Privacy notice

1. Who we are

LukeBridge (Shanghai) is a coordination and medical-travel assistance company registered in Shanghai, People's Republic of China. For the purposes of data protection law, we are the personal information handler (the “controller”) for the information described here. Our privacy contact is care@lukebridge.com.

LukeBridge is not a medical provider. We do not diagnose or treat, and the hospital that treats you is a separate controller of the records it holds.

2. Which law applies

Because we are established in Shanghai, we handle personal information under the Personal Information Protection Law of the People's Republic of China (PIPL) and related Chinese regulations. We also comply with the mandatory privacy laws that reach us from the countries we serve. Where those laws give you a right that is stronger than this notice, that right prevails; nothing here reduces a protection you already have.

• New Zealand — the Privacy Act 2020 and its information privacy principles, to the extent it applies to an overseas agency. We apply its substance to every New Zealand enquirer.
• Australia — the Privacy Act 1988 and the Australian Privacy Principles, including the Notifiable Data Breaches scheme.
• United Kingdom — UK GDPR and the Data Protection Act 2018 where UK GDPR applies to us because we offer services to people in the UK. Our Article 27 representative is set out in section 8.
• United States — applicable federal and state privacy law, including the state consumer-health-data laws described in section 9.
• Canada — PIPEDA and applicable provincial privacy law, as described in section 10.

3. What we collect

• Contact details — name, email, phone, city, country, preferred language and contact method.
• Health information you choose to give us — diagnosis, treatment history, records, reports, and free-text answers. We ask for the minimum needed to screen and coordinate; we do not request your full file at the pre-screen stage.
• Travel and logistics information — passport nationality, companion details, and travel dates, once you decide to proceed.
• Technical information — pages viewed, a random session identifier, the channel that brought you here, and the country reported for your connection. IP addresses are hashed before storage and are not kept in readable form.

4. Why we collect it, and on what basis

We process information to answer your enquiry, assess administrative feasibility, coordinate a hospital pathway if you proceed, keep records of what was agreed, meet legal, tax and accounting obligations, and understand which outreach channels work.

Our basis is your consent (PIPL Article 13(1)), the performance of our agreement with you (Article 13(2)), and legal obligations (Article 13(3)). You can withdraw consent at any time by emailing us; withdrawal does not affect processing already carried out, and may mean we can no longer coordinate your case.

5. Health information and separate consent

Health information is “sensitive personal information” under PIPL Article 28. We process it only with your separate, explicit consent under Article 29. The pre-screen form now contains three separate affirmations, each with its own checkbox:

• consent to contact you and to our non-medical role;
• separate consent to process the health information you provide (PIPL Article 29);
• separate consent to store and process that information outside mainland China (PIPL Article 39), including on Cloudflare's global network.

A single “I agree” is not enough for sensitive data, so we do not use one. You can withdraw either of the separate consents without withdrawing the other.

Sending records to a hospital requires a further, hospital-specific consent that names the hospital and the categories of information. We do not send anything before you sign it.

6. Who we share it with

• A treating hospital's international department, only after the hospital-specific consent described above.
• Professional interpreters and translators, bound by confidentiality, where needed for your case.
• Our infrastructure providers — Cloudflare for hosting and database services, and our email provider. They process data on our instructions under contract.
• Your own clinicians, if you ask us to share the hospital's written opinion with them.
• Regulators, courts, or authorities, where the law requires it.

We do not sell personal information, do not rent it, and do not use health information to build advertising audiences. We do not share it with travel agencies, insurers, or advertisers.

7. Overseas transfers

Coordination necessarily involves transfers in both directions, and we name them rather than burying them:

• Into China — your clinical records are sent to the hospital you have chosen, so it can assess and treat you.
• Out of China — our website and database run on Cloudflare's global network, and our email provider may process messages outside mainland China. Those providers are bound by contract to protect the data and to act only on our instructions.

Under PIPL Articles 38 and 39, we tell you the recipient, the purpose, and the categories of information, and we obtain separate consent for the transfer. PIPL Article 38 allows a security assessment, certification, or the CAC standard contract; the mechanism we rely on is shown below. Before we transfer health information, we confirm that the chosen mechanism covers that transfer, and the executed contract and its filing reference are available to you on request. If the mechanism is not in place for a transfer, we do not make it.

Where your local law requires additional safeguards — for example the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — we use those too.

8. UK representative (UK GDPR Article 27)

Because we offer services to people in the UK and are not established there, UK GDPR Article 27 requires us to designate a representative in the UK for data-protection matters. Our representative's name, postal address, and email are published here and in the terms.

If those details are not yet published, email care@lukebridge.com before you send any health information and we will confirm whether a representative is in place for your enquiry. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. US consumer health data

We are not a HIPAA-covered entity, but several state consumer-health-data laws apply to any business that collects health information from their residents. We treat the following as applicable to US visitors, and we apply the same baseline to all 50 states:

• Washington — My Health My Data Act (RCW 19.373). We provide this consumer health data privacy policy, obtain affirmative consent before collecting consumer health data, do not sell it, and do not use geofencing around health-care facilities. Washington residents have a private right of action for violations.
• Nevada — SB 370 (NRS 603A.300 et seq.). We obtain consent before collecting consumer health data, honour access and deletion requests, and do not sell consumer health data.
• Connecticut — Connecticut Data Privacy Act. We honour access, correction, deletion, portability, and opt-out rights for Connecticut residents, and we obtain consent before processing sensitive data including health information.

What we collect and why. The categories are those in section 3, collected to assess your enquiry and coordinate care. Who we share it with. The recipients are those in section 6. How to exercise your rights. Email care@lukebridge.com with the subject line “US health privacy request”. We respond within 45 days and may ask for information to verify your identity. You may use an authorised agent. We will not discriminate against you for exercising these rights.

We do not sell consumer health data, do not use it for targeted advertising, and do not disclose it to anyone except as described in section 6.

10. Canada

We handle Canadian personal information in line with PIPEDA's fair-information principles and the substantially similar provincial laws that apply to residents of Quebec, British Columbia, Alberta, and other provinces. You can ask for access, correction, and deletion, and you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Cross-border transfers are described in section 7; where a province requires a transfer impact assessment or notice, we provide it on request.

11. How long we keep it

• Enquiries that do not proceed — 24 months from last contact, then deleted.
• Coordination case records — 7 years from the end of the engagement, to support clinical handover and to meet legal obligations.
• Website analytics — 24 months, aggregated after that.
• Financial records — for the period required by PRC accounting and tax rules.
• Research data — we do not accept or hold research data. If we ever receive data connected to a registered clinical study, we will follow the 818 rules and the hospital's records requirements, including the 30-year research archive where it applies, rather than our ordinary 7-year retention.

12. How it is protected

Data is encrypted in transit. Access is limited to the named coordinator and records screener on your case, through individual accounts — there are no shared logins. Records are held in access-controlled systems rather than email inboxes once a case is opened. We do not store card numbers; payments go through banks or licensed payment providers.

We apply security headers to the public site (HSTS, a content-security policy, frame denial, and content-type protection), hash IP addresses before storage, and rate-limit the public forms. These are the “appropriate technical measures” PIPL Article 51 requires, not a guarantee against every attack.

If a breach occurs that may cause harm, we notify affected individuals and the competent authority as required by PIPL and, where applicable, your local breach-notification law (including the UK ICO within 72 hours and the OAIC under the Australian Notifiable Data Breaches scheme).

13. Your rights

Subject to applicable law and to records we must keep, you can ask us to: give you a copy of your information; correct it; delete it; restrict or object to certain processing; provide it in a portable format where that right applies; and withdraw consent for future processing. Email care@lukebridge.com and we respond within 20 working days (or 45 days for a verified US consumer-health-data request).

If you are not satisfied, you can complain to the competent Chinese authority (the cyberspace administration or market regulation authority) or to your local data protection authority — for example the Office of the Privacy Commissioner in New Zealand, the OAIC in Australia, the ICO in the UK, the Office of the Privacy Commissioner of Canada, or your state attorney general in the US.

14. Cookies and analytics

On the public website we use two first-party cookies and no third-party analytics or advertising scripts. The operator console is served on a separate hostname and uses a separate, HttpOnly sign-in cookie that is not set on the public site:

• lb_attr — remembers the channel that brought you here for 30 days so we can measure which outreach works. It records campaign parameters, the referrer, and the landing path, not health information.
• lb_sid — a random session identifier used to count visits without identifying you.

Both are set only after you accept measurement in the cookie banner. If you decline, no attribution or page-view request is sent, no session identifier is created, and the banner does not reappear unless you reopen it from “Cookie settings” in the footer. Declining does not limit any part of the site or the pre-screen.

Our server logs page views and button clicks against the session identifier only. No health information is included in these events. You can change your choice at any time with the “Cookie settings” link in the footer, which reopens the choice. Choosing decline stops future measurement and clears the attribution and session cookies; it does not delete aggregate page-view counts already recorded under the session identifier.

15. Patients under 18

A parent or legal guardian must make the enquiry and give consent for a patient under 18. We ask for evidence of the guardian relationship before we share records with a hospital.

16. Changes and contact

If this notice changes materially, we will say so on this page and email anyone with an open case. The effective date is shown to the day, and a summary changelog is published below. Questions, requests, and complaints about privacy go to care@lukebridge.com.

This notice is a plain-language summary of our practices, not legal advice to you. It should be read with the compliance notice and the terms of service.