ヘルプ
お問い合わせ

Privacy Policy

Organization Name Document Name Document Owner
AIRS Medical Inc. Privacy Policy Jonghyeng Park, CPO
Effective Date Version Document Approver
May 14, 2026 1.0 Jangsoon Park, CEO
1. Introduction and Purpose

This supplemental notice (“Japan Notice”) applies to individuals located in Japan whose personal information is handled by AIRS Medical in connection with the provision of our products and services. This Japan Notice supplements our [General Privacy Policy] and provides additional information required under Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) (“APPI”). In the event of any conflict between the Privacy Policy and this Japan Notice, this Japan Notice shall prevail for individuals located in Japan.

AIRS Medical Inc., including its subsidiaries and affiliates (collectively “AIRS Medical,” “we,” “us,” or “our”), operates in Japan through AIRS Medical Japan G.K.

2. Data Handling Entity and Business Structure

2.1 Business Operator Handling Personal Information

Item Details
Business Operator AIRS Medical Japan G.K. (AIRS Medical Japan合同会社)
Address 15-16F, Toranomon Hills Business Tower, 1 Chome-17-1 Toranomon, Minato City, Tokyo 105-6490, Japan
Representative (代表社員) Sunghwan Lee イ・ソンファン
Privacy Inquiries Contact [email protected]
3. Categories of Personal Information Collected

3.1 Website and Business Operations

We may collect the following categories of personal information through our website, events, and business operations:

  • Name, job title, organization/employer, business contact details (email, phone, address)
  • Technical data (IP address, browser type, device information, access logs)
  • Marketing and communication preferences

3.2 Patient-Related Data

In the course of providing our service, AIRS Medical may process patient-related data(e.g., DICOM metadata, Medical imaging data) on behalf of healthcare providers. In this capacity, AIRS Medical acts as an entrusted party and processes such data strictly in accordance with the healthcare provider’s instructions and applicable law.

3.3 De-identification Measures for Cloud-Based Processing

Given the nature of our products and services, we apply appropriate data protection measures to patient data during cloud-based processing. Where technically feasible, de-identification measures are applied prior to transmission. Where the nature of the service requires that certain patient identifiers be transmitted to the cloud environment for clinical purposes, such data is protected by industry-standard encryption and access is strictly limited to authorized personnel on a need-to-know basis. For on-premises deployments, all data processing occurs within the healthcare institution's own infrastructure.

4. Purpose of Use

We specify and publicly announce the following purposes for which we use personal information:

Category Purpose of Use
Business contact information (healthcare professionals, distributors)
  • Provision and support of our product and services.
  • Management of distribution agreements and EULA;
  • Customer and distributor relationship management;
  • Product information and event invitations; invoicing and payment processing; regulatory compliance
Patient-related data (DICOM metadata, imaging data)
  • Provision of MRI image enhancement service as entrusted by the healthcare provider;
  • Quality assurance and improvement of AI models (only with de-identified or anonymously processed data and where permitted);
  • compliance with medical device regulations
Website visitor data (technical data, cookies)
  • Website operation and improvement;
  • usage analytics;
  • security monitoring
Inquiry and support data
  • Responding to inquiries;
  • providing customer support;
  • product improvement

We will not use personal information beyond the scope necessary to achieve these purposes without obtaining prior consent, except where permitted by APPI Art. 18(3).

5. Handling of Special Care-Required Personal Information

Our products and services may involve the processing of Special Care-Required Personal Information (such as medical history and health-related data) on behalf of healthcare providers. In such cases, we process this information solely as an entrusted party, in accordance with the instructions of the healthcare provider who is responsible for obtaining any necessary consent or legal basis for the collection of such information.Our service agreements set forth the respective responsibilities of AIRS Medical and the healthcare provider regarding the handling of such information

6. Third-Party Provision of Personal Data

We will not provide personal data to third parties without the prior consent of the individual, except in the following circumstances permitted under APPI Art. 27:

  • Where required by law (e.g., requests from regulatory authorities, court orders)
  • Where necessary for the protection of the life, body, or property of an individual, and it is difficult to obtain the consent of the individual
  • Where specially necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain consent
  • Where entrusting the handling of personal data to a third party within the scope necessary for achieving the purpose of use

We may entrust the handling of personal data to authorized distributors and service partners to the extent necessary for the provision of our products and services. We exercise necessary and appropriate supervision over such entrusted parties in accordance with APPI Art. 25.

7. Joint Use of Personal Information

AIRS Medical Japan G.K. may jointly use certain personal data with the following parties for the purposes described below:

  • Data items jointly used: Name, job title, company or institution name, business contact details (email, phone, address), and related business correspondence
  • Scope of joint users: AIRS Medical Inc. (Republic of Korea) and its subsidiaries (United States, Germany)
  • Purpose of joint use: Product and service delivery, customer and distributor relationship management, marketing and promotional activities, and business operations, and to achieve the purposes of use that have been notified or publicly announced.
  • Entity responsible for management of jointly used data: AIRS Medical Inc., 13-14 Floor, Keungil Tower, 223 Teheran-ro, Gangnam-gu, Seoul, Republic of Korea ([email protected])

This joint use does not apply to patient-related data, which is processed strictly as an entrusted party on behalf of healthcare providers as described in Section 5.

8. Cross-Border Transfer of Personal Data

In the course of providing our services, personal data collected in Japan may be transferred to the following countries outside Japan:

Country Purpose of Transfer Protection Mechanism Compliance Monitoring
Republic of Korea Product and service delivery;
System administration;
Customer management;
Privacy-related inquiries 		APPI-equivalent measures ensured through intra-group data protection rules.
Korea's Personal Information Protection Act (PIPA), enforced by PIPC. 		Annual compliance review
Germany Business operations of AIRS Medical Europe GmbH;
Customer management for EU region 		APPI-equivalent measures ensured through intra-group data protection rules.
EU General Data Protection Regulation (GDPR), recognized by PPC as equivalent protection. 		Annual compliance review
United States Business operations of AIRS Medical U.S Inc;
Cloud-based business operations (CRM, communication, collaboration, infrastructure backup);
Customer management for U.S region 		APPI-equivalent measures ensured through Data Processing Agreements with service providers;
security certifications (SOC 2 Type 2, ISO 27001 and its series) 		Annual compliance review and periodic confirmation of service providers' security measures

Information on Personal Data Protection Systems of Recipient Countries

Republic of Korea: Korea's Personal Information Protection Act (PIPA) is enforced by the Personal Information Protection Commission (PIPC). Korea has not been designated by the PPC as a country with equivalent protection; however, AIRS Medical ensures APPI-equivalent measures through intra-group data protection rules and ongoing compliance monitoring.

Germany (EU): Germany is subject to the EU General Data Protection Regulation (GDPR). EU member states have been recognized by Japan's PPC as providing an equivalent level of protection (PPC Announcement No. 1, January 23, 2019).

United States: The United States does not have a comprehensive federal data protection law equivalent to APPI. Protection is ensured through Data Processing Agreements with cloud service providers, security certifications (SOC 2 Type 2, ISO 27001 and and its series), and periodic compliance monitoring by AIRS Medical.

Where personal data is transferred to countries other than those listed above, we will ensure appropriate safeguards are in place in accordance with applicable law. For patient-related data, de-identification measures are applied prior to any cloud-based processing.

9. Security Control Measures

AIRS Medical implements the following categories of safety management measures in accordance with APPI Art. 23 and PPC Guidelines:

  • Organizational measures (組織的安全管理措置): Designation of a Chief Privacy Officer (CPO); internal rules and procedures for handling personal data; regular compliance monitoring; incident response and breach notification procedures.
  • Personnel measures (人的安全管理措置): Regular data protection training for authorized personnel; strict contractual confidentiality obligations; access restricted on a need-to-know basis.
  • Physical measures (物理的安全管理措置): 24-hour security monitoring of premises; access control to areas housing devices used to process personal data.
  • Technical measures (技術的安全管理措置): Encryption of data in transit and at rest; two-factor authentication (2FA) and strong password policies; access control management; verified third-party service providers under Data Processing Agreements.

For further details, please refer to the 'Data Security and Safety' section of our Global Privacy Policy.

10. Rights of the Individual

Your general rights regarding personal data are described in the 'Your Legal Rights' section of our Global Privacy Policy. In addition to those rights, under APPI, you may exercise the following rights regarding retained personal data (保有個人データ) held by AIRS Medical Japan G.K.:

  • Request notification of the purpose of use (利用目的の通知)
  • Request disclosure of your personal data or records of third-party provision (保有個人データ又は第三者提供記録の開示)
  • Request disclosure of your personal data and records of third-party provision (開示請求)
  • Request correction, addition, or deletion (訂正等請求)
  • Request suspension of use, erasure, or cessation of third-party provision (利用停止等請求)

Fees: In accordance with Article 38 of the APPI, a fee of ¥1,000 (including tax) per request will be charged for "Notification of Purpose of Use" and "Disclosure(including records of third-party provision)" requests. Details on the payment method will be provided upon your request.

Note for Patients: For personal data processed by AIRS Medical on behalf of a healthcare provider, please direct your request to the relevant healthcare provider, as AIRS Medical acts as an entrusted party in such cases. To exercise these rights, please contact us using the information provided in Section 15 below.

11. Data Breach Notification

In the event of an actual or suspected leakage, loss, or damage of personal data, AIRS Medical will promptly investigate the incident. Where required under APPI Art. 26, we will submit a preliminary report to the Personal Information Protection Commission (PPC) promptly and a detailed report within the timeframe prescribed by applicable regulations, and notify affected individuals without delay.

In cases where AIRS Medical processes personal data as an entrusted party, we may fulfill our obligations by notifying the relevant healthcare provider (Data Controller) without delay.

12. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Notice, or as required by applicable law. The retention period varies depending on the nature of the data, the purpose of processing, and our legal obligations. When personal data is no longer necessary, we securely delete or anonymize it.

For patient-related data processed as an entrusted party, retention periods are determined by the healthcare provider in accordance with applicable laws. Data processed for the purpose of image enhancement is not retained beyond the period necessary to complete processing and return results.

For further details, please refer to the 'Data Retention' section of our Global Privacy Policy.

13. Cookies

Our use of cookies and similar technologies on the AIRS Medical website is described in the Global Policy. Where cookie data or similar person-related information may be provided to third parties who may associate it with other information to identify an individual, we will obtain or confirm the necessary consent in accordance with applicable law. Users may manage their cookie preferences through the cookie banner displayed on our website.

External Transmission of Information

To improve our website performance and analyze visitor traffic, we use third-party tools (e.g., Google Analytics). In this process, certain technical information (such as IP addresses, browser type, and browsing history) may be transmitted to the servers of these service providers located outside of Japan (including the United States). This data is used solely for website analytics purposes and is strictly separated from the clinical or patient-related data processed by our medical software services.

14. Children’s Personal Information

Our website and services are not directed at individuals under 16 years of age. While APPI does not specify a minimum age for consent, AIRS Medical has adopted 16 years of age as our internal standard for the collection of personal information from minors. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 16 without verified parental consent, we will take steps to delete such data promptly.

15. Complaints and Inquiries

For any inquiries, complaints, or requests relating to the handling of your personal information by AIRS Medical in Japan, please contact:

AIRS Medical Japan G.K.

  • Email: [email protected]
  • Postal Address: 15-16F, Toranomon Hills Business Tower, 1 Chome-17-1 Toranomon, Minato City, Tokyo 105-6490, Japan

If you are not satisfied with our response, you may file a complaint with Japan’s Personal Information Protection Commission (PPC):

Change Log

Date Version Description Reason Author
May 14, 2026 1.0 Initial Release Enactment Hyejun Yoon

Language

KR
Global (EN)
EMEA (EN)
JP
DE
いいえ
はい