Privacy Policy

Last updated: November 3, 2026

MediPrep AI (the "Company") values the personal information of its users and complies with all relevant laws, including the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection. This Privacy Policy explains how the Company collects, uses and protects users' personal information.

1. Personal Information We Collect

The Company collects the following personal information for member registration, service provision and similar purposes.

• Required items: Email address, login ID (social login identifier), name, profile photo
• Information collected while the service is used:
  • Lecture recording files (audio data that the user uploads or records in the app)
  • Exam question images (photos that the user takes or uploads)
  • Study materials generated by AI (lecture transcripts, summaries, key terms, exam hints and similar)
  • In-app purchase history (token top-up records)
  • Group activity information (group membership, shared study materials)
  • Chat history (conversations with the AI chatbot)

2. Purposes of Collection and Use

The Company uses the personal information it collects for the following purposes.

• Member management: Member registration, identity verification, member identification, account management
• Service provision: Lecture recording and speech-to-text conversion, AI-based study material generation, group collaboration features
• Payment management: Managing token purchases and usage history
• Service improvement: Improving service quality and developing new features

3. Provision to Third Parties and Outsourcing

The Company uses the following third-party services to provide the service, and personal information may be processed through them.

The Company does not provide personal information to third parties for purposes other than the above without the user's consent.

4. Retention and Use Period

As a rule, personal information is destroyed without delay once the purpose of its collection and use has been achieved. However, where retention is required by law, the Company keeps member information for the period set by the relevant law, as follows.

• Login records: 3 months (Protection of Communications Secrets Act)
• Records of consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Records of payment and of the supply of goods and the like: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)

5. Destruction Procedure and Method

As a rule, the Company destroys personal information without delay once the purpose of its collection and use has been achieved.

• Destruction procedure: Personal information whose purpose of use has been achieved is moved to a separate database, kept for a certain period in accordance with internal policy and relevant laws, and then destroyed.
• Destruction method: Personal information stored as electronic files is deleted by technical means that make the records impossible to reproduce.

6. User Rights and How to Exercise Them

Users may exercise the following rights.

• Request to access personal information: You may request access to the personal information collected.
• Request to correct personal information: You may request correction of inaccurate personal information.
• Account deletion (withdrawal): You can delete your account yourself through the 'Delete account' function on the profile screen in the app, in which case all personal information and service usage records are deleted immediately.
• Request to suspend processing of personal information: You may request that the processing of your personal information be suspended.

You may exercise these rights through the in-app functions or by emailing the Privacy Officer.

7. Safety Measures for Personal Information

The Company takes the following measures to keep personal information safe.

• SSL/TLS encrypted communication when data is transmitted
• Control of data access through Firebase security rules
• Encrypted storage of passwords (Firebase Authentication)
• Minimizing access rights to personal information

8. Installation, Operation and Refusal of Automatic Personal Information Collection Devices

The Company does not currently operate automatic personal information collection devices such as cookies. However, third-party SDKs used to provide the service (Firebase, RevenueCat and others) may collect the minimum device information that is technically necessary.

9. Privacy Officer

The Company has designated a Privacy Officer, as below, to protect users' personal information and handle complaints related to personal information.

10. Changes to This Privacy Policy

This Privacy Policy may be added to, deleted from or amended following changes in laws, policies or security technology, and any change will be announced in the app or on this page.