Privacy Policy

APIS Co., Ltd. · Effective 9 November 2026

APIS Co., Ltd. ("APIS", "we") helps patients prepare their cancer records and explore treatment in Korea, including proton and carbon-ion therapy. This policy explains how we handle personal information on apiskorea.com and in APIS Gateway (apiskoreaonco.com). We follow the Personal Information Protection Act of the Republic of Korea.

1. What we collect

• Account: your name, email address and password (stored only in a protected, hashed form).
• Case information you give us: diagnosis and details about your situation, medical records, scans, photos of records, imaging files (DICOM) and messages.
• Health information: your records contain sensitive health information. We collect it only with your consent.
• Records of your consent and of actions on your case (for security and accountability).
• Technical data: IP address, browser type and access times, kept in security logs. We use only the cookies needed to keep you signed in. We do not use advertising cookies.

2. Why we use it

• To organize your records and prepare a summary and a plain-language explanation.
• To show you treatment options and, if you ask, to prepare your case for review by a Korean hospital.
• To contact you about your case.
• To keep the service secure and to meet legal obligations.

We do not sell your information and do not use it for advertising.

3. AI processing

If you agree (consent item (c), optional), APIS sends your records to an AI service, Anthropic (United States), to prepare a summary and an explanation. Names and identification numbers are removed first; scanned pages and photos are sent as images with those details blacked out. The AI provider does not use this data to train its models and deletes it within 30 days, except where the law requires otherwise. For now, the APIS team reviews each result before it is shown to you, and we will reply within 1 business day.

AI results are not a diagnosis or a treatment recommendation. Treatment decisions are made by hospitals and your doctors.

4. Sharing with hospitals

We send your records to a hospital only when you ask us to and you have given consent for it. We send them to the hospital you choose, for its review of your case. Some hospitals ask us to deliver records through a secure file-sharing service such as Dropbox.

5. Service providers and transfers outside Korea

Your records are stored on APIS systems in Korea. We use these providers:

Provider	What they do	Location	What they receive
Anthropic, PBC	AI processing (only with consent item (c))	United States	Records with names and ID numbers removed; deleted within 30 days
Cloudflare, Inc.	Secure connection to APIS Gateway	Global network	Encrypted traffic passing to our systems; not stored as records
Gabia Inc. (Hiworks)	Email from APIS	Korea	Your name and email address, email content
Dropbox, Inc.	Delivery of records to a hospital that requests it	United States	The records sent to that hospital, only when you ask us to send them

Information is transferred over encrypted connections when it is used for the purposes above.

6. How long we keep it

We keep your information while your case is active and as long as needed for the purposes above. You can ask us to delete your case at any time, and we will delete it unless the law requires us to keep it. Security logs are kept for a limited period and then deleted.

7. Your rights

You can ask to see, correct or delete your information, and you can withdraw your consent at any time. Withdrawing consent stops future processing; it does not affect processing done before. You can request deletion in APIS Gateway or by email. We will respond without undue delay.

8. Security

Stored files are encrypted. Access is limited to APIS staff who need it for your case and is recorded. Connections are encrypted.

9. Contact and privacy officer

Privacy officer: HongRok Moon, CEO, APIS Co., Ltd.
Email: info@apiskorea.com

If you are not satisfied with our response, you may contact the Personal Information Protection Commission of Korea (privacy.go.kr) or the privacy authority in your country.

10. Changes

We will post any changes on this page with a new effective date. If a change affects how we use your health information, we will ask for your consent again.