Privacy Policy Privacy Policy

Introduction

Thai Eye Hospital Co., Ltd. (the “Hospital,” “we,” or “our”) provides medical services at Thai Eye Hospital. The Hospital recognizes the importance of protecting the personal data of its service users and is committed to complying with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and all related laws.

This Privacy Policy explains how the Hospital collects, uses, discloses, and protects your personal data in your capacity as a patient, service user, or visitor to the Hospital’s websites and various contact channels.

This Privacy Policy covers the various services provided by the Hospital to the User. You agree that your use of the Hospital’s services through various channels or your provision of information to the Hospital constitutes your acceptance of the Hospital’s practices as specified in this Privacy Policy. Furthermore, the Hospital maintains a policy of continuously developing and improving its services to be modern, efficient, and consistently compliant with good corporate governance principles and relevant laws. Therefore, the Hospital may amend this Privacy Policy from time to time. You are encouraged to periodically review this policy to stay informed of the Hospital’s latest privacy practices.

For your convenience, you may click on the title of each section to read this Privacy Policy section by section, as follows:

1. Definitions

Within this Policy:

• (a) “Data Controller” means the service provider under this policy, namely Thai Eye Hospital Co., Ltd., located at 168 Charoen Rat Road, Bang Khlo, Bang Kho Laem, Bangkok 10120, Contact: Data Protection Officer (DPO), Email: [email protected], Tel. (+66)2-689-8888.
• (b) “Data Processor” means a third party who processes data for the benefit of, or on behalf of, the Data Controller.
• (c) “Data Processing” means any operation performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• (d) “Data” means personal data, non-personal data, and system data.
• (e) “Personal Data” means any information relating to a person, which enables the identification of such person, whether directly or indirectly.
• (f) “User” means you, a visitor, or a user, who is the data subject under this policy.

2. Sources and Methods of Acquiring Your Personal Data

Directly from you, such as information you provide during registration, or information the User amends or updates in your account profile. This is for the purpose of keeping your personal data up to date and to improve the quality and efficiency of the Hospital’s products and services.

3. Data Collected by the Hospital

4. Purposes of Data Collection and Use

5. Disclosure of Data to Third Parties

The Hospital will not sell, rent, or disclose your personal data to third parties for commercial purposes, except in the following circumstances:

• Doctors, nurses, and medical personnel involved in your treatment.
• Hospitals or medical facilities receiving patient referrals.
• Your health insurance company (as consented to by you).
• Assigned third-party service providers, such as laboratories and IT system providers.
• Government agencies, such as the Food and Drug Administration (FDA) and the Ministry of Public Health, as required by law.
• Cases where it is necessary to prevent danger to life or health.

6. Data Retention Period

The Hospital will retain your personal data for the following periods:

• Medical records and medical data: At least 10 years from the date of the last treatment, or as prescribed by law.
• Financial and payment data: 5-10 years, in accordance with accounting and tax laws.
• Website and cookie data: As specified in Clause 13 (Cookies and Tracking Technologies).

Retention is based on the purposes and necessities for which the Company must collect and process the data, unless the law prescribes or permits a longer retention period, which may be approximately 5–10 years or longer as necessary, such as the statutory limitation period for relevant matters, for litigation, or for inspection by regulatory bodies. The Hospital will store the data in appropriate storage facilities according to the type of personal data. The Company may need to retain personal data even after the statutory limitation period has expired, such as in cases of ongoing litigation or legal proceedings.

The Hospital will securely maintain your personal data using appropriate administrative safeguards, technical safeguards, and physical safeguards to ensure the security of personal data processing. This means maintaining confidentiality, integrity, and availability, and preventing personal data breaches. The Hospital has established policies, regulations, and criteria for personal data protection, such as IT security standards and measures to prevent recipients of data from the Hospital from using or disclosing data outside the intended purposes, without authority, or unlawfully. The Company periodically updates such policies, regulations, and criteria as necessary and appropriate.

Additionally, the Hospital requires its employees, personnel, and data recipients to maintain the confidentiality and security of your personal data in accordance with the measures prescribed by the Company whenever they handle your personal data.

7. Cross-Border Transfer of Personal Data

In the event that the Hospital transfers, transmits, and/or sends data overseas, the Hospital will establish standards for agreements and/or business joint venture contracts ensuring that the receiving organization has adequate personal data protection standards recognized and consistent with relevant laws. This is to ensure your personal data will be safely protected, for example:

• In cases where the Hospital needs to store and/or transfer personal data for storage purposes.
• For Cloud processing, the Company will select organizations with international security standards and will store personal data in an encrypted format or through other methods that render the data subject unidentifiable.

The Data Controller may send or transfer the User’s personal data overseas in the following cases:

(a) The destination country or international organization receiving the personal data has adequate data protection standards as prescribed by data protection laws, rules, or regulations.

(b) Consent has been obtained from the data subject, provided that the User (data subject) has been informed of the inadequate personal data protection standards of the destination country or international organization.

(c) It is necessary for compliance with a law.

(d) It is necessary for the performance of a contract to which the User (data subject) is a party, or in order to take steps at the request of the User prior to entering into a contract.

(e) It is necessary for the conclusion or performance of a contract between the Data Controller and a third party in the interest of the User.

(f) To prevent or suppress a danger to the life, body, or health of the User or any other person, when the data subject is incapable of giving consent at that time.

(g) It is necessary for the performance of a task carried out for significant public interest.

The data subject may review the list of third parties to whom the Hospital may disclose personal data from the list of business partners, which may be requested from the Data Protection Officer (DPO) via the contact channels in Clause 14. The list of third parties to whom the Hospital may disclose personal data may change, increase, or decrease, and the Hospital will keep this information continually updated.

8. Rights of the Data Subject

You are fully entitled to your rights as a data subject under the personal data protection laws, which include but are not limited to the following rights of the User:

• Right of Access: To request a copy of the personal data held by the Hospital.
• Right to Rectification: To request the correction of inaccurate or incomplete data.
• Right to Erasure: To request the deletion or destruction of data when it is no longer necessary or upon withdrawal of consent.
• Right to Restriction of Processing: To request a temporary suspension of data processing.
• Right to Data Portability: To receive data in a machine-readable format.
• Right to Object: To object to data processing that relies on legitimate interests.
• Right to Withdraw Consent: To withdraw the consent previously provided at any time.
• Right to Lodge a Complaint: To file a complaint against the Hospital if you believe the collection, use, and disclosure of your personal data violates or fails to comply with relevant laws. Please see Clause 14.

You may exercise these rights by contacting the Hospital’s Data Protection Officer (DPO) via the channels specified in Clause 14. The Hospital will process your request within 30 days of receipt. However, there may be necessary circumstances where the Hospital may reject or be unable to comply with your request, such as to comply with legal obligations or court orders, for public interest, or if the exercise of rights may violate the rights or freedoms of others. If the Company rejects your request, the Hospital will notify you of the reasons for the refusal.

9. Data Security Measures

The Hospital implements appropriate technical and administrative measures to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction, which include:

• Data encryption in storage systems and during transmission.
• Role-Based Access Control (RBAC).
• Regular personal data protection training for personnel.
• Regular security audits and risk assessments of systems.
• Data backup and disaster recovery policies.

10. Collection, Use, and/or Disclosure of Personal Data under the Personal Data Protection Law

The User acknowledges and agrees that the Data Controller may collect, use, and/or disclose the User’s data without obtaining prior consent, strictly to the extent necessary, in accordance with the stated purposes, and only in the following cases:

(a) To achieve purposes relating to the preparation of historical documents or archives for public interest, or for research or statistical purposes, provided that appropriate safeguards are implemented to protect the rights and freedoms of the User’s personal data.

(b) To prevent or suppress a danger to a person’s life, body, or health.

(c) It is necessary for the performance of a contract to which the User is a party, or to take steps at the User’s request prior to entering into such a contract.

(d) It is necessary for the performance of a task carried out in the public interest by the Data Controller, or for the exercising of official authority vested in the Data Controller.

(e) It is necessary for the legitimate interests of the Data Controller or any other person, provided that such interests are not overridden by the fundamental rights of the User’s personal data.

(f) It is necessary to comply with the laws applicable to the Data Controller.

The Data Controller shall strictly record the collection, use, or disclosure of the User’s personal data in accordance with the preceding paragraph.

11. Use by Persons under Guardianship or Custodianship

The User warrants that they are not, and will not permit, persons with defective legal capacity as listed below to visit, use, or become members of the website and application: (a) Incompetent persons under the User’s guardianship. (b) Quasi-incompetent persons under the User’s custodianship.

In the event the User permits the aforementioned persons to visit or use the services, it is deemed that the User has exercised their power of parental control, guardianship, or custodianship over such persons, as the case may be, to agree to and provide consent under this policy for and on behalf of such persons in all respects.

12. Personal Data Breach Notification

In the event the Data Controller becomes aware of a personal data breach, regardless of who caused the breach, the Data Controller shall proceed as follows:

(a) In the event the breach poses a risk to the rights or freedoms of any individual, the Data Controller shall notify the Office of the Personal Data Protection Committee of the breach without undue delay, and where feasible, within 72 (seventy-two) hours of becoming aware of it.

(b) In the event the breach poses a high risk to the rights or freedoms of any individual, the Data Controller shall notify the Office of the Personal Data Protection Committee and the affected Users (data subjects) of the breach and the remedial measures without undue delay, and where feasible, within 72 (seventy-two) hours of becoming aware of it.

13. Cookies and Tracking Technologies

The Hospital’s website uses cookies and similar tracking technologies to improve the user experience. You can set your cookie acceptance preferences through your browser; however, rejecting certain types of cookies may affect website functionality.

• Necessary Cookies: For basic website functionality.
• Analytics Cookies: To analyze user behavior (consent required).
• Marketing Cookies: To display relevant advertisements (consent required).

14. Contact Channels

If you have any questions, wish to exercise your rights, or wish to file a complaint regarding personal data protection, please contact:

Thai Eye Hospital

168 Charoenraj Road, Bang Khlo, Bang Kho Laem, Bangkok 10120

Telephone: (+66)2-689-8888

Email: [email protected]

You have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) if you find that the Hospital fails to comply with the PDPA.

15. Policy Changes

The Hospital reserves the right to amend or update this Privacy Policy from time to time to reflect changes in the law, regulations, or the Hospital’s practices. The Hospital will notify you of any material changes via the website or other appropriate communication channels.

16. Governing Law

This Policy shall be governed by and construed in accordance with the laws of Thailand.

17. Dispute Resolution

Should any dispute or controversy arise in connection with this Policy, and the parties are unable to reach an amicable settlement, the parties agree to submit such dispute to the jurisdiction of the competent courts in Thailand.

This Privacy Notice is effective from 12 June 2026.