Efforts to protect personal information
The Society handles personal information in compliance with the following laws, regulations,and guidelines. For this reason, it has established and implemented a personal information
protection management system.
a)Personal Information Protection Law (2003 law no. 57)

b)

The Ministry of Health, Labour and Welfare’s Guidelines for Health Insurance Societies
and Similar Organizations on Appropriate Handling of Personal Informationc)

The Ministry of Health, Labour and Welfare’s Guidelines for Medical and Long-TermCare Service Providers on Appropriate Handling of Personal Informationd)Other laws, regulations, norms, etc., concerning the protection of personal information

The management system shall be audited and reviewed at least once annually and efforts
made to achieve continual improvements to the system. In addition, any deficiencies
discovered will be responded to immediately.
Although in principle personal information shall be handled in accordance with items 1 to 7
below, when exceptional cases such as the following apply, such handling shall be conductedunder the responsibility of the Personal Information Protection Supervisor:a)Cases subject to laws and regulationsb)

Emergencies that threaten life or propertyc)

Other unavoidable cases

Parties with questions concerning the Society’s Fundamental Policy on the Protection of
Personal Information and its protection of personal information, or parties that havediscovered any deficiencies or other concerns in connection with the Society’s protection ofpersonal information, are requested to contact the Society’s General Affairs Section.

Phone

0493-22-0890

Hours: weekdays, 9:00 am–5:00 pm

Fax

0493-23-7466

Faxes accepted 24 hours/day

E-mail bosch-kenpo@bosch-kenpo.or.jp

E-mails accepted 24 hours/day1

1.

Organization
The society shall appoint one chief privacy officer (CPO) to serve as the Personal
Information Protection Supervisor and one chief administrative officer (CAO) as thePersonal Information Protection Auditor.
a)Each section shall have a designated Personal Information Protection Manager. A
staff member in charge of personal information protection shall be appointed foreach type of operation. He or she shall implement personal information protection
efforts for the relevant operations.

b)

A Training Supervisor and a Complaints Processing Supervisor shall be appointedin connection with the protection of personal information. They shall handlein-house education and training efforts and the processing of complaints,respectively.

c)

All employees, including temporary personnel and those on assignment at othercompanies, shall comply with the management system for protection of personal
information and shall quickly report any deficiencies or incidents.

3.

Obtaining personal informationa)

When the Society is to obtain personal information directly from the person
concerned, the information shall be obtained only after providing advance notice ofthe purpose of use, along with an explanation of how such personal information will
be handled, and his or her consent has been obtained.

4.

Retention and use of personal informationa)

Personal information shall be handled in accordance with the purpose of its use. If
this purpose changes, the consent of the person concerned must be obtained again.

b)

The Society shall endeavor to protect personal information from external threats byimplementing safety measures for the information systems it uses, in accordancewith the risks inherent to each item of personal information.

c)Within the Society’s organization, the personnel using and processing personal
information shall be limited in accordance with the operations handled by such2personnel, and a system shall be established and managed to ensure that
unnecessary access to or use of personal information does not take place.
d)Measures shall be implemented in all aspects of the management of personal
information, including its transportation and removal, in accordance with its
purpose of use and any associated risks.

5.

Subcontracting
The Society shall not subcontract the handling of personal information except in cases
where it has notified the person concerned in advance and the person has voiced noobjections. When it does subcontract the handling of personal information, the Societyshall notify the subject of the information in advance and obtain his or her consent.

6.

Provision of personal information to third parties
The Society shall not provide personal information to third parties without first
notifying the person concerned. When it does provide personal information to a thirdparty, the Society shall obtain the consent of the person concerned, either whenobtaining the information or at some point before it provides the information to the thirdparty.

7.

Where to address requests for disclosure of personal information, etc., and otherinquiries
The patient may request notification of the purposes of use of, disclosure of, revision of,addition to, partial deletion of, cessation of use of, full deletion of, and cessation ofprovision to third parties of his or her personal information. Please direct inquiries on
personal information using the contact information provided below.

3