> For the complete documentation index, see [llms.txt](https://docs.hits.ai/terms-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hits.ai/terms-en/privacy-policy/2026.11.04.md). # HyperLab Privacy Policy (Effective November 4, 2026) Effective Date: November 4, 2026 \ (hereinafter referred to as 'the Company') establishes and discloses the following privacy policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of the information subject and to handle related grievances promptly and smoothly. ○ This privacy policy applies to all mobile and desktop applications, online websites (including the Small Molecule Discovery Lab space and the Bio Co-Scientist Lab space of HyperLab), and all interactions between you and the Company (e.g., customer service inquiries) provided by the Company. ○ This privacy policy will be applied from November 4, 2026. ### 1. Purpose of Collection and Use of Personal Information The Company processes personal information for the following purposes. The personal information being processed will not be used for any purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act will be implemented. 1. Membership Registration and Management\ Personal information is processed for the purpose of confirming the intention of membership registration, identification for the provision of membership services, maintenance and management of membership qualifications, prevention of unauthorized use of services, and various notifications and communications. The specific purposes of collecting and using personal information follow Article 3, Paragraph 1. 2. Service Provision\ Personal information is processed for the purpose of providing services, such as the use of Lab spaces (including the Small Molecule Discovery Lab space and the Bio Co-Scientist Lab space), creation of and participation in new projects, and the generation of artificial intelligence responses and performance of computations in the Bio Co-Scientist Lab space. The specific purposes of collecting and using personal information follow Article 3, Paragraph 1. 3. Payment and Refund of Paid Services\ Personal information is processed for the purposes of recurring payments for paid Plans, purchase of Credits, charging differences resulting from Plan changes, processing withdrawals of subscription and refunds, retrying failed payments, and notifications and communications related to Paid Services such as recurring payments and the expiration of Credits. The specific purposes of collecting and using personal information follow Article 3, Paragraph 1. 4. Product Improvement\ The Conversation Content of Free Users of the Bio Co-Scientist Lab space and Feedback submitted by users are processed for the purpose of improving the quality of the service and the performance of artificial intelligence models. Specific matters follow Article 13. 5. Response to Customer Inquiries and Securing Service Stability\ Personal information is processed for the purposes of handling customer service inquiries and reports, responding to service failures, detecting and responding to security threats, and verifying violations of the Terms of Service. 6. Statistics Compilation and Research\ Personal information is processed for the purposes of compiling and analyzing service usage statistics and scientific research, and, where necessary, is pseudonymized and used in accordance with Article 12. 7. Marketing and Advertising (Optional)\ Personal information is processed for the purposes of providing service promotion information, announcements of new services and events, newsletters, targeted advertisements, etc., only where the information subject has given separate consent. ### 2. Period of Processing and Retaining Personal Information ① The Company processes and retains personal information within the personal information retention and use period according to the laws or the period agreed upon by the information subject when collecting personal information. ② The period of processing and retaining personal information is as follows: * The Company deletes all personal information of the user two years from the last date of service use or when the preservation period according to the law has elapsed. In this case, any period during which a recurring payment for a paid Plan is maintained or the user holds Credits, tokens or Hyper Screening Points that remain valid is deemed a period of service use. This criterion also applies to accounts of members whose use of a Lab space has been deactivated due to a Plan change by the Administrator, etc. Upon withdrawal of membership, the Company deletes the user's personal information after a preservation period of 180 days from the date of withdrawal or the preservation period according to the law for the purpose of preventing misuse of services, etc. However, even after all preservation periods have elapsed, if any of the following reasons apply, personal information will be deleted when such reasons are resolved: * If an investigation or inquiry according to the violation of laws is in progress, at the end of the investigation or inquiry * If there remains any debt or credit relationship due to service use, at the end of such debt or credit relationship * If the provision of goods or services has not been completed, upon completion of the provision of goods or services and payment and settlement of the price ③ Personal information that must be retained for a certain period according to the law and the relevant laws are as follows: | Preservation Item | Basis for Legislation | Preservation Period | | ------------------------------------------------------------------- | ----------------------------------------------------------- | ------------------- | | Records of contracts or withdrawal of offers | Act on the Consumer Protection in Electronic Commerce, Etc. | 5 years | | Records of payment and supply of goods, etc. | Act on the Consumer Protection in Electronic Commerce, Etc. | 5 years | | Records on consumer complaints or dispute resolution | Act on the Consumer Protection in Electronic Commerce, Etc. | 3 years | | Records on display/advertisement | Act on the Consumer Protection in Electronic Commerce, Etc. | 6 months | | Account books and documents for all transactions defined by tax law | Framework Act on National Taxes | 5 years | | Service visit records | Protection of Communications Secrets Act | 3 months | ### 3. Categories of Personal Information Processed ① The Company collects and processes the following categories of personal information: | Purpose of Collection and Use | Collected Items | Retention Period | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Membership Registration and Management | Name, Date of Birth, Email, Password, Mobile Phone Number, Company Name (or Corporation Name) | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Identity Verification | Name, Date of Birth, Gender, Nationality (Domestic/Foreign), Mobile Carrier Information, Mobile Phone Number, Encrypted User Identification Value (CI), Duplicate Registration Information (DI) | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Service Purchase and Payment (including recurring payments for paid Plans and purchase of Credits) | Orderer's payment information (credit card information, card company name, etc.), payment authorization number, purchase and usage history of subscription Plans and Credits, bank of account, account number, account holder's name, mobile phone number | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Notifications and communications related to Paid Services (recurring payment notices, payment failure notices, advance notice of Credit expiration, etc.) | Email, mobile phone number, subscription Plan information, recurring payment date, Credit balance and validity period | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Issuance of Tax Invoice | Business Registration Number | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Issuance of Cash Receipt | Cash receipt application information (telephone number or business registration number registered with the National Tax Service) | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Cancellation and Refund | Bank of account, account number, account holder's name, email, orderer's payment information (credit card information, card company name, etc.) | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Customer Service Use | Personal information included in inquiries and consultation content, caller number, consultation content, information for identity verification (mobile phone number, etc.) | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Statistics Compilation and Research | Name, Date of Birth, Gender, Nationality (Domestic/Foreign), Service Use and Payment Records, Pseudonymized Information | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Service and Personalized Service Provision | Email, shipping address, behavioral information (online user activity information that can analyze interests, preferences, and tendencies, such as service usage history, purchases/payments, and search history), website access time, access IP, cookies, device type, OS type and version, etc. | Until 2 years from the last date of service use or as prescribed by relevant laws. | | Provision of the Bio Co-Scientist Lab space service (generation of artificial intelligence responses and performance of computations) | Personal information included in queries, instructions and uploaded files entered by users and the responses and computation results generated in response (hereinafter 'Conversation Content') | Until the user deletes the relevant Conversation Content or withdraws membership, or 2 years from the last date of service use, whichever comes first (or, if there is a preservation period under relevant laws, that period) | | Product improvement (improving service quality and the performance of artificial intelligence models) | Conversation Content of Free Users of the Bio Co-Scientist Lab space (excluding Conversation Content generated after opting out of use for product improvement), Feedback submitted by users and the Conversation Content that is the subject of the Feedback | 24 months from the date of collection after pseudonymization | | Provision of service promotion information, advertisements and targeted advertisements, announcements of new services and events, newsletters, etc. (with optional consent) | Name, date of birth, gender, frequency of access, service usage and payment history, website access time | Until 2 years from the last date of service use or as prescribed by relevant laws. | ② In the process of using the service or processing the service provision work, the following information may be automatically generated or additionally collected: * IP Address, cookies, access log, visit date, service usage record, bad usage record, usage and Credit deduction records of the Bio Co-Scientist Lab space, Feedback submission records, settings information such as whether the user has opted out of the use of Conversation Content for product improvement, and IP-based access country information ③ The Company does not allow children under the age of 14 to register as members and does not collect personal information of children under the age of 14. ④ Among the personal information under paragraph 1, the Company processes personal information necessary for membership registration and management, service provision, payment and refund of Paid Services, etc. without the consent of the information subject to the extent necessary for the conclusion and performance of a contract with the information subject pursuant to Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act, and personal information that must be preserved under relevant laws pursuant to Item 2 of the same paragraph. Personal information for the provision of service promotion information, advertisements, targeted advertisements, etc. is processed with the separate consent of the information subject; the information subject may refuse such consent, and refusal does not restrict the use of the service. ### 4. Matters Concerning the Provision of Personal Information to Third Parties ① The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and Article 3 (Items of Personal Information Processed) Paragraph 1, and does not use or disclose the personal information of customers beyond this scope without prior consent. However, exceptions are made in accordance with Articles 17 and 18 of the Personal Information Protection Act in the following cases: 1. When the customer has given prior consent 2. When there are special provisions in the law or it is inevitable to comply with legal obligations 3. When it is inevitable for public institutions to perform their duties as specified in the law, etc. 4. When necessary for the investigation of crimes, prosecution and maintenance of prosecutions, and performance of court duties 5. When the customer or their legal representative is unable to express their intentions or it is impossible to obtain prior consent due to an unknown address, etc., and it is clearly necessary for the urgent interest of the customer or third party's life, body, and property ② The Company is currently not providing personal information to third parties. ### 5. Matters Concerning the Consignment of Personal Information Processing ① The Company consigns personal information processing tasks for smooth personal information task processing as follows: * Entrusted Party: Amazon Web Services Inc. * Scope of Work: Operation and management of cloud servers * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Google LLC * Scope of Work: Google Analytics, Gmail, Firebase, Google Tag Manager, Gemini API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Microsoft Corporation * Scope of Work: Clarity * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Channel Corp. * Scope of Work: Management and operation of consultation channels and receipt of customer inquiries and reports * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Sentry * Scope of Work: Error information collection * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Stibee Inc. * Scope of Work: Newsletter distribution * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Feat Corp. * Scope of Work: FeatPaper * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: PayPal Pte. Ltd. * Scope of Work: Online product payment * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: eMolecules, Inc. * Scope of Work: Partial execution of the Company's HS-X service (a series of services that includes discovering active substances (Hit Compounds) according to user orders, generating and synthesizing molecules, and delivering the results) * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Hecto Financial Co., Ltd. * Scope of Work: Processing of recurring payments for paid Plans and Credit payments of the Bio Co-Scientist Lab space (domestic and international credit card payments) * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Modal Labs, Inc. * Scope of Work: Provision of computing resources (GPUs, etc.) for performing computational functions of the Bio Co-Scientist Lab space * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: FoundryLabs, Inc. (E2B) * Scope of Work: Provision of computing environments for code execution and data analysis in the Bio Co-Scientist Lab space * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: OpenAI OpCo, LLC * Scope of Work: OpenAI API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract * Entrusted Party: Anthropic PBC * Scope of Work: Anthropic API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Period of Entrustment: Until membership withdrawal or termination of the entrustment contract ② When entering into a consignment contract, the Company specifies in the contract documents, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing personal information other than for the purpose of performing the consigned work, technical and administrative protection measures, restrictions on re-consignment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information safely. ③ If the content of the consigned work or the trustee changes, we will disclose it without delay through this privacy policy. ### 6. Transfer of Personal Information Overseas ① Where the consignment of processing or storage of personal information is necessary for the conclusion and performance of a contract with the information subject, such as the provision of services, the Company transfers personal information overseas as follows pursuant to Article 28-8, Paragraph 1, Item 3 of the Personal Information Protection Act: * Recipient Name and Contact: Amazon Web Services, Inc., * Transfer Country: Japan, United States * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy * Purpose of Use by Recipient: Operation and management of cloud servers * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract * Recipient Name and Contact: Google LLC, * Transfer Country: United States and other countries where Google operates facilities * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy (including Conversation Content of the Bio Co-Scientist Lab space transmitted through the Gemini API) * Purpose of Use by Recipient: Google Analytics, Gmail, Firebase, Google Tag Manager, Gemini API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract (however, Conversation Content transmitted through the Gemini API is retained for a limited period for abuse monitoring and then deleted) * Recipient Name and Contact: Microsoft Corporation, * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy * Purpose of Use by Recipient: Clarity * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract * Recipient Name and Contact: Sentry, * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy * Purpose of Use by Recipient: Error information collection * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract * Recipient Name and Contact: PayPal Pte. Ltd., * Transfer Country: Singapore * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy * Purpose of Use by Recipient: Payment processing and information management * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract * Recipient Name and Contact: eMolecules, Inc., * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time of service use * Personal Information Items Transferred: Collection items as stated in the privacy policy * Purpose of Use by Recipient: To partially perform the Company's HS-X service (a series of services including the discovery of active substances (Hit Compounds) based on user orders, generation and synthesis of molecules, and delivery of results) * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract * Recipient Name and Contact: Modal Labs, Inc., * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time computations are run in the Bio Co-Scientist Lab space * Personal Information Items Transferred: Personal information contained in data transmitted for computation (such as files uploaded by users) (account information and user identification information are not transmitted) * Purpose of Use by Recipient: Provision of computing resources (GPUs, etc.) for performing computational functions of the Bio Co-Scientist Lab space * Retention and Use Period by Recipient: Deleted immediately upon completion of the computation (not stored separately) * Recipient Name and Contact: FoundryLabs, Inc. (E2B), * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time computations are run in the Bio Co-Scientist Lab space * Personal Information Items Transferred: Personal information contained in data transmitted for computation (such as files uploaded by users) (account information and user identification information are not transmitted) * Purpose of Use by Recipient: Provision of computing environments for code execution and data analysis in the Bio Co-Scientist Lab space * Retention and Use Period by Recipient: Deleted immediately upon completion of the computation (not stored separately) * Recipient Name and Contact: OpenAI OpCo, LLC, * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time of using the Bio Co-Scientist Lab space * Personal Information Items Transferred: Personal information contained in the Conversation Content (Input and Output) of the Bio Co-Scientist Lab space * Purpose of Use by Recipient: OpenAI API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract (however, transmitted Conversation Content is retained for up to 30 days for abuse monitoring and then deleted) * Recipient Name and Contact: Anthropic PBC, * Transfer Country: United States * Time and Method of Transfer: Transmission through the network at the time of using the Bio Co-Scientist Lab space * Personal Information Items Transferred: Personal information contained in the Conversation Content (Input and Output) of the Bio Co-Scientist Lab space * Purpose of Use by Recipient: Anthropic API (operation of artificial intelligence models for generating responses in the Bio Co-Scientist Lab space) * Retention and Use Period by Recipient: Until membership withdrawal or termination of the entrustment contract (however, transmitted Conversation Content is in principle deleted within 30 days, and if a usage policy violation is detected, it is retained for up to 2 years and then deleted) ② Information subjects may refuse the overseas transfer of personal information, and if you wish to refuse, you may request it by email, etc. to the personal information protection officer under Article 14. However, as the overseas transfer under paragraph 1 is necessary for the provision of the service, refusing it may restrict the use of all or part of the service. ③ When transferring personal information overseas, the Company takes measures necessary for the protection of personal information, such as safety measures, grievance handling and dispute resolution, in accordance with Article 28-8, Paragraph 4 of the Personal Information Protection Act. ### 7. Destruction Procedure and Method of Personal Information ① When personal information becomes unnecessary, such as when the personal information retention period has expired or the processing purpose has been achieved, the Company will destroy the personal information without delay. ② If personal information needs to be retained continuously despite the expiration of the personal information retention period agreed by the information subject or the achievement of the processing purpose, due to other laws, such personal information will be moved to a separate database (DB) or stored in a different place. ③ The procedure and method of personal information destruction are as follows: 1. Destruction procedure The Company selects personal information that has a reason for destruction, and after obtaining approval from the Company's personal information protection officer, destroys the personal information. 2. Destruction method Information in electronic file format is destroyed using a technical method that cannot reproduce the record. Printed personal information is shredded with a shredder or destroyed by incineration. ### 8. Destruction of Personal Information of Inactive Users ① If a user has not used the service for 2 years from the last date on which the user used the service, the Company destroys the user's personal information without delay. However, if there is a reason set forth in Article 2, Paragraph 2 or the information must be preserved under relevant laws, it is destroyed when such reason ends or the preservation period expires. ② Whether the service has been used under paragraph 1 is determined based on service access records such as logins, provided that any period during which a recurring payment for a paid Plan is maintained or the user holds Credits, tokens or Hyper Screening Points that remain valid is deemed a period of service use. ③ The Company notifies the user of the scheduled destruction date and the items of personal information to be destroyed by email, etc. at least 30 days before destruction under paragraph 1, and does not destroy the information if the user logs in to the service before the scheduled destruction date. ### 9. Rights and Obligations of the Information Subject and Legal Representative and Method of Exercising Them ① Customers can exercise their rights to request access, correction, deletion, and suspension of processing of personal information to the Company at any time. ② The exercise of rights according to Paragraph 1 can be done through a written document, electronic mail, or facsimile (FAX) to the Company according to Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay. Customers can also directly view, correct, or withdraw through the "Member Information Change" page after undergoing the identity verification process. ③ The exercise of rights according to Paragraph 1 can be done through a legal representative of the information subject or an agent such as a person who has been delegated. In this case, you must submit a power of attorney according to Form No. 11 of the Notice on Personal Information Processing Methods (No. 2026-10). ④ The right to request access and suspension of processing may be restricted according to Article 35, Paragraph 4, and Article 37, Paragraph 2 of the Personal Information Protection Act. ⑤ The correction or deletion of personal information cannot be requested if the personal information is specified as a collection target in other laws. ⑥ When a request for access, correction, deletion or suspension of processing is made under the rights of the information subject, the Company verifies whether the person making the request is the person concerned or a legitimate representative. ⑦ Free Users of the Bio Co-Scientist Lab space may opt out of the use of Conversation Content for product improvement at any time on the service settings screen, and the specific method follows Article 13, Paragraph 4. ### 10. Measures for Securing the Safety of Personal Information The Company has implemented the following measures to ensure the security of personal information: 1. Regular Self-Audits The Company conducts regular (quarterly) self-audits to ensure the security of personal information handling. 2. Minimization and Training of Personal Information Handlers The Company designates and limits the number of employees handling personal information to minimize and manage personal information effectively. 3. Establishment and Implementation of Internal Management Plan The Company has established and implements an internal management plan for the safe processing of personal information. 4. Technical Measures Against Hacking The Company installs security programs and conducts regular updates and checks to prevent personal information leaks and damage due to hacking or computer viruses, installs systems in areas where access from outside is controlled, and monitors and blocks access technically and physically. 5. Encryption of Personal Information Users' passwords are encrypted, stored and managed so that only the user knows them, and important data is protected by separate security functions such as encrypting files and transmitted data or using file locking features. 6. Preservation and Anti-Tampering of Access Records Records of access to the personal information processing system are retained and managed for at least one year; however, where personal information of 50,000 or more information subjects is added, or unique identification information or sensitive information is processed, such records are retained and managed for at least two years. In addition, security functions are used to prevent access records from being forged, altered, stolen or lost. 7. Restriction of Access to Personal Information The Company takes necessary measures to control access to personal information by granting, changing and revoking access rights to the database system processing personal information, and controls unauthorized access from outside using an intrusion prevention system. 8. Use of Locking Devices for Document Security Documents and auxiliary storage media containing personal information are kept in a secure location with locking devices. 9. Control of Unauthorized Access Physical storage locations containing personal information are kept separately, and access control procedures for them are established and operated. 10. Access Control for Conversation Content When Conversation Content of the Bio Co-Scientist Lab space is reviewed for product improvement, etc., access rights are limited to the minimum number of persons designated by the Company, and access records are retained and inspected. ### 11. Installation, Operation, and Rejection of Devices for Automatic Personal Information Collection ① The Company uses 'cookies' to provide personalized and customized services by storing and retrieving customer information as needed. ② Cookies are very small text files sent by the server used to operate the website to the customer's browser and stored on the hard disk of the customer's computer. When the customer later visits the website, the website server reads the contents of the cookies stored on the customer's hard disk to maintain the customer's preferences and provide customized services. ③ Cookies do not automatically or actively collect personally identifiable information, and customers can refuse or delete cookies at any time. However, refusing cookies may result in difficulties in using some of the Company's services requiring login. ④ Customers can configure whether to allow cookies as follows (for Internet Explorer): 1. Select \[Internet Options] from the \[Tools] menu. 2. Click on the \[Privacy] tab. 3. Set the \[Privacy Handling Level] as desired. ### 12. Matters Concerning the Processing of Pseudonymized Information The Company may pseudonymize and use personal information collected for statistical compilation, scientific research, public interest record preservation, etc. by deleting part of the information or replacing it in whole or in part, so that specific individuals cannot be identified without additional information. In this case, the Company takes the technical, managerial and physical measures necessary to ensure safety so that such information is not lost, stolen, leaked, forged, altered or damaged, such as separately storing and managing the additional information required to restore the original state, and prepares and keeps related records to manage the details of processing pseudonymized information, such as the purposes of processing and the recipients when provided to third parties. ### 13. Matters Concerning the Processing of Personal Information When Using the Bio Co-Scientist Lab space ① The Company processes queries, instructions and uploaded files entered by users in the Bio Co-Scientist Lab space and the responses and computation results generated in response (hereinafter 'Conversation Content') to provide the service. Users are asked to take care not to enter personal information not necessary for using the service, in particular personal information of third parties or sensitive information such as health information, into the Conversation Content. ② The Company may use the Conversation Content of Free Users of the Bio Co-Scientist Lab space (meaning users of the Free-Trial Plan or the Free Plan) to improve the quality of the service and the performance of artificial intelligence models (hereinafter 'Product Improvement'). In this case, the Company processes Conversation Content only to the minimum extent necessary for Product Improvement, and if Conversation Content is used to train artificial intelligence models, the Company takes measures before training such as detecting and deleting or pseudonymizing information that can identify individuals. ③ The Company does not use the Conversation Content of Paid Users (meaning users of paid Plans, members invited under a paid Plan and users who have entered into a separate individual contract with the Company) for Product Improvement, and the same applies to Conversation Content generated during the period of using a paid Plan even if the user later switches to a free Plan. However, if a user submits a rating of or comments on a response (hereinafter 'Feedback') through the in-service rating function, etc., the Company may use the Feedback and the Conversation Content that is the subject of the Feedback for Product Improvement, regardless of whether the user is a Free User or a Paid User. ④ Free Users may opt out of the use of Conversation Content for Product Improvement at any time on the service settings screen, and Conversation Content generated after opting out will not be used for Product Improvement. Opting out does not restrict the use of the service. ⑤ The Company does not use data such as Conversation Content entered or generated by users before November 4, 2026 (the effective date of the HyperLab Terms of Service) for Product Improvement without the user's separate consent. ⑥ The Company takes necessary protective measures, such as limiting the number of persons who access Conversation Content for Product Improvement to the minimum and retaining access records, and does not provide Conversation Content to third parties. The Company does not use Conversation Content confirmed to contain sensitive information for Product Improvement and deletes it without delay. ⑦ For the generation of responses and performance of computations in the Bio Co-Scientist Lab space, Conversation Content may be consigned for processing to, and transferred overseas to, artificial intelligence model providers and computing infrastructure providers, and the specific details follow Articles 5 and 6. ⑧ If a response of the Bio Co-Scientist Lab space raises concerns about the infringement of personal information or contains inappropriate content, users may report it or raise an objection through the in-service customer inquiry channel (Channel Talk) or the contact information of the personal information protection officer under Article 14, and the Company will review it and take necessary measures without delay. ### 14. Personal Information Protection Officer ① The Company has designated the following personal information protection officer to take overall responsibility for the tasks related to the processing of personal information, to handle complaints and remedy damage related to personal information processing. Name: Joongkil Shin Department: Platform Development Division Contact: +82-2-6953-0317 Email: ② Information subjects can inquire about all personal information protection-related inquiries, complaints, and damage remedy that occur while using the Company's service to the personal information protection officer and the department in charge. The Company will respond and handle the inquiries of the information subject without delay. ### 15. Criteria for Judgment of Additional Use and Provision The Company may use or provide personal information additionally without the consent of the information subject in accordance with Article 15, Paragraph 3, and Article 17, Paragraph 4 of the ｢Personal Information Protection Act｣, considering the matters under Article 14-2 of the ｢Enforcement Decree of the Personal Information Protection Act｣. Accordingly, the Company has considered the following matters to use or provide personal information additionally without the consent of the information subject. ▶ Whether the purpose of additional use or provision of personal information is related to the original collection purpose ▶ Whether additional use or provision is predictable in consideration of the circumstances of collecting personal information or processing practices ▶ Whether the additional use or provision of personal information unfairly infringes on the interests of the information subject ▶ Whether necessary measures such as pseudonymization or encryption have been taken for security assurance ※ The judgment criteria for considering additional use or provision are voluntarily determined and disclosed by the Company ### 16. Change of Privacy Policy If there is an addition, deletion, or modification of the contents of the current privacy policy, it will be announced through the 'Notice' on the homepage at least 7 days in advance. However, if there are significant changes to the customer's rights, it will be announced at least 30 days in advance, and customer consent may be obtained again if necessary. Previous privacy policies can be found at . ### 17. Remedy for Infringement of Rights and Interests of Information Subjects Information subjects can apply for dispute resolution or consultation, etc., to the Personal Information Dispute Mediation Committee and the Korea Internet & Security Agency Personal Information Infringement Report Center to receive remedy for personal information infringement. In addition, inquiries about other personal information infringement reports and consultations can be made to the following institutions. 1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 ([www.kopico.go.kr](http://www.kopico.go.kr)) 2. Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr) 3. Supreme Prosecutors' Office: (without area code) 1301 ([www.spo.go.kr](http://www.spo.go.kr)) 4. Korean National Police Agency: (without area code) 182 (ecrm.cyber.go.kr) Those whose rights or interests have been infringed due to a disposition or omission by the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), and Article 37 (Suspension of Processing, etc.) of the 「Personal Information Protection Act」 may file an administrative appeal in accordance with the Administrative Appeals Act. ※ For more details on administrative appeals, please refer to the website of the Central Administrative Appeals Commission ([www.simpan.go.kr](http://www.simpan.go.kr)).