Website Privacy Notice

1. Scope of This Notice

RnPT Inc. (알앤피티 주식회사) ("RnPT," "we," "us," or "our") is a company incorporated under the laws of the Republic of Korea.

This Website Privacy Notice applies only to rnptinc.com (the "Website"), our corporate website. The Website provides information about RnPT, our operating service KRACE, partnership opportunities, and company news.

This Notice does not apply to the KRACE platform. If you use KRACE to arrange healthcare, wellness, or related coordination services, your personal information is processed under a separate policy:

• KRACE Privacy Policy: https://kracecare.com/policy/privacy-policy
• KRACE Terms of Service: https://kracecare.com/policy/terms-and-conditions

This Notice is governed by the Personal Information Protection Act of the Republic of Korea ("PIPA") and related regulations.

---

2. Limits of Collection on This Website

To be explicit about what this Website does and does not do:

• We do not request sensitive information as defined under PIPA Article 23. No field on the Website is designed to collect health information, medical history, diagnoses, treatment details, or biometric data. If sensitive information is nonetheless included in a message or form you send us, we will not use it for any purpose, will not transfer it to any third party, and will delete it promptly.
• We do not process payments. No payment card details, bank information, or transaction data are collected through the Website.
• We do not collect passport, visa, or travel documentation.
• We do not operate user accounts. There is no registration, login, or profile on the Website.

Where any of the above is required in connection with a KRACE booking, that processing occurs on the KRACE platform under the KRACE Privacy Policy.

---

3. Information We Collect

3.1 Information You Provide Directly

All fields are provided voluntarily. The optional interest field on the Early Access waitlist is free text — please do not include medical history, health conditions, symptoms, or any other health information. Any such content will be handled in accordance with Section 2 above.

Registration for the Early Access waitlist requires separate, optional consent to receive marketing communications. You may withdraw that consent at any time using the unsubscribe link in any message or by contacting support@rnptinc.com.

3.2 Information Collected Automatically

• Device and browser information: device type, operating system, browser type and version, language settings
• Usage data: pages visited, referring URL, time spent
• Log data: IP address, access times
• Approximate location derived from IP address
• Interaction data: clicks, scrolling, and similar in-page interactions (only where you have consented — see Section 6)
• Cookie and tracking identifiers (see Section 6)

---

4. Purposes and Legal Basis

---

5. Sharing, Entrustment, and Overseas Transfer

5.1 Third-Party Provision

RnPT does not sell, rent, or trade personal information. We do not provide personal information collected through this Website to third parties for their own purposes, except where required by Korean law, court order, or a competent authority in accordance with PIPA Article 18.

5.2 Entrustment of Processing (PIPA Article 26)

We entrust certain processing operations to the vendors listed in Section 5.3. These parties process personal information only on our instruction and under contractual confidentiality and security obligations. All processing agents for this Website are located outside the Republic of Korea, and are therefore also disclosed as overseas transfers below.

5.3 Overseas Transfer of Personal Information (PIPA Article 28-8)

Application execution and storage for the Website take place in the United States. Vercel Inc. operates the servers that execute Website functions in Washington, D.C., United States, and Supabase, Inc. operates the database and storage in North Virginia, United States. Separately, static files (images, stylesheets, scripts) are cached and delivered from Vercel's global edge network; where you access the Website, the edge node nearest to you may process your IP address for the sole purpose of delivering those files.

Method of transfer. Personal information is transmitted electronically over encrypted network connections (TLS) through these providers' service integrations and APIs.

Basis for transfer.

• Transfers to Vercel Inc., Supabase, Inc., and Usercentrics A/S are made under PIPA Article 28-8(1)(iii), as entrusted processing and storage necessary for the performance of the service, disclosed in this Notice in lieu of separate consent. Consent management necessarily operates before consent is given, as it is the mechanism by which consent is obtained and recorded.
• Transfers to Google LLC, Microsoft Corporation, and Meta Platforms, Inc. are made on the basis of your consent, obtained through the cookie consent banner.

Your right to refuse overseas transfer. You may refuse the overseas transfer of your personal information.

• Transfers to Google LLC, Microsoft Corporation, and Meta Platforms, Inc. can be declined at any time through our cookie settings (Section 6). Declining does not affect your ability to browse the Website or submit an inquiry.
• Transfers to Vercel Inc., Supabase, Inc., and Usercentrics A/S are essential to operating the Website and managing consent. If you refuse these transfers, we cannot provide the Website or process your inquiry. You may avoid these transfers by not using the Website and contacting us instead by telephone at +82-31-8039-7331.

Contact details for the recipients above are available on request at support@rnptinc.com.

5.4 Business Transfer

In the event of a merger, acquisition, or transfer of business, personal information may be transferred to a successor entity. We will give advance notice and obtain any consents required by applicable law.

---

6. Cookies and Tracking

When you first visit the Website, a consent banner is presented. Analytics and advertising cookies are activated only after you give explicit consent, and are managed under Google Consent Mode v2. You may change your preferences at any time through the cookie settings link on the Website or through your browser settings. Declining non-essential cookies does not affect your ability to browse the Website or submit an inquiry.

Consent management. We collect and record consent through Cookiebot, provided by Usercentrics A/S. The cookies used for consent management are essential, as they record whether and to what extent you have consented, and therefore cannot be declined.

Usage behavior analysis. Microsoft Clarity records in-page interactions such as clicks and scrolling to help us improve usability. We operate it with input field content masked so that text you type is not recorded, and it runs only where you have consented to analytics cookies.

You may also opt out of interest-based advertising and analytics directly:

• Google: https://adssettings.google.com
• Meta: https://www.facebook.com/adpreferences
• Microsoft: https://choice.microsoft.com/opt-out

---

7. Retention and Destruction

Personal information is retained only for as long as necessary to fulfill the purpose of collection and is destroyed without delay upon expiration of the applicable period, in accordance with PIPA Article 21.

Method of destruction. Electronic files are deleted using methods that render recovery impossible. Where immediate destruction is not technically feasible (for example, in backup systems), the data is isolated from active processing and securely purged within 30 days.

---

8. Your Rights

Under PIPA, you have the right to:

• Access personal information we hold about you (Article 35)
• Correct inaccurate or incomplete information (Article 36)
• Delete your information, subject to legal retention requirements (Article 36)
• Suspend processing in certain circumstances (Article 37)
• Withdraw consent for optional processing at any time

To exercise these rights, contact support@rnptinc.com. We will respond within 10 days as required under PIPA Article 38. Identity verification may be required. Rights may be exercised through a legal representative or authorized agent.

If you believe your rights have been infringed, you may contact:

• Personal Information Protection Commission — www.pipc.go.kr / 182 (Korea, toll-free)
• Personal Information Infringement Report Center — privacy.kisa.or.kr / 118
• Personal Information Dispute Mediation Committee — www.kopico.go.kr / 1833-6972
• Cyber Investigation Bureau, Korean National Police Agency — ecrm.police.go.kr / 182

8.1 Visitors in the European Economic Area and the United Kingdom

Where the EU or UK General Data Protection Regulation applies to our processing, you additionally have the right to data portability, the right to object to processing based on legitimate interests, and the right to lodge a complaint with your local supervisory authority. Our legal bases correspond to those set out in Section 4. Requests may be sent to support@rnptinc.com.

8.2 Residents of the United States

RnPT does not sell personal information for monetary consideration.

Where you consent to advertising cookies, personal information may be shared with advertising partners for cross-context behavioral advertising, which may constitute "sharing" (and in some states "selling") under applicable US state privacy law, including the California Consumer Privacy Act as amended and the Texas Data Privacy and Security Act.

You may opt out at any time through the cookie settings on this Website, which we treat as a valid opt-out of sale and sharing. We honor opt-out preference signals, including Global Privacy Control (GPC), where technically supported by our consent management platform.

Where applicable state law grants you rights of access, correction, deletion, portability, or opt-out of targeted advertising, you may exercise them by contacting support@rnptinc.com. We do not discriminate against you for exercising these rights.

---

9. Security

We implement technical and organizational safeguards in accordance with PIPA Article 29, including:

• Encryption of personal information in transit (TLS)
• Access controls and authentication management for administrative systems
• Restriction of access to personal information to personnel who require it for their duties, subject to confidentiality obligations
• Regular review of vendor security posture

RnPT maintains ISO/IEC 27001 certification for information security management and ISO 37301 certification for compliance management.

In the event of a personal data breach, RnPT will notify the Personal Information Protection Commission and affected individuals without undue delay in accordance with PIPA Article 34.

---

10. Children

The Website is not directed at children under 14. In accordance with PIPA Article 22, we do not knowingly collect personal information from children under 14 without verifiable consent from a legal guardian. If you believe we have inadvertently collected such information, contact support@rnptinc.com and we will delete it promptly.

---

11. Changes to This Notice

We may update this Notice to reflect changes in our operations or legal requirements. Where changes materially affect your rights, we will post notice on the Website at least 7 days before the change takes effect. Non-material changes will be posted on this page with an updated "Last Updated" date.

---

12. Language and Governing Law

This Notice has been drafted, and shall be construed, in the English language. The Korean version is provided for reference and convenience. In the event of any inconsistency, the English version prevails.

This Notice is governed by the laws of the Republic of Korea.

---

13. Contact and Business Information

Personal Information Protection Officer (PIPA Art. 31)