Privacy Policy

1. Definitions

2. Personal Information We Collect

2.1 Information You Voluntarily Provide via Consultation Forms

When you submit a consultation request yourself, or an overseas travel agency, company, or other organization submits one on your behalf with authorization, we may collect the information described below. Whether specific fields are collected, whether they are mandatory, and how they are used are subject to the forms actually deployed on the website:

When an organizational user provides information on behalf of a patient, it must warrant that it has the authority to provide the information and to instruct us to process it, that it has provided this Policy to the patient, completed the applicable notifications, and obtained valid authorization or consent. We may reasonably rely on its written or verifiable confirmation, but we reserve the right to request supplementary authorization materials, contact the patient or guardian directly for verification, or suspend processing where reasonable doubts exist. Where separate consent must by law be given by the patient or the patient's guardian, such consent will be obtained separately.

2.2 Information We Collect Automatically

When you visit this website, we may automatically collect the following information:

• Device and technical information: browser type, operating system, screen resolution, and device or log identifiers necessary for the website to actually function (if any)
• Network information: IP address (used for security protection and geographic identification), visit time
• Usage information: pages visited, consultation form source-page identifiers, language preferences; collected only where genuinely necessary and consistent with the configuration actually deployed
• Cookies: used to remember your language preferences and similar settings (see Section 8)

2.3 Source Pages of Information

This website may place consultation forms on the following pages and record the form source-page identifier. Before launch, we will verify against the actual pages and fields:

• Homepage
• Contact
• Dental / Eye Surgery / Optometry
• Orthopaedics / Cancer Surgery
• Chinese Medicine (TCM) / Hair Transplant / Aesthetic Medicine
• Health Checkup / Treatments

3. Sensitive Personal Information

3.1 Medical and Health Information Constitutes Sensitive Personal Information

Under Article 28 of the Personal Information Protection Law of the People's Republic of China (the "PIPL"), medical and health information constitutes sensitive personal information. The medical condition descriptions you enter in consultation forms and the medical record attachments you upload are both sensitive personal information.

3.2 Conditions for Processing Sensitive Personal Information

We process your medical and health information only under the following conditions:

• Specific purpose: used only to assess your medical needs, match suitable medical institutions and specialties, and arrange your medical travel itinerary;
• Sufficient necessity: processed only when genuinely necessary for hospital matching, medical record translation, or assisting medical institutions with pre-admission assessment; if we are only providing general medical travel information, we do not require you to provide detailed medical records;
• Separate consent: before you submit a medical condition description, medical record attachment, or other medical and health information, we will obtain separate consent through an independent checkbox or similar mechanism; such consent is not combined with acceptance of general terms of service, marketing, or cross-border transfer consent. An organizational user may not give, on behalf of a patient, separate consent that must by law be given by the patient or the patient's guardian, unless it holds clear and valid authorization;
• Strict protective measures: we adopt security measures including encrypted transmission, access control, and de-identified storage (see Section 9).

3.3 Information We Notify You Of

Pursuant to Article 30 of the PIPL, we hereby notify you of the following:

• Necessity of processing medical and health information: for personalized hospital and department matching, medical record translation, or assisting medical institutions with pre-admission assessment, we generally need to understand a profile of your condition directly relevant to that purpose; no detailed medical records are required where only general information is provided;
• Impact on your rights and interests: your medical and health information may be used by authorized staff and by the medical institutions you confirm to engage, for needs matching and pre-admission assessment. Any network transmission and storage carries residual security risks; we will adopt measures commensurate with the risk as required by law and limit the scope of those with access, but we do not guarantee absolute security beyond reasonable control.

3.4 Your Non-Compulsory Choices

You may choose not to fill in a medical condition description or upload medical record attachments. In that case, we can still provide general medical travel consultation, but will be unable to perform precise hospital matching or treatment plan estimates.

3.5 Personal Information Protection Impact Assessment

Before processing sensitive personal information, using personal information for automated decision-making that has a material impact on individual rights and interests, entrusting processing to or providing personal information to another personal information processor, providing personal information abroad, or carrying out other processing activities that materially affect individual rights and interests, we will conduct a personal information protection impact assessment as required by law and retain records of the processing.

4. Purposes and Legal Bases for Processing

4.1 Purposes of Processing

4.2 Legal Bases

4.3 Legal Bases under the GDPR (for EEA/UK Users)

5. Use of Personal Information

5.1 Internal Use

Your personal information will be used by our staff (including the assigned consultation specialist) within the following scope:

• Reviewing the content of consultation requests and assessing medical needs
• Matching suitable medical institutions and departments
• Communicating with you by email or instant messaging
• Recording consultation progress and service status

5.2 What We Do Not Do

We undertake that we will not use your personal information for the following purposes:

• Sending you marketing information unrelated to medical travel services (unless you have separately and expressly consented)
• Using it for automated decision-making that has a material impact on your rights and interests, or for user profiling unrelated to this service; if automated matching, recommendation, or ranking is enabled in the future, we will separately inform you of its rationale, purpose, and main parameters as required by law, and provide the right to object or to request an explanation
• Selling it to any third party
• Using it for AI model training

6. Sharing of Personal Information with Third Parties

6.1 Data Storage Services

If we use Feishu or other cloud services to store and collaboratively process consultation materials, we will confirm the service provider, product version, server region, and actual processing scope, and will agree with the processor on the processing purposes, duration, methods, categories of information, protective measures, and the rights and obligations of both parties as required by law. The processor bears corresponding responsibility for processing that breaches the entrustment agreement or exceeds our instructions; we perform our statutory duties of selection, agreement, and supervision, but do not automatically bear responsibility beyond what the law provides for the processor's independent unlawful acts.

6.2 Partner Medical Institutions

Where the necessary consent has been obtained and it is necessary for pre-admission assessment, appointment, or performance of the services you request, we may provide the minimum necessary information to the medical institutions you have selected or confirmed that you wish to engage:

Medical institutions generally act as independent personal information processors in determining the purposes, methods, and retention periods of processing related to admission and treatment, and are responsible for their processing activities after receiving the information. Before providing the information, we fulfill the notification obligation and obtain separate consent as required by law; after provision, you should generally contact the medical institution directly to exercise relevant rights, and we will assist within the scope required by law and reasonably practicable.

6.3 Other Third Parties

Third parties such as translation and travel arrangement providers may act as processors or independent personal information processors. We will perform our entrusted-processing agreement and supervision obligations according to their actual role, or notify and obtain separate consent as required by law before providing information to independent processors. Independent personal information processors are responsible for the subsequent processing they decide themselves; we do not warrant processing that goes beyond our instructions or falls within their independent control.

6.4 What We Will Not Share

Other than the circumstances above, we will not share your personal information with any other third party, except in the following circumstances required by law:

• Where required by laws and regulations
• Where required by a lawful request from competent government authorities
• Where necessary to protect your or others' life, health, or property safety

7. Cross-Border Data Transfers

7.1 Cross-Border Transfer Scenarios

This website serves international patients and the following cross-border data flows may occur. Please note: your submission of information from abroad to servers located in China constitutes data entering China; personal information leaving China in the sense of Chinese law may arise only when, after being stored in China, the information is provided by us to organizations or persons abroad, or to systems accessible from abroad:

7.2 Our Cross-Border Transfer Compliance Measures

Before personal information actually leaves China, we will establish ledgers, verify the recipients and the necessity, identify the categories of information, and select the applicable compliance path as required by law. After leaving China, personal information may be subject to foreign laws and the control of recipients; we will assess and adopt contractual, technical, and administrative measures as required by law, but do not give absolute assurances against changes in foreign laws, lawful government access, or recipients' independent unlawful acts beyond the agreement, and we will take measures such as holding recipients accountable and ceasing provision as required by law.

Pursuant to Articles 38 to 40 of the PIPL and the Provisions on Promoting and Regulating Cross-Border Data Flows (effective March 22, 2024), we will adopt the corresponding compliance path depending on the circumstances below:

• Specific exemptions: exemption from filing a cross-border data transfer security assessment, concluding a standard contract for cross-border personal information transfers, or passing cross-border personal information certification may apply only in statutory circumstances such as where the provision of personal information abroad is genuinely necessary for concluding or performing a contract to which you are a party. Whether an exemption applies must be assessed case by case in light of the specific transfer purpose, recipient, necessity, and scope of information, and no blanket presumption is made. The exemption does not relieve other obligations such as notification, separate consent (except where consent is not required by law), personal information protection impact assessment, and security protection.
• Quantitative threshold determination: if no statutory exemption applies, we will select the security assessment, standard contract, or cross-border personal information certification path as required by law, taking into account whether we are an operator of critical information infrastructure, whether important data is involved, and the cumulative volume of general personal information and sensitive personal information transferred abroad since January 1 of the current year:

• Where a non-critical-information-infrastructure operator transfers abroad cumulatively 100,000 or more but fewer than 1,000,000 individuals' general personal information (excluding sensitive personal information), or fewer than 10,000 individuals' sensitive personal information: in principle, conclude a standard contract for cross-border personal information transfers or pass cross-border personal information certification as required by law; except in statutory exemption circumstances
• Where a critical information infrastructure operator provides personal information or important data abroad, or another data processor provides important data abroad, or transfers abroad cumulatively 1,000,000 or more individuals' general personal information (excluding sensitive personal information) or 10,000 or more individuals' sensitive personal information: in principle, file a cross-border data transfer security assessment; except in statutory exemption circumstances

(The above quantitative thresholds are based on the Provisions on Promoting and Regulating Cross-Border Data Flows and the Measures for Cross-Border Personal Information Certification)

• Outbound notification and separate consent: before providing your personal information abroad, we will notify you as required by law of the name, contact details, processing purpose, processing methods, and categories of information of the overseas recipient, and the ways and procedures for you to exercise rights against the overseas recipient, and will obtain separate consent as required by law; except where laws or administrative regulations do not require consent. The outbound transfer of medical and health information will also adopt an independent confirmation mechanism commensurate with the processing of sensitive personal information.
• Uncertainty note: determining the applicable cross-border compliance path involves complex judgments such as data volume statistics and whether important data is involved; we recommend that the specific path be further confirmed by a practicing lawyer in light of the actual business volume.

7.3 Cross-Border Transfers under the GDPR (for EEA/UK Users)

Where the GDPR or UK data protection law applies to the processing activities concerned, we will identify the applicable controller/processor roles, cross-border transfer mechanisms, and supplementary measures, and provide the information required by such laws. Mechanisms that may be adopted include (subject to what is actually signed and implemented):

• Standard Contractual Clauses (SCCs)
• Approved Binding Corporate Rules (BCRs)
• Or other appropriate safeguards recognized under the GDPR

8. Cookies and Tracking Technologies

8.1 Cookies We Use

The cookie banner and preference center at launch will distinguish strictly necessary cookies from non-necessary cookies such as analytics, functional, and advertising cookies, according to what is actually deployed. Except for strictly necessary cookies, we will obtain consent before setting cookies where the law requires it, and allow you to withdraw consent at any time. The cookie name, provider, purpose, duration, and whether cross-border transfer is involved should be itemized in the cookie list.

8.2 Tracking Technologies We Do Not Use

• Unless the cookie list and the consent management interface expressly state otherwise, we do not use Google Analytics or other non-necessary third-party analytics tools to track user behavior
• We do not use advertising tracking cookies
• We do not use cross-site tracking technologies

8.3 Your Choices

You can manage or delete cookies through your browser settings. Please note, however, that disabling necessary cookies may affect the normal use of the website (for example, language preferences may not be saved).

9. Data Security Measures

9.1 Technical Measures

Pursuant to Article 51 of the PIPL, we adopt the following security measures:

We will, in accordance with applicable law and in light of the scale of processing and risk, adopt measures on the basis of the classified protection of cybersecurity, including classification and grading, permission review, vulnerability handling, backup and recovery, log auditing, and emergency response, and will conduct personal information protection compliance audits as required by law. Security measures are subject to actual deployment and risk levels and do not constitute a guarantee that systems will never be interrupted, information will never be lost, or that all attacks can be prevented.

• Transmission protection: adopt encryption or secure transmission measures such as HTTPS/TLS depending on the risk
• Storage protection: adopt encryption, access control, backup, and other measures according to actual deployment, and periodically review cloud service configurations and permissions
• Access control: only authorized staff can access consultation data, with the minimum necessary permissions assigned by role
• De-identification: display sensitive fields in de-identified form in non-essential scenarios
• Logging: record data access logs for audit and traceability

9.2 Administrative Measures

• Internal policies: establish personal information processing operating procedures and designate persons responsible at each stage
• Staff training: provide regular personal information protection training to staff
• Confidentiality agreements: all staff who can access personal information sign confidentiality agreements
• Emergency plans: formulate emergency response plans for personal information security incidents

9.3 Response to Data Security Incidents

If a leak, tampering, or loss of personal information occurs or may occur, we will take the following measures in light of the nature of the incident, its scope of impact, attributable causes, and applicable law; where the incident is caused by user devices, accounts, organizational users, independent third parties, or force majeure, each responsible party bears liability according to its fault and causal contribution as provided by law:

• Users and organizational users should take reasonable measures to protect email accounts, instant messaging accounts, devices, and authorization documents, and send medical records only through the secure channels we designate. Where damage occurs or is aggravated because they disclosed information themselves, misdirected it, lost control of accounts, used insecure channels, or failed to notify us in time, they bear corresponding responsibility as provided by law.
• Immediately take remedial measures
• Notify the department performing personal information protection duties in accordance with Article 57 of the PIPL
• Notify the affected individuals as required by law, informing them of the categories of information involved, the cause and likely harm, remedial measures already taken, measures individuals can take to mitigate harm, and our contact details; except where the law provides that notification is not required
• Retain records of the handling of the incident in accordance with applicable law and internal security management requirements

10. Retention of Personal Information

Early deletion: we will proactively delete your personal information in the following circumstances:

The above periods are counted from the date the corresponding triggering event occurs, and we will periodically review them in light of limitation periods for service disputes, statutory retention obligations, the sensitivity of the data, and the principle of minimum necessity. Upon expiry of the period, we will delete or anonymize the information; where deletion cannot be performed immediately only due to backup technical constraints, we will cease processing other than storage and necessary security protection measures.

• The purposes of processing have been achieved, cannot be achieved, or are no longer necessary
• You withdraw your consent
• We cease providing services
• Other circumstances provided by laws and regulations

If laws or regulations prescribe a longer retention period, we will retain the information as required by law.

11. Your Rights

11.1 Rights under the PIPL of China

Pursuant to Articles 44 to 50 of the PIPL, you enjoy the following rights:

11.2 Rights under the GDPR (for EEA/UK Users)

11.3 Response to the Exercise of Rights

We will handle requests promptly after verifying the requester's identity, authorization, and the scope of the request, and will generally respond within 15 working days; where other time limits are prescribed by applicable law, those limits prevail. For requests that are repetitive, clearly beyond reasonable scope, likely to harm the rights and interests of others, or where identity cannot be verified, we may request supplementary materials, charge necessary costs, defer, or refuse as permitted by law, with reasons provided.

• If we refuse your request, we will explain the reasons
• You have the right to bring legal proceedings in a people's court in accordance with the law
• You also have the right to complain to the department performing personal information protection duties

12. Protection of Minors

12.1 Age Restriction

This website is primarily intended for adults, but medical travel may involve minor patients. We do not process the personal information of minors under the age of 14 without the consent of their parents or other guardians, and we will follow the special rules on processing minors' personal information.

12.2 Minors Accompanied for Medical Treatment

If the patient is under 14, their parents or other guardians should submit the request or give clear authorization, and provide guardian consent as required by law. For patients aged 14 or above but under 18, we will also adopt appropriate guardian involvement and protection measures in light of their age, comprehension, and service risks.

12.3 Obligations of Guardians

When submitting a consultation request on behalf of a minor, the guardian should confirm that they hold lawful guardianship and are responsible for the truthfulness of the information submitted.

13. Third-Party Links

This website may contain links to third-party websites such as medical institutions and travel service providers. Once you voluntarily navigate to them, the third party processes information independently under its own rules, and this Policy does not apply to such independent processing. We do not control third-party websites; however, where we know or should have known of unlawful processing risks, we will take necessary measures such as removing the link as required by law.

14. Changes to This Policy

14.1 Notification of Changes

When a material change is made to this Policy, we will notify you through the following means:

• Posting a notice in a prominent position on this website
• Sending a notice to the email address you provided
• "Material changes" include, without limitation: changes in the types of information collected, changes in the purposes of use, new third-party sharing, changes in cross-border transfer arrangements, and changes in how users exercise their rights.

14.2 Version Management

The version number and effective date are indicated at the top of this Policy. You may review the current version on this website at any time. Historical versions are available on request.

15. Contact Us

15.1 Contact Details for Privacy Matters

If you have any questions or suggestions about this Policy, or need to exercise your rights, please contact us through the following means:

• Email: info@healincn.com
• Phone: +86 175 2173 7495
• Address: Room 1166, 11/F, Huaxu International Tower, 336 Middle Xizang Road, Huangpu District, Shanghai, China

15.2 Response Times

• General inquiries: reply within 5 working days of receipt
• Requests to exercise rights: reply within 15 working days of receipt (GDPR requests: within 30 days)

15.3 Complaints

If you believe our processing of your personal information infringes your lawful rights and interests, you have the right to complain to the following authorities:

• The local cyberspace administration, public security, market regulation, health, or other departments performing personal information protection duties as provided by law (depending on the specific matter)
• The data protection supervisory authority in your country (such as the data protection authority of an EU member state)

16. Appendix: Legal Basis Index

The main laws and regulations cited in this Policy are indexed in the table below: