Privacy Policy

HanFang Clinic ("the clinic", "we") takes the protection of your personal data ("you", "service users") seriously. This privacy policy explains how we collect, use, disclose and protect your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

1. Data we collect

We may collect the following personal data:

1.1 Data you give us directly

• Name, gender, date of birth, age
• Phone number, email, LINE ID
• Health information, such as treatment history, symptoms, existing conditions and drug allergies
• Appointment and service information

1.2 Data collected automatically

• Website usage, such as pages visited and time spent
• Device information, such as IP address, browser type and operating system
• Cookies and other tracking technologies

1.3 The AI chat assistant on our website

If you chat with the AI assistant on our website, we store the chat messages anonymously (we don't ask for your name or phone number, and phone numbers, emails and ID numbers you type are masked automatically), together with how you reached the site, such as the channel or ad campaign. We use this to answer your questions and to improve our services, website content and advertising messages overall. Messages are processed by an external AI provider, are not sent to advertising platforms, and are deleted within 180 days. The AI assistant's answers are general information, not a diagnosis.

2. Why we collect and use your data

We use your personal data to:

• Provide Traditional Chinese Medicine services such as acupuncture, cupping, gua sha and Chinese herbal medicine
• Manage appointments and communicate with you
• Prepare and keep medical records as required by law
• Improve our services and develop our website
• Send news, promotions or health content (if you agree)
• Comply with legal requirements

3. Legal basis for processing

• Consent: for health data and marketing communications
• Contract: for providing the medical services you request
• Legal obligation: for medical records and reports required by law
• Legitimate interest: for improving our services and website security

4. Disclosure of personal data

We do not disclose your personal data to third parties except:

• With your consent
• To service providers acting for us, such as online booking or payment systems
• To government or regulatory authorities as required by law
• To another healthcare facility when referring you (with your consent)

5. How long we keep data

• Medical records: at least 5 years from your last treatment, as required by law
• Website usage data: no longer than 2 years
• Marketing data: until you withdraw your consent

6. Your rights under the PDPA

You have the right to:

• Access and obtain a copy of your personal data
• Have your data corrected
• Have your data deleted (subject to legal limits)
• Restrict the use of your data
• Data portability
• Object to the processing of your data
• Withdraw your consent
• Complain to the Personal Data Protection Committee

7. Cookie policy

Our website uses cookies for:

• Essential cookies: so the website works properly
• Analytics cookies: such as Google Analytics, to understand how the website is used
• Social media cookies: such as Facebook Pixel, to improve advertising

You can set your browser to refuse cookies, but some parts of the website may not work as well.

8. Security measures

We use appropriate security measures to prevent unauthorised access, use, disclosure, alteration or destruction of personal data, including:

• Data encryption (SSL/TLS)
• Strict access control
• Regular review and improvement of our security systems

9. Changes to this policy

We may update this privacy policy from time to time and will let you know through our website or other suitable channels. Continuing to use our services after a change means you accept the updated policy.

10. Contact us

If you have questions about this policy or want to exercise your PDPA rights, contact: