Privacy Policy
Date of establishment: January 10, 2017
Date of last revision: August 25, 2026
0. Purpose
Medical Excellence JAPAN (hereinafter "MEJ") recognizes that the appropriate handling of personal information is a social responsibility in the course of providing the services offered through this website (including https://www.japaninternationalhealthcare.org/) — namely the Japan International Healthcare (hereinafter "JIH") recommendation program, overseas publicity and other activities (hereinafter collectively, the "Services") — and hereby establishes this Policy in accordance with the Act on the Protection of Personal Information (Act No. 57 of 2003; hereinafter the "APPI"), relevant guidelines, and the Guidance concerning the Appropriate Handling of Personal Information by Medical and Nursing Care Related Businesses.
1. Name, Address and Representative of the Business Operator Handling Personal Information
Name of the corporation: Medical Excellence JAPAN (MEJ)
Address: Nihonbashi Life Science Building 2 #804, 3-11-5 Nihonbashi-honcho, Chuo-ku, Tokyo 103-0023, Japan
Chief Executive Officer (CEO): Kenji Shibuya
Department in charge: Administration Department
2. Scope of Application
This Policy applies to all aspects of the Services, including browsing of the official website, search for recommended medical institutions, inquiry forms, e-mail newsletters, various procedures, and notice of web conferences and events in which MEJ is involved.
3. Collection of Personal Information
3.1 Items Collected
MEJ collects the following personal information by lawful and fair means, to the extent necessary for the provision of the Services:
- Name, gender, date of birth, nationality, language(s) used
- E-mail address; relationship with the traveler
- Details of inquiries and applications
- Basic patient information necessary for coordination with recommended medical institutions (limited to the minimum necessary)
- Website browsing information (cookies, IP addresses, browser information, device information, referrer, access date and time, etc.)
- Usage history of the Services
3.2 Methods of Collection
As a rule, MEJ collects personal information directly from the individual concerned, and notifies or publicly announces the purpose of use in this Policy or on the relevant screen before collection.
4. Purposes of Use of Personal Information
MEJ uses the personal information collected only for the following purposes and will not use it beyond the scope necessary to achieve such purposes. If the purpose of use is changed, MEJ will notify or publicly announce the change to the individual concerned in advance or after the change.
(1) Overseas publicity activities (multilingual website, coordination with government and related organizations, media relations, etc.)
(2) Handling inquiries from and coordination with medical institutions in Japan and overseas, overseas remittance institutions, patients overseas, and other parties
(3) Provision of information regarding the Services, compilation of statistics, service improvement and development
(4) Access analysis (understanding and analysis of usage through cookies, etc.)
(5) Notice of training sessions and seminars for recommended medical institutions and related organizations
(6) Notifications and reports required by laws and regulations
5. Handling of Special Care-Required Personal Information
MEJ will not, in principle, collect special care-required personal information (Article 2, Paragraph 3 of the APPI), such as medical information and medical history, without the explicit consent of the individual concerned. In cases where such information must unavoidably be collected, such as inquiries to determine whether recommended medical institutions can respond to a case, MEJ will individually examine whether the case falls under any of the items of Article 17, Paragraph 2 of the APPI and obtain the consent of the individual concern where necessary.
When providing such information to a third party, MEJ will obtain the consent of the individual concerned in writing or by electronic means, notwithstanding the main text of Article 27, Paragraph 2 of the APPI.
6. Personal Information of Users Under 16 Years of Age
When MEJ collects personal information from users under the age of 16, MEJ will, in principle, obtain the consent of their legal representative (such as a person with parental authority). When providing services specifically intended for users under the age of 16, MEJ will also publicly notify parents and other persons with parental authority of such services.
7. Security Management Measures
MEJ takes the following measures to prevent the leakage, loss or damage of personal data and to ensure other aspects of security management. MEJ aims to obtain ISO/IEC 27001 (JIS Q 27001) certification by the end of December 2026, and the operation of this Policy will be managed in an integrated manner with the relevant ISMS.
(1) Organizational security management measures
- Clarification of the person responsible for the management of personal information protection and the departments handling personal information
- Establishment of rules concerning security management and audits of their operation status
- Establishment of procedures for responding to incidents (reporting, notification to the individual concerned, and reporting to the Personal Information Protection Commission)
(2) Human security management measures
- Provision of training and education to employees at least once a year
- Obtaining written undertakings of confidentiality
(3) Physical security management measures
- Access control to offices and server rooms
- Prevention of theft of equipment and recording media
- Shredding and erasure of unnecessary documents
(4) Technical security management measures
- Access control (granting of minimum necessary privileges and periodic review)
- Encryption of communications (TLS 1.3, etc.)
- Anti-virus measures for devices, log collection and monitoring
- Backup and recovery drills
(5) Understanding of the external environment
- Regularly confirming the operating environment of the Services and reviewing security management measures as necessary
8. Provision of Personal Data to Third Parties
MEJ will not provide personal data to third parties without the consent of the individual concerned, except in the following cases:
(1) Where provision is based on laws and regulations
(2) Where provision is necessary for the protection of the life, body or property of an individual and it is difficult to obtain the consent of the individual concerned
(3) Where provision is particularly necessary for improving public health or promoting the sound upbringing of children and it is difficult to obtain the consent of the individual concerned
(4) Where provision is necessary for a national institution, a local government or a person entrusted by them to execute affairs prescribed by laws and regulations, and obtaining the consent of the individual concerned is likely to impede the execution of such affairs
When providing personal data to a third party, MEJ will record the recipient, the items provided and the purpose of use, and retain such records for the prescribed period (Article 29 of the APPI).
9. Provision to Third Parties in Foreign Countries (Cross-Border Transfers)
MEJ may provide personal data to third parties in foreign countries in connection with overseas coordination with recommended medical institutions, collaboration with overseas remittance institutions and other activities. In such cases, MEJ will do so by one of the following methods:
(1) Provision to a country recognized by the Personal Information Protection Commission as having a system for the protection of personal information equivalent to that of Japan
(2) Provision after notifying the individual in advance of the following matters and obtaining the consent of the individual concerned:
- Name and location of the recipient
- Information concerning the system for the protection of personal information in the relevant country
- Information concerning the measures taken by the recipient to protect personal information
(3) Provision to a business operator certified by the Personal Information Protection Commission as having established a system conforming to certain standards concerning its rules and arrangements for handling personal data
(4) Provision by a method prescribed by the rules of the Personal Information Protection Commission, such as concluding standard contractual clauses
The name of the recipient, the country in which it is located and the level of protection will be made public on a dedicated consent screen or in a separate schedule before the provision.
10. Outsourcing of Handling Operations
MEJ may outsource the handling of personal data to external business operators to the extent necessary for the provision of the Services. MEJ selects outsourcing contractors after evaluating their information security implementation status, incident history and other factors, and concludes contracts that include confidentiality obligations and audit rights.
If an outsourcing contractor intends to re-outsource any handling, prior or subsequent approval of MEJ is required. MEJ supervises outsourcing contractors through written or on-site confirmation at least once a year.
11. Joint Use
MEJ may jointly use personal data with related organizations, recommended medical institutions, overseas remittance institutions and others. When conducting joint use, MEJ will notify or publicly announce the following matters to the individual concerned in advance:
- The scope of the parties engaged in joint use
- The purpose of use of the parties engaged in joint use
- The items of personal information subject to joint use
- The name of the person responsible for the management of the personal information
- The method of collection
12. Handling of Pseudonymized Information and Anonymized Information
MEJ will not create pseudonymized information or anonymized information for the time being.
If MEJ creates such information in the future, it will establish rules prohibiting acts aimed at identifying individuals and will handle such information appropriately in accordance with Articles 41 through 43 of the APPI and relevant guidelines.
13. Response to Data Leakage and Other Incidents
In the event of a leakage or other incident subject to the reporting obligation, MEJ will report to the Personal Information Protection Commission without delay and notify the individual concerned. The types of incidents subject to the reporting and notification obligations are those prescribed in Article 7 of the Enforcement Rules of the APPI as being likely to harm the rights and interests of individuals (inclusion of special care-required personal information, risk of property damage due to unauthorized use, unauthorized means using advanced information and communications technology, etc.).
If notification to the individual concerned is difficult, MEJ will take alternative measures such as posting a notice on this website.
14. Cookies and Access Analysis (Response to Rules on External Transmission)
MEJ may use cookies and similar technologies on this website to improve convenience, understand usage and improve the Services. Users can choose whether to permit transmission via the consent banner displayed when use of the website begins.
(1) Content of transmitted information
Cookie ID, IP address, browser information, device information, browsing history, language settings, etc.
(2) Transmitting business operators
| Service Name | Provider |
|---|---|
| Google Tag Manager | Google LLC |
| Google Analytics | Google LLC |
| Google Search Console | Google LLC |
| Microsoft Clarity | Microsoft Corporation |
(3) Purpose of use
Analysis of usage, creation of statistics, service improvement, optimization of advertisement delivery, etc.
The names of transmitting business operators, the names of the countries of destination, the purposes of use and other matters will be made readily available to users before any transmission.
15. Handling of Statistical Information and Attribute Information
MEJ creates and publishes only statistical information from which individual persons cannot be identified, for the purpose of analyzing usage.
MEJ will not publish or provide to third parties any information in a form that could identify a specific individual.
16. Matters Notified Regarding Retained Personal Data
MEJ notifies individuals concerned of the following matters regarding retained personal data:
- Name, address and representative of the business operator handling personal information
- Purpose of use of all retained personal data (same as Article 4)
- Procedures for requests for disclosure and other requests, and for requests for suspension of use and other requests (same as Article 17)
- Contact point for complaints (same as Article 18)
17. Requests for Disclosure, Correction, Suspension of Use, etc.
The individual concerned may make the following requests regarding their retained personal data held by MEJ:
(1) Request for disclosure (including provision by electronic means)
(2) Request for correction, addition or deletion
(3) Request for suspension of use or erasure
(4) Request for suspension of provision to third parties
Requests are accepted at the inquiry desk set out in Article 18. After verifying the identity of the applicant (identification document, certificate of seal registration, e-mail address verification, etc.), MEJ will respond in principle within two weeks.
The application form and any fees will be notified at the time of the request. If the request falls under grounds on which disclosure may be refused under laws and regulations, MEJ may decline the request after explaining the reasons.
18. Contact for Inquiries and Complaints
Inquiries and complaints regarding the handling of personal information are accepted at the following contact:
Department in charge: Administration Department, Medical Excellence JAPAN (MEJ)
Address: Nihonbashi Life Science Building 2 #804, 3-11-5 Nihonbashi-honcho, Chuo-ku, Tokyo 103-0023, Japan
Telephone: +81-3-6261-3971 (main)
E-mail: jih@me-jp.org
Office hours: Weekdays 10:00 a.m. – 5:00 p.m. (excluding year-end/new-year holidays and public holidays)
19. Compliance with Laws and Regulations and Continuous Improvement
MEJ reviews the operation status of this Policy and related rules on a regular basis (at least once a year), reviews and improves them as necessary, and provides ongoing training to employees.
20. Revision and Publication of This Policy
MEJ may revise this Policy in response to amendments to laws and regulations, changes in the content of the Services or other necessity. When this Policy is revised, MEJ will promptly publish it on this website and record the revision history in the Supplementary Provisions. For important changes, MEJ will notify users of the Services individually or through e-mail newsletters and other means to the extent possible.
Supplementary Provisions (Revision History)
January 10, 2017: Established
August 25, 2026: Last revision