Legal Review Case: AI Healthcare Service Terms of Use & Privacy Policy

Client Information

Corporate Client / Service Operator
 

Case Details

Decent Law Firm’s Corporate Legal Team conducted a comprehensive legal review of the Terms of Use and Privacy Policy for an AI-based infant head shape analysis and customized chatbot consultation service.

The service operates as a web-based platform where users upload vertex (top-of-head) photographs, which are analyzed by AI to quantify cranial proportions—left/right, front/back, and diagonal ratios—and subsequently provide informational guidance through an AI chatbot.

The primary legal issues addressed in this engagement were ensuring the lawful processing of biometric data classified as sensitive personal information, and mitigating regulatory risk by clearly defining the service as non-medical in nature.

1. Privacy Policy: Protection of Biometric and Children’s Data
Given that the service processes head photographs and cranial measurement data, it involved the handling of biometric information classified as sensitive personal data under the Personal Information Protection Act.

To address this risk, biometric data processing was structured to require separate and explicit consent, distinct from general personal data consent, with strict limitations on use beyond the stated purposes.

In addition, the data retention policy was carefully designed to minimize unnecessary storage: data is automatically deleted within 30 days for registered users and immediately for non-registered users upon completion of analysis.

Considering the involvement of children under the age of 14, the Privacy Policy further specified clear legal guardian consent procedures, as well as detailed technical and organizational safeguards, including encryption of biometric data and restricted access controls.


2. Terms of Use: Clear Definition of Non-Medical Nature
There was a regulatory risk that AI-generated analysis results could be misconstrued as medical diagnosis, potentially triggering violations of the Medical Service Act or Medical Device Act.

To mitigate this risk, the Terms of Use explicitly state that the service is not a medical device or medical service, but rather a non-medical informational service. AI analysis results and chatbot responses are clearly characterized as reference materials only.

The Terms also limit the company’s liability for any decisions made based on the provided information and emphasize the user’s responsibility to seek professional medical consultation when necessary.