Privacy policy (including protection of children's personal information)

The controller of personal information is Chengdu MedBridge Medical Management Co., Ltd., unified social credit code 91510107MA6ACY3X4N, ICP filing Shu ICP Bei 2026024704.

Our personal information protection officer can be reached through the contact page or directly through your coordinator. We commit to answering requests for access, correction and deletion within fifteen business days.

Identity and contact data: child's name, sex, date of birth, nationality, identity document type and number (passport or ID), guardian's name and contact details, country of residence.

Health data (sensitive personal information): presenting complaint, past history, diagnosis, pathology reports, imaging, laboratory results, genetic test results, medication and allergy history, surgical records, current treatment.

Service data: consultation records, proposal documents, booking and travel arrangements, in-hospital records in China, interpreting and escort notes, fee and payment evidence.

Technical data: access logs, IP address, device and browser type, page paths. Used for security and troubleshooting; not used for advertising profiles.

Personal information of a minor under fourteen is sensitive personal information. To process it we must obtain the explicit consent of the parents or other guardian, in a form that leaves a record — a signed document, an electronic signature, or a recordable verbal confirmation. Implied consent and pre-ticked boxes are not accepted.

We apply the principle of minimum necessity: only fields directly relevant to this coordination are collected. Historical information unrelated to the current condition is not actively solicited; where a family volunteers information the service does not need, we do not enter it into our systems and delete it promptly.

Children's personal information is never used for profiling, targeted marketing, algorithmic recommendation, behavioural analysis or any commercial exploitation. We do not serve advertising to families based on a child's health status.

We do not create publicly visible case pages, story pages or promotional material for a child under fourteen. Any case presentation requires written guardian consent and irreversible de-identification — removal of name, face, identifiable time and place, and any rare-disease-plus-location combination that could re-identify the child.

A guardian may withdraw consent to processing of a child's personal information at any time. On withdrawal we stop processing and delete the information, except that records of medical services already delivered are kept for the retention period required by law.

To prepare and translate records, conduct specialist assessment, match departments and specialists, coordinate bookings and travel, prepare visa documents, interpret and escort in China, and follow up after treatment.

For internal statistics to improve service quality, in which case data is de-identified first and cannot be traced back to an individual.

For legal purposes: responding to lawful requests from judicial or regulatory authorities, or where necessary to address a situation that endangers life.

Never for: sale, exchange or rental to third parties; marketing unrelated to this service; training externally provided models.

To deliver the service we provide necessary information to: the intended hospital and its departments (records, imaging, results); medical translation providers (document segments requiring translation); visa document recipients (invitation letter and plan summary); transfer, accommodation and insurance providers (name, dates, contact details and party size only).

Every recipient must sign confidentiality and data processing terms specifying purpose, duration, security measures and liability for breach. We do not assume substitute liability for a recipient's independent processing, but will terminate the relationship on discovery of a breach.

Beyond legal requirements and the service necessities above, we disclose nothing to any third party — including not disclosing a family's payment capacity to partner hospitals, and not disclosing individual cases to commercial partners.

Families are usually outside China and records must reach hospitals inside China. That transfer is a cross-border flow of personal information, and we apply the following: encrypted channels; document-level access permissions; access limited to staff with a genuine need; retention of transfer and access logs.

Where transfer originates in the EU, Russia or another jurisdiction with localisation requirements, we obtain separate consent or execute the applicable clauses as local law requires, and where feasible prefer the family uploading records itself, reducing our active retrieval.

Recipients of cross-border transfers are limited to partner hospitals in China and necessary service providers. We do not route a child's information to unrelated third countries.

Data is stored on servers in China. Access rights are configured minimally by role, and sensitive fields are encrypted at rest.

Retention: enquiries that do not convert are kept for twelve months; medical records of concluded cases are kept for five years from the end of service, aligned with the customary retention period for medical documentation; security access logs are kept for six months.

At expiry data is deleted or irreversibly anonymised. Where law imposes a longer mandatory retention, that period applies and access remains restricted afterwards.

Access and copy: you may request a copy of the personal information we hold about you.

Correction: you may request correction of inaccurate information. For clinical records, correction follows the originating institution.

Deletion: you may request deletion where the purpose is fulfilled, consent is withdrawn, or the processing is unlawful.

Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.

Refusal of automated decisions: we do not make automated decisions with significant effect on you based on personal information. If that changes, a human review channel will be provided.

Complaint: you may complain to the regulator, or to us first. We commit to a reply within fifteen business days.

Measures include encryption in transit and at rest, least-privilege access control, operation logging, staff confidentiality training and contractual constraints, and periodic access reviews.

On any actual or suspected leak, tampering or loss, we begin assessment immediately, report to the regulator as required by law, and notify affected families by a channel reasonably calculated to reach them — describing the nature of the incident, its likely impact, the measures taken, and any protective steps the family can take.

When this policy is amended for regulatory change or business adjustment, the change is published on this page with a new effective date. Where the purposes, methods or categories of processing change materially, the guardian's explicit consent is obtained again.