隐私政策 / Privacy Policy

EN1. Scope of this Policy

This Policy applies to all collection and processing of personal data by %%COMPANY_NAME%% ("Reach Care", "we", "us") through the website reachcarehealth.com (including its sub-pages, booking and enquiry forms), by email and through our other communication channels. It describes the categories of data we collect, why and how we use them, with whom we share them, how long we keep them, where they are transferred, and how you can exercise your rights.

We provide this information in accordance with the Personal Information Protection Law of the People's Republic of China (PIPL), the EU/UK General Data Protection Regulation (GDPR) and other mandatory laws applicable to our activities. If you are resident in the European Union or the European Economic Area, the United Kingdom, Brazil, Japan, South Korea or Southeast Asia, the provisions on your rights and complaint channels apply to you as well. Where mandatory law in your jurisdiction affords you greater protection than this Policy, that law prevails.

This Policy is published in Chinese and English, both versions having equal force. Where the mandatory law of your jurisdiction requires a specific language version to prevail or requires a local-language version, that requirement prevails.

EN2. Data Controller and Contact Details

Data controller: %%COMPANY_NAME%%.

Registered address: %%ADDRESS%%.

Unified social credit code / registration number: %%REGISTRATION_NO%%.

Privacy contact: %%PRIVACY_EMAIL%%.

For the purposes of Article 4(7) GDPR and Article 73 PIPL, the entity named above is the controller of your personal data. You may contact us at the email address above to exercise the rights set out in section 10, or to raise any question or complaint regarding the processing of your personal data.

EN3. Personal Data We Collect

We collect only the data necessary to provide medical coordination and related services. Information you provide voluntarily through our booking form, enquiry field or other channels includes:

• Identifiers: first name and last name;
• Contact details: email address and telephone number;
• Location and travel: country of residence, city, place of departure, intended travel date range and expected length of stay;
• Service preferences: the medical service you are interested in and your language preference;
• Communications: any information you choose to enter in the enquiry field (see section 4 regarding health-related information);
• Technical and source data: the referring page and the country associated with your IP address.

We do not intentionally collect biometric data, precise location tracking, financial account details or full identity document numbers. If you voluntarily provide medical records, laboratory reports, imaging or other clinical documents, we use them solely to assess your request and to coordinate the services you have asked for.

Please provide only information that is directly relevant to your enquiry, and refrain from submitting health information about third parties who are not the subject of the request.

EN4. Health-Related Data and Separate Consent

Health information that you choose to enter in the enquiry field or in other free-text communications — such as your health condition, medical history, surgical history, allergies, medication and summaries of laboratory or imaging results — is health-related sensitive personal data. It constitutes "special categories of personal data" within the meaning of Article 9 GDPR and sensitive personal information under Article 28 PIPL.

We process such data only on the basis of your separate, explicit consent (Article 9(2)(a) GDPR; Article 29 PIPL), and only to assess whether the relevant medical services are suitable for you, to pass necessary information to the medical institution and to arrange your care. We do not use your health information for marketing, and we do not sell it or disclose it to unrelated third parties.

You are not obliged to provide health information. If you do not, we may be unable to complete the assessment required to arrange an appointment or coordinate services, but this will not prevent you from browsing this website or contacting us with general questions. If you provide health information on behalf of another person (for example your minor child or a family member you care for), you confirm that you are duly authorised to do so; see also section 11 for minors.

EN5. Purposes and Legal Bases for Processing

We process your personal data for the following purposes, relying on the legal bases indicated:

• Responding to your enquiry, assessing your needs, providing indicative itineraries and cost estimates, and assisting with an appointment when you decide to proceed — Article 6(1)(b) GDPR (performance of, or steps prior to entering into, a contract); Article 13(1)(2) PIPL.
• Coordinating supporting services such as translation, accompaniment, travel, visa and local ground services — same legal basis as above.
• Sending service-related notices, itinerary reminders and post-treatment follow-up coordination for services you have requested — Article 6(1)(b) GDPR, or Article 6(1)(f) legitimate interests where these do not override your rights and freedoms; Article 13(1)(2) PIPL.
• Maintaining the security of our website and communications, preventing misuse and fraud, troubleshooting and carrying out aggregated, non-identifying analytics — Article 6(1)(f) GDPR (legitimate interests); Article 13(1)(6) PIPL.
• Sending service information or marketing, and processing health-related sensitive data, in each case on the basis of your consent — Articles 6(1)(a) and 9(2)(a) GDPR; Article 13(1)(1) and Article 29 PIPL. You may withdraw your consent at any time.
• Complying with legal obligations, responding to lawful requests from regulators or courts, and establishing or defending legal claims — Article 6(1)(c) GDPR; Article 13(1)(3) PIPL.

If you do not provide the information necessary for the first three purposes above, we may be unable to arrange your appointment or coordinate services. You may browse this website without consenting to processing that is not necessary. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

EN6. Cookies and Browser Local Storage

This website uses strictly necessary cookies and browser local storage, for example to remember your language preference and to support basic page functionality. These items are stored on your device and are generally not transmitted to our servers automatically. You can review, delete or block cookies and local storage at any time through your browser settings; doing so may reset preferences such as your language choice.

We use Cloudflare Web Analytics for aggregated website traffic measurement. It does not set cookies, does not track you across websites and is not used to identify individuals.

We do not use third-party advertising cookies and we do not carry out interest-based advertising. If we deploy non-essential cookies or similar technologies in jurisdictions that require consent, we will obtain your consent in advance and provide an equally simple way to withdraw it.

EN7. Sharing and Processing by Third Parties

We do not sell or rent your personal data, and we do not provide it to third parties for consideration. To achieve the purposes described above, we may share data with, or engage as processors, the following categories of recipients, strictly to the extent necessary and always subject to confidentiality and data-security obligations:

• Partner medical institutions and licensed physicians — for appointment scheduling, clinical assessment and treatment;
• Travel agencies and local ground and translation providers — for visa documentation support, flights, accommodation, ground transport and on-site interpretation or accompaniment;
• IT, cloud hosting and email service providers — for website operation, data storage, system maintenance and communications;
• Disclosures required by law or requested by you — where required by law, regulation or a lawful request from a competent authority, or where necessary to protect the vital interests or safety of you or another person; where you have expressly asked us to share information with a specific third party (for example a family member or your doctor at home), we will act on your instructions.

We enter into data protection and confidentiality terms with our processors, require them to implement appropriate security measures and prohibit them from using the data for purposes other than those we have instructed. We never sell your health information to anyone.

EN8. Cross-Border Transfers

We operate in the People's Republic of China. Personal data necessary to provide our services to you will be transferred to, and stored in, mainland China, and will be processed by our partner medical institutions and our translation and ground-service providers to the extent required to deliver the services.

Our transfers rely on the following safeguards:

• For data originating in the EU/EEA or the UK, we rely on Article 46 GDPR and enter into the European Commission's Standard Contractual Clauses (2021/914) with the overseas recipient, carrying out a transfer impact assessment and adopting supplementary measures where necessary;
• Under Article 38 PIPL, we complete cross-border provision through one of the statutory routes (standard contract, security assessment or personal information protection certification) and comply with the information and separate-consent requirements of Article 39 PIPL;
• For sensitive personal information such as medical records and health data, we will obtain your separate consent before the transfer and inform you of the name or category of the overseas recipient, contact details, purposes and methods of processing, categories of data involved, and the way in which you may exercise your rights against the overseas recipient.

We put in place contractual, technical and organisational measures to ensure that overseas recipients provide a level of protection for your personal data that is not lower than that described in this Policy. Where the law of your jurisdiction imposes stricter requirements on international transfers, we will comply with those requirements.

EN9. Retention Periods

Applying the principle of data minimisation, we keep your personal data only for as long as necessary for the purposes described in this Policy. In setting retention periods we follow these principles:

• Enquiries that do not proceed to a booking are kept for a reasonable period after our last contact, and are then deleted or irreversibly anonymised;
• Information required to deliver the services (for example appointment and coordination records) is kept for a reasonable period after the service relationship ends, so that we can handle follow-up, queries and disputes;
• Records relating to medical treatment are kept in accordance with the requirements of the relevant medical institution and applicable law;
• Financial, tax and contractual records are kept for the mandatory retention periods prescribed by law;
• Where you withdraw consent or request erasure and we have no other lawful basis to retain the data, we will delete or anonymise it.

When a retention period expires, we delete your personal data or render it irreversibly anonymous, unless the law requires otherwise.

EN10. Your Rights and How to Exercise Them

To the extent provided by applicable law, you have the following rights in relation to your personal data:

• Access and copies: to confirm whether we process your personal data and to obtain a copy of it (Article 15 GDPR; Article 45 PIPL);
• Rectification: to have inaccurate or incomplete data corrected or completed (Article 16; Article 46 PIPL);
• Erasure: to have data erased in the circumstances provided by law (Article 17; Article 47 PIPL);
• Restriction: to obtain restriction of processing in the circumstances provided by law (Article 18);
• Objection: to object to processing based on legitimate interests, and to object at any time to processing for direct marketing purposes (Article 21; Article 44 PIPL);
• Portability: to receive the personal data you provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller (Article 20; Article 45 PIPL);
• Withdrawal of consent: to withdraw your consent at any time, as easily as it was given (Article 7(3); Article 15 PIPL), without affecting the lawfulness of processing carried out before withdrawal;
• Automated decisions: to obtain human intervention and an explanation in respect of decisions based solely on automated processing (Article 22) — we do not currently make such decisions;
• Complaint: to lodge a complaint with a supervisory authority, including the data protection authority of your EU/EEA member state, the UK Information Commissioner's Office (ICO), the competent authorities in China (including the cyberspace administration, public security and market regulation authorities), the Brazilian National Data Protection Authority (ANPD), the Japanese Personal Information Protection Commission (PPC) and the Korean Personal Information Protection Commission (PIPC).

How to exercise your rights: please send your request to %%PRIVACY_EMAIL%%. Requests relating to a minor should be made by a parent or other guardian. To protect your information, we may ask you for the details necessary to verify your identity. In accordance with Article 12(3) GDPR we will respond within one month of receiving your request; in accordance with Article 50 PIPL we will respond within 15 working days. Where a request is complex or we receive a number of requests, we may extend this period and will tell you the reasons and the expected time frame. You will not be treated less favourably for exercising these rights.

EN11. Minors

Our services are intended for adults aged 18 or over. Anyone under 18, or who is a minor under the law of their own jurisdiction, must act through a parent or other guardian, who may submit the enquiry, make the booking, sign the relevant documents and provide personal data on their behalf; that consent must be genuine, freely given and verifiable.

As a matter of principle we do not process the personal information of children under 14. Where processing is genuinely necessary for a specific service, we will obtain the separate consent of the child's parent or other guardian and adopt dedicated processing rules. A minor's health information is sensitive personal information, and we process it only with the separate consent of the guardian.

If we become aware that we have collected a minor's personal data without guardian consent, we will delete or anonymise it without undue delay.

EN12. Security Measures

We implement technical and organisational measures proportionate to the risk, including: encrypted transmission across the website (HTTPS/TLS); least-privilege access controls and identity verification for systems and data; confidentiality and data protection undertakings with staff and partners, supported by privacy training; system log auditing, vulnerability checks and a security incident response process; and minimisation and, where appropriate, de-identification of sensitive information.

If personal data is or may have been breached, altered or lost, we will activate our response process without delay, take remedial measures and notify you and the competent authorities as required by law, explaining the circumstances, the possible consequences and the steps you can take. Please note that no technical measure can guarantee absolute security; communicate with us only through our published official channels and avoid posting health information or medical records on public platforms.

EN13. Changes to this Policy

We may update this Policy from time to time to reflect legal, regulatory or operational changes. The updated version will be published on this page with its effective date. Where a change is material — for example to the purposes of processing, the categories of data, the recipients or the routes of cross-border transfer — or where the law requires fresh consent, we will notify you by a prominent notice on this website or by other effective means, and will seek your consent again where necessary. We recommend that you review this page periodically to stay informed of the current version.

EN14. Effective Date

This Policy takes effect on %%EFFECTIVE_DATE%%. It applies to the collection and processing of personal data from that date until it is replaced by a new version.

EN15. How to Contact Us

If you have any question, comment or complaint about this Policy, or wish to exercise the rights described in section 10, please contact our privacy contact:

Email: %%PRIVACY_EMAIL%%
Post: %%COMPANY_NAME%%, %%ADDRESS%%
WhatsApp / WeChat: +86 18758577890

We will deal with your request promptly and respond within the time frames set out in section 10.