Privacy & Personal Data Protection Policy

1. Identity and Contact Details of the Data Controller

The entity responsible for the processing of personal data collected through this website (randassociates.info) is:

2. Data Minimization Principle & Information Collected

In compliance with the data minimization principle (Art. 5.1.c GDPR), this website collects only the information strictly necessary for scheduling and coordinating your ophthalmological appointment:

• Identifying Information: Full name.
• Contact Information: Phone number and email address (optional).
• Service Preference: Selected clinical consultation category (diagnostics, laser correction, cataracts, glaucoma, dry eye therapy).
• Time Preference: Preferred consultation date and time slot.

3. Purpose and Legal Basis for Processing

Personal data is processed solely for the following legitimate purposes:

1. Appointment Management: Contacting the patient via phone or email to confirm date, time, and pre-examination instructions (Legal basis: Art. 6.1.b GDPR – pre-contractual steps requested by the data subject).
2. Regulatory Compliance & Explicit Consent: Handling requests based on explicit affirmative consent provided via an unchecked consent box (Legal basis: Art. 6.1.a GDPR).
3. Patient Inquiries & Customer Support: Addressing inquiries regarding clinical services, facilities accessibility, and fees.

4. Data Retention Policy

Appointment request details are retained only for the duration strictly necessary to complete scheduling and fulfill associated patient care requirements. If an appointment is cancelled or not completed without subsequent clinical engagement, contact details are deleted or anonymized from active operational systems within 90 days.

5. Third-Party Sharing and International Transfers

Ｒ ａｎｄ Ａｓｓｏｃｉａｔｅｓ LLC does not sell, lease, commercialize, or share personal data with external third parties for marketing purposes. Access to patient information is strictly limited to authorized administrative and clinical medical staff bound by formal duties of professional confidentiality and medical privacy.

6. Patient Rights (GDPR / Japanese APPI)

Under applicable data protection regulations, you are entitled to exercise the following rights at any time:

• Right of Access: Obtain confirmation on whether your personal data is being processed and receive a copy.
• Right of Rectification: Request correction of inaccurate, obsolete, or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data when no longer needed for clinical administration.
• Right to Restriction & Objection: Restrict or object to specific processing under legally defined circumstances.
• Right to Data Portability: Receive your provided data in a structured, standard, and machine-readable format.

To exercise any of these rights, submit a written request with verification of your identity to [email protected] or by postal mail to our registered clinic office in Musashino-shi, Tokyo.

7. Technical Security and Encryption

We apply rigorous industry-standard cybersecurity measures including end-to-end SSL/TLS (HTTPS) transmission encryption, perimeter network firewalls, strict role-based access controls, and redundant encrypted backups to safeguard all data against unauthorized access, loss, or alteration.