Privacy Policy

Operator

Kim Jinwook Neurosurgery Clinic

Effective date

Draft — not yet live

Contact

jjjbel@gmail.com

1. Service and operator

KJW Video Publisher is operated by 김진욱신경외과 (Kim Jinwook Neurosurgery Clinic), a medical clinic in the Republic of Korea. It is an internal tool for approved clinic personnel and is not offered to the general public.

2. Purpose and YouTube API Services

The tool uses YouTube API Services only to identify the authenticated clinic-owned channel, upload a human-approved clinic-owned video with approved metadata, and verify the uploaded video's identifier, processing state, and visibility. Use of this tool is also subject to the YouTube Terms of Service. Google's handling of information is described in the Google Privacy Policy.

3. Data accessed and processed

4. Authentication data

A refresh token is designed to be stored locally with restricted file permissions and used only for the approved publishing purpose. Access tokens are obtained for limited API operations and are intended to be held only temporarily. The tool does not collect or store the user's Google password or one-time verification code. OAuth client secrets and tokens are not provided to AI models.

5. Local audit evidence

The tool creates local evidence to prevent duplicate publication and support accountability. This may include source and approval digests, execution identity, target channel ID, approved metadata, timestamps, upload-attempt state, uploaded video ID, and verification outcome. This evidence is used only for clinic operations, security, troubleshooting, and compliance.

6. Use, sharing, sale, ads, and tracking

Data is used only to provide and protect the internal publishing workflow. The clinic does not sell YouTube API Data, share it with advertisers or data brokers, or use it for advertising. The public documentation pages use no analytics, tracking technology, cookies, advertising, or third-party scripts. Access is limited to authorised clinic personnel and service components required to perform the approved operation.

7. Security

The design separates OAuth credentials from AI-model prompts and tool results, restricts credential-file permissions, binds publishing to the approved channel and media digest, prevents automatic resubmission after uncertainty, and records local evidence. These controls reduce risk but do not replace the missing revocation and deletion workflow described in section 10.

8. Retention and freshness

Authorisation tokens may be retained only while necessary for the active user's specific consent and the stated internal publishing purpose. Other stored YouTube API Data must be deleted or refreshed within 30 calendar days unless an applicable YouTube policy permits longer retention. Direct deletion requests and deletion following the client's own revocation mechanism must be completed as soon as possible and no later than 7 calendar days. Data associated with a grant revoked through Google's security settings must be removed as soon as possible and within the applicable policy deadline.

9. Revocation and deletion requests

Users can revoke Google access through the Google security settings page required by YouTube policy or the current Google Account third-party access settings. To request deletion of locally stored OAuth/API-related data, email jjjbel@gmail.com. See the Data Deletion and Revocation page for the distinction between local data deletion and deleting a published video from YouTube.

10. Current compliance gap

The reviewed implementation does not evidence an in-product disconnect control, immediate programmatic token revocation, automated local credential deletion, API Data deletion workflow, or periodic 30-day refresh/delete job. These features must not be represented as automated. Until they are implemented and tested, requests require documented manual handling and audit submission remains on hold.

11. Contact

Privacy questions, complaints, revocation requests, and deletion requests may be sent to Jinwook Kim at jjjbel@gmail.com.