개인정보 처리방침 · Privacy Policy개인정보 처리방침 Privacy Policy

1. Controller and operator

The controller of the personal information processed on this website is the Samsung Advanced Institute for Health Sciences & Technology (SAIHST), Sungkyunkwan University, which organises the 2nd International Symposium of SAIHST, Sungkyunkwan University.

Studio Nabi operates this website and the congress secretariat on behalf of SAIHST (processing entrusted by SAIHST).

2. Personal information we process

• Registration: category (Professor, Researcher, Student or Others, with your description for Others), first and last name, affiliation type and name, country (with your description for Others, and whether it is Korea or abroad, derived from the country), e-mail address, and mobile phone number with country calling code. We also record your consent (its version, a fingerprint of the consent text you agreed to, and the time) and when you registered.
• Sign-in: you sign in with your registration e-mail address and the last 4 digits of the mobile number you registered; the 4 digits you type are only compared with that number, never stored or logged. The registration e-mail also carries a one-time sign-in link (valid for 1 hour). Signing in starts a session (7 days, or until you log out). We store only fingerprints (SHA-256 hashes) of the links and sessions, never the links themselves, and the time of your last sign-in.
• Attendance: when you enter an attendance code, the time slot and the time. If the secretariat records your attendance manually, also the reason and the staff member who recorded it.
• Q&A: the questions you submit during the live stream, the session you choose, and whether your initials are shown or you ask anonymously.
• Certificate of attendance: its number, the name and affiliation printed on it, when it was issued and last downloaded, and its verification code (stored only as a fingerprint and an encrypted copy).
• Technical data: to limit abuse (for example too many sign-in requests), we count requests per e-mail address and per IP address. The counters hold only keyed fingerprints (HMAC) of the address, never the address itself; each counts for one window (at most 24 hours: the sign-in with the last 4 digits of the mobile number has a daily limit) and is deleted after it, at the latest by the next daily clean-up. For staff accounts only (not attendees), the networks a staff member has signed in from successfully are kept as keyed fingerprints (HMAC, pseudonymous) for up to 60 days, only to exempt them from the account lock (see also the staff cookie in section 9). Our own server logs record no e-mail addresses, IP addresses or sign-in links. Our hosting provider processes IP addresses and request data to deliver the website (section 5).

3. Why we process it

• Registering you for the symposium and confirming your registration.
• Signing you in to My page, the live stream and the replays (your registration e-mail address and the last 4 digits of your mobile number, or the one-time link in the registration e-mail).
• Your mobile number: checking its last 4 digits when you sign in, and contacting you about your registration if needed.
• Service e-mails (registration confirmation, sign-in links) and notices about the symposium.
• Recording attendance, issuing the certificate of attendance, and letting the holder of a certificate have it checked (the verification page shows only a masked name).
• Running the live Q&A (approved questions are shown publicly with initials or as anonymous).
• Statistics only as aggregated counts (for example the number of registrants by category or country); no individual profiling.

We do not use your information for advertising, and this website runs no analytics or tracking.

4. How long we keep it, and how it is deleted

We keep the personal information of this edition's attendees until 2027-06-03 (the end of the symposium plus 6 months).

After the end of that day (Korea Standard Time), an automatic job that runs every day at about 03:00 KST permanently deletes from our database the registrations, sign-in links and sessions, attendance records, certificates of attendance and Q&A questions of this edition. A deleted certificate's verification page then says that the certificate cannot be found. Records of administrative actions (the audit log) are kept for accountability without personal information: the link to the attendee is removed and free-text notes are cleared.

Backups: our database provider (Supabase) keeps backups for its backup retention period (7 days on the Pro plan), so deleted information can remain in a backup for up to that period until it is overwritten.

E-mail delivery logs: Resend, which delivers our e-mails, keeps its own delivery logs (for example the recipient address and the subject) under its own retention policy.

You can ask us to delete your information earlier (section 7).

5. Processors and transfer abroad

We entrust the following service providers with processing on our behalf. Some are located or based outside Korea; your information reaches them over the network while you use the website.

Supabase — database and file storage

• Items: all personal information in section 2.
• Location: stored in the Seoul region (ap-northeast-2), Republic of Korea; the provider is a company in the USA.
• Period: until the retention date above, plus the backup retention period.

Netlify — website hosting, content delivery network and server functions

• Items: what your browser sends to and receives from the website while you use it (including your IP address). Netlify's network briefly keeps copies of public pages, such as a certificate's verification page with the masked name (up to 5 minutes) and the live page's approved questions with initials (about a minute); the database itself is not at Netlify.
• Location: USA (worldwide delivery network).
• Period: while you use the website; Netlify's own logs are kept under its policy.

Resend — e-mail delivery

• Items: your e-mail address and the content of our service e-mails (registration confirmation, sign-in links).
• Location: a company in the USA; our e-mails are sent from its Tokyo region (ap-northeast-1), Japan.
• Period: delivery logs under Resend's retention policy.

Vimeo — video player for the live stream and replays

• Items: the website passes no personal information to Vimeo. When the player loads in your browser, Vimeo receives your IP address and browser information.
• The player is embedded with "do not track" (dnt=1): Vimeo sets no tracking cookies.
• Location: USA. Period: under Vimeo's policy.

Channel Talk — 1:1 chat

• An external link only: the website passes no personal information. If you use the chat, Channel Talk's own privacy policy applies.

6. Provision to third parties

As stated in the registration consent, registration information may be provided to the co-organisers of the symposium and to the system operators. We provide it to no one else unless the law requires it.

7. Your rights and how to exercise them

• You may ask to see, correct or delete your personal information, ask us to stop processing it, or withdraw your consent.
• You can correct the spelling of your name, your affiliation and your phone number yourself on My page. To change your e-mail address, contact the secretariat.
• Contact the privacy officer (section 8) by e-mail or phone. We may ask you to confirm that the request is yours (for example by replying from your registered e-mail address). You may also act through a representative.
• If your registration is deleted before the symposium ends, you can no longer sign in, watch online or receive a certificate.

8. Privacy officer

• Privacy officer: Congress Secretariat (Studio Nabi)
• E-mail: saihst.nabi@gmail.com
• Phone: +82-31-284-0835

9. Cookies

This website uses only cookies that are essential for signing in. There are no analytics, advertising or tracking cookies.

• __Host-saihst_attendee: keeps you signed in after a successful sign-in (HttpOnly, Secure, SameSite=Lax). It ends when you log out, or after 7 days.
• Staff only (the administration pages at /admin): payload-token keeps a staff member signed in (2 hours); payload-lng and payload-theme remember the language and colour theme chosen there; saihst-staff-device (signed, HttpOnly, SameSite=Strict, Path=/api/users, 30 days) remembers up to 5 staff accounts that signed in successfully on this browser, only to exempt them from the account lock. Attendees never receive these cookies.
• When you close the cookie notice, your browser remembers that in its local storage (not a cookie; it is never sent to us).
• The Vimeo player is embedded with "do not track" (dnt=1).

10. How we protect your information

• All connections use HTTPS (TLS), and browsers are told to use HTTPS only (HSTS).
• Sign-in links and sessions are stored only as SHA-256 fingerprints; certificate verification codes as a fingerprint and an encrypted copy; e-mail and IP addresses used for rate limiting only as keyed fingerprints (HMAC).
• Row-level security is enabled on every database table, so the database provider's public data interface cannot read them; the website reads the database only from its server.
• Access control: only authorised staff can sign in to the administration. Phone numbers, exports, attendance records and certificates are limited to administrators, and exports and other sensitive actions are recorded in an audit log. Staff passwords are stored hashed, and accounts are locked after repeated failed sign-ins.
• The website does not send its source code to browsers (no source maps). Private files are handed out only through short-lived signed links.

11. Help with complaints

For help with a privacy complaint you can also contact:

• Personal Information Infringement Report Center (개인정보침해신고센터, KISA): 118, privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972, www.kopico.go.kr
• Supreme Prosecutors' Office (대검찰청): 1301, www.spo.go.kr
• Korean National Police Agency (경찰청): 182, ecrm.police.go.kr

12. Changes to this policy

This policy carries a version and an effective date (shown at the top of this page). Changes are published on this page before they take effect.