Privacy notice
How XeroCare, operated by XerostAI Co.,Ltd. ((주)제로스트에이아이), handles personal information.
What we collect and why
When you send a consultation & quote request: your name, how to reach you and your ID there (email address or messenger ID), your preferred dates, the clinic, treatment and price comparison you chose, your note (if you write one), the screen language and the time you agreed. We use these to check with the clinic, get you its consultation answer and quote, and reply to you with the result and booking details.
When you use the AI consultation (chat): what you write in the chat, the AI’s replies, the time and the screen language. We use these to answer your questions about prices, clinics, treatments and travel, and to turn the chat into a consultation & quote request if you want.
When anyone visits the site: access logs (see “What our servers record” below), to run the service, keep it secure and find faults.
Browsing prices needs no account. We do not collect national ID numbers, passport numbers, payment details or health conditions. Please do not write them in a note or in the chat.
We do not accept consultation & quote requests or AI consultations from children under 14.
How long we keep it
Consultation & quote requests are kept for 1 year after the consultation ends (when we confirm the booking or close it as cancelled), then deleted.
AI consultation chats are kept for 1 year after the last message, then deleted.
If a request is still open, we delete it as soon as you ask.
Deleted data stays in our daily server backups (7 are kept) and disappears from them within about 8 days.
To ask for deletion, email xerocare@xerost.ai with your request number (for example XC-261015-ABC123) or your contact details.
What we give to clinics (third-party provision)
Only the clinic you chose for that request, or, if you did not choose one, the clinics we contact for that request, receive your name, your preferred dates (if you gave them), the treatment and your question (for example the area to treat and what you want), so that they can check availability and answer with a consultation and quote. We do not give your contact details to clinics: we keep them and reply to you ourselves. You may refuse this. If you do, we cannot check with a clinic for you. How long a clinic keeps this information follows that clinic’s own privacy policy.
We record in our inquiry inbox which clinic we passed your details to and when (record of third-party provision, kept and deleted together with the request).
Service providers and transfer abroad
Amazon Web Services (Republic of Korea, Seoul region) runs our servers, stores requests and sends our staff a notice email about each new request. The notice email contains only the request number, the clinic and the treatment — not your personal details. Retention is the same as above.
Anthropic, PBC (United States) generates the AI consultation replies. What you write in the chat, and the price and clinic data needed for the answer, are sent to Anthropic over an encrypted connection (HTTPS) each time you send a message.
Anthropic deletes inputs and replies from its servers within 30 days of receiving or generating them. If they are automatically flagged for a usage policy violation, it may keep them for up to 2 years, and longer where the law requires.
Under its commercial terms, Anthropic does not train models on the content we send.
Contact: Anthropic, PBC · privacy@anthropic.com · 548 Market St, PMB 90375, San Francisco, CA 94104, USA
If you do not use the AI consultation, nothing is sent to the United States. If you do not want your information transferred abroad, please use the consultation & quote request form instead of the chat.
What our servers record
Our load balancer keeps an access log for each request: your IP address and port, the full address you asked for (including the query text — so search words you type, for example in /search?q=, are recorded), the time, the response status, the size and processing time, and your browser’s User-Agent. It does not contain request bodies, form contents or cookies. These logs are deleted automatically after 90 days.
Our application separately records the request method, the page path without query text, the response status and how long it took. When a consultation & quote request arrives we record that it arrived and its number, but not names or contact details. Requests for images (img.xerocare.xerostai.com) are not logged. The site does not set cookies for visitors and does not use outside analytics tools (only our staff’s inbox login uses a cookie). We count visits ourselves, only as daily totals: page views, chats started, and request forms opened and sent, split by language, page type, the name of the site that linked here and campaign tags (utm) in the address. These totals hold no cookies, IP addresses, browser details or any other identifier, so they cannot be linked to you. Known automated visits (bots) are not counted.
Your rights
You can ask to see, correct or delete your information, or to stop processing it. Email xerocare@xerost.ai. To confirm it is you, we reply to the contact you used for the request.
How we protect it
Requests are stored encrypted on our server (AES-256-GCM). The encryption key is kept separately in our server settings store. Only our staff can open the request inbox, with a password.
Privacy officer
Department: XeroCare Customer Support · Contact: xerocare@xerost.ai
Changes to this notice
If this notice changes, we will post the new version here with its effective date. Effective date: Oct 17, 2026
Change history: Oct 17, 2026 — the clinic you choose (or, if you choose none, the clinics we contact for your request) now also receives your question, and we ask for this as a separate consent. Questions in requests received before this date, or without that consent, are not passed to clinics. First version effective Oct 15, 2026.