top of page
CuraSource-Medical-logo

Privacy Policy

CuraSource Medical USA

This Privacy Policy describes how CuraSource Medical collects, uses, discloses, transfers, and protects information about visitors to our website at www.curasourcemedical.com (the “Site”) and the business customers, prospective customers, distributors, healthcare-organization personnel, and other third parties who interact with us in connection with our medical-device business. Please read it carefully. By using the Site or contacting us through the Site you acknowledge that you have read and understood this Privacy Policy.

Effective Date: June 1, 2026 Last Updated: May 22, 2026

Table of Contents

1. Introduction and Scope

1.1 Who This Policy Applies To

1.2 Business-to-Business Focus

1.3 Products We Do Not Knowingly Process Patient Health Data

1.4 Where We Operate

 

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information We Receive From Third Parties

2.4 Sensitive Information

2.5 Children's Information

​

3. How We Use Your Information

3.1 Responding to Inquiries and Operating Our Sales Process

3.2 Product, Regulatory, and Safety Operations

3.3 Site Operation, Improvement, and Security

3.4 Marketing and Business Development

3.5 Legal, Regulatory, and Compliance Purposes

3.6 Aggregated, De-Identified, and Anonymized Information

 

4. Legal Bases for Processing (EU/EEA, U.K., and Similar Jurisdictions)

4.1 Performance of a Contract or Pre-Contractual Steps

4.2 Compliance with Legal Obligations

4.3 Legitimate Interests

4.4 Consent

4.5 Vital Interests and Public Interest

 

5. How We Share Your Information

5.1 Within the CuraSource Group

5.2 Service Providers and Processors

5.3 Authorized Distributors and Channel Partners

5.4 Authorities and Other Third Parties for Legal Reasons

5.5 Corporate Transactions

5.6 With Your Consent or at Your Direction

 

6. International Data Transfers

6.1 Transfers From the EEA, U.K., and Switzerland

6.2 Transfers Out of China

6.3 Transfers Out of Other Jurisdictions

 

7. Data Retention and Security

7.1 Retention

7.2 Security

 

8. Cookies and Similar Tracking Technologies

8.1 What These Technologies Are

8.2 Categories of Cookies We Use

8.3 Specific Third-Party Services

8.4 Managing Cookies

8.5 Do Not Track and Global Privacy Control

 

9. Your Privacy Rights (General)

9.1 How to Exercise Your Rights

9.2 Limitations

 

10. Jurisdiction-Specific Disclosures and Rights

10.1 European Economic Area, United Kingdom, and Switzerland (GDPR / U.K. GDPR / FADP)

10.2 California (CCPA / CPRA)

10.3 Washington State (My Health My Data Act)

10.4 Other U.S. State Privacy Laws

10.5 Canada (PIPEDA and Provincial Privacy Laws)

10.6 China (PIPL)

10.7 Brazil (LGPD)

10.8 Australia (Privacy Act and Australian Privacy Principles)

10.9 Other Jurisdictions

 

11. Children's Privacy

 

12. Automated Decision-Making and Profiling

 

13. Third-Party Links and Services

 

14. Changes to This Policy

 

15. How to Contact Us and File a Complaint

15.1 Privacy Contact

15.2 Complaints Procedure
15.3 Accessibility

 

16. Legal Entity Information

 

17. Definitions

1.  Introduction and Scope

CuraSource Medical (“CuraSource,” “we,” “us,” or “our”) respects your privacy and is committed to protecting Personal Information in accordance with applicable data-protection and privacy laws across every jurisdiction in which we do business. We design, manufacture, and supply single-use medical devices and related products—including syringes and hypodermic needles, IV infusion sets, urine bags, scalp vein sets, blood transfusion sets, vaginal speculums, extension tubes, 3-way values, IV bags, insulin pen needles, and other diagnostic and therapeutic equipment—to hospitals, clinics, group purchasing organizations, distributors, wholesalers, government and humanitarian buyers, and other business customers worldwide.

CuraSource Medical is the trading name of Jiangsu Kanghua Medical Equipment LLC, the legal entity that owns and operates the CuraSource brand. Throughout the remainder of this Policy we refer to ourselves as “CuraSource” , “CuraSource Medical" , or "CuraSource Medical USA."

​

​

1.1 Who This Policy Applies To

​

This Privacy Policy applies to Personal Information we process about:

  • Visitors to our Site, regardless of where they are located;

  • Representatives of prospective and existing business customers, distributors, agents, suppliers, and other commercial counterparties;

  • Healthcare-organization personnel (clinicians, biomedical engineers, procurement officers, regulatory affairs staff) who request product information, quotations, regulatory documentation, or technical support;

  • Recipients of our marketing communications and attendees at trade shows, exhibitions, and webinars at which we make our Site available;

  • Individuals who submit complaints, adverse-event reports, product-quality reports, or other safety information through the Site;

  • Other individuals who otherwise interact with the Site.

​

1.2 Business-to-Business Focus

​

CuraSource is a business-to-business (“B2B”) supplier. We do not sell products to consumers through the Site, do not host an online checkout, and do not collect payment-card information through the Site. We collect Personal Information through the Site primarily through web-form submissions (e.g., contact forms, quote-request forms, distributor-inquiry forms, regulatory-document request forms) and through automated technologies such as cookies, web beacons, pixels, and similar tracking technologies described in Section 8.

​

1.3 Products We Do Not Knowingly Process Patient Health Data

​

Although our products are used in the diagnosis and treatment of patients, our Site is directed at the professional personnel of organizations that purchase medical devices, not at patients. We do not intentionally collect protected health information (“PHI”), patient identifiers, or other individually identifiable patient health data through the Site. If you are a healthcare provider, please do not include patient-identifying information when submitting complaints, adverse-event reports, or technical-support requests through the Site. If you must share such information, please contact us as described in Section 15 so that we can provide a secure channel.

​

1.4 Where We Operate

​

CuraSource Medical USA is headquartered in Seattle, Washington, in the United States. Our mailing address is located in the city of Portland, Oregon. Our manufacturing operations are conducted at our facility in the People’s Republic of China. Our customers and distributors are located on six continents. As a result, Personal Information we collect may be transferred to, stored in, and processed in the United States, China, and other countries whose data-protection laws may differ from those in your country of residence. We rely on the legal mechanisms described in Section 6 to safeguard those transfers.

2.  Information We Collect

We collect Personal Information directly from you, automatically when you use the Site, and (less commonly) from third parties such as our authorized distributors, public business directories, professional networks, trade-show organizers, and credit-reference, sanctions-screening, and fraud-prevention providers.

​

2.1 Information You Provide Directly

​

When you fill out a contact form, request a quotation, ask for a product specification or regulatory certificate, register for a webinar, subscribe to newsletters, submit a complaint, or otherwise communicate with us through the Site, we collect the information you choose to provide. This typically includes:

  • Identity and contact details: full name, professional title or role, name of the organization you represent, business email address, business telephone number, business mailing address, country of residence;

  • Inquiry details: the products or services you are interested in, the nature of your inquiry, quantities, intended use country, any free-text message you submit;

  • Account and authentication details, if we provide you with a distributor or partner portal (login identifier, password hash, multi-factor-authentication information);

  • Marketing preferences: language preferences, topics of interest, and consent or opt-out choices;

  • Complaints, adverse-event, and product-quality information: any details you choose to share about products, incidents, or experiences, which we may be required to retain to comply with medical-device vigilance, post-market surveillance, and product-liability obligations;

  • Information you provide in correspondence: anything you share with us by email, telephone, or other communications channel after first contacting us through the Site.

​

2.2 Information Collected Automatically

​

When you visit the Site, certain information is collected automatically through cookies, software development kits, web beacons, pixel tags, server logs, and similar technologies. This information may include:

  • Device and connection data: Internet Protocol (IP) address, approximate geolocation derived from IP address (typically city or region level), device type, operating system and version, browser type and version, screen resolution, language settings, mobile network information, and unique device identifiers;

  • Usage data: pages and resources viewed, the date and time of access, time spent on pages, referring and exit URLs, search terms used to find the Site, click paths and scroll depth, the files you download, and similar interaction data;

  • Performance and diagnostic data: error reports, latency information, and similar data used to diagnose Site issues;

  • Advertising and measurement identifiers: identifiers set by Google Analytics, Meta Pixel, and similar third-party measurement and advertising services that allow those providers to recognize your browser or device across sites.

​

2.3 Information We Receive From Third Parties

​

We may receive Personal Information about you from:

  • Authorized distributors, sales agents, and channel partners who refer you to us or who pass on inquiries;

  • Public sources such as company websites, professional directories, professional social networks (e.g., LinkedIn), regulatory filings, and trade-show registration lists;

  • Service providers that perform sanctions screening, anti-money-laundering checks, denied-party screening (including U.S. Treasury OFAC, U.S. Commerce BIS, U.K. HM Treasury, EU consolidated list, and analogous lists), and other compliance checks that we are required to perform on prospective business counterparties under applicable export-control, trade-sanctions, and anti-corruption laws;

  • Credit-reference and trade-credit-insurance providers, where we are evaluating extending payment terms to a business customer;

  • Analytics, advertising, and measurement providers that report aggregated or device-level information about how visitors find and use the Site.

​

2.4 Sensitive Information

​

We do not seek to collect Sensitive Information (sometimes called “special categories of Personal Information”) through the Site. Sensitive Information includes information that reveals racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic data, biometric data processed to uniquely identify a natural person, data concerning health, data concerning a natural person’s sex life or sexual orientation, precise geolocation, government-issued identifiers, and (in certain U.S. states) log-in credentials and consumer-health data. Please do not submit Sensitive Information through the Site unless we specifically request it and you have given us your explicit consent.

​

2.5 Children’s Information

​

Our Site is directed exclusively at professional purchasers of medical devices and is not intended for, marketed to, or designed for children. We do not knowingly collect Personal Information from children under the age of 16 (or such higher age as may apply under applicable local law—for example, under 13 in the United States for purposes of the Children’s Online Privacy Protection Act). If you believe that a child has provided us with Personal Information, please contact us as described in Section 15 and we will take steps to delete the information.

​

3.  How We Use Your Information

We use the Personal Information we collect for the following purposes:

​

3.1 Responding to Inquiries and Operating Our Sales Process

​

  • To respond to contact-form submissions, quotation requests, product-specification requests, regulatory-document requests, distributor inquiries, and other questions you submit;

  • To prepare and send quotations, proforma invoices, sample agreements, and other commercial documentation;

  • To negotiate, enter into, and perform business contracts with the organization you represent;

  • To verify your identity and your authority to act on behalf of your organization, and to perform the customer-onboarding diligence that applicable laws require of medical-device manufacturers.

​

3.2 Product, Regulatory, and Safety Operations

​

  • To process and investigate complaints, product-quality reports, field-safety reports, and adverse-event reports concerning our medical devices;

  • To comply with our post-market surveillance, vigilance, recall, and corrective-action obligations under applicable medical-device regulations, including 21 C.F.R. Part 803 (U.S. FDA Medical Device Reporting), EU Regulation 2017/745 on medical devices, the U.K. Medical Devices Regulations 2002, China’s Regulations on the Supervision and Administration of Medical Devices, Health Canada’s Medical Devices Regulations, and equivalent rules in other countries to which we export;

  • To contact you in connection with product safety notices, recalls, field-safety corrective actions, or other safety-critical communications, even if you have opted out of marketing.

​

3.3 Site Operation, Improvement, and Security

​

  • To operate, maintain, secure, and improve the Site, including monitoring availability, troubleshooting errors, and analyzing usage patterns to improve content and navigation;

  • To prevent, detect, investigate, and respond to fraud, abuse, security incidents, denial-of-service attacks, scraping, and other malicious or unlawful activity directed at the Site or our customers;

  • To enforce our website terms of use and other applicable policies.

​

3.4 Marketing and Business Development

​

  • To send commercial communications (including newsletters, product announcements, white papers, webinar invitations, and trade-show invitations) to professional contacts who have requested them or whose receipt of such communications is otherwise permitted by applicable law;

  • To measure the effectiveness of our marketing campaigns, including open and click-through rates, attribution of conversions, and audience-engagement metrics;

  • To personalize content and offers based on your professional role, the products you have inquired about, and your country.

​

3.5 Legal, Regulatory, and Compliance Purposes

​

  • To comply with U.S., E.U., U.K., Chinese, and other applicable export-control, trade-sanctions, anti-money-laundering, anti-corruption, and customs laws (including, where applicable, conducting denied-party, sanctions, and end-use/end-user screening);

  • To comply with applicable tax, accounting, recordkeeping, and reporting obligations;

  • To respond to lawful requests by public authorities, including to meet national-security, law-enforcement, or court-order requirements;

  • To establish, exercise, or defend legal claims, including product-liability claims and regulatory enforcement matters;

  • To comply with this Privacy Policy and any other notices, contracts, or commitments we provide to you.

​

3.6 Aggregated, De-Identified, and Anonymized Information

​

We may aggregate, de-identify, or anonymize Personal Information so that it can no longer reasonably be associated with you, and we may use that information for any lawful business purpose, including statistical analysis, benchmarking, research, and product development. We do not attempt to re-identify de-identified or anonymized information except as permitted by applicable law (for example, to test the effectiveness of our de-identification procedures).

​

4.  Legal Bases for Processing (EU/EEA, U.K., and Similar Jurisdictions)

Where the EU General Data Protection Regulation 2016/679 (“GDPR”), the U.K. GDPR, the Swiss Federal Act on Data Protection, or a similar law that requires a specified legal basis for processing applies to our processing of your Personal Information, we rely on the following legal bases:

​

4.1 Performance of a Contract or Pre-Contractual Steps (GDPR Art. 6(1)(b))

​

Where you (or the organization you represent) have entered into, or are in the process of entering into, a contract with us—for example, to purchase products or to act as our distributor—we process Personal Information of the individuals involved in negotiating and performing that contract as necessary to carry it out.

​

4.2 Compliance with Legal Obligations (GDPR Art. 6(1)(c))

​

We process Personal Information as required to comply with legal obligations to which we are subject, including obligations under medical-device regulations, export-control and sanctions laws, anti-money-laundering laws, tax and accounting laws, and applicable court orders or other legally binding requests.

​

4.3 Legitimate Interests (GDPR Art. 6(1)(f))

​

We process Personal Information where doing so is necessary for the legitimate interests pursued by us or a third party and where those interests are not overridden by your interests, fundamental rights, or freedoms. The legitimate interests we rely on include:

  • Responding to professional inquiries from prospective business customers;

  • Operating, securing, and improving the Site and our products and services;

  • Promoting our products and services to professional audiences;

  • Carrying out due-diligence on prospective business counterparties;

  • Investigating complaints, defending legal claims, and protecting our property and rights;

  • Reorganizing or restructuring our business, including in the context of a sale, merger, or acquisition (see Section 5).

You have the right to object to processing carried out on the basis of legitimate interests, as described in Section 9 and Section 10.

​

4.4 Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a))

​

Where required by law, we process Personal Information on the basis of your consent—for example, to send certain marketing communications, to place non-essential cookies or similar tracking technologies, or to process Sensitive Information that you choose to provide to us. You may withdraw your consent at any time without affecting the lawfulness of any processing carried out before withdrawal.

​

4.5 Vital Interests and Public Interest (GDPR Art. 6(1)(d) and (e))

​

In rare cases, we may process Personal Information to protect a person’s vital interests—for example, when handling an urgent medical-device safety report—or to perform a task carried out in the public interest, such as cooperating with public-health authorities in response to a product safety issue.

​

5.  How We Share Your Information

We do not sell Personal Information for monetary consideration. Subject to applicable law, we share Personal Information in the following categories of circumstances:

​

5.1 Within the CuraSource Medical USA Group

​

We share Personal Information among CuraSource Medical entities, including our U.S. headquarters in Seattle, Washington, and our affiliated manufacturing, quality, and regulatory operations in China, where necessary to operate our global business consistent with the purposes described in Section 3.

​

5.2 Service Providers and Processors

​

We share Personal Information with third-party service providers that process information on our behalf and under our instructions, including:

  • Website hosting, content-delivery-network, cybersecurity, and domain-management providers;

  • Customer-relationship-management (CRM), email-delivery, marketing-automation, and helpdesk-ticketing platforms;

  • Analytics, advertising-measurement, and conversion-attribution providers, including Google LLC (Google Analytics) and Meta Platforms, Inc. (Meta Pixel);

  • Form-processing, anti-spam, and bot-mitigation providers;

  • Cloud storage, backup, and disaster-recovery providers;

  • Professional advisors such as outside counsel, auditors, and consultants;

  • Translation, interpretation, and localization providers;

  • Shipping, logistics, customs-brokerage, and trade-document providers;

  • Sanctions-screening, anti-money-laundering, credit-reference, and trade-credit-insurance providers.

We require service providers to process Personal Information only for the purposes for which we have engaged them, in accordance with our instructions, and subject to appropriate confidentiality and security obligations.

​

5.3 Authorized Distributors and Channel Partners

​

Where you submit an inquiry that we determine is best handled by one of our authorized distributors or agents in your country or region, we may forward the Personal Information you submitted to that distributor or agent so that they can respond to you.

​

5.4 Authorities and Other Third Parties for Legal Reasons

​

We may disclose Personal Information to courts, government authorities, regulators, and other third parties as we believe necessary or appropriate to:

  • Comply with applicable laws, regulations, legal process, or governmental requests, including requests from medical-device regulators, customs authorities, tax authorities, and law-enforcement bodies in any country in which we operate;

  • Enforce our terms and conditions, and protect our rights, property, and safety, or that of our customers, employees, or others;

  • Detect, prevent, or otherwise address fraud, security, or technical issues;

  • Cooperate with public-health authorities in connection with the investigation of medical-device incidents.

​

5.5 Corporate Transactions

​

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of all or substantially all of our assets, or transition of service to another provider, Personal Information may be transferred to the relevant counterparty and its advisors as part of the diligence and completion process, subject to customary confidentiality protections.

​

5.6 With Your Consent or at Your Direction

​

We may share Personal Information with other third parties when you consent to or direct that sharing.

​

6.  International Data Transfers

CuraSource Medical is a global business and operates principally from the United States (Seattle, Washington) and the People’s Republic of China, with customers and distributors on six continents. As a result, Personal Information that we collect may be transferred to, stored in, or accessed from countries other than your country of residence.

​

6.1 Transfers From the EEA, U.K., and Switzerland

​

Where we transfer Personal Information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been the subject of an “adequacy decision” under the GDPR, U.K. GDPR, or Swiss Federal Act on Data Protection, we use appropriate safeguards, which may include:

  • The European Commission’s Standard Contractual Clauses (Module 1, 2, 3, or 4 as applicable), the U.K. International Data Transfer Addendum, or the Swiss equivalent;

  • Supplementary technical, organizational, and contractual measures appropriate to the nature of the transfer and the destination country, including encryption in transit and at rest, access controls, and assessments of the legal regime of the destination country;

  • Other lawful transfer mechanisms recognized by applicable law, including, where appropriate, your explicit consent or the necessity of the transfer for the performance of a contract you have entered into.

You may request a copy of the relevant transfer safeguards by contacting us as described in Section 15, subject to redaction to protect commercially sensitive information.

​

6.2 Transfers Out of China

​

Where Personal Information collected in China is transferred outside China, including to our U.S. headquarters or to our other affiliates and service providers, we comply with the Personal Information Protection Law of the People’s Republic of China (“PIPL”), including by, as applicable, obtaining separate consent, executing the Cyberspace Administration of China Standard Contract for Cross-Border Transfers of Personal Information, completing personal-information protection impact assessments, and (where required) passing the CAC security assessment.

​

6.3 Transfers Out of Other Jurisdictions

​

Where we transfer Personal Information from other jurisdictions (including Brazil, Canada, Australia, Japan, Singapore, the Republic of Korea, the United Arab Emirates, Saudi Arabia, South Africa, and others) we comply with the local cross-border transfer requirements of those jurisdictions, including by relying on appropriate consent, contractual safeguards, registrations, or assessments where required.

7.  Data Retention and Security

7.1 Retention

​

We retain Personal Information only for as long as is necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, regulatory, or reporting requirements that apply to us. In determining the appropriate retention period, we consider:

  • The nature, amount, and sensitivity of the Personal Information;

  • The potential risk of harm from unauthorized use or disclosure;

  • The purposes for which we process the Personal Information and whether we can achieve those purposes through other means;

  • Applicable legal, regulatory, and contractual requirements, including those imposed by medical-device regulators, tax authorities, and limitations periods for legal claims.

Typical retention periods that we apply (subject to overriding legal obligations) include:

  • Contact-form submissions and quotation requests: up to 36 months from the last interaction, unless a commercial relationship develops, in which case the information is retained as part of the customer record;

  • Customer records and commercial correspondence: for the duration of the commercial relationship plus the longer of (i) the limitations period for contractual claims under applicable law and (ii) ten (10) years after termination, to comply with medical-device recordkeeping requirements;

  • Complaints, adverse-event reports, and vigilance records: at least the lifetime of the device plus the period required by applicable medical-device regulations (commonly fifteen (15) years for implantable devices and ten (10) years for other devices, but longer where local law so requires);

  • Marketing records: until you opt out, plus a short residual period for suppression-list purposes;

  • Site server logs: typically 12 to 24 months, except where longer retention is necessary for security investigations or required by law;

  • Tax and accounting records: as required by applicable tax law (commonly 7 to 10 years).

When we no longer need Personal Information, we will securely delete, destroy, or anonymize it, except where overriding legal obligations require continued retention.
 

7.2 Security
 

We maintain administrative, technical, physical, and organizational measures designed to protect Personal Information against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures include, depending on the sensitivity of the information and the risks involved:

  • Encryption of data in transit using industry-standard TLS;

  • Encryption of data at rest in our cloud environments where appropriate;

  • Logical access controls, role-based authorization, and least-privilege principles;

  • Multi-factor authentication for access to administrative interfaces;

  • Network segmentation, firewalls, intrusion detection, and vulnerability scanning;

  • Secure software-development practices and routine patching;

  • Background checks of personnel, confidentiality undertakings, and information-security training;

  • Vendor risk-management procedures, including security and privacy assessments before engaging service providers that process Personal Information on our behalf;

  • Documented incident-response and breach-notification procedures, including the procedures we use to comply with our notification obligations under applicable law.

No system of security is impenetrable, and we cannot guarantee the absolute security of our systems. You are responsible for safeguarding any account credentials we issue to you and for notifying us promptly of any suspected unauthorized use of your account.

8.  Cookies and Similar Tracking Technologies

8.1 What These Technologies Are

​

Cookies are small text files that a website places on your device when you visit. Similar technologies include web beacons (also known as clear GIFs or pixel tags), local-storage objects, session-storage objects, software development kits, fingerprinting techniques, and server-side tracking. In this Policy, we refer to all of these collectively as “Cookies.” Cookies allow a website to recognize your browser or device, remember your preferences, measure how you interact with a website, and personalize content.

​

8.2 Categories of Cookies We Use

​

We use the following categories of Cookies on the Site:

  • Strictly Necessary Cookies—required to operate the Site and to provide features you request, such as remembering form inputs, maintaining sessions, and providing basic security. These Cookies do not require consent in most jurisdictions.

  • Functional / Preference Cookies—remember your preferences (such as your country and language) to improve your experience.

  • Performance / Analytics Cookies—help us measure how visitors use the Site so we can improve its content and performance. These include cookies set by Google Analytics.

  • Marketing / Advertising Cookies—used to measure the effectiveness of our marketing campaigns and, where applicable, to deliver advertising that may be of interest to you. These include the Meta Pixel set by Meta Platforms, Inc.

​

8.3 Specific Third-Party Services

​

Google Analytics. We use Google Analytics, a web-analytics service provided by Google LLC and its affiliates, to understand Site usage. Google Analytics uses cookies and similar identifiers to collect information such as IP address, browser type, pages visited, time spent, and referring URL. Google processes this information on our behalf, and we have configured Google Analytics to use IP-anonymization features where available. You can learn more about how Google collects and processes data at https://policies.google.com/technologies/partner-sites and you can install the Google Analytics Opt-Out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Meta Pixel. We use Meta Pixel, a service provided by Meta Platforms, Inc. and Meta Platforms Ireland Limited, to measure the effectiveness of our marketing activities and to understand the actions visitors take on the Site after viewing or clicking our content on Meta’s platforms (Facebook, Instagram, etc.). Meta Pixel uses cookies and similar identifiers and may set Meta’s cookies on your device. Meta acts as an independent controller for certain of these processing activities and acts as a joint controller with us for others, as described in Meta’s controller agreements. You can learn more about how Meta processes your data at https://www.facebook.com/privacy/policy/ and you can adjust your Meta ad-preferences at https://www.facebook.com/settings?tab=ads.

​

8.4 Managing Cookies

​

Where required by applicable law, we ask for your consent before placing non-essential Cookies on your device, and we provide a cookie banner or preference center that allows you to accept all, reject all, or selectively manage non-essential Cookies. You can also control Cookies through your browser settings; however, blocking strictly necessary Cookies may impair the functionality of the Site.

​

8.5 Do Not Track and Global Privacy Control

​

Some browsers transmit “Do Not Track” (“DNT”) signals. Because there is no industry consensus on how to interpret DNT signals, we do not currently respond to them. Where required by law (including in California under the CPRA), we treat browser-based Universal Opt-Out Mechanisms—such as the Global Privacy Control (“GPC”) signal—as a valid request to opt out of “sale” and “sharing” of Personal Information for the browser from which the signal is received.

9.  Your Privacy Rights (General)

Depending on your country and state of residence and the applicable law, you may have the following rights with respect to Personal Information that we hold about you. We describe the specific rights available under particular legal regimes in Section 10.

  • Right of access. You may request confirmation of whether we process Personal Information about you and, if so, a copy of that Personal Information and certain related information.

  • Right to rectification. You may ask us to correct Personal Information that is inaccurate or incomplete.

  • Right to erasure (“right to be forgotten”). You may ask us to delete Personal Information about you in certain circumstances.

  • Right to restrict processing. You may ask us to restrict our processing of Personal Information about you in certain circumstances.

  • Right to data portability. You may ask to receive Personal Information you have provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.

  • Right to object. You may object to processing of Personal Information about you that is based on our legitimate interests, including for direct-marketing purposes.

  • Right to withdraw consent. Where we process Personal Information on the basis of consent, you may withdraw that consent at any time.

  • Right not to be subject to solely automated decision-making. You may have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects about you. We do not currently engage in such automated decision-making through the Site.

  • Right to lodge a complaint. You may lodge a complaint with the data-protection or privacy regulator of your country or state of residence, as described in Sections 10 and 15.

  • Right to non-discrimination. Where applicable law so requires, we will not discriminate against you for exercising your privacy rights.

​

9.1 How to Exercise Your Rights

​

To exercise any of the rights described above, please contact us using the details in Section 15. We will respond to your request within the time required by applicable law. We may need to verify your identity before fulfilling certain requests; we will only use the information you provide for verification purposes for that purpose. You may use an authorized agent to submit a request on your behalf, where applicable law permits; we may require written proof of authorization and may verify the agent’s identity.

​

9.2 Limitations

​

We may decline a request or only partially fulfill it where applicable law permits or requires us to do so—for example, where fulfilling the request would adversely affect the rights or freedoms of others, where we are required by law to retain the information (such as for medical-device recordkeeping), or where the request is manifestly unfounded or excessive. We will inform you of the reason for any refusal to the extent permitted by law.

10.  Jurisdiction-Specific Disclosures and Rights

10.1 European Economic Area, United Kingdom, and Switzerland (GDPR / U.K. GDPR / FADP)

​

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following additional information applies to you.

Controller

The controller responsible for the processing of your Personal Information is CuraSource Medical (the trading name of Jiangsu Kanghua Medical Equipment LLC), with its registered headquarters in Seattle, Washington, United States.

Your Rights

You have the rights described in Section 9, exercisable in accordance with the GDPR, U.K. GDPR, or Swiss Federal Act on Data Protection, as applicable. You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement. In the U.K., this is the Information Commissioner’s Office (https://ico.org.uk/). In Switzerland, this is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/). A list of EU data-protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. We would, however, appreciate the opportunity to address your concerns first by contacting us as described in Section 15.

EU/UK Representatives

Where required, we appoint EU and U.K. representatives under Article 27 of the GDPR and U.K. GDPR. Their contact details, where appointed, will be published on the Site. You may also contact our representatives by emailing ian.shen@curasourcemedical.com with the subject line “EU/UK Representative” and we will route your request accordingly.

International Transfers

See Section 6 for information about the safeguards we apply to transfers of Personal Information out of the EEA, U.K., or Switzerland.

​

10.2 California (CCPA / CPRA)

​

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), grants you specific rights regarding your Personal Information. This section supplements the information elsewhere in this Policy.

Notice at Collection

We collect the following categories of Personal Information about California residents (using the categories set out in Cal. Civ. Code § 1798.140):

  • Identifiers (e.g., real name, business contact information, IP address, online identifiers);

  • Commercial information (e.g., records of products or services requested);

  • Internet or other electronic-network activity information (e.g., browsing history on the Site, interaction information);

  • Geolocation data (approximate location derived from IP address);

  • Professional or employment-related information (e.g., job title, employer, professional role);

  • Inferences drawn from any of the above to create a profile reflecting professional preferences or characteristics.

We collect these categories from the sources, for the purposes, and disclose them to the categories of recipients described in Sections 2, 3, and 5. We retain each category in accordance with Section 7.

Sale and Sharing

CuraSource does not “sell” Personal Information in exchange for monetary consideration. However, our use of third-party analytics and advertising Cookies described in Section 8 (including Google Analytics and Meta Pixel) may constitute “sharing” for cross-context behavioral advertising under the CCPA. We honor the Global Privacy Control as a valid opt-out of such sharing for the browser from which the signal is received and provide a “Your Privacy Choices” link in the footer of the Site for additional controls.

Sensitive Personal Information

We do not collect Sensitive Personal Information (as defined in CCPA) for the purpose of inferring characteristics about California residents.

California Rights

California residents have the right to know, the right to delete, the right to correct, the right to opt out of sale and sharing, the right to limit use and disclosure of Sensitive Personal Information (where applicable), and the right to non-discrimination for exercising these rights. You may submit a request as described in Section 15 or by emailing ian.shen@curasourcemedical.com with “California Privacy Request” in the subject line. You may use an authorized agent to submit a request, subject to verification.

Shine the Light

California Civil Code § 1798.83 entitles California residents to request information about disclosures of Personal Information to third parties for those third parties’ direct-marketing purposes. We do not make such disclosures.

​

10.3 Washington State (My Health My Data Act)

​

Washington State’s My Health My Data Act (“MHMDA”) provides specific protections for “consumer health data,” which is defined broadly. CuraSource is headquartered in Washington State and complies with MHMDA with respect to Washington residents and persons whose consumer health data is collected in Washington.

Consumer Health Data We Collect

Our Site is not intended to collect consumer health data. We do not knowingly collect data that identifies a consumer’s past, present, or future physical or mental health status, including information related to gender-affirming care, reproductive or sexual health, biometric data, or precise location information that could indicate a consumer’s attempt to acquire or receive health services or supplies. If you believe that we have inadvertently collected such information about you, please contact us as described in Section 15 and we will promptly delete it where required.

Washington Rights

If we do hold consumer health data about you, you have the right to confirm whether we are collecting, sharing, or selling your consumer health data; to access that data; to withdraw consent to its collection, sharing, or sale; and to have that data deleted (and to have us notify recipients of the data of your deletion request). We do not sell consumer health data and would obtain your valid authorization before doing so.

Washington Complaints

You may file a complaint with the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.

​

10.4 Other U.S. State Privacy Laws

​

Residents of certain other U.S. states—including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa (ICDPA), Indiana (ICDPA), Tennessee (TIPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Minnesota (MCDPA), Maryland (MODPA), and others as enacted from time to time—may have additional rights with respect to their Personal Information, including rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. To exercise these rights, please contact us as described in Section 15. You may also have the right to appeal a denial of a privacy request, which you may do by replying to our response or emailing ian.shen@curasourcemedical.com with “Privacy Appeal” in the subject line. If your appeal is denied, you may contact the attorney general of your state.

​

10.5 Canada (PIPEDA and Provincial Privacy Laws)

​

If you are located in Canada, the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and substantially similar provincial laws (including Quebec’s Act respecting the protection of personal information in the private sector (Law 25), British Columbia’s Personal Information Protection Act, and Alberta’s Personal Information Protection Act) apply to our processing of your Personal Information.

Consent

We collect, use, and disclose your Personal Information with your knowledge and consent, except where authorized or required by law. Your consent may be express or implied depending on the circumstances and the sensitivity of the Personal Information at issue. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.

Cross-Border Transfers

Personal Information that we collect from Canadian residents may be transferred to and processed in the United States, China, and other countries. While in those countries, the Personal Information may be subject to lawful access requests by courts, law-enforcement, regulatory, or national-security authorities of those countries. We use contractual and other measures to provide a comparable level of protection while the information is being processed by our service providers.

Quebec Privacy Officer

Quebec residents may exercise their rights under Law 25 (including rights of access, correction, de-indexation, and portability) by contacting our Privacy Officer at ian.shen@curasourcemedical.com. You may also lodge a complaint with the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca/).

Federal Complaints

You may also lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/).

​

10.6 China (PIPL)

​

If you are located in China, the Personal Information Protection Law of the People’s Republic of China (“PIPL”) applies. In addition to the rights described in Section 9, you have the right to refuse and restrict the processing of your Personal Information, the right to obtain a copy or transfer your Personal Information, and the right to request an explanation of our processing rules. You may also designate a person to exercise your rights after your death, where applicable. Where we transfer your Personal Information outside China, we comply with the requirements described in Section 6.

​

10.7 Brazil (LGPD)

​

If you are located in Brazil, the Lei Geral de Proteção de Dados (“LGPD”) applies. You have the rights described in Section 9 in accordance with the LGPD, including the right to information about the public and private entities with which we share your data and the right to anonymize, block, or eliminate unnecessary or excessive Personal Information. You may contact the Brazilian Data Protection Authority (“ANPD”) at https://www.gov.br/anpd/.

​

10.8 Australia (Privacy Act and Australian Privacy Principles)

​

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to our processing of your Personal Information. You may make a complaint to us as described in Section 15 and, if you are not satisfied with our response, to the Office of the Australian Information Commissioner (https://www.oaic.gov.au/).

​

10.9 Other Jurisdictions

​

Because we export to customers on six continents, we are subject to additional privacy laws including (without limitation) the Act on the Protection of Personal Information of Japan; the Personal Data Protection Act of Singapore; the Personal Information Protection Act of the Republic of Korea; the Protection of Personal Information Act of South Africa; the Personal Data Protection Law of Saudi Arabia; the Data Protection Law of the United Arab Emirates and the laws of the Dubai International Financial Centre and Abu Dhabi Global Market; the Nigeria Data Protection Act; and the New Zealand Privacy Act. We endeavor to comply with the requirements of these laws to the extent applicable. If you have a question about your rights under your local law, please contact us as described in Section 15.

11.  Children’s Privacy

As stated in Section 2.5, the Site is directed at professional purchasers of medical devices and is not designed for or directed to children. We do not knowingly collect Personal Information from children under the age of 16 (or such higher minimum age as may apply under applicable local law). In the United States, our practices are intended to comply with the Children’s Online Privacy Protection Act (“COPPA”), which prohibits the knowing online collection of Personal Information from children under 13 without verifiable parental consent. If you become aware that a child has provided us with Personal Information, please contact us as described in Section 15 and we will take steps to delete the information.

12.  Automated Decision-Making and Profiling

We do not currently use Personal Information collected through the Site to make decisions about you based solely on automated processing—including profiling—that produces legal or similarly significant effects concerning you. If we begin to do so, we will update this Policy and, where required by law, provide meaningful information about the logic involved, the significance, and the envisaged consequences of such processing, and we will provide you with appropriate safeguards such as the right to obtain human intervention, to express your point of view, and to contest the decision.

13.  Third-Party Links and Services

The Site may contain links to third-party websites, plug-ins, applications, or services that are not operated or controlled by us. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and services and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

14.  Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will indicate the date of the most recent update at the top of this Policy and, where required by law, provide a more prominent notice (including, for some changes, email notification or a banner on the Site). Your continued use of the Site after the effective date of an updated Policy constitutes your acceptance of the updated Policy to the extent permitted by applicable law.

15.  How to Contact Us and File a Complaint

15.1 Privacy Contact
 

If you have any questions, concerns, or complaints about this Privacy Policy or our processing of your Personal Information, or if you would like to exercise any of your privacy rights, please contact us using the details below. We treat all privacy inquiries as a priority and will respond within the time required by applicable law.
 

Email: ian.shen@curasourcemedical.com

Subject lines we recommend you use:

  • “Privacy Inquiry” for general questions;

  • “Data Subject Request” / “Consumer Privacy Request” to exercise privacy rights;

  • “Cookie Inquiry” for questions about Cookies or cookie consent;

  • “Privacy Complaint” to file a complaint;

  • “Privacy Appeal” to appeal the denial of a privacy request.
     

Mailing address: 2000 NE 42nd Ave, Suite D/Unit 2290, Portland OR, 97213

CuraSource Medical USA

Attn: Privacy Officer

Portland, Oregon, United States
 

15.2 Complaints Procedure
 

We are committed to resolving privacy complaints fairly and promptly. When you submit a complaint:

  • We will acknowledge receipt within 5 business days;

  • We will investigate your complaint, which may involve contacting you for additional information needed to verify your identity or to understand your concern;

  • We will respond substantively within the time required by applicable law (and in any event within 30 days where no shorter or longer period is prescribed), and will explain any extension we need to take.

If you are not satisfied with our response, you may lodge a complaint with the data-protection or privacy authority in your jurisdiction, as identified in Section 10.
 

15.3 Accessibility
 

If you require this Privacy Policy in an alternative format (for example, in large print, audio, or a different language), please contact us using the details above and we will endeavor to accommodate your request.

16.  Legal Entity Information

CuraSource Medical is the trading name of Jiangsu Kanghua Medical Equipment LLC, the legal entity responsible for processing Personal Information described in this Policy. References in this Policy to “CuraSource,” “CuraSource Medical,” “we,” “us,” and “our” include Jiangsu Kanghua Medical Equipment LLC and its subsidiaries and affiliates as the context requires. For the avoidance of doubt, the controller responsible for the processing described in this Policy is CuraSource Medical, with its headquarters located in Seattle, Washington, United States of America.

17.  Definitions

The following capitalized terms have the meanings given below for purposes of this Policy:

​

  • “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, including “personal data” as defined under the GDPR, U.K. GDPR, Swiss FADP, LGPD, PIPEDA, PIPL, MHMDA, CCPA, and other applicable laws.

​

  • “Sensitive Information” means Personal Information described in Section 2.4.

​

  • “Process,” “Processing,” and similar terms have the meanings given under applicable law and include any operation performed on Personal Information.

​

  • “Controller” means the entity that determines the purposes and means of the processing of Personal Information.

​

  • “Processor” means an entity that processes Personal Information on behalf of a controller.

​

  • “Sale” and “Sharing” have the meanings given under the CCPA and other applicable U.S. state privacy laws.

​

  • “Consumer Health Data” has the meaning given under the Washington My Health My Data Act.

 

 

— End of Privacy Policy —

bottom of page