Privacy Policy
[Legal entity / facility name] ("the clinic") respects your personal data. This policy explains how we collect, use and disclose it under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA).
1. Data controller
[Legal entity], [address], [email], [phone] · Data Protection Officer: [name / email, if appointed]
2. Data we collect
- Contact data: preferred name, phone, LINE ID, WhatsApp, email
- Health data (sensitive): medical history, medications, allergies, examination findings and medical records
- Identity data: full name, date of birth, ID or passport number when you are treated
- Payment data: payment records (we do not store full card numbers)
- Website data: cookies and technical data, see section 8
3. Purposes and legal bases
- Booking and answering questions: steps taken at your request before a contract
- Examination, treatment and follow-up: contract, and explicit consent for health data (PDPA s.26)
- Keeping medical records: legal obligation (Medical Facilities Act)
- Medical emergencies: protecting life, body or health
- News and offers: only with your consent, which you can withdraw at any time
4. Disclosure
We never sell your data. We disclose it only to:
- A referral hospital, when medically necessary
- Service providers that help us operate (booking system, LINE, WhatsApp, cloud hosting) under confidentiality obligations
- Government authorities where the law requires
5. International transfers
Messaging apps such as LINE and WhatsApp may store data on servers outside Thailand. We use only providers with protection measures required by the PDPA. [list actual providers]
6. Retention
- Medical records: at least 5 years from your last visit, as required by the Medical Facilities Act [or longer per clinic policy]
- Contact data of people who did not become patients: [e.g. 1 year]
- Marketing data: until you withdraw consent
7. Your rights
You may request access to or a copy of your data, correction, deletion, restriction or objection, data portability, and withdrawal of consent. Contact [email]; we respond within 30 days. Some rights may be limited because the law requires us to keep medical records. You may complain to Thailand’s Personal Data Protection Committee (PDPC).
8. Cookies
This site uses cookies necessary for it to work. [Analytics / advertising cookies, if any, require consent via a cookie banner first]
9. Security
Access to medical records is limited to those who need it, systems are encrypted, and we do not send health data over insecure channels. If a breach occurs we notify the PDPC and you as the law requires.
10. Changes
We may update this policy; the effective date at the top of this page shows the latest version.