Privacy Policy / プライバシーポリシー

2.1 Who we are (Controller)

This Privacy Policy describes how Asmario LLC (“we”, “us”, “our”) processes Personal Data in connection with Curelina (the “Service”).

• Company name: Asmario LLC
• Address: 5F-B ParkFront Hakata-ekimae 2nd, 1-23-2 Hakata-ekimae, Hakata-ku, Fukuoka-shi, Fukuoka, Japan
• Contact (privacy inquiries): support@curelina.org

2.2 Scope

This Policy applies to Personal Data we collect or process in connection with the Service, including potentially sensitive data such as health/medical information, and related information (collectively, “Personal Data”).

2.3 Roles (Healthcare customers and end users/patients)

The Service is typically used by healthcare organizations, facilities, or other entities (each, a "Customer") for professional purposes.

The Service employs technical measures to minimize the inadvertent capture of patient information during image analysis and similar operations. However, in the event patient or similar data is included in information uploaded or entered into the Service, the Customer is generally the data controller (or equivalent), and we act as a processor/service provider on the Customer's behalf under applicable agreements.

• If you are a patient or otherwise an end user whose data was provided by a Customer, please direct requests to exercise your rights to that Customer.
• We may act as an independent controller for data necessary to operate the Service (e.g., account administration, security logs, billing, and support communications).

2.4 Personal Data we collect

Depending on how the Service is used, we may collect, receive, or generate:

2.5 How we use Personal Data

We use Personal Data for the following purposes:

• Provide, operate, and maintain the Service (including authentication and access management)
• Security, fraud prevention, audit logging, and monitoring
• Troubleshooting, incident response, and service reliability
• Improve and develop the Service (including aggregated or de-identified analytics where feasible)
• Feature development (including creating de-identified statistical datasets and using them for product development and research publications/presentations)
  • However, such use is limited to data that cannot identify or re-identify an individual or any specific healthcare organization/facility.
• Communicate with you, provide customer support, and send important notices
• Contract administration, billing, payment processing, and compliance
• Comply with legal obligations and protect rights, safety, and property

For patient/end-user data provided by Customers, we process such data only as instructed by the Customer and consistent with our contractual obligations.

2.5.1 Legal bases (EEA/UK and similar jurisdictions)

Where we act as a controller and applicable law requires a legal basis (e.g., GDPR in the EEA/UK), we rely on one or more of the following:

• Performance of a contract (e.g., providing the Service)
• Legitimate interests (e.g., securing the Service, preventing fraud, improving reliability), balanced against your rights
• Compliance with legal obligations
• Consent (e.g., optional analytics/marketing where enabled; withdrawable at any time)

Where we process special category data (such as health data) as a controller, we do so only when an additional condition applies (e.g., explicit consent, public health, or other permitted grounds). In most cases, patient/end-user data is processed as a processor on behalf of the Customer.

2.6 Sharing and subprocessors

We do not disclose Personal Data to third parties except as described below and as permitted by applicable law.

We may share Personal Data with:

• Service providers/subprocessors (e.g., hosting, cloud infrastructure, storage, authentication, monitoring, support tooling)
• Professional advisors (legal, auditors) where necessary
• Authorities where required by law or to protect rights and safety
• Business transfers (e.g., merger, acquisition), subject to appropriate safeguards

We require service providers to protect Personal Data and to process it only for specified purposes.

We use the following subprocessors:

2.7 International data transfers

The Service and our providers may process Personal Data in countries other than where you live. Where required, we implement appropriate safeguards (e.g., data processing agreements and standard contractual protections) for cross-border transfers.

2.8 Data retention

We retain Personal Data for as long as necessary to provide the Service and meet contractual, legal, security, and audit requirements, and then delete or de-identify it. Patient/end-user data is retained and deleted in accordance with Customer instructions and contractual terms.

2.9 Security

We implement reasonable administrative, technical, and organizational measures designed to protect Personal Data, such as access controls, encryption in transit, monitoring, logging, and vendor management. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

2.10 Your rights and choices

Depending on your jurisdiction and our role (controller vs processor), you may have rights to access, correct, delete, restrict, or object to processing, and to portability where applicable.

• If you are an end user/patient whose data was provided by a Customer, please contact that Customer.
• If we act as a controller for your Personal Data, you may contact us using the details in Section 2.1.

You may also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

2.11 Cookies

If the Service uses cookies or similar technologies, they may be used to keep you signed in, remember preferences, support security, and (where enabled) analytics. You can control cookies through browser settings; disabling cookies may affect functionality.

2.11.1 United States (HIPAA and state privacy laws)

The Service is designed to minimize and avoid collecting Protected Health Information (PHI) and direct patient/clinician identifiers. If the Service is nevertheless used in contexts involving PHI under HIPAA, our role and obligations may depend on our contractual relationship with the Customer (e.g., as a Business Associate under a Business Associate Agreement (BAA)). Where applicable, we will follow the requirements set forth in the applicable agreements and law.

Certain U.S. state privacy laws may provide additional rights. Where we act as a processor/service provider, requests should be directed to the Customer. Where we act as a controller, you may contact us as described in Section 2.1.

2.12 Children

The Service is intended for professional use and is not directed to children. If we learn we collected Personal Data from a child in a manner not permitted by law, we will take steps to delete it.

2.13 Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide notice through the Service or other reasonable means.