Privacy Policy

This Privacy Policy explains how DYPHI Inc. collects, uses, shares, stores, and protects personal information through NextWeight.

NextWeight is a healthcare information, preliminary review support, and international patient coordination service operated by DYPHI Inc. NextWeight is not a hospital and does not provide diagnosis, prescriptions, treatment, or surgery.

1. Who is responsible for your information?

The organisation responsible for the processing described in this policy is:

DYPHI Inc.
Room 203-J23, 2F, 15 Gyeryong-ro 105beon-gil, Yuseong-gu, Daejeon, Republic of Korea
Privacy enquiries: snm@dyphi.com
General enquiries: info@dyphi.com
Telephone: +82-70-4167-2554
Corporate website: https://www.dyphi.com/

2. Information we may collect

We collect information that you provide directly when you use our enquiry form, request a preliminary review, communicate with us, or submit documents.

This may include:

• Name, country of residence, nationality, preferred language, email address, and WhatsApp number
• Age, sex, height, weight, and calculated BMI
• Health conditions, symptoms, medications, allergies, medical history, and previous surgery
• Previous weight-management treatments, including medication or bariatric procedures
• Treatment interests, preferred travel dates, and information relevant to care planning
• Medical documents that you choose to provide, such as laboratory results, medical reports, discharge summaries, surgical records, or imaging reports
• Messages exchanged with us through forms, email, WhatsApp, or other agreed communication channels
• Consent records, including the version and date of the notice accepted

We may also collect limited technical information when you use the website, such as:

• Browser and device type
• Pages viewed and approximate visit time
• Referring website or campaign parameters
• Approximate location at country or regional level
• Essential security, performance, or analytics information collected through cookies or similar technologies

We do not intentionally collect information from children under 18. Our services are intended for adults. A family member contacting us on behalf of an adult patient should have the patient's permission or appropriate authority.

3. Why we use your information

We may use personal information to:

• Respond to your enquiry
• Prepare the preliminary medical review you request
• Organise the health information and documents you provide
• Identify a potentially appropriate hospital or specialist for review
• Coordinate communication with a hospital or specialist, after obtaining the required consent
• Support treatment, travel, scheduling, interpretation, and follow-up planning requested by you
• Communicate with you about your case
• Operate, secure, and improve the website and service
• Keep records of consent and communications
• Comply with legal and regulatory obligations
• Prevent fraud, misuse, or security incidents

We do not sell personal information. We do not use health information for behavioural advertising.

4. Health information and medical documents

Health information and medical documents may contain sensitive personal information.

We process this information only when it is necessary for the service you request and when the required consent has been obtained.

We apply the following principles:

• We request only information reasonably necessary for preliminary review or coordination.
• Access is limited to personnel who need the information for the requested service.
• We do not make a medical diagnosis or determine treatment eligibility.
• Medical information is disclosed to a hospital or specialist only for the requested review, planning, or coordination and after the relevant consent has been obtained.
• If translation or technical support is required, access is limited to the information necessary for that task and is subject to confidentiality obligations.
• You should not send medical documents through an unsecured channel when a secure submission method is available.

5. When we share information

We may share information only as needed with:

• A hospital, specialist, or other licensed healthcare provider selected to review or manage your case
• Service providers supporting secure hosting, forms, file storage, email, communications, analytics, translation, or technical operations
• Professional advisers where necessary for legal, regulatory, accounting, or security purposes
• Public authorities when disclosure is required by applicable law

We require service providers to process information only for the agreed purpose and to apply appropriate confidentiality and security measures.

We do not describe an institution as a “partner hospital” unless a current formal partnership has been verified.

6. International transfer of information

NextWeight serves users outside Korea. Information submitted from another country may be transferred to and processed in the Republic of Korea by DYPHI Inc. and, where you request medical review, by the relevant Korean hospital or specialist.

Depending on the services used to operate the website, limited information may also be processed by technology providers in other countries.

Where required, we provide additional information and obtain consent concerning:

• The recipient or category of recipient
• The destination country
• The information transferred
• The purpose of transfer
• The timing and method of transfer
• The retention period
• Your right to refuse, and the effect of refusal on the requested service

If you do not agree to a transfer that is necessary for a Korean medical review, we may be unable to coordinate that review.

How information moves through this service

Stage 1 — Browser-only preparation.

• You enter information locally in your browser.
• There is no server submission.
• There is no storage by DYPHI Inc.
• There is no disclosure to a hospital.
• There is no transfer to Korea through the website.
• You may reset and delete the local form content at any time.

Stage 2 — You choose an external channel (transfer to DYPHI Inc. in Korea).

• You open WhatsApp or email.
• Immediately before you open WhatsApp, you confirm the transfer acknowledgement: information you choose to send may be transmitted through WhatsApp and received and processed by DYPHI Inc. in the Republic of Korea.
• You intentionally choose what to send.
• The third-party channel processes that content.

Stage 3 — Disclosure to a clinic or medical professional.

• Separately, and only at this later stage, DYPHI Inc. obtains recipient-specific disclosure consent immediately before it sends your information to a named clinic or medical professional.
• The specific clinic or medical professional is identified to you before that disclosure.
• Only the necessary information is sent.

The transfer acknowledgement in Stage 2 and the recipient-specific disclosure consent in Stage 3 are separate. The Stage 2 acknowledgement is obtained before you send information to DYPHI Inc.; the Stage 3 disclosure consent is obtained later, before DYPHI Inc. sends information to a named clinic or medical professional.

7. WhatsApp and email

WhatsApp and email are third-party communication services with their own privacy and security practices.

We contact you through WhatsApp or email when you choose that channel or ask us to do so.

You are not required to send medical documents through ordinary email or WhatsApp. When medical documents are needed, we may provide a more secure submission method.

Do not use the website, email, or WhatsApp for a medical emergency. Contact local emergency services or a local healthcare provider immediately.

8. Cookies and website analytics

We may use essential technologies needed for website security, language settings, form operation, and performance.

Google Analytics

We currently use Google Analytics, provided by Google, to understand general website usage such as pages viewed, device type, approximate location, and referral source.

We do not intentionally send health information, medical details, form responses, generated enquiry-summary content, email addresses, telephone numbers, WhatsApp numbers, or document information to Google Analytics.

Google may process analytics data according to its own privacy terms.

Where required by applicable law, non-essential analytics or marketing technologies must not operate until the user has made the relevant choice.

Health information entered in the browser-based enquiry tool is not included in analytics events, advertising pixels, page URLs, or campaign parameters.

9. How long we retain information

Unless a longer period is required by law or necessary for an active service, we generally apply the following periods:

• A general enquiry that does not proceed to preliminary review or coordination: 12 months after the last communication
• A preliminary review that does not proceed to treatment coordination: 3 years after the review is closed
• A case involving treatment coordination or follow-up support: 5 years after the service is completed
• Contract, payment, accounting, or tax records: for the period required by applicable law
• Consent and withdrawal records: for the period necessary to demonstrate compliance
• Technical security logs: for the minimum period reasonably necessary for security and incident investigation

Information may be deleted earlier upon a valid request, unless retention is required by law, needed to resolve a dispute, or necessary to protect legal rights.

DYPHI Inc. must ensure that the actual deletion schedule used by its systems matches these periods.

10. How the website currently handles information

The website is delivered over HTTPS.

The enquiry tool currently operates in the user's browser and does not submit or store the entered information on a NextWeight server.

NextWeight does not currently accept medical-document uploads through this website.

If a server-side form, secure file-upload service, CRM, or other storage system is introduced, this Privacy Policy will be updated to describe the actual access, storage, logging, retention, deletion, and security controls before that system is used for health information.

No online communication service, including WhatsApp or email, can guarantee absolute security.

11. Your choices and rights

Subject to applicable law, you may request:

• Access to the personal information held about you
• Correction of inaccurate or incomplete information
• Deletion of information
• Restriction or suspension of processing
• Withdrawal of consent
• A copy of information you provided
• Cessation of optional communications
• Information about relevant recipients or international transfers

To make a request, contact snm@dyphi.com.

We may need to verify your identity before acting on a request. We will respond without undue delay and within the period required by applicable law.

Withdrawal of consent does not affect processing that was lawful before withdrawal. If you withdraw consent needed for preliminary review or coordination, we may be unable to continue that service.

12. Third-party websites and medical providers

The website may link to hospitals, healthcare providers, WhatsApp, research publications, or other third-party websites.

Those organisations operate under their own privacy practices. DYPHI Inc. is not responsible for their independent websites or policies.

A medical provider receiving your information becomes responsible for its own clinical records and processing activities under applicable law.

13. Changes to this policy

We may update this Privacy Policy when the service, legal requirements, or technology changes.

The current effective date and last-updated date will be displayed at the top of the page. Material changes will be communicated through an appropriate notice.

14. Contact us

Privacy enquiries: snm@dyphi.com
General enquiries: info@dyphi.com
Telephone: +82-70-4167-2554

DYPHI Inc.
Room 203-J23, 2F, 15 Gyeryong-ro 105beon-gil, Yuseong-gu, Daejeon, Republic of Korea