Handling of Personal Information

Date of enactment September 18, 2020
Date of last revision February 1, 2023
Bridgian Corporation
Representative Director Hiroshi Natsukawa

WITH RESPECT TO THE PROTECTION OF ALL PERSONAL INFORMATION HANDLED BY OUR COMPANY, WE ARE FULLY AWARE OF OUR SOCIAL MISSION AND COMPLY WITH LAWS AND REGULATIONS REGARDING THE PROTECTION OF THE RIGHTS OF THE INDIVIDUAL AND PERSONAL INFORMATION. IN ADDITION, WE HEREBY DECLARE THAT WE HAVE ESTABLISHED A PERSONAL INFORMATION PROTECTION MANAGEMENT SYSTEM TO REALIZE THE FOLLOWING POLICY, AND THAT WE WILL MAKE COMPANY-WIDE EFFORTS TO CONTINUOUSLY IMPROVE THE SYSTEM WHILE ALWAYS BEING AWARE OF THE LATEST TRENDS IN IT TECHNOLOGY, CHANGES IN SOCIAL DEMANDS, AND CHANGES IN THE BUSINESS ENVIRONMENT.

1. Personal information shall be obtained, used, and provided only to the extent necessary for the Company's legitimate business operations in the medical coordination business, postpartum care business, and service operations, as well as for the employment and personnel management of employees. We will also take measures to ensure that personal information is not used for purposes other than those specified.
2. We will comply with laws, regulations, national guidelines, and other norms regarding the protection of personal information.
3. To prevent the risk of leakage, loss, or damage of personal information, we will continuously improve our personal information security system by injecting management resources that match the actual conditions of our business in order to prevent such risks by taking reasonable security measures. In addition, we will promptly take corrective measures if any problems are found in the protection of personal information.
4. We will respond promptly, sincerely, and appropriately to complaints and consultations regarding the handling of personal information.
5. The personal information protection management system will be reviewed in a timely and appropriate manner in light of changes in the environment in which the Company operates, and improvements will be made on an ongoing basis.

... and upwards

1. Purpose of use of personal information handled by the Company

   Personal data in possession [Subject to disclosure

   Classification.	Purpose of Use
   Customer information from inquiries received through our website, e-mail, etc.	To respond to inquiries (including contacting the individual)
   Personal Customer Information	To provide medical coordination For customer support To manage your usage history To respond to inquiries
   Mamma Levata's membership information	To provide postpartum care services For member support For member management To respond to inquiries from members
   MammaLevata Visitor Information	For facility tours and introductions
   Information for the person in charge of your business partner	To confirm the contents of the request (e.g., correspondence records)
   Our Employee Information	For human resource management, business management, health management, and security management of employees
   Information on applicants for employment with the Company (including applicant information obtained from application forms)	To contact applicants for employment and to manage the Company's recruitment operations
   Identified Personal Information	For the purposes of use stipulated in the Numbering Act

2. Outsourcing the Handling of Personal Information
   In the course of business operations, we may outsource the handling of personal information to outside parties within the scope of the purposes of use described in the previous section. In this case, we will select a contractor with a high level of personal information protection, sign a contract for appropriate management and confidentiality of personal information, and have the contractor implement appropriate management.
3. Voluntary nature of providing personal information
   Whether or not you provide us with your personal information is voluntary. However, if you do not provide the required information, we may not be able to respond appropriately.

With regard to requests from the individual or his/her representative for notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, elimination, or suspension of provision to a third party (hereinafter referred to as "Request for Disclosure, etc.") of retained personal data or records provided to a third party held by the Company, the following procedures will be used. The following procedures will be used to respond to such requests.

1. Business Entity
   Bridgian Corporation
   5F THE FORME GINZA, 8-18-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan
   Representative Director Hiroshi Natsukawa
2. Personal Information Protection Manager
   Administrator Name: Yu Xi
   Department: Medical Tourism Department
   Contact: 03-5809-3026
3. Purpose of Use of All Retained Personal Data
   Purposes of Use of Personal Information" in "1. Purposes of Use of Personal Information" in "■ Handling of Personal Information".
4. Contact for complaints regarding handling of retained personal data
   BRISIAN Co., Ltd. Personal Information Inquiry Desk
   THE FORME GINZA 5F, 8-18-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan
   TEL 03-5809-3026 FAX 03-5809-3027
   E-mail: yu@brisian.co.jp
5. Name of authorized personal information protection organization and contact for complaint resolution
   Japan Information Processing Development Corporation
   Secretariat of Authorized Personal Information Protection Organizations
   Roppongi First Building, 1-9-9 Roppongi, Minato-ku, Tokyo 106-0032, Japan
   03-5860-7565 / 0120-700-779
   (Only complaints regarding the handling of personal information are accepted.
6. Procedures for responding to requests for disclosure, etc. of retained personal data
   1. Contact for Requests for Disclosure, etc.
      For requests for disclosure, etc., please contact the Personal Information Inquiry Desk above.
      If you wish to request disclosure, etc. through electromagnetic procedures, please let us know. In principle, we will respond in accordance with your request.
   2. Procedures for Requests for Disclosure, etc.
      (1) After receiving your request, we will send you by mail the prescribed request form "Request Form for Disclosure, etc. of Retained Personal Data" that you are requested to use.

      Please send the completed request form, a document verifying that the request is made by a representative, and a postal money order for the handling fee (only for requests for notification of purpose of use and disclosure) to the Personal Information Inquiry Desk above.

      (3) After receiving the above request form, we will ask you for information on about two items of personal information registered with us (e.g., telephone number and date of birth, etc.) that can be used to verify your identity.

      In principle, responses will be sent in writing (by sealed envelope) to the person in question.

   3. If the request is made by a representative, a document confirming the representative's identity
      If the person requesting disclosure, etc. is a representative, please enclose documents proving the representative's identity and documents proving the representative's identity. The information on the place of domicile included in each document should be limited to the prefecture of origin, and any information after that should be blacked out or otherwise processed. Please send us documents that do not include your personal number, or black out all the digits.

      (1) Documents proving that the person is a representative
      ＜In the case of a representative authorized by the principal to make a request for disclosure, etc.
      A letter of attorney from the principal (original)
      A copy of either of the following
      A copy of the family register
      Certificate of residence (showing the relationship between the minor and the agent)
      Other official documents that confirm the authority of legal representation
      A copy of any of the following
      Certificate of registered matters concerning guardianship registration, etc.
      Other official document that can confirm the authority of legal representation

      (2) Documents proving the identity of the proxy
      Driver's license
      Passport
      Health insurance card (all digits of the symbol, number, etc. of the insured person, etc. must be blacked out)
      Certificate of residence

   4. Fee for requests for notification or disclosure of purpose of use
      1,000 yen per request
      (If the request is made in writing, please enclose a postal money order with the request form, etc. to be sent to us. If the request is made by other means, we will consult with you at the time of request)
7. Measures taken for the secure management of retained personal data
   1. Formulation of Basic Policy
      To ensure the proper handling of personal data in our possession, we have formulated a "Personal Information Protection Policy" regarding "Compliance with Relevant Laws, Regulations, Guidelines, etc." and "Contact Point for Questions and Complaints Handling.
   2. Establishment of Rules for Handling Retained Personal Data
      For each stage of acquisition, use, storage, provision, deletion/disposal, etc., of personal data in our possession, we have established personal information protection rules regarding handling methods, responsible persons/persons in charge, and their duties, etc.
   3. Organizational Safety Control Measures
      (1) In addition to appointing a person responsible for the handling of retained personal data, the Company clarifies the employees who handle retained personal data and the scope of retained personal data handled by such employees, and maintains a system for reporting to the person responsible in the event that a fact or indication of a violation of the law or handling regulations is detected.
      The Company conducts periodic self-inspections of the handling of retained personal data, as well as audits by other departments and outside parties.
   4. Personnel Safety Control Measures
      (1) Regular training is provided to employees on points to keep in mind regarding the handling of retained personal data.
      (2) All employees are required to submit a written pledge regarding confidentiality of personal data, including retained personal data.
   5. Physical Security Control Measures
      (1) In the area where retained personal data is handled, the Company controls the entry and exit of employees, restricts the equipment, etc. that they may bring into the area, and takes measures to prevent unauthorized persons from viewing retained personal data.
      (ii) Measures are taken to prevent theft or loss of equipment, electronic media, and documents, etc. that handle retained personal data, and measures are taken to ensure that retained personal data is not easily identified when such equipment, electronic media, etc. are carried, including during transportation within the business site.
   6. Technical Safety Control Measures
      (1) Access control is implemented to limit the scope of persons in charge and the personal information database, etc. handled.
      (2) A mechanism is in place to protect the information system that handles retained personal data from unauthorized external access or unauthorized software.

... and upwards