NEUROGAIT Solution Privacy Policy

SALTED Co., Ltd. (the “Company”) complies with the Personal Information Protection Act and other applicable laws and establishes and publishes this NEUROGAIT Solution Privacy Policy to protect the personal information of data subjects.

Article 1 (Parties Responsible for Processing Personal Information and Scope of Application)

1. The Medical Institution determines the purposes and means of processing Patient personal information, the retention period, and access rights. The Company processes personal information only to the extent necessary to operate the service, in accordance with its personal information processing entrustment agreement with the Medical Institution and the Medical Institution’s lawful instructions.
2. The name of the Medical Institution and its department responsible for personal information protection are displayed on the Patient registration screen or the consent screen for the collection and use of personal information.
3. For membership and usage information entered directly by an Individual Member in the NEUROGAIT Care App, the Company applies this Policy as the personal information controller.

Article 2 (Purposes of Processing Personal Information)

The Medical Institution and the Company process personal information to the extent necessary for the following purposes. If a processing purpose changes, separate consent will be obtained or other measures required by applicable law will be taken.

1. Institution and healthcare professional account management: Verification of institutions, account issuance, identity verification, access-right management, prevention of unauthorized use, and customer support
2. Patient registration and management: Patient identification, association of measurement records, management of measurement schedules and results, and Patient management by Medical Institutions
3. NEUROGAIT Insole service: Measurement and analysis of plantar pressure, gait, balance, and related parameters and provision of results
4. NEUROGAIT Motion service: Video-based measurement and analysis of body movement, posture, range of motion, and related parameters and provision of results
5. NEUROGAIT Care App: Individual Member registration and authentication, management of the Member’s own information, and provision of personal features offered by the Company
6. Service operation: Cloud storage and backup, response to service failures, access-log management, security, and handling of inquiries and disputes
7. Service improvement: Creation of statistics that do not identify individuals and quality improvement. If personal information or pseudonymized information is used for research or algorithm development, a separate lawful basis and safeguards will be established.

Article 3 (Categories of Personal Information Processed)

Information indicating health status, such as diagnosis, diagnosis and surgery history, pain, questionnaire responses, gait, balance, plantar pressure, and range of motion, is processed as sensitive information. Where sensitive information is processed on the basis of consent, separate consent is obtained distinct from consent to the processing of general personal information.

Video containing a face or voice constitutes personal information if an individual can be identified. Unless the face or voice is used to identify or authenticate an individual, it is not used as biometric information.

Article 4 (Processing and Retention Period)

1. When the agreement between a Medical Institution and the Company ends, the Company immediately deletes from the production system, or returns in accordance with the Medical Institution’s lawful instructions, the personal information processed on behalf of that Medical Institution.
2. When a Medical Institution deletes a Patient, the Company immediately deletes the Patient’s personal information and Measurement Information from the production system.
3. When an Individual Member withdraws from the NEUROGAIT Care App, the Company immediately deletes that Member’s personal information from the production system.
4. Personal information and Measurement Information not subject to Paragraphs 1 through 3 are retained for five years from the date of collection or creation and then deleted.
5. If a Medical Institution must retain medical records under the Medical Service Act or other applicable laws, those records are retained separately under the responsibility of the Medical Institution.
6. Information that must be retained under other laws is segregated from other information and retained only for the categories and periods prescribed by those laws.
7. Information subject to deletion that remains in backups is not used for any purpose other than recovery, access to it is restricted, and it is securely deleted in an unrecoverable manner within seven days after deletion from the production system.

Article 5 (Provision of Personal Information to Third Parties)

1. The Medical Institution and the Company do not provide personal information to third parties unless the data subject separately consents or applicable law provides a specific legal basis.
2. If the NEUROGAIT Care App offers a feature through which an Individual Member may request that the Member’s Measurement Information be sent to a Medical Institution or another person, the Company will inform the user of the recipient, purpose, and items to be transferred and will process the transfer based on the user’s clear request or consent.
3. If a lawful request is received from an investigative agency or other authority, personal information may be provided within the scope and in accordance with the procedures prescribed by applicable law.

Article 6 (Entrustment and Sub-Entrustment of Personal Information Processing)

1. Processing Entrusted by Medical Institutions to the Company

2. External Processors Used by the Company

When the companies below process information registered by a Medical Institution, they are the Company’s sub-processors. When they process information provided directly by NEUROGAIT Care App Members, they are processors engaged by the Company.

1. Before sub-entrusting the processing of information registered by a Medical Institution to an external company, the Company obtains the Medical Institution’s consent and provides the information necessary for the Medical Institution to disclose the sub-processor and the sub-entrusted activities to data subjects.
2. The Company incorporates into its entrustment and sub-entrustment agreements provisions concerning the prohibition of processing beyond the specified purpose, access restrictions, safeguards, restrictions on further sub-entrustment, supervision, incident response, return and destruction, and compensation for damages.
3. Changes to processors or entrusted activities will be disclosed through this Policy.

Article 7 (Overseas Transfer of Personal Information)

The Company stores principal personal information and Measurement Information in the AWS Republic of Korea region. However, because Firebase Crashlytics is used to respond to app errors, the following information may be transferred overseas.

1. The overseas processing entrustment is conducted to the extent necessary to provide the service and perform the service agreement. Where Article 28-8(1)(3) of the Personal Information Protection Act applies, the foregoing information is disclosed in this Policy. For processing not covered by that legal basis, the Company will establish another lawful basis, such as separate consent to the overseas transfer.
2. A data subject may contact the Company’s Chief Privacy Officer to submit an inquiry or exercise rights under applicable law concerning an overseas transfer. If applicable law recognizes a right to refuse an overseas transfer, the Company will explain the refusal procedure, any resulting restrictions on use of the service, and take the necessary measures.
3. The Company manages its configurations and source code to prevent Patient identifiers and health information—including Patient names, mobile phone numbers, Patient numbers, diagnoses, measurement videos, and measurement results—from being included in Firebase Crashlytics error logs.

Article 8 (Destruction of Personal Information)

1. When personal information is no longer necessary, the Company selects the information to be destroyed through its internal procedures, including approval by the Chief Privacy Officer, and destroys it without delay.
2. Electronic files are securely deleted so that they cannot be restored or reproduced, and paper documents are shredded or incinerated.
3. Personal information that must be retained under applicable law is segregated in a separate database or storage location and is not used for purposes other than retention.

Article 9 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

1. Data subjects may exercise rights guaranteed by applicable law, including the rights to access, transmit, correct or delete, and suspend the processing of personal information and to withdraw consent.
2. As a general rule, rights concerning Patient information and Measurement Information registered by a Medical Institution should be exercised with the applicable Medical Institution. At the Medical Institution’s request, the Company provides the technical support necessary to process the exercise of those rights.
3. Rights concerning information provided directly by NEUROGAIT Care App Members may be exercised through the app’s profile or withdrawal features or by contacting the Company’s privacy contact.
4. If an agent exercises rights on behalf of a data subject, the Company or Medical Institution may request a power of attorney and identity-verification materials prescribed by applicable law.
5. Data subjects must not infringe their own or another person’s personal information or privacy.

Article 10 (Personal Information of Children Under 14 Years of Age)

1. The Company does not permit children under 14 years of age to directly register for the NEUROGAIT Care App.
2. If a Medical Institution processes the personal information of a Patient under 14 years of age and consent is required, the Medical Institution must obtain consent from the Patient’s legal representative and verify that consent.
3. Rights concerning a child’s personal information may be exercised by the child’s legal representative.

Article 11 (Device Permissions and Processing of Video Information)

1. Users may revoke permissions in their device settings. Consent to device permissions and consent to the collection and use of personal information are separate.
2. Motion videos may include the face, body, surrounding background, and voice.
3. If the face-mosaicking feature is applied, the mosaicked video is processed first. If a mosaicked file is not generated or the feature is not applied, the original video may be stored and transmitted. The Medical Institution must inform the Patient of this before recording.

Article 12 (Automatic Collection Technologies and Analytics Tools)

1. The web service may use cookies to maintain login sessions, ensure security, and save preferences. Users may reject or delete cookies through their browser settings, but some features may be restricted.
2. The apps use Firebase Crashlytics to process installation identifiers, app, device, and operating-system information, and error and crash information.
3. The third-party app error-collection tool used by the Company is Firebase Crashlytics.

Article 13 (Safeguards for Personal Information)

The Company and Medical Institutions implement the following measures to safeguard personal information within their respective areas of responsibility:

1. Administrative measures: Establishing and implementing an internal management plan, minimizing the number of personnel who handle personal information, conducting regular training, and managing and supervising processors and sub-processors
2. Technical measures: Granting, changing, and revoking access rights; using secure authentication methods; encrypting information subject to encryption under applicable law during transmission and storage; one-way hashing of passwords; retaining and reviewing access logs; preventing malware; conducting vulnerability assessments; and protecting backups
3. Physical measures: Controlling access to computer rooms and document storage rooms and securely storing documents and media
4. Incident response: Operating procedures to detect and contain personal information incidents, analyze causes, assess impact, report to relevant authorities, and notify data subjects

Article 14 (Chief Privacy Officer and Requests to Exercise Rights)

The Company designates the following Chief Privacy Officer to oversee personal information processing and handle inquiries, complaints, and requests for relief relating to personal information.

• Chief Privacy Officer: Kyung-Hoon Kang
• Telephone: +82-2-552-0815
• Email: kh.kang@salted.ltd
• Fax: +82-2-558-0815

The contact responsible for handling rights requests concerning Patient information registered by a Medical Institution is the privacy department of that Medical Institution displayed on the Patient registration and consent screens.

Article 15 (Remedies for Infringement of Rights)

Data subjects may contact the following organizations for advice or relief regarding infringement of personal information rights.

• Personal Information Infringement Report Center: 118 (without an area code), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: +82-1833-6972, www.kopico.go.kr
• Korean National Police Agency Cybercrime Reporting System: 182 (without an area code), ecrm.police.go.kr

Article 16 (Changes to this Privacy Policy)

1. If this Policy is amended, the effective date and material changes will be disclosed through the service or the Company’s website.
2. Changes that materially affect the rights of data subjects will be communicated before they take effect by reasonable means, such as email, text message, or in-app notification.
3. Previous versions of this Privacy Policy will be made available through the service or the Company’s website.

Announcement Date: September 21, 2026 · Effective Date: October 21, 2026