Privacy Policy

Global Bridge Inc. ("we") handles the personal data collected through Medical Bridge and our medical tourism coordination services in accordance with Japan's Act on the Protection of Personal Information, the EU General Data Protection Regulation (GDPR) and the laws of Spain, the Netherlands and other relevant countries, as set out below. By submitting our inquiry or booking form you agree to this policy.

1. Who we are (data controller)

• Company: Global Bridge Inc. ("we", "us")
• Head office: Hulic JP Akasaka Building, 2-5-8 Akasaka, Minato-ku, Tokyo 107-0052, Japan
• EU establishments: Rambla de Catalunya 125, 08008 Barcelona, Spain / De Ruijterkade 112, 1011AB Amsterdam, Netherlands
• U.S. office: 4700 Millenia Blvd Ste 175, Orlando, FL 32839, United States
• Privacy contact: info@global-bridge.tokyo

We are the business operator handling personal information under Japan's Act on the Protection of Personal Information ("APPI") and the controller under the EU General Data Protection Regulation ("GDPR") for the personal data described in this policy.

2. Scope

This policy applies to all personal data we collect through this website (Medical Bridge, https://medical.global-bridge.tokyo/), including its inquiry and booking forms, through Google Forms we direct you to, through consultations by email, video call or in person, and in the course of providing our medical tourism coordination services.

3. Information we collect

Information you give us directly

• Name, email address, telephone number, country and city of residence, nationality
• The service you are interested in, the content of your inquiry, your preferred timing and preferred means of contact
• Age, date and time of birth, family situation and similar details, to the extent relevant to your inquiry

Information collected while providing our services

• Passport details, accommodation and travel dates, and information needed to arrange your stay and invoice medical costs (limited to what the service you request requires)

Health information (sensitive personal information under the APPI; special-category data under GDPR Article 9)

• Medical history, current symptoms, medication, allergies, pregnancy or breastfeeding status and previous test results
• Results of blood, urine, genetic and SNP tests taken through us, and the physician's findings
• Measurement data exported from wearables such as Apple Watch or from health apps (heart rate, sleep, activity and similar) that you upload through our form or send by email

Information collected automatically

• Access logs such as IP address, browser and operating system, referring URL and time of access, recorded in our hosting provider's server logs

4. Purposes of use

• Responding to inquiries and holding the free initial consultation
• Preparing quotes, concluding and performing contracts, invoicing and confirming payment
• Enabling partner-clinic physicians to assess suitability, booking and coordinating tests and treatments, and preparing and explaining test reports
• Arranging the stay you request, including accommodation, interpreters, transfers and support with visas or bank accounts
• Follow-up after you return home (email and video) and guidance on return visits
• Sending confirmation emails, progress updates and after-service communications
• Improving the quality and security of this website and our services, and preventing misuse and impersonation
• Complying with legal obligations, including accounting, tax and anti-money-laundering requirements
• Sending news and offers from us (only with your consent; you can unsubscribe at any time)

If we need to use your information for any other purpose, we will obtain your consent first.

5. Legal bases (GDPR)

If you are in the European Economic Area (EEA), we process your personal data on one of the following bases:

• Your consent (GDPR Article 6(1)(a))
• Performance of a contract, or steps taken at your request before entering into one (Article 6(1)(b))
• Compliance with a legal obligation (Article 6(1)(c))
• Our legitimate interests in improving and securing our services, where these are not overridden by your rights and interests (Article 6(1)(f))

Health information is processed only with your explicit consent under GDPR Article 9(2)(a). You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

6. Sharing with third parties and processors

We do not share personal data with third parties except as described below. We never sell personal data or share it for advertising purposes.

Sharing based on your consent

• We share the minimum necessary information with our partner clinics in Barcelona and their physicians, the laboratories performing tests, and interpreters, for the purpose of assessing suitability and carrying out tests, treatments and interpretation. We explain in the pre-consultation who will receive what, and health information is shared only after your explicit consent.
• Partner clinics create and keep medical records as independent controllers under Spanish law (Law 41/2002 on patient autonomy, Organic Law 3/2018 on data protection and digital rights, and related rules). We will help you direct requests concerning medical records to the clinic.

Processors acting on our behalf

• Website hosting and form submissions: Netlify, Inc. (United States)
• Email, document and file storage, and Google Forms: Google LLC (Google Workspace, Google Forms, Google Drive)
• Providers of video-conferencing, e-signature, invoicing and payment tools

We have confidentiality and data-processing agreements with our processors and supervise their handling of your data.

Disclosure required by law

• Where required by law; where necessary to protect life, health or property and consent is difficult to obtain; where specially necessary for public health or child welfare; or where cooperation with public authorities performing statutory duties is required
• In connection with a merger, business transfer or similar succession, in which case the successor will be bound by protections equivalent to this policy

7. International transfers

We have offices in Japan, Spain, the Netherlands and the United States, and our processors operate servers in the United States and elsewhere. Your personal data may therefore be transferred between these countries.

• Transfers from the EEA to Japan rely on the European Commission's adequacy decision for Japan.
• Transfers from the EEA to the United States or other countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework or another transfer mechanism permitted under Chapter V of the GDPR.
• For residents of Japan, this policy constitutes the information required under Article 28 of the APPI about the provision of personal data to third parties located abroad (the processors and partners listed above), and we obtain your consent when you submit our form. Information on the data protection systems of the destination countries is available from the Personal Information Protection Commission of Japan or from us on request.

8. Retention

• Inquiries that do not lead to a contract: deleted within two years of our last contact.
• Contracts: contracts, invoices and copies of application documents are kept for the period required by Japanese and other applicable law after the contract ends (in principle seven years for accounting records) and then deleted or anonymised.
• Health information and measurement data: deleted from our systems once sharing and coordination with the partner clinic are complete and the post-return follow-up period (in principle three months) has ended, or earlier at your request. Medical records held by partner clinics are retained by the clinic under Spanish law.
• Access logs: up to twelve months from collection.

Longer retention may apply where the law requires it or where it is needed to resolve a dispute.

9. Cookies and analytics

This website does not currently use advertising cookies or third-party tracking tools. We may store minimal information in your browser needed for the site to work, such as your language preference or form-submission state.

If we introduce analytics tools such as Google Analytics in future, we will update this policy and, where required, obtain your consent through a consent banner.

10. Security

• Encryption in transit (TLS), least-privilege access to stored data and two-step verification
• Restriction of personal-data handling to designated staff, regular training and strict confidentiality duties
• Selection criteria for processors and partners, and regular review of their handling
• Prompt deletion or disposal of personal data that is no longer needed

In the event of a personal data breach, we will notify the competent supervisory authority (within 72 hours of becoming aware, where GDPR applies) and affected individuals without undue delay, in accordance with applicable law.

11. Confidentiality (NDA)

Because our medical tourism coordination services involve sensitive matters concerning your life plans, business, family and finances and health, we make the following confidentiality commitments.

• We will keep strictly confidential all personal data, information about your family, assets, business and career, health, test results and treatments, and any other information you disclose to us in confidence during consultations and the provision of our services ("Confidential Information"), and will not disclose it to any third party without your prior consent.
• We will use Confidential Information only for the purpose of performing the services you request.
• Our officers and staff, processors and partner professionals and partner clinics are bound by contract to confidentiality obligations at least as strict as ours, and access to Confidential Information is limited to those who need it for their work.
• These obligations continue after the consultation ends and after our services are completed.
• The following is not Confidential Information: information already public when disclosed; information lawfully obtained from a third party without a duty of confidentiality; information whose disclosure is required by law or by order of a court or public authority (in which case we will notify you in advance where legally permitted); and information you have agreed may be disclosed.
• Consultations with physicians and medical records are additionally protected by medical confidentiality under Spanish law.
• If you would like a separate written non-disclosure agreement (NDA) in addition to this policy, please contact info@global-bridge.tokyo. We can sign our standard form or one you provide.

12. Your rights

• Access: you may ask what personal data we hold about you, for what purposes and with whom it has been shared.
• Rectification and erasure: you may ask us to correct or complete inaccurate data and to delete data that is no longer needed (the "right to be forgotten").
• Restriction: you may ask us to stop using your data or to limit how it is processed.
• Data portability: where GDPR applies, you may receive the data you provided in a structured, machine-readable format.
• Objection: you may object to processing based on legitimate interests and to direct marketing, which you can stop at any time.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact info@global-bridge.tokyo. After verifying your identity to prevent impersonation, we will respond within one month (and without delay for requests under the APPI). No fee is charged.

If you are not satisfied with our response, you may lodge a complaint with a supervisory authority: in Japan, the Personal Information Protection Commission; in Spain, the Agencia Española de Protección de Datos (AEPD); in the Netherlands, the Autoriteit Persoonsgegevens; or the data protection authority of the EEA country where you live.

13. Children

Personal data of anyone under 16 (or a different age where the law of your country so provides) should be provided only with the consent of a parent or guardian. Please obtain the agreement of family members before sharing their information with us.

14. Links to other sites

External sites linked from this website, including partners, public authorities and Google Forms, are governed by their own privacy policies, for which we are not responsible.

15. Changes to this policy

We may update this policy to reflect changes in the law or in our services. Significant changes will be announced on this website, and the updated policy applies from the time it is published here.

16. Contact

Global Bridge Inc., Privacy Officer

Hulic JP Akasaka Building, 2-5-8 Akasaka, Minato-ku, Tokyo 107-0052, Japan

EU contact: Rambla de Catalunya 125, 08008 Barcelona, Spain

Email: info@global-bridge.tokyo

Effective date: 7 October 2026