Data Protection and Privacy Policy

1. Information We Collect

Depending on the services requested, we may collect:

• Identity and contact information: name, date of birth, address, telephone number, email address, passport or government-issued identification details, citizenship, and emergency-contact information.
• Health and medical information: medical history, diagnoses, symptoms, medications, allergies, laboratory results, imaging, physician notes, treatment requests, accessibility needs, and other information needed to assess or coordinate requested care.
• Travel and scheduling information: preferred appointment dates, itinerary details, accommodation needs, visa-related information, and transportation arrangements.
• Payment and transaction information: billing details, payment status, and records of services purchased. Payment-card information may be processed directly by our payment processor.
• Communications: emails, telephone calls, messages, forms, documents, and other communications with us.
• Website and device information: IP address, browser type, device identifiers, pages viewed, and similar technical information, subject to our cookie and tracking practices.

Please provide only information that is accurate and reasonably necessary for the services you request. If you provide information concerning another person, you represent that you are authorized to do so.

2. How We Use Information

We may use personal information to:

• respond to inquiries and determine the services requested;
• coordinate appointments, consultations, treatment planning, travel, lodging, translation, and related support;
• transmit medical records and other information to NTT Medical Center Tokyo and other authorized healthcare providers;
• communicate with customers, authorized representatives, providers, insurers, vendors, and travel-service providers;
• process payments, maintain business records, and administer our agreements;
• protect the health, safety, security, and legal rights of customers, Nippon Health, and others;
• comply with applicable law, legal process, contractual obligations, and regulatory requirements; and
• improve and secure our services, systems, and website.

When the HIPAA Privacy Rule applies, Nippon Health will use and disclose protected health information only as permitted by applicable law and any controlling business associate agreement or other HIPAA-compliant arrangement. Where required, we will limit a use, disclosure, or request to the minimum information reasonably necessary for the applicable purpose.

3. Healthcare Coordination and International Disclosure

By requesting healthcare-travel coordination, you understand that information necessary to arrange or support your care may be transmitted from the United States to NTT Medical Center Tokyo, physicians, laboratories, interpreters, travel coordinators, and other service providers located in Japan or another country.

Privacy and data-protection laws outside the United States may differ from U.S. law. Nippon Health applies contractual, administrative, technical, and physical safeguards appropriate to the sensitivity of the information and the services being provided. Where applicable law requires a specific authorization or consent for an international disclosure, treatment-related disclosure, or other use, we will request it separately. This Policy does not replace any authorization or consent required by law.

4. When We Disclose Information

We may disclose personal information:

• To healthcare providers: including NTT Medical Center Tokyo, physicians, laboratories, pharmacies, and other providers involved in evaluating, arranging, or delivering requested care.
• To service providers: including secure hosting, communications, document transfer, payment, translation, transportation, accommodation, scheduling, and professional-service providers that support our operations.
• At your direction: to family members, caregivers, representatives, insurers, employers, or others whom you authorize.
• For legal and safety purposes: when required or permitted by law, legal process, public-health obligations, or a good-faith need to protect a person from a serious threat or protect legal rights.
• In a business transaction: in connection with a proposed or completed merger, financing, acquisition, reorganization, or transfer of assets, subject to appropriate confidentiality protections.

We do not sell medical information. We do not use protected health information for targeted advertising or disclose it to advertising platforms except where expressly permitted by law and supported by any authorization required by law.

5. HIPAA and Protected Health Information

HIPAA applies only to information and activities within its legal scope. Nippon Health's HIPAA status may depend on the function being performed and its relationship with a HIPAA-covered entity. Signing an agreement with a covered entity does not, by itself, make every item of information handled by Nippon Health protected health information under HIPAA.

To the extent Nippon Health acts as a business associate or otherwise handles protected health information subject to HIPAA, it will:

• use or disclose protected health information only as permitted by law and the applicable agreement;
• maintain reasonable and appropriate administrative, technical, and physical safeguards;
• require applicable subcontractors that handle protected health information to accept appropriate privacy and security obligations;
• report impermissible uses or disclosures and security incidents as required by law and contract;
• support applicable requests for access, amendment, restriction, confidential communications, or an accounting of disclosures; and
• return, destroy, or protect protected health information following termination, as required by the applicable agreement and law.

If Nippon Health is legally required to issue a separate HIPAA Notice of Privacy Practices, that notice will supplement this Policy and will control with respect to protected health information where the two documents conflict.

6. Your Privacy Choices and Rights

Subject to applicable law and appropriate identity verification, you may request that we:

• provide access to certain personal information we maintain about you;
• correct inaccurate or incomplete information;
• delete information that we are not legally or contractually required to retain;
• restrict or object to certain uses or disclosures;
• communicate with you through a specified channel or at a specified location;
• provide an electronic copy of certain information; or
• withdraw a consent or authorization, with prospective effect, where processing depends on that consent or authorization.

Some rights may be exercised through the healthcare provider that controls the relevant medical record. We may retain information necessary to comply with law, document services, resolve disputes, enforce agreements, protect safety, or establish or defend legal claims.

7. Information Security

We maintain administrative, technical, and physical safeguards designed to protect personal and medical information against unauthorized access, acquisition, use, alteration, disclosure, or destruction. These measures may include access controls, encryption, secure transmission methods, workforce confidentiality requirements, vendor diligence, system monitoring, incident-response procedures, and periodic risk assessments.

No method of transmission or storage is completely secure. Customers should not send sensitive medical information through ordinary email or another unsecured channel when a secure method is available.

8. Data Retention

We retain personal information only for as long as reasonably necessary to provide the requested services, satisfy legal and contractual obligations, comply with applicable healthcare-record requirements, resolve disputes, maintain security and audit records, and establish or defend legal claims. Retention periods vary based on the type of information, the services provided, the applicable agreement, and legal requirements.

9. Website Cookies and Tracking Technologies

Our website may use cookies and similar technologies needed for security, functionality, preferences, and performance. We do not knowingly permit advertising or analytics technologies to receive protected health information unless the disclosure complies with HIPAA and other applicable law, including any required agreement or authorization. Additional details should be stated in a separate Cookie Notice or consent tool if nonessential cookies or analytics technologies are used.

10. Children's Information

Our services are not directed to children acting independently. Information concerning a minor must be submitted by, or with appropriate authorization from, a parent, legal guardian, or other legally authorized representative. We may require documentation of that authority.

11. State Privacy Laws

Residents of certain U.S. states may have additional rights concerning personal information. The availability and scope of those rights depend on the applicable statute and may be subject to exemptions for protected health information, medical information, regulated entities, or particular processing activities. We will not unlawfully discriminate against a person for exercising an applicable privacy right.

12. Changes to This Policy

We may revise this Policy to reflect changes in our services, practices, contractual obligations, or legal requirements. The revised Policy will state its effective date and will be posted through the same channel in which this Policy is made available. If required by law, we will provide additional notice or obtain consent before applying a material change.

13. Contact and Complaints

Questions, privacy requests, or complaints may be submitted to:

If HIPAA applies to the information at issue, you may also have the right to submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights. Nippon Health will not retaliate against anyone for making a good-faith privacy complaint or exercising an applicable privacy right.