1. Scope and operator
This policy applies to the public website, partner application, partner workspace and referral-intake functions operated by Chongqing Kangqiao Media Co., Ltd. (Unified Social Credit Code 91500000MACE9F255Q). It does not replace the privacy notices of hospitals, clinics or professional providers that independently determine how they process information for their own services.
Depending on the transaction and applicable law, Kangqiao may act as an independent personal-information processor or controller, a joint participant with another organisation, or a service provider processing documented instructions. The relevant notice or agreement governs that role.
2. Information we may collect
- Partner identity and due-diligence information, including legal name, contact details, market, business description, agreement and payout-verification records.
- Account and security information, including credentials in protected form, role, language, session, device, network and audit events.
- Referral and prospective-client information, including contact details, country, preferred language, relationship to the partner, service category, timing and a short needs summary.
- Special-category or sensitive information, including health-related information, only when necessary for an authorised intake or controlled follow-up process.
- Commercial and compliance records, including attribution, milestones, quality assessment, service-fee status, tax or payment references and investigation records.
3. Purposes and legal bases
We use information to assess and manage partners, receive and verify referrals, coordinate requested non-clinical services, protect source attribution, prevent duplication and fraud, administer fees, maintain security, respond to rights requests, and comply with law.
The legal basis depends on the person, jurisdiction and processing activity. It may include consent or separate consent, steps requested before a contract, performance of a contract, compliance with law, protection of vital interests, or legitimate interests where recognised and not overridden by the person's rights. We do not treat one legal basis as universally valid across countries.
4. Health information and consent
Health information may be sensitive personal information under China's Personal Information Protection Law and special-category data under other laws. Initial referrals must contain only what is reasonably necessary to identify the request and arrange follow-up. Full medical records must not be uploaded through a general field or sent by an unverified channel.
Where law requires explicit, separate or guardian consent, the relevant process must obtain it before the information is collected, disclosed or transferred. A partner's assertion of consent may be verified and does not remove the partner's own responsibilities.
5. Sharing and access
Information may be shared on a need-to-know basis with authorised Kangqiao personnel, selected medical or professional providers, infrastructure and security vendors, payment or compliance providers, professional advisers, and public authorities where lawfully required. Contractual, access-control and confidentiality measures are applied according to role and risk.
Partners do not receive directories of other partners, hospitals or internal contacts. They receive only their own records and limited milestones. We do not sell personal information or provide medical information to unrelated parties for behavioural advertising.
6. International transfers
A cross-border referral may involve information moving between the person's location and China. Before a transfer, the parties must identify the transfer, purpose, recipient, data categories and applicable safeguards. Depending on the law, safeguards may include separate consent, a prescribed contract, certification, security assessment, transfer impact assessment or another approved mechanism.
The platform does not claim that a single transfer mechanism satisfies every country. A transfer will be limited, suspended or redesigned when the required legal basis or safeguard is unavailable.
7. Retention
Information is kept only for the shortest period reasonably necessary for the stated purpose, contractual evidence, dispute handling, accounting, tax, compliance and security obligations. Retention varies by record type and jurisdiction. When retention is no longer justified, information is deleted, anonymised or isolated from routine use, subject to lawful backup and preservation requirements.
8. Security
We use role-based access, tenant isolation, password hashing, session controls, audit logging, data minimisation and controlled document handling. No system can guarantee absolute security. A suspected incident is contained, assessed and notified to affected persons or authorities where the applicable law requires.
9. Cookies and technical data
The platform uses essential local storage and session cookies for language, authentication, security and workflow continuity. It does not currently require third-party advertising cookies. If analytics or optional cookies are introduced, the relevant notice and consent controls will be updated where required.
10. Your rights
Subject to identity verification, legal exceptions and local law, a person may request access, explanation, correction, completion, deletion, restriction, objection, portability, withdrawal of consent or review of a significant automated decision. Withdrawing consent does not invalidate processing already lawfully completed and may prevent a requested service from continuing.
The platform does not make a clinical or similarly significant decision solely by automated means. Duplicate and risk signals are subject to human review.
11. Children and vulnerable persons
The partner programme is for adults and duly represented organisations. A referral concerning a child or a person unable to consent must be submitted only by an authorised guardian or other person with a valid legal basis. Age thresholds and guardian-consent rules vary by jurisdiction and must be checked before processing.
12. Contact and updates
Privacy requests may be emailed to contact@kangqiao.health with 'Privacy' in the subject line, or sent to the company address stated on the Contact page and marked for Privacy. We may update this policy for legal, operational or technical changes. Material changes will be dated and, where required, presented for notice or renewed consent.