Privacy Policy (Handling of Personal Information)

METRIA Inc.

METRIA Inc. (“the Company”) deeply recognizes the importance of protecting personal information in its non-contact vital-sign measurement service “METRIA,” its AI image-reading support system “QOLL-Med,” and its other products and services (collectively, “the Services”). The Company complies with the Act on the Protection of Personal Information (“the APPI”) and other applicable laws and guidelines, and establishes and appropriately operates this Privacy Policy (“this Policy”) as set out below.

Because the Services handle information relating to health and medicine (including special care-required personal information as defined in the APPI), the Company exercises particular caution in its handling.

Article 1 (Business Operator Information)

The information of the personal information handling business operator under this Policy is as follows.

Name: METRIA Inc. (株式会社METRIA)
Address: 1-9-11 Higashi-Azabu, Minato-ku, Tokyo, Japan
Representative: Yusuke Fukushima, Representative Director
Personal Information Protection Manager: Teppei Todo, Executive Officer
Contact: contact@metria-vitals.com

Article 2 (Definitions)

The terms used in this Policy have the meanings defined in the APPI. The principal terms are as follows.

Personal information: information about a living individual that can identify a specific individual by the descriptions etc. contained in it (including information that can be readily collated with other information and thereby identify a specific individual), and information containing an individual identification code. Facial images, facial video, and the like may constitute personal information as information capable of identifying a specific individual.
Special care-required personal information: personal information containing descriptions etc. defined by the APPI and related cabinet orders as requiring special care in handling so as not to cause unfair discrimination or prejudice against the individual — such as medical history, physical or mental disabilities, and the results of health examinations. Information estimated or recorded regarding an individual’s health condition in the Services may fall under this category.
Personal data / retained personal data: personal information constituting a personal information database etc., and personal data that the Company has the authority to disclose, correct, suspend the use of, and so on.
Pseudonymously / anonymously processed information: information processed in accordance with the standards set by the APPI so that a specific individual cannot be identified unless collated with other information (pseudonymously processed information), and information processed so that a specific individual can neither be identified nor restored (anonymously processed information).

Article 3 (Information Collected)

In providing the Services, the Company may collect the following information. The items actually collected differ depending on the features and services used.

Biometric and health-related information (including special care-required personal information): camera footage and facial video; pulse waveforms obtained via rPPG (remote photoplethysmography); and vital and health indicators estimated therefrom, such as blood oxygen saturation (SpO₂) and heart rate.
Attribute information: age (or age range), sex, and other attributes.
Interview and input information: health, lifestyle, and similar information that the individual inputs or answers through AI interviews, questionnaires, and the like.
Device and usage information: device information, OS/browser information, cookies, usage logs, access date and time, and the like.

The Company does not collect information such as name, address, telephone number, or email address or other contact details (except where, upon receiving an inquiry, the Company uses contact details voluntarily provided by the individual solely for the purpose of responding).

The handling of camera footage and facial video (whether or not it is stored) differs by usage mode, as follows.

Standard measurement mode: camera footage and facial video are acquired only temporarily, to the extent necessary for measurement, and are automatically discarded upon completion of the analysis. Except for the vital and health indicators obtained through analysis, the Company does not store camera footage or facial video.
Learning mode (optional): only where the individual has consented to learning mode, camera footage and facial video are stored and used as research-and-development data in order to improve estimation accuracy and for R&D (algorithm training). Learning mode is optional; standard measurement is available even without consent. Consent may be withdrawn at any time, and after withdrawal no new storage for that purpose is performed. Information stored in learning mode is retained for the period necessary to achieve the R&D purpose.

Article 4 (Method of Collection; Collection of Special Care-Required Personal Information)

The Company collects personal information by proper means, without deception or other wrongful means.
When collecting special care-required personal information (including the biometric and health-related information in Article 3), the Company obtains the individual’s prior consent, except for the exceptions provided by law.
When collecting biometric information through the camera functions etc. of the Services, the Company clearly indicates the purpose of use and the content of the information to be collected prior to collection, and begins measurement only after obtaining the individual’s consent.

Article 5 (Purposes of Use)

The Company uses collected personal information within the scope necessary to achieve the following purposes.

To provide the non-contact vital-sign measurement service (METRIA), and to display, record, manage over time, and provide feedback to the individual on measurement results.
To undertake the development, manufacture, sale, and operation of, and to provide, the AI image-reading support system (QOLL-Med) and other systems (see also Articles 9 and 13).
To provide AI interviews and other health-support features, and features for continued use (including where a family watch-over feature is provided).
To improve the quality of the Services, to validate the accuracy of and conduct R&D on the rPPG estimation model and other algorithms, and to develop new features (including camera footage and facial video stored in learning mode; where special care-required personal information is used, this is done within the scope of the consent obtained in advance).
To utilize information for R&D in the health and medical fields (conducted by the method set out in Article 13).
To respond to inquiries and consultations from individuals, and to verify identity.
To respond to acts that violate the terms of use, to prevent unauthorized use, and to protect the Company’s rights, property, and services.
To respond to laws or to requests from public authorities.
For purposes incidental or related to the foregoing.

Article 6 (Change of Purposes of Use)

The Company may change the purposes of use within the scope reasonably deemed to have relevance to the purposes of use before the change. In such case, the Company will notify the individual of the changed purposes of use by the Company’s prescribed method, or announce them on this website.

Article 7 (Handling of Special Care-Required Personal Information)

The Company strictly manages special care-required personal information separately from other personal information, and does not handle it beyond the scope of the purposes of use in Article 5.
The Company does not provide special care-required personal information to third parties without the individual’s consent (opt-out third-party provision).

Article 8 (Third-Party Provision)

At present, the Company does not provide personal data to third parties based on the individual’s consent. If it does so in the future, it will amend this Policy in advance and obtain the individual’s consent in accordance with law.
Notwithstanding the preceding paragraph, the Company may provide personal data without the individual’s consent in the following cases.
1. Where based on laws and regulations.
2. Where necessary to protect a person’s life, body, or property, and it is difficult to obtain the individual’s consent.
3. Where specially necessary to improve public health or to promote the sound development of children, and it is difficult to obtain the individual’s consent.
4. Where it is necessary to cooperate with a state organ, a local government, or a party entrusted by them in performing statutory affairs, and obtaining the individual’s consent is likely to impede those affairs.
Entrustment (Article 9), provision accompanying business succession, and joint use do not constitute provision to third parties.

Article 9 (Entrustment of the Handling of Personal Data)

The Company may entrust all or part of the handling of personal data within the scope necessary to achieve the purposes of use. In such case, the Company appropriately selects the contractor, obligates safety-management measures by contract, and exercises necessary and appropriate supervision over the contractor. The Company, including its contractors, handles personal data within Japan (Article 11).

Article 10 (Joint Use)

At present, the Company does not jointly use personal data. If it does so in the future, it will amend this Policy in advance and announce the items of personal data to be jointly used, the scope of joint users, their purposes of use, and the party responsible for management.

Article 11 (Region of Data Handling; Provision to Third Parties in Foreign Countries)

The Company handles personal data within Japan and does not provide it to third parties in foreign countries. If, in the future, personal data is handled abroad through the use of foreign cloud service providers or the like, the Company will amend this Policy in advance and, in accordance with law, provide the individual with information regarding the personal-information protection system of the relevant country and take measures such as obtaining the necessary consent.

Article 12 (Handling of Pseudonymously and Anonymously Processed Information)

The Company may process personal information into pseudonymously or anonymously processed information and handle it in accordance with the standards set by the APPI.
The Company complies with the prohibition on identification acts and other obligations set by law regarding such information. Except where permitted by law, pseudonymously processed information is not collated with other information for the purpose of identifying the individual.
When the Company creates anonymously processed information, it announces the items of information contained therein on this website in accordance with law.

Article 13 (Utilization for R&D in the Health and Medical Fields)

In order to improve the Services and to contribute to extending healthy life expectancy and advancing prevention and medicine, the Company utilizes the information it collects (including camera footage and facial video stored in learning mode) for R&D such as the rPPG estimation model, and for R&D in the health and medical fields.
At present, the utilization in the preceding paragraph is conducted as R&D within the Company (in-house use), and is carried out either (i) within the scope of the consent obtained in advance, or (ii) after processing into anonymously or pseudonymously processed information in accordance with the APPI.
At present, the Company does not provide personal data to third parties (such as pharmaceutical companies) for R&D purposes. If it does so in the future, it will amend this Policy in advance and either obtain the individual’s consent in accordance with law or handle the information after appropriate processing.
The Company may, in the future, consider collaboration with certified operators under the Act on Anonymized Medical Data That Contributes to Research and Development in the Medical Field (the Next-Generation Medical Infrastructure Act). Where handling under that Act is performed, the Company will separately carry out the necessary procedures and explanations in accordance with that Act and its related guidelines. (Because the Company is not a certified data-creation operator under that Act, it will not collect information without the individual’s consent on the basis of that Act’s opt-out.)

Article 14 (Handling of Cookies etc. and Usage Information)

The Company may use cookies, similar technologies, and access-analysis tools in order to provide and maintain the Services, to improve convenience, and to analyze usage.
At present, the Company does not perform advertising delivery using cookies etc., or provide information to third parties for advertising purposes. If it does so in the future, it will amend this Policy in advance.
You can refuse to accept cookies through your browser settings. In that case, some features of the Services may be unavailable.

Article 15 (Personal Information of Minors; Eligible Persons)

For the time being, the Services are intended for persons aged 18 or older, and are not intended for minors. The Company confirms age and the like at the start of use, and endeavors not to collect the personal information of minors. If the Services target minors in the future, the Company will take the necessary measures — such as obtaining the consent of a person with parental authority or other statutory agent in accordance with law — and will amend this Policy in advance.

Article 16 (Security Management Measures)

The Company takes organizational, human, physical, and technical security-management measures to prevent the leakage, loss, or damage of the personal data it handles (including special care-required personal information) and to otherwise ensure secure management. The Company handles personal data within Japan. Regarding the specific content of the security-management measures, the Company will respond appropriately in accordance with law upon a request made to the contact in Article 18.

Article 17 (Requests for Disclosure etc. of Retained Personal Data)

The individual or their agent may request the Company to notify the purpose of use of, disclose, correct/add to/delete the content of, suspend the use of or erase, and suspend the third-party provision of retained personal data (collectively, “requests for disclosure etc.”).
Please make requests for disclosure etc. to the contact in Article 18. After confirming that the requester is the individual or a legitimate agent, the Company will respond appropriately and promptly in accordance with law.
The Company may charge its prescribed fee for requests to notify the purpose of use and for disclosure.

Article 18 (Complaints and Contact)

For questions, complaints, requests for disclosure etc., and other inquiries regarding this Policy and the handling of personal information, please contact the following. The Company endeavors to respond to complaints appropriately and promptly.

Contact name: METRIA Inc. Personal Information Inquiry Desk
Personal Information Protection Manager: Teppei Todo, Executive Officer
Email: contact@metria-vitals.com
Address: 1-9-11 Higashi-Azabu, Minato-ku, Tokyo, Japan

Article 19 (Continuous Improvement and Changes to this Policy)

The Company reviews the operational status of its handling of personal information as appropriate, and endeavors to improve it.
The Company may change this Policy in response to amendments to laws, changes in business content, and the like. Unless otherwise provided by law, the amended Policy takes effect when it is posted on this website.

Article 20 (Governing Law)

The interpretation and application of this Policy are governed by the laws of Japan.

Enacted: July 25, 2026 METRIA Inc., Yusuke Fukushima, Representative Director