Legal Review Case: AI Healthcare Service Terms of Use & Privacy Policy
Case Overview
- Client Information
- Corporate Client / Service Operator
- Case Details
-
Decent Law Firm’s Corporate Legal Team conducted a comprehensive legal review of the Terms of Use and Privacy Policy for an AI-based infant head shape analysis and customized chatbot consultation service.
The service operates as a web-based platform where users upload vertex (top-of-head) photographs, which are analyzed by AI to quantify cranial proportions—left/right, front/back, and diagonal ratios—and subsequently provide informational guidance through an AI chatbot.
The primary legal issues addressed in this engagement were ensuring the lawful processing of biometric data classified as sensitive personal information, and mitigating regulatory risk by clearly defining the service as non-medical in nature.
Decent's Strategy
Given that the service processes head photographs and cranial measurement data, it involved the handling of biometric information classified as sensitive personal data under the Personal Information Protection Act.
To address this risk, biometric data processing was structured to require separate and explicit consent, distinct from general personal data consent, with strict limitations on use beyond the stated purposes.
In addition, the data retention policy was carefully designed to minimize unnecessary storage: data is automatically deleted within 30 days for registered users and immediately for non-registered users upon completion of analysis.
Considering the involvement of children under the age of 14, the Privacy Policy further specified clear legal guardian consent procedures, as well as detailed technical and organizational safeguards, including encryption of biometric data and restricted access controls.
2. Terms of Use: Clear Definition of Non-Medical Nature
There was a regulatory risk that AI-generated analysis results could be misconstrued as medical diagnosis, potentially triggering violations of the Medical Service Act or Medical Device Act.
To mitigate this risk, the Terms of Use explicitly state that the service is not a medical device or medical service, but rather a non-medical informational service. AI analysis results and chatbot responses are clearly characterized as reference materials only.
The Terms also limit the company’s liability for any decisions made based on the provided information and emphasize the user’s responsibility to seek professional medical consultation when necessary.
Results & Significance
Through the legal review of the Terms of Use and Privacy Policy, the client was able to structure its AI service in a manner that avoids classification as a medical device or medical practice, while proactively addressing key legal risks related to the processing of biometric and children’s personal data.
Decent Law Firm’s Corporate Legal Team—comprised of attorneys with experience at major corporations and leading law firms—provides advisory services that align legal documentation with the actual technical and operational structure of AI and IT services, encompassing terms of use, privacy compliance, and regulatory risk design.
Decent supports clients in building legally sound and scalable services through proactive legal review prior to launch.
Legal Consultation
All consultations are conducted after a case review by the attorney in charge.
Providing the key details of your case in advance will help you receive more specific advice.
