GDPR & Data Protection Notice

Scope and publication status

This notice supplements the Website Privacy Policy where the EU General Data Protection Regulation (GDPR) or UK GDPR applies. Being able to visit a U.S. website from Europe does not by itself establish that those laws apply. Applicability depends on the business's activities, including relevant establishment, offering of services, or monitoring of people in those jurisdictions.

This is a draft for business and legal review, not a certification of GDPR compliance. The website does not establish a clinical relationship or provide a channel for sensitive health information. The responsible business must confirm the missing operational details below before treating this notice as an approved disclosure.

Who is responsible and how to make contact

The website presents Omni Health Services within the NBJPN Holdings LLC family. The exact legal entity acting as controller for website inquiries, its registered details, and any allocation of responsibilities between Omni and NBJPN Holdings have not yet been confirmed for this notice.

Use the NBJPN Holdings general inquiry contact shown below to ask for the person responsible for website privacy. This is a routing contact, not a verified data protection officer or EU/UK representative. Whether a data protection officer or representative is required, and their details if applicable, must be confirmed by the business.

Data, purposes, and lawful bases

The website inquiry form collects first name, last name, mobile number, email address, and message, with a submission identifier, creation time, and administrative status. Hosting and platform providers may process request, device, IP address, and diagnostic information. The Website Privacy Policy describes the purposes and recipients; the Cookie Policy & Storage Notice describes browser storage.

Where GDPR applies, each processing purpose needs a documented lawful basis. Depending on the actual circumstances, responding to a requested pre-contract inquiry may fall under steps requested before a contract; general inquiry administration and security may rely on assessed legitimate interests; specified retention or disclosure duties may rely on a legal obligation. These are potential bases for review, not a claim that the necessary assessments have been completed. The controller must confirm its chosen basis and, where relevant, the specific legitimate interest or legal obligation for each purpose.

The form's privacy acknowledgement is not blanket consent to all processing. Optional offline storage uses a separate affirmative choice that can be withdrawn. If any personal-data processing relies on consent, that consent must be specific and freely given and can be withdrawn without affecting the lawfulness of processing before withdrawal. Do not submit health information; any intended processing of special-category data would require separate safeguards and an applicable additional legal condition.

The form requires the displayed contact fields to submit an online inquiry. You may instead browse without submitting or call the listed business contact. This form does not perform automated eligibility decisions, clinical profiling, or decisions producing legal or similarly significant effects.

Your data protection rights

Where applicable and subject to legal conditions, you may request access to your personal data and a copy, correction of inaccurate or incomplete data, erasure, or restriction of processing. Data portability may apply to information you provided where processing is automated and based on consent or a contract.

You may object, on grounds relating to your situation, to processing based on legitimate interests. You have the right to object to direct marketing at any time if it occurs. The website application currently has no marketing signup or advertising integration. Rights concerning solely automated decisions may apply where those decisions have legal or similarly significant effects.

These rights are not absolute. For example, a lawful retention duty may limit erasure. A controller should explain an applicable refusal or limitation and available complaint rights. Exercising a right does not require consenting to marketing or sending medical information through this website.

Making a request and response periods

Contact NBJPN Holdings using the email or phone shown below and ask to route a website data protection request to the responsible controller. State the right you want to exercise and, if relevant, the approximate inquiry date and contact address used. Avoid diagnoses, medical records, identity documents, or other sensitive details in ordinary email or the general website form. Ask for a secure verification channel if additional identification is needed.

Under GDPR, a controller generally must respond without undue delay and within one month of receiving a request. A further two months may be permitted for complexity or the number of requests, with notice and reasons within the first month. Applicable identity-verification and clarification rules can affect the process. Requests are generally free; legally permitted exceptions exist for manifestly unfounded or excessive requests.

These are legal requirements where applicable, not confirmation that Omni has an implemented request-management service or a guaranteed response from the general inquiry form. The business must establish ownership, verification, response tracking, and fulfillment procedures. Submitting a request does not automatically erase a database record.

Recipients, retention, and international transfers

Authorized business personnel and website hosting, database, delivery, and platform service providers may process information as described in the Website Privacy Policy. Inquiries currently remain stored until removed by an authorized administrator; no automated deletion schedule is configured. The controller must establish and disclose justified retention periods or criteria and verify arrangements with its processors.

The listed general inquiry contact is in the United States. The countries where each provider processes or stores data, and any onward transfers, have not been fully confirmed. Where GDPR transfer rules apply, the controller must identify and document a valid transfer mechanism, relevant safeguards, and any required assessment. This notice does not claim that adequacy, Standard Contractual Clauses, or a particular certification is in place. Browsing, checking the inquiry acknowledgement, or choosing offline storage is not consent to an international transfer.

Ask the responsible controller for confirmed recipients, processing locations, retention criteria, and information about any applicable safeguards or how to obtain a copy. Those details remain subject to business confirmation.

Complaints and independent guidance

Where GDPR applies, you can complain to a competent data protection supervisory authority, including in the EU country of your habitual residence, workplace, or an alleged infringement. For UK matters, contact the Information Commissioner's Office. You do not have to use this website's inquiry form or first obtain permission from the business to contact a regulator.

• European Commission: Data protection information for individuals
• European Data Protection Board: Supervisory authorities
• UK ICO: Make a complaint
• Website Privacy Policy
• Cookie Policy & Storage Notice