Balance One Privacy Policy

Balance Play (the "Operator", "we") publishes this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea to explain how we handle personal information and how you can exercise your rights. It applies to the parent app "Balance One" and to the parent invitation and consent web pages (together, the "Service").

• Controller: Balance Play
• Address: 404, 15-17 Myeongji-ro 40beon-gil, Cheoin-gu, Yongin-si, Gyeonggi-do, Republic of Korea
• Privacy contact: Sungwon Cho, Director · eps32444@gmail.com · +82-10-4107-9418

How the Service is organised. Balance One is the app parents use to take part in the member administration and movement assessment service of the sports or education center their child attends (the "Center"). When a Center registers a child as a member and invites the parent, the Center is the controller of the child's and the parent's personal information and the Operator processes it on the Center's behalf. For accounts and child profiles a parent creates directly in the app without a Center, the Operator is the controller. See Section 15.

1. Purposes of processing

We process personal information only for the following purposes. If a purpose changes, we obtain separate consent or take the other measures required by Article 18 of the Act.

1. Membership and account management: creating and securing the parent account (ID and password, Kakao or Apple sign-in), registering and identifying the child's profile, verifying and recording parental consent, preventing misuse, sending account and consent notices, confirming account closure, handling complaints
2. Movement assessments and questionnaires: producing and delivering results for posture, balance, gait, joint range of motion (ROM) and six fundamental movement skills and for temperament, sensory and developmental questionnaires; age-reference comparisons and narrative explanations; viewing the overall result sheet
3. Center services: managing the child's Center and class, class reservations, attendance and vouchers, Center notices and polls, direct messages with the child's teacher
4. Notifications: app push notifications and emails needed to use the Service (assessment schedules, result availability, new messages, notices)
5. Additional features: AI counselling content, character, play and music content, registration and use of free coupons
6. Marketing communications (optional, separate consent): news about programs, events and offers from the Center and the Operator
7. Service integrity: keeping access logs, responding to incidents, preventing and handling security events

2. Personal information we process and how we collect it

(1) We process the following information. "Required" items are the minimum needed for the feature; "optional" items do not affect registration or the basic Service if not provided.

(2) We do not collect: location, contacts, camera captures or audio recordings (the app has no capture or recording feature), payment instruments (card or bank account numbers), purchase history, advertising identifiers, app usage analytics or crash logs, web browsing or search history.

(3) The app asks the device for two permissions: notifications (push delivery) and photo library (choosing an attachment for a message). Refusing them does not limit any other part of the Service.

3. Retention periods

(1) We keep personal information for the period agreed with you at collection or required by law.

(2) After closing an account you may register again with the same ID or email address; information from the closed account is not restored.

4. Provision to third parties

(1) We use personal information only within the purposes in Section 1 and provide it to third parties only with your consent or where Articles 17 and 18 of the Act allow.

(2) We provide personal information as follows.

For members registered and invited by a Center, the Center processes this information as controller (Section 15). When a parent who signed up directly in the app later registers a Center, the information is provided to that Center as shown above.

(3) Kakao and Apple sign-in is a request you make directly to those providers; we receive the result of the authentication (member identifier and email address).

5. Processors

(1) We entrust the following processing to service providers.

(2) Under Article 26 of the Act our contracts with processors prohibit processing beyond the entrusted work and require technical and organisational safeguards, restrictions on sub-processing, our supervision and liability for damages. We supervise processors to ensure they handle personal information safely.

(3) Changes to the entrusted work or the processors are published in this Policy without delay.

6. International transfers

(1) We transfer personal information abroad (for storage or processing on our behalf) as follows.

(2) You may refuse these transfers. Push notifications can be turned off in the device settings and the token becomes invalid when the app is deleted. Explanation generation is part of health and physical-measurement processing, so it does not occur if you decline or withdraw that consent; in that case assessments and questionnaires are not provided. Apple sign-in can be replaced by ID sign-up or Kakao sign-in. Questions about refusal can be sent to the privacy contact in Section 13.

(3) Assessment data, video and images are stored in the Republic of Korea (Amazon Web Services, Seoul region). If you use the Service from outside Korea, your information is transferred to and stored in the Republic of Korea.

7. Your rights and how to exercise them

(1) You, and the legal guardian of a child member, may at any time:

1. request access to personal information;
2. request correction of errors;
3. request deletion;
4. request suspension of processing;
5. withdraw consent (marketing, health and physical-measurement data, collection and use of personal information).

(2) How to exercise these rights

• In the app: Settings > Edit personal information (correct parent and child information); press and hold a profile in the profile list > Delete (delete a child profile); Settings > Withdraw (close the account and withdraw all consents); device notification settings (turn off push)
• Through the Center: ask the child's Center
• Through the Operator: email or call the privacy contact in Section 13

(3) We respond within 10 days of receiving a request. A request made through a legal guardian or other representative requires a power of attorney in the form prescribed by the Enforcement Rules of the Act. We may verify that the requester is the data subject or an authorised representative.

(4) Access and suspension requests may be limited under Articles 35(4) and 37(2) of the Act, and information that other laws require us to collect cannot be deleted on request.

(5) If you withdraw consent to health and physical-measurement data, assessments stop and the data we hold is deleted. If you withdraw consent to the collection and use of personal information, the child's registration and the Service end.

8. Deletion procedure and method

(1) When personal information is no longer needed because the retention period has passed or the purpose has been achieved, we delete it without undue delay (within 5 days unless there is a justified reason).

(2) Where another law requires us to keep information after the agreed period or purpose has ended, we move it to a separate database or storage location and use it only for the purpose required by that law.

(3) Procedure: as soon as an account closure or profile deletion is requested we suspend the account or profile and block access, then delete the information that is not subject to a retention obligation within 30 days of that date (Section 3). Other information follows (1).

(4) Method: electronic files are permanently deleted so that they cannot be recovered or reproduced (including deletion of video and image objects in cloud storage); paper records are shredded or incinerated.

9. Security measures

Under Article 29 of the Act we apply the following measures.

1. Organisational: internal management plan, minimum number of staff handling personal information and their training, supervision of processors
2. Technical
   • Passwords are stored with one-way, non-reversible hashing (bcrypt)
   • All traffic between the app and our servers is encrypted with TLS (HTTPS and WSS); Kakao and Apple sign-in tokens are verified on the server
   • Login (JWT) and profile-ownership checks, access limited to the member's own Center, time-limited invitation and reset links with tokens stored only as hashes
   • Result images shown in the app are composites in which the face is masked by pixelation, and image URLs expire after one hour
   • Passwords and authentication tokens are masked in server request logs; access records are kept
   • Managed access keys and signed URLs for cloud storage (Amazon S3)
3. Physical: access control to servers and databases, restricted access to places where personal information is kept

10. Children's personal information and parental consent

(1) Most members of the Service are children under 14. The Operator and the Center obtain the consent of the parent or legal guardian before processing a child's personal information, as required by Article 22-2 of the Act, and do not ask children for information directly. For Centers in the United States, we obtain verifiable parental consent for children under 13 as required by the Children's Online Privacy Protection Act (COPPA). Balance One is an app for parents and is not intended for use by children.

(2) How we verify parental consent: through an invitation link sent to the email address the Center collected from the parent, or in the app while the parent is logged in, the parent personally enters the child's date of birth (matched against the Center's record), provides their name and relationship to the child, and separately consents to the collection and use of personal information (Document 1), the collection and use of health and physical-measurement data (Document 2) and the parental consent (Document 3). Consent to marketing communications (Document 4) is optional. We record the date and time, the document versions, the method, whether the date of birth was verified, the IP address and device information as evidence of consent.

(3) Consent entered by Center staff or anyone other than the parent or legal guardian is not valid.

(4) The parent or legal guardian may review, correct or delete the child's information or withdraw consent at any time as described in Section 7. We do not condition the child's participation on disclosing more information than is reasonably necessary. Without consent we cannot register the child or provide assessments and questionnaires.

11. Health and physical-measurement data

(1) Movement and physical-measurement data and developmental and temperament questionnaire answers are health-related information. We inform you of this and obtain your separate consent under Article 23 of the Act, apart from the general consent to personal information.

(2) The items and purposes are set out in Section 2 and Section 1(2). Results are guidance for physical activity and are not a medical diagnosis. Age-based reference values were developed from measurements of children in the Republic of Korea.

(3) We do not use video or body-position data to identify your child or anyone else, and we do not sell or share it for advertising. Statistics used to improve the Service are de-identified.

(4) The information sent to OpenAI to generate explanations is limited to the child's age band and sex and the measurement values and questionnaire result categories as text; the name, date of birth, video and images are never sent (Section 6).

12. Automatically collected information and how to refuse it

(1) The app does not use advertising identifiers or cookies to collect behavioural information.

(2) The app stores a minimum of information on your device to keep you logged in (authentication token, selected profile, language). This information is not sent to our servers and is removed when you log out, close the account or delete the app.

(3) The app generates a Firebase Cloud Messaging registration token for push notifications and stores it on our servers. You can turn notifications off in the device settings; deleting the app invalidates the token.

(4) The overall result sheet and music pages shown inside the app are our own server pages and use no tracking tools.

13. Privacy contact and requests for access

(1) We have appointed the following person to take overall responsibility for personal information processing and to handle complaints and remedies.

• Privacy contact: Sungwon Cho, Director
• Email: eps32444@gmail.com
• Phone: +82-10-4107-9418
• Address: 404, 15-17 Myeongji-ro 40beon-gil, Cheoin-gu, Yongin-si, Gyeonggi-do, Republic of Korea (Balance Play)

(2) You may direct all privacy questions, complaints and requests for remedies arising from the Service, including requests for access under Article 35 of the Act, to the privacy contact. We answer and act without undue delay.

(3) Questions about a member registered by a Center may also be sent to that Center; we act on the Center's instructions.

14. Remedies for infringement

You may seek dispute resolution or advice from the following bodies in the Republic of Korea.

• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (no area code), https://privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 (no area code), https://www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (no area code), https://www.spo.go.kr
• Korean National Police Agency Cyber Bureau: 182 (no area code), https://ecrm.cyber.go.kr

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35, 36 or 37 of the Act may file an administrative appeal under the Administrative Appeals Act. Parents in the United States may also contact the Federal Trade Commission (https://www.ftc.gov) regarding COPPA.

15. Roles of the Center and the Operator

(1) When a Center registers a child and invites the parent, the Center is the controller under the Act and the Operator is its processor for operating the Balance Membership service, managing the systems and supporting parents. The consent screens show the Center's name and contact details, and each Center can view and process only its own members' information.

(2) Information in accounts and profiles a parent creates directly in the app without a Center is processed by the Operator as controller. If a Center is registered later, the information is provided to that Center under Section 4.

(3) In either case you may exercise the rights in Section 7 against the Operator or the Center, and we act together with the Center.

(4) Where the Operator processes personal information for its own purposes — service-improvement statistics, system security and stability, or marketing notices in the Operator's name (with separate consent) — the Operator is the controller to that extent.

16. Changes to this Policy and effective date

(1) This Policy takes effect on 14 September 2026.

(2) If this Policy is amended because of changes in law, policy or the Service, we announce the change in the app or on this page at least 7 days before it takes effect (30 days for changes that materially affect your rights).

(3) Revision history

Earlier versions are available from the privacy contact on request. In case of any inconsistency between the Korean and English versions of this Policy, the Korean version prevails for users in the Republic of Korea.