Data protection and cross-border care

Privacy Policy

How Medical Supporter collects, uses, stores, and shares personal and medical information, including contact channels for APPI, GDPR, PIPL, and other privacy rights.

Last updated: 2026-08-03

1. Data controller

新義豊株式会社 (Medical Supporter) is responsible for personal data processed through this website and our medical coordination services. Address: 福岡県福岡市博多区博多駅南3丁目17番15-402号シャトー福泉; email: service@medicalsupporter.org; website: https://medicalsupporter.org.

2. Information we collect

We may collect your name, contact details, nationality, language, medical summary, records, test reports, imaging, prescriptions, insurance and payment information, passport or visa-related details, and information you provide through forms, LINE, WhatsApp, email, or phone.

3. Purposes of use

We use data to answer inquiries, assess suitable Japanese medical institutions, translate records, arrange second opinions, book appointments, support visa steps, accompany clinic visits, process payments, follow up, keep legal records, handle disputes, and improve service quality.

4. Medical information and consent

Medical information is highly sensitive. We process it only with explicit consent from you or your lawful representative, to perform our agreement, to protect vital interests, or where law permits, and share it only with recipients necessary for referral, translation, visa, and care coordination.

5. Sharing and international transfers

To deliver services, we may share necessary data with Japanese medical institutions, physicians, translators, travel or lodging support, payment providers, IT vendors, insurers, and legal advisers. Data may be processed in Japan, your location, or vendor locations, using contracts, access limits, and data minimization.

6. LINE voice, AI calls, and international processing

When you send voice through LINE or ask us to contact a medical institution, voice, transcripts, medical summaries, insurance status, preferred visit timing, call audio, and conversation summaries may be processed by services such as LINE, Twilio, OpenAI, and Cartesia for recognition, transcription, AI dialogue, speech synthesis, quality, and security. These providers may process data outside Japan.

We handle original LINE voice audio only transiently during recognition and do not store it in our company database. The voice transcript and the related medical-coordination case record are retained for no more than 30 days, then deleted or de-identified. We minimize data and disclose to medical institutions only what is needed for coordination, such as the medical summary, insurance status, and timing.

For AI calls to medical institutions, Twilio provides the real-time call connection, speech recognition, and transcription; OpenAI processes the dialogue; and Cartesia generates speech. Medical summaries, insurance status, preferred visit timing, call audio, and dialogue data may be processed outside Japan. We do not retain Medical Supporter AI-call recordings or full verbatim transcripts, although each provider may retain necessary data under its contract with us and its data-processing policies.

You may use text only in LINE and may cancel an AI call before it is placed. Withdrawal of consent applies only to future processing and does not affect processing already completed or records that must be retained by law. Cancelling an AI call does not require us to provide a manual call or another substitute service.

7. Retention and security

We retain data only as long as needed for services, accounting, tax, medical coordination records, legal duties, or dispute handling. We use access controls, encrypted transmission, least-privilege access, vendor review, and confidentiality measures, but no internet transmission is absolutely secure.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, withdrawal of consent, or a copy of your data. Contact us at service@medicalsupporter.org; we may verify identity before acting on medical data requests.

9. Cookies and analytics

Necessary storage supports security, language, and form-abuse prevention. Google Analytics runs only after analytics consent and receives only non-sensitive parameters such as query-free page paths, language, broad service category, and conversion source; names, contact details, medical information, and free text are never sent to analytics. With analytics consent, first-party attribution data (UTM, gclid, fbclid, landing page, and origin-only referrer) is retained for up to 30 days and may accompany an inquiry or checkout initiation in the existing case or payment workflow. Cookie choices last up to 180 days. Meta Pixel and Google Ads tags are not currently active; if configured later, they must wait for advertising consent. You may reject or withdraw through the footer settings; withdrawal removes GA cookies and attribution storage that the site can clear.