1. Introduction

Tara Clinic (“we,” “our,” or “the Clinic”) is committed to upholding the highest standards of personal data protection and privacy in accordance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA) of the Kingdom of Thailand. We treat all personal information entrusted to us with utmost care and in full compliance with the provisions of this Act, particularly the obligations outlined in Chapter 2 (Rights of Data Subjects) and Chapter 3 (Duties of Data Controllers and Data Processors).

2. Collection of Personal Data

We collect personal data strictly limited to what is necessary and proportionate for the following lawful purposes under Section 24 of the PDPA:

• Patient registration and health record maintenance
• Medical diagnosis, treatment, and follow-up
• Billing, invoicing, and insurance coordination
• Appointment scheduling and customer support
• Marketing communications (subject to explicit consent under Section 19)
• Compliance with legal obligations and public health requirements

We may collect the following types of data:

• Full name, date of birth, gender
• Contact details (phone, email, address)
• Identification or passport number
• Health-related data and medical history
• Insurance information and payment details
• CCTV video recordings for safety and security

3. Legal Basis for Processing

We process personal data in accordance with Section 24, and sensitive data such as health records under Section 26, which allows for processing when:

• Explicit consent is given
• It protects the vital interests of the data subject
• It is necessary for medical treatment by a licensed professional
• It is required by public health authorities

You may withdraw your consent at any time, in accordance with Section 19.

4. Retention and Protection of Personal Data

We retain personal data only as long as necessary for the purposes described or as required by law. Data is stored securely, following Section 37 of the PDPA, and access is strictly controlled. Staff are trained in compliance with PDPA and professional confidentiality standards.

5. Disclosure of Personal Data

We do not disclose your data to third parties except when:

• Required by law or regulatory authority
• Needed for medical or insurance services (with your consent)
• To third-party processors under Section 37(2), with contractual confidentiality

Data is not transferred outside Thailand unless the destination offers equivalent protection as required under Section 28, or you have provided explicit consent.

6. Rights of Data Subjects

Under Chapter 2 of the PDPA, you have the following rights:

• Access – to view and obtain a copy of your personal data
• Rectification – to correct inaccurate or incomplete data
• Erasure – to request deletion of your data under certain conditions
• Objection – to oppose certain forms of data processing
• Data Portability – to receive data in a structured format
• Consent Withdrawal – at any time, without affecting past processing
• Complaint – to file a complaint with the PDPA Committee

To exercise your rights, please contact us using the information below. We will respond within the statutory timeframe outlined in Section 36.

7. Contact Us

If you have questions or wish to exercise your rights under this Privacy Policy, please contact:

8. Updates to This Policy

We may update this policy from time to time to comply with evolving laws and best practices. Any changes will be communicated via our official website or posted at the clinic.

9. Governing Law

This policy is governed by and construed in accordance with the laws of the Kingdom of Thailand.