforms Ireland Limited): measuring visits and sign-ups that come from advertising, and serving advertising based on your interests
2. The behavioural data collected
Pages visited, time of visit, and actions such as clicking an advert or completing sign-up
Browser type and device information, IP address, cookie identifiers
3. Where these tools are — and are not — installed
They run only on screens anyone can open — the home page, pricing, sign-up and the like.
They are never installed on screens you reach after logging in (the trainer dashboard) or on client link screens (session notes, profiles, body composition and so on). Clients' workout records, body metrics, session photos and videos, and the client link addresses themselves are therefore never collected by an advertising tool or transferred abroad through one.
We do not pass directly identifying information such as names or contact details to advertising tools.
4. How to refuse
Refuse or delete cookies in your browser settings. (Chrome: Settings > Privacy and security > Third-party cookies / Safari: Settings > Privacy > Prevent cross-site tracking)
On a mobile device, reset the advertising identifier or turn off app tracking in the device settings.
Turn off personalised advertising in your Meta account under [Settings & privacy] > [Ads preferences].
Refusing cookies places no restriction whatsoever on your use of the Service.
Enquiries about behavioural data, or requests to see or delete it, can be directed to the privacy officer named in Article 8.