MedQraft
← All insights
Regulatory software

From Organizing Skin Photos to Supporting Disease Assessment: Reviewing an App's Intended Use

A fictional app example connects changes in software functions and intended use to medical-device status review in South Korea.

Last regulatory review: 2026-10-22 Rev. 1.0 8 min read

Adding a feature that analyzes the likelihood of a skin disease to a photo-organizing app creates a reason to review its medical-device status during planning.
The issue is the change in function and intended use: the app now provides results intended to support disease assessment.

This article addresses software teams preparing for the South Korean market.
The app below is a fictional planning example, not an actual MFDS determination about a product.

The same photos can lead to different outputs

The first concept sorts ordinary smartphone photos by date so that users can retrieve their personal images.
Assume that it does not analyze skin conditions or calculate disease likelihood.
The second concept analyzes features in those photos, provides a result concerning the likelihood of a particular skin disease, and is designed for that result to support disease assessment.

Aspect Photo organization Proposed disease-analysis feature
Input Ordinary photos the user wants to keep Skin photos intended for disease-likelihood analysis
Processing Date sorting and photo retrieval Image-feature analysis and disease-related output generation
Output A dated photo list An analysis result concerning disease likelihood
Intended use Retrieving personal photos Supporting disease assessment
Review focus Consistency between the assumed function, purpose and implementation Device-status review prompted by a medically intended output
The same photo input branches into a dated album and a disease-analysis result
Figure 1.
Identical input data can serve different processing functions and intended uses.
These fictional interfaces are original conceptual illustrations, not actual patient data or diagnostic results.

Calling a product an album does not establish that it is outside medical-device regulation.
Medical-image display or processing, connections to medical devices, and integration with diagnostic functions can change the relevant considerations.
This comparison is not a general exclusion rule for medical imaging systems.

Ask what the decision is for

Sorting photos by date also involves computational comparisons and choices.
The presence of such operations alone does not make software a medical device.
What changes in this example is the purpose of producing a skin-disease likelihood result to support disease assessment.

Article 2(2) of South Korea's Digital Medical Products Act defines digital medical devices by reference to medical devices incorporating digital technology and specified purposes, including disease diagnosis, treatment and observation of prognosis.
MFDS guidance also includes standalone software among the relevant technologies.
Being an app therefore does not, by itself, remove the need to review device status.
[Sources 1 and 2]

Words such as “likelihood” or “for reference” do not replace a review of the actual function.
Consider what the software analyzes, who receives the result, and which decisions it is intended to support.
A statement that a physician makes the final decision is also information about the workflow; it does not explain away the software's preceding role.

Connect input, processing, output and use

A practical starting point is to describe what the feature does in one sentence.
The following is MedQraft's planning suggestion, not a statutory application format.

A user supplies a skin photo; the software analyzes image features and provides a result concerning disease likelihood; the specified user applies that information to support disease assessment.

That sentence still leaves decisions to make.
Is the intended user a layperson or a healthcare professional? Which disease and body site are covered? Under what conditions are photos acquired? What exactly does the output mean? Record decisions and unresolved points separately, without inventing performance figures or target populations.

A sequence from skin-photo input through feature analysis and a disease-related output to decision support
Figure 2.
Review the function from image input to the point where the result is used.
This describes a fictional app and does not establish a validated diagnostic algorithm or performance.

If a screen says “analysis result” but the development requirements describe only date sorting, the documents are not describing the same product.
Likewise, if the plan describes personal recordkeeping while the actual function estimates disease likelihood, resolve that inconsistency before preparing the product description for a device-status review.

Compare the plan before and after the feature addition

What to document Questions for this fictional example
Target and user Whose skin photos are involved, and who supplies the input and reads the result?
Actual processing Does it only sort by date, or analyze disease-related features?
Meaning of the output Is it a photo list, a disease-likelihood result or other medical information?
Intended use Is the result for retrieving personal records or supporting disease assessment?
Context and connections Is the app standalone, or connected to medical devices or clinical systems?
Unresolved points Which targets, use conditions or output limitations remain undecided?

Place the before-and-after screens beside their function descriptions.
This helps distinguish a display improvement from a change affecting the product's purpose.
It also supports a consistent explanation when asking about device status.
If the boundary remains unclear, prepare the function, intended use, operating principle and example outputs, and consult the MFDS device-status review route.
[Source 3]

Separate device status from classification and authorization

The conclusion is not that adding disease analysis establishes a particular device class.
Review medical-device status on the basis of the actual function and intended use, then examine the applicable classification, risk class and authorization requirements.
A screen alone cannot establish the class or required test program.

Function, purpose and context feed into a device-status review followed by applicable classification and requirements
Figure 3.
Define the product and establish the basis for reviewing its device status, then consider the applicable classification and authorization requirements.
This is MedQraft's practical outline, not a substitute for an official determination.

Three questions can focus the review meeting: What new result does the feature produce? Which decisions is the user intended to make with it? Do the plan, interface and actual behavior describe that purpose consistently? If the answers change, update the product definition as well as the feature list.

A determination that a product is not a medical device does not mean every related framework is irrelevant.
South Korea also has a separate category for digital medical and health-support products, so assess the applicable scope against the actual purpose and functions.
[Source 2]

Related reading

Sources and scope

  1. Korean Law Information Center: Digital Medical Products Act, Article 2(2).
    Definition checked in the version effective October 8, 2026.
    Korean original.
  2. MFDS electronic civil-service system: Digital medical products guidance.
    Product scope, standalone software and the separate health-support category.
    Korean original.
  3. Government24: Request for review of medical-device status.
    Reference route for the review service.
    Korean original.

Checked October 22, 2026.
This article discusses South Korean regulation.
English legal terminology is used descriptively; the Korean legal text governs.
The fictional app, planning sentence and review questions are MedQraft's own explanatory material and must not be cited as an MFDS determination of device status or class.

Let's talk

Apply what you have read
to your product.

Tell us your product's current stage and the questions you need to review.

Discuss your questions ↗
MedQraft / Let's talk

Project inquiry

Start with your challenge.
We will work through it together.

Tell us your product's current stage and the support you need.
We will review the questions and define a suitable scope of support.

Contact@medqraft.co.kr ↗
Information: name, company, email, inquiry and service of interest · Purpose: responding to your inquiry · Retention: until the inquiry is resolved Read the privacy policy
Privacy policy

MedQraft / Privacy

Privacy policy

MedQraft processes only the information needed for website inquiries.
We delete the collected inquiry information when the inquiry is resolved.

Effective date: September 18, 2026

1. Scope and purposes of processing

This policy applies to visits and business inquiries at www.medqraft.co.kr.
We process personal information to review and respond to inquiries, discuss the scope of support, and operate the website reliably.
Customer business data stored in Q-Atelier is governed by the relevant service agreement and separate notices.

2. Information collected and retention

Required information
Name, email address and inquiry
Optional information
Company, selected service of interest, and contact or business details you provide in your inquiry
Collection methods
Website inquiry forms and email inquiries
Basis for processing
Consent to collection and use provided through the inquiry form.
Where necessary to fulfill a request relating to the formation or performance of a contract, we process information on the applicable legal basis.
Retention period
We retain inquiry information until the inquiry is resolved, then delete it without delay.
If information becomes part of a separate contract, we separately explain the required information and retention period.
Where retention is legally required, only the relevant information is stored separately.

You may decline to provide required information, but this will prevent submission of the website inquiry form.
You can make an inquiry without providing optional information.
Do not submit sensitive information unnecessary for the inquiry, such as national identification numbers or patient information.

3. Service providers and external services

Inquiries are forwarded from the website server through an email delivery service to our company mailbox.
We do not maintain a separate inquiry database in this processing workflow.

Vercel Inc.
Website hosting, server-side inquiry processing, operations and security.
Technical information such as IP address, request time, browser and request details may be processed.
Plus Five Five, Inc. (Resend)
Delivery of inquiry notification emails containing name, email, company, service of interest and inquiry details, and management of delivery logs
Gabia Hiworks
Receipt, storage and replies to inquiries in our company mailbox

We do not sell inquiry information or provide it for advertising purposes.
We do not disclose it for an independent third party's purposes unless there is a lawful basis, such as a legal requirement or separate consent.

4. Overseas processing and storage

Overseas cloud services are used to process website requests and deliver emails.
Information entered in an inquiry is transmitted over an encrypted connection upon submission.

Vercel Inc. / United States
Information is transmitted for inquiry request processing and hosting.
Privacy contact: privacy@vercel.com.
Operational records are subject to the retention periods of the services and settings used and Vercel's processing policies.
Vercel data processing information
Plus Five Five, Inc. (Resend) / United States
Information is transmitted upon submission to deliver the inquiry email and manage delivery records.
Privacy contact: privacy@resend.com.
Resend's published default retention period for emails and logs on its standard plans is 30 days.
Earlier deletion may be requested from the provider.
Resend retention and deletion information

Deleting inquiry emails from our mailbox and deleting technical records held by external providers involve different processes.
You may contact the person listed below about deletion, restriction of processing or overseas processing.
If you do not wish to use overseas processing through the website form, you may email us directly.
The processing policies of the email services used will still apply.

5. Deletion and safeguards

After confirming that an inquiry has been resolved, we delete the email and separately saved copies.
Printed materials, if any, are destroyed by shredding or another method that prevents reuse.
Where deletion of information held by an external processor is necessary, we submit a request through that provider's deletion procedure.

Access to personal information is restricted to staff who need it for their work.
We protect information through HTTPS transmission and account access controls.
We do not publish materials containing personal information in public repositories or on public pages.

6. Your rights

You may request access, correction, deletion, restriction of processing or withdrawal of consent by contacting the designated email address.
We will verify your identity to the extent necessary, process the request under applicable law, and notify you of the result.
If we cannot fulfill a request, for example because of a legal retention obligation, we will explain the reason.
For requests made through a representative, we may verify their authority.

7. Access information and external content

We use Naver conversion tracking to measure visits and completed inquiries attributable to Naver search advertising.
Technical information such as the visited URL, referring page, browser and cookies, and whether an inquiry was completed, may be processed.
The name, email, company and inquiry text entered in the form are not included in conversion events.
You can block or delete cookies in your browser.

Server access information may be processed for website delivery and security.
Vercel Web Analytics is used for anonymous visitor statistics on the introduction page and Insights.
Insights statistics aggregate article views, referral sources, countries and device types.
Visitor analytics do not use analytics cookies.
Names, emails, companies and inquiry text from the consultation form are not included in analytics events.
Instagram-specific links use UTM parameters to identify referral sources.
Loading external video or fonts on the website may transmit technical information, including IP address and browser details, to the relevant provider.

You can block or delete cookies and site data in your browser settings.
Some features or external content may be restricted depending on your settings.

8. Privacy officer and contact

Business
MedQraft / Representative: Byeonghwi Kim
Privacy officer and inquiry contact
Byeonghwi Kim
Email
Contact@medqraft.co.kr
Postal inquiries
Suite 222, 56 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea (Geumto-dong, Widen Tower)

For privacy-related complaints, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee for assistance.

9. Changes to this policy

Changes to processing purposes, information collected, retention periods or service providers will be published on this page with their effective date.

September 18, 2026: Website inquiry privacy policy first published

October 14, 2026: Added information on Insights visitor analytics and Instagram referral measurement