Privacy policy
I. This Policy
This policy explains how Shanghai Shanen Health Management Service Co., Ltd. (hereinafter referred to as "FamilyAid" or "We") collects, uses, shares, and protects your personal information when you visit this website or use our Medical Care Coordination Service (hereinafter referred to as "This Service").
FamilyAid is an organization that provides coordination services for international patients seeking medical care on the Chinese mainland. We are not a hospital, clinic, or healthcare facility. Hospitals and physicians are independent processors of your medical data, handling this information in accordance with their respective privacy policies and applicable laws.
By using this website or this service, you acknowledge that you have read this Policy. For cases involving processing based on consent (particularly with respect to health information and its cross-border transmission), we will obtain your consent separately, without binding it to your acceptance of the Terms and Conditions; you may withdraw your consent at any time.
II. Who We Are and How to Get in Touch
FamilyAid is the processor of the personal data referred to in this policy (the "controller" under the GDPR).
Operating Entity: Shanghai Shanen Health Management Service Co., Ltd.
Registered Address: 2nd Floor, Nos. 378–380, Pingfu Road, Xuhui District, Shanghai
Contact information: shanenguoji@familyaid.com.cn (Please include "Privacy Matters" in the email subject line)
Personal Data Protection Officer / Data Protection Officer (DPO): Xiaodong Xu; please contact them at shanenguoji@familyaid.com.cn. Given that our processing of health-related data has reached a significant scale, we have established this role in accordance with Article 37 of the GDPR and Article 52 of the Personal Information Protection Law.
III. Information Collected by Us
3.1 Information voluntarily provided by you
Identity and Contact Information: Name, email address, phone number, WhatsApp/WeChat account, country of residence.
Itinerary and scheduling information: intended city, estimated consultation time, number of accompanying persons; passport details required for hospital registration or for applying for a visa invitation letter.
Voluntarily provided health information: symptoms, diagnosis, medical history, medication history, medical records, imaging and pathological data, previous treatments, and additional notes.
Case History Record: Your messages, call records, and documents sent to us.
Payment information: billing details and transaction records. Bank card data is processed by the payment service provider; we do not store the full card number.
3.2 Automatically collected information
Device and technical data (IP address, browser type and version, operating system, device type, language settings); usage data (pages viewed, access time, time spent on page, source channel, click behavior); and Cookies and similar technologies (see Article 11). Analytics and marketing technologies will not be loaded until you consent to their use.
3.3 Information from third parties
With your authorization, we may obtain information from partner hospitals (e.g., appointment records, discharge summaries), from the physician you have designated, from family members who have submitted information on your behalf, or from the insurance company you have requested us to coordinate with.
IV. Health Information (Sensitive Personal Information)
Health information is classified as special category data under the EU/UK GDPR; as sensitive personal information under the CCPA/CPRA in California, USA; and as sensitive personal information under China's Personal Information Protection Law.
We collect and use health information only in the following circumstances:
Obtain your separate, explicit consent during data collection; record the timestamp, form version, and the original consent text displayed;
Essential for preparing or coordinating the medical care arrangement you have requested; and
Limited to the minimum scope required to achieve this purpose.
We do not use health information for advertising, marketing, user profiling, automated decision-making, or general model training; nor do we sell such information.
We have conducted a Data Protection Impact Assessment (DPIA) for the aforementioned processing activities in accordance with Article 35 of the GDPR, and have also carried out a Personal Information Protection Impact Assessment (with the report retained for three years) pursuant to Articles 55 and 56 of the Personal Information Protection Law; furthermore, we maintain records of all processing activities that are available for inspection by the competent authorities.
Health information is shared only with: the partner hospitals and physicians involved in reviewing or treating your case, the coordinator and medical translator assigned to you; upon your request, it may also be shared with your insurance provider or your local physician.
You may withdraw your consent at any time by sending an email to shanenguoji@familyaid.com.cn. Withdrawing your consent does not affect any actions that have already been taken prior to such withdrawal; however, it may prevent us from continuing to coordinate medical care for you.
V. How We Use Your Information and the Legal Basis
| Purpose of Use | Specific circumstances | Legal Basis (GDPR) |
|---|---|---|
| Reply to your inquiry | Review Case, Select Option, Quote | Steps to be taken prior to entering into or performing a contract; health information constitutes express consent. |
| Coordinate medical care | Medical record translation, arrangement of second clinical consultation, appointment scheduling, hospitalization, and translation personnel | Express consent; for the conclusion or performance of a contract |
| Contacting you | Service progress, schedule changes, result notification, follow-up | Performance of the contract; lawful interests |
| Payment & Invoicing | Issuing invoices, collecting fees, and maintaining statutory accounting books and records | Performance of the contract; statutory obligations |
| Improve websites and services | Aggregate statistics and service quality assessment | Legal interests; Analytical technology – Agreement |
| Marketing (only if you choose to receive it) | Service Updates, Healthcare Guide, Rehabilitation Information | Agree; can be withdrawn at any time. |
| Law and Compliance | Responding to legitimate claims, archiving, and defending against claims | Legal obligations; lawful interests |
Where consent is required, you may withdraw it at any time without affecting the legality of the processing conducted prior to such withdrawal; where the processing is based on legitimate interests, we have conducted a balancing exercise, and you have the right to object.
VI. With whom do we share information?
We share information only when necessary:
Partner hospitals and primary care physicians — name, contact information, passport details required for hospital registration, as well as medical record information necessary for assessment and treatment. Each hospital processes your data independently in accordance with its own policies and applicable laws (including relevant regulations on medical record management in China); we do not issue clinical instructions to the hospitals.
In-house coordinators and translators – Our more than 400 in-house field service personnel, along with translators hired as needed, have all signed written confidentiality agreements and are permitted to access only the information necessary for their work.
Service providers (trusted service providers) – cloud hosting and storage (medical data is prioritized for use on Chinese mainland nodes), email and instant messaging, CRM, payment processing, finance, translation tools, and website analytics service providers. They act solely at our discretion, have signed data processing agreements, and shall not use your data for their own purposes. The current list can be provided upon request.
Travel and Logistics Provider – Visa documentation, airport pickup and accommodation partners; used only upon your request for us to arrange these services.
Your insurance provider or your local doctor — available only upon your request.
Regulatory and legal procedures – undertaken in accordance with laws, regulations, court orders or government requirements; or where such procedures are necessary to establish, assert or defend legal claims, or to protect the material interests of natural persons. We will inform you within the scope permitted by law.
Business Changes – In the event of a merger, reorganization, or asset transfer, data may be transferred to a transferee; the transferee shall remain subject to this Policy, or you may be notified in advance regarding the different purposes for which the data is being transferred.
We do not sell personal information, nor do we share personal information for cross-scenario behavioral advertising; furthermore, we do not disclose any health-related information to advertising platforms.
VII. Cross-border Transmission
Our partner hospital is located on the Chinese mainland. This service involves two transmissions in opposite directions, each subject to different rules:
(1) Inbound transmission: Overseas → Chinese mainland
If you are located in the European Economic Area, the United Kingdom, Switzerland, the United States, or other regions, your personal information will be transmitted to the Chinese mainland for processing.
For entities operating within the European Economic Area: China does not yet have a sufficient adequacy determination from the European Commission; therefore, we rely on Standard Contractual Clauses (SCC, Decision No 2021/914), supplemented by a Transfer Impact Assessment (TIA) and supplementary technical measures (dynamic and static encryption, strict access control, data minimization, and anonymization where feasible). The assessment has substantially taken into account the risk of data being requested by Chinese authorities in accordance with the law, as well as the remedies available to you.
From the UK: Use the UK International Data Transfer Addendum (IDTA/Addendum) and the Data Transfer Risk Assessment.
You may request the relevant safeguard measures document.
(2) Outbound transmission: Chinese mainland → Overseas
When we transfer personal information from China to a境外 recipient (for example, when using overseas cloud, email, or instant messaging services, or when, at your request, forwarding the data to your domestic physician), Article 38 of the Personal Information Protection Law shall apply. The measures we take include: undergoing a security assessment by the National Cyberspace Administration, obtaining a personal information protection certification, or submitting a standard contract for filing with the provincial cyberspace administration; and, prior to transmission, obtaining your separate consent in accordance with Article 39, while informing the overseas recipient of the recipient's name, contact information, purpose of processing, method of processing, type of information, and the manner in which you can exercise your rights with that recipient.
⚠ Practical Note: The use of WhatsApp, overseas email services, or overseas cloud services all constitutes the transfer of personal information abroad. For medical records, imaging data, and pathological materials, please use the secure domestic upload channel provided by us; if you contact us via WhatsApp or other channels on your own initiative, it indicates your acceptance of the nature of data transmission through such channels; however, we will not send your complete medical records via such channels.
VIII. Shelf Life
| data | storage life |
|---|---|
| Unprocessed consultation records | 24 months since the last contact |
| Case files and medical records | Three years from the date of completion of the self-service (aligned with the limitation period for civil actions); this period shall be extended where a lawsuit is pending or where the law imposes otherwise. |
| Contracts, Invoices, and Accounting Records | According to the time periods stipulated by Chinese accounting and taxation regulations |
| Consent Form (Health Information, Cross-Border Transfer) | For a period of 3 years from the date of approval, as compliance evidence documentation |
| Marketing Contact Data | The subscription will be terminated upon your cancellation or after 24 months of inactivity. |
| Cookie Consent Record | 6–12 months |
| Website Analysis (Summary) Data | 14 months |
Original images and pathological records are retained only for the duration of clinical review or the current medical visit; an authoritative copy of the medical record is kept by the hospital; we do not retain these records long-term. Upon expiration, such records shall be securely deleted or anonymized.
IX. Safety Measures
The measures include: Transport Layer Security (TLS) and static encryption; role-based least-privilege access control and multi-factor authentication for internal systems; written confidentiality commitments from all employees and partners; regular review of access privileges; secure data deletion procedures; supplier security assessments; logging and monitoring; incident response plans; and specialized training on the handling of health information.
There is no absolute security for internet transmission or electronic storage; we cannot guarantee perfect security. We recommend using the encrypted upload channel we provide.
In the event of a personal data breach, we shall, in accordance with Article 33 of the GDPR, notify the competent authorities within 72 hours, provided that such notification is not unduly delayed and is feasible; we shall also notify you personally when there is a high risk to your rights and interests, and we shall fulfill our notification and reporting obligations under the Personal Information Protection Law.
X. Your Rights
European Economic Area / United Kingdom (GDPR / UK GDPR): Access, Correction, Erasure, Restriction of Processing, Data Portability, Right to object to processing (including direct marketing), Revocation of consent at any time, Exemption from the requirement to subject automated decision-making processes to human intervention, and the right to lodge a complaint with the competent data protection authority.
California (CCPA / CPRA): Be informed about the categories and specific nature of the personal information collected, its source, purpose, and the categories of recipients; delete; correct; refuse to sell or share (we do neither); restrict the use and disclosure of sensitive personal information (we only use such information when providing you with the requested services; however, you may still exercise this right); appoint a authorized representative; and not be discriminated against for exercising these rights. We support the Global Privacy Control (GPC) signal.
Chinese Mainland (Personal Information Protection Law): Rights including the right to be informed and to make decisions, the right to access and copy personal information, the right to rectify or supplement personal information, the right to delete personal information, the right to withdraw consent, the right to request interpretation or processing rules, the right to request transfer of personal information to another processor when statutory conditions are met, and the right to cancel an account. When processing personal information of minors under the age of 14, we shall obtain the consent of the parents or other guardians and apply the special rules for the processing of children's personal information.
How to exercise your rights: Send an email to shanenguoji@familyaid.com.cn, with the subject line clearly stating "Privacy Matters." We will verify your identity (you may be required to provide information consistent with your records; a authorized representative must provide proof of authorization) and respond within 1 month for GDPR requests (this period may be extended by an additional 2 months upon notification), within 45 days for CCPA requests (this period may be extended by an additional 45 days), or within 15 working days for PIPL requests. Exercising your rights is free of charge, except in cases of clearly unreasonable or excessive requests.
XI. Cookies and Similar Technologies
We use necessary, functional, and analytical technologies, as well as marketing technologies that are only activated with your consent. Non-essential scripts are not loaded until you consent; marketing technologies are disabled by default and are never used on health-related pages. You can adjust your preferences at any time via the "Cookie Settings" section in the footer; please refer to our Cookie Policy for more information.
XII. Children's Privacy
This service is not intended for children. Within the European Economic Area and the United Kingdom, we do not collect personal data of children under the age of 16 without the consent of their parents or guardians; within China, the processing of personal data of minors under the age of 14 requires the consent of their guardians and is subject to special regulations. For patients under the age of 18, all consent documents must be submitted and signed by their parents or guardians. If you believe that a child has provided us with information without obtaining the necessary consent, please contact shanenguoji@familyaid.com.cn, and we will promptly delete the relevant data.
13. Third-party websites
This website may contain links to third parties, such as partner hospitals, visa authorities, or insurance companies. We are not responsible for the content or privacy practices of these third parties; please review their respective policies before providing any information to them.
14. Policy Changes
The updated version will be published on this page with a new update date indicated. In the event of material changes (e.g., the addition of new processing purposes, new recipient categories, or new cross-border transmission scenarios), we will notify you separately via email or through a prominent announcement, and will obtain your consent again where required by law. By continuing to use this Website or this Service after such changes take effect, you shall be deemed to have accepted the revised Policy.
15. Contact and Complaints
Shanghai Shanen Health Management Service Co., Ltd.
2nd Floor, Nos. 378–380 Pingfu Road, Xuhui District, Shanghai
shanenguoji@familyaid.com.cn
If you are located within the European Economic Area or the United Kingdom and are not satisfied with our response, you may file a complaint with your local data protection authority; if you are located in California, you may file a complaint with the California Privacy Protection Bureau or the Attorney General; if you are located in China, you may file a complaint or report with the Cyberspace Administration of China or the relevant competent authorities.