Privacy Policy

1. Scope

This Privacy Policy explains how Ora (“Ora”, “we”, “us”) collects, uses, shares, and protects personal information when you use our website and services (the “Service”). By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

2. Information we collect

Information you provide

• Account and contact details — your name and email address (for example, through Google sign-in), and phone number if you provide one.
• Estimate inputs — your city or country, treatment of interest, quantity, and travel preferences.
• Treatment information you choose to share — uploaded quotes, treatment plans, dental records, ADA/treatment codes, or images.
• Communications — messages you send us or to providers through us.

Information collected automatically

• device and browser information, approximate location (e.g., from your IP or, with permission, your device), and usage data;
• cookies and similar technologies used for core functionality and analytics.

3. How we use your information

• to provide the Service, generate estimates, and operate your account;
• to facilitate introductions to clinics or clinicians when you ask us to;
• to communicate with you about your request, including by email or messaging apps;
• to improve, secure, and troubleshoot the Service;
• to comply with legal obligations.

4. Legal bases

Where applicable law (such as the EU/UK GDPR) requires it, we process personal information on these bases: your consent (for example, to share your details with a provider); performance of a contract (to deliver the Service you request); our legitimate interests (to operate and improve the Service); and legal obligations.

5. How we share information

• With clinics and clinicians you ask to be introduced to, so they can review your case and contact you. This sharing happens with your consent.
• With service providers that operate the Service on our behalf, under contracts that limit their use of your data. Today these are: Vercel (hosting), Neon (database), Cloudflare (file storage and delivery), Resend (email delivery), PostHog (product analytics), and Google (sign-in, where you choose it). All are located in the United States.
• For legal reasons, where required by law or to protect rights, safety, and the integrity of the Service.
• In a business transfer, if Ora is involved in a merger, acquisition, or sale of assets.

We do not sell your personal information.

6. Health-related information

Some information you choose to share (such as dental records or treatment plans) may relate to your health. We treat this information as sensitive and share it only with the providers you ask us to, and with the service providers needed to operate the Service. Ora is a facilitator, not a healthcare provider, and is generally not a “covered entity” under laws such as HIPAA; the clinics you engage are responsible for their own handling of your records under the laws that apply to them.

7. International transfers

Ora connects patients with providers in Korea, and our service providers may be located in other countries. As a result, your information may be processed outside your home country, including in the Republic of Korea and the United States. Where required, we use appropriate safeguards for such transfers.

8. Cookies and analytics

We use cookies and similar technologies for essential functionality and to understand how the Service is used (for example, privacy-conscious product analytics and error monitoring). You can control cookies through your browser settings; disabling some cookies may affect functionality.

9. Data retention

We keep personal information only for as long as needed for the purposes described here, or as the law requires, and then delete or anonymize it. Specifically:

• Consultation requests and the information you attach — 3 years after the request is closed (the record-keeping period Korean e-commerce consumer-protection law sets for handling complaints and disputes).
• Doctor and clinic applications — 1 year after review ends, or immediately on request.
• Portal accounts — until you close the account, then deleted, except where a legal retention period applies.
• Consent records — 3 years after the consent is withdrawn or the data is deleted, so we can show consent was given.
• Access logs — 3 months.

You can ask us to delete your information sooner as described below.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; and to withdraw consent at any time. Residents of some regions (e.g., the EU/UK and California) may have additional rights. To exercise any of these, contact us at hello@orakorea.co and we will respond as required by applicable law.

11. Security

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Children

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance.

14. Contact, and our privacy officer

Ora is operated by Ora Korea Co., Ltd. (주식회사 한국으로오라), 306 Apgujeong-ro, Gangnam-gu, Seoul, Republic of Korea. Our Chief Privacy Officer under Korea's Personal Information Protection Act is [name and title — to be appointed]. For privacy questions or requests, contact us at hello@orakorea.co; we respond within 10 days.

15. Remedies (Republic of Korea)

If you believe your personal information has been mishandled, you may also contact the Korean authorities: the Personal Information Infringement Report Center run by KISA (dial 118, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (dial 1833-6972, www.kopico.go.kr). The Korean-language version of this policy, which governs for data subjects in Korea, is at /privacy/ko.