International Data Transfers

ORGO Inc. ("ORGO," "we," or "us") establishes this statement on cross-border transfers and consent (this "Statement") for the movement analysis service "MYoACT" (the "Service") that it provides.

This Statement explains, to users and customers, the overseas processing paths that the Service uses for cloud infrastructure, AI inference, video analysis processing, web analytics, error monitoring, advertising measurement, payment processing, customer support, document sharing, and email delivery.

The main terms and abbreviations used in this Statement are as follows.

• Health-related data: data relating to the physical and mental condition of the persons analyzed (raw video, skeletal/pose data, analysis results, physical attributes and related metadata).
• User: a person issued an account for the Service.
• Subprocessor: a provider to which we entrust processing necessary for the provision of the Service.
• APPI: the Act on the Protection of Personal Information of Japan.
• GDPR: the EU General Data Protection Regulation.
• HIPAA: the U.S. Health Insurance Portability and Accountability Act.
• PHI / ePHI: Protected Health Information under HIPAA and its electronic form.
• CCPA: the California Consumer Privacy Act.
• DPA: a data processing agreement governing the handling of personal data.
• BAA: a Business Associate Agreement under HIPAA.
• SCC: the standard contractual clauses adopted by the European Commission.
• UK IDTA: the UK International Data Transfer Agreement.
• Swiss Addendum: an addendum for compliance with Swiss data protection law.
• TOMs: the technical and organisational measures implemented to protect personal data.
• DSR: a request for disclosure, correction, cessation of use, or similar.
• LLM: a Large Language Model.

This Statement explains overseas processing paths by functional category. The individual company names, main countries/regions, and types of safeguards of the vendors and subprocessors corresponding to each functional category are set out in the subprocessor list that ORGO publishes on its website.

The Service uses service providers that may be located outside Japan, accessed from outside Japan, or that process data outside Japan. The functional categories concerned are: cloud infrastructure (hosting, authentication, database, storage, logs, content delivery), AI inference, video analysis processing, web analytics and data warehouse, error monitoring, advertising measurement, payment processing, customer support, document sharing and knowledge management, email delivery, and development/maintenance/operations subcontracting. The processing location, basis under APPI §28, and safeguards for each functional category are managed in accordance with the "Main overseas processing paths" table below, and paths that constitute cross-border transfers are addressed in the respective sections of this Statement. Email delivery uses a domestic provider and is operated without sending patient identifiers or health-related data. Where the processing, backups, or similar for that delivery involve overseas processing, it is treated as a cross-border transfer in the same way as the other paths in this Statement.

We also use a development, maintenance, and operations subprocessor (Philippines). Access by that subprocessor from the Philippines to the Service's systems is treated as a Japan → Philippines cross-border transfer; for EU customer matters, it is also treated as an EU → Philippines cross-border transfer.

When personal data is provided to a third party in a foreign country, ORGO, in accordance with APPI §28, obtains the data subject's consent where necessary, or relies on a framework that continuously ensures equivalent safeguards or another applicable basis. Where consent under APPI §28 is obtained, ORGO presents the following items on the consent screen or in an individual notice before obtaining consent.

1. The name of the foreign country. Where the destination country cannot be identified, in place of the country name we present, in accordance with the Personal Information Protection Commission's guidelines (handling where the destination country cannot be identified): (i) the fact that the destination country cannot be identified, (ii) the reason, and (iii) alternative information useful to the data subject (the destination country/region category [the United States, the EU, the Asia-Pacific area, or other regions] and the safeguards taken).
2. An overview of the personal data protection system in that foreign country (presented based on the Personal Information Protection Commission's published information, including its "Guidelines on the Act on the Protection of Personal Information (Provision to Third Parties in Foreign Countries)" and "Systems concerning the protection of personal information").
3. The contractual and supplementary measures taken by the recipient.

Not all overseas processing is based on consent under APPI §28; some is managed through contractual measures, the continuous assurance of equivalent safeguards, or another applicable basis. The APPI §28 basis category for each functional category is shown in the "Main overseas processing paths" table below. The individual names of the recipients corresponding to each category are set out in the subprocessor list that ORGO publishes on its website.

Advertising measurement is the only path based on data subject consent. We present items 1-3 above in the consent management tool on the Service's web application before consent is obtained. That consent is not a condition of using the Service; the Service remains available to those who do not give it. This provision of information at the time of obtaining consent is not delegated to the publication of the subprocessor list.

Where the Service is used through a customer organization, obtaining consent from the persons analyzed is the responsibility of that customer organization, and we do not present a consent screen to them. We provide the information the customer organization needs, and cooperate with it, so that it can address Article 28 of the Act on the Protection of Personal Information of Japan.

If a data subject requests suspension of use, erasure, suspension of third-party provision, or another request, ORGO responds in accordance with applicable law, including APPI §35, without undue delay.

Where the GDPR applies, transfers outside the EEA are managed under GDPR Art.44-46 through vendor-specific standard contractual clauses (SCCs), the UK IDTA where applicable, the Swiss Addendum (including amendments for the FADP/FDPIC), and supplementary technical and organizational measures.

In applying the SCCs, we use SCC Module 3 for paths where we subcontract as the processor for an EU customer, and SCC Module 2 for transfers from the customer (controller) to us (processor). For the UK we additionally use the UK IDTA or UK Addendum, and for Switzerland the Swiss Addendum (including amendments for the FADP/FDPIC).

For each path, we conclude or accept a DPA and SCC (including the UK IDTA and Swiss Addendum) as appropriate to the processing, and, for paths to which HIPAA applies, a BAA. The external LLM used by the AI inference platform is treated as part of the cloud infrastructure provider's service and subprocessor chain, and is handled within the framework of our contracts, DPA, and BAA with the cloud infrastructure provider. The individual company names for each path are set out in the subprocessor list that ORGO publishes on its website.

Whether HIPAA applies is not uniform across all uses of the Service. We assess whether HIPAA applies based on the customer's attributes, the purpose of use, the nature of the data, and whether a Covered Entity / Business Associate relationship exists.

Where we provide the Service to U.S. hospitals or other HIPAA Covered Entities and a Business Associate relationship arises, we confirm a HIPAA-compliant configuration and whether a BAA is required. For customers that are HIPAA Covered Entities, the cloud infrastructure is configured on the basis of using only HIPAA-eligible services, and it is handled within the scope of the BAA with the cloud infrastructure provider. The AI inference platform is handled within the cloud infrastructure provider's BAA framework. For the video analysis processing path, we apply safeguards through a BAA, DPA, SCC (including the UK IDTA and Swiss Addendum), and TOMs.

For hospitals, healthcare institutions, and other customers in a medical or rehabilitation context ("medical-sector customers"), the following stricter premises apply in addition to the general cross-border transfer explanation.

1. By design, the AI assistant does not receive original binaries such as original videos, images, or other source files. Invocation of the AI inference platform is limited to text and numeric series (user-entered text, conversation context, analysis metadata, skeletal coordinates, joint angles, and explanatory text).
2. For the video analysis processing path, we apply safeguards through a BAA, DPA, SCC (including the UK IDTA and Swiss Addendum), and TOMs.
3. AI assistant inputs, outputs, and operational logs are retained only for the periods set out in "14. Retention and deletion" of the Privacy Notice.
4. Disclosure and other requests (DSRs) are handled under ORGO's response procedures, addressing the right to deletion under APPI §35, GDPR Art.17, and the CCPA.
5. The individual company names in the subprocessor chain are set out in the subprocessor list that ORGO publishes on its website.

The location (country/region category), handling, basis under APPI §28, and type of safeguard for each main functional category used by the Service are as follows. The individual company names and main countries/regions corresponding to each category are set out in the subprocessor list that ORGO publishes on its website.

We confirm the contractual terms and safeguards required for each path according to the type of data, the nature of processing, and the possibility of contact with health-related data or direct identifiers.

For paths that handle health-related data, payment data, or payloads containing direct identifiers (cloud infrastructure, AI inference, video analysis processing, payment, web analytics and data warehouse, customer support, advertising measurement, document sharing and knowledge management), we apply the necessary safeguards through a DPA, SCC (including the UK IDTA and Swiss Addendum), TOMs, and, for paths to which HIPAA applies, a BAA.

For the video analysis processing path, we minimize identifiers by combining a patient-identifier exclusion rule (not including direct identifiers such as patient names, patient IDs, or medical record IDs in file names or metadata) with temporary processing environments.

The AI inference platform (external LLM) is handled as a sub-service of the cloud infrastructure provider, under the cloud infrastructure provider's contracts (DPA, BAA, etc.). The text and numeric series sent from the AI assistant to the AI inference platform are classified as highly sensitive health-related data, so we do not assert non-contact with personal information for this path.

The individual company names and main countries/regions corresponding to each functional category are set out in the subprocessor list that ORGO publishes on its website.

---

Last updated: September 1, 2026