Privacy Notice

1. Patient Privacy Notice

Policy Framework

Bangkok Dusit Medical Services Public Company Limited (Samitivej Chinatown Hospital) (“the Company”) is committed to protecting your personal data as a recipient of our examination, treatment, medical and other services. Your personal data is protected under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). As the data controller, the Company is legally required to provide you with this notice explaining why and how we collect, use and disclose your personal data, and to inform you of your rights as a data subject.

Purposes

The Company processes your personal data within the scope permitted by the PDPA and only to the extent necessary for the purposes described. The table below summarizes how we use your personal data and the lawful basis of processing for each purpose.

Purpose	Data Category	Lawful Basis of Processing
1. Examination, treatment and medical services 1.1 Medical services within the Company’s healthcare facilities Our physicians, nurses and/or other members of our healthcare team will record your personal data, use it to consult with physicians or other medical personnel, take still photographs and video to monitor your treatment, and/or carry out any other actions in line with professional standards throughout your care. We will explain the details to you before proceeding and give you the opportunity to ask questions until you are satisfied. 1.2 Medical services requiring data sharing between network healthcare facilities To provide you with medical care, our physicians, nurses and/or other relevant personnel may disclose your personal data to network healthcare facilities where certain services require data to be shared between them. The Company has put personal data protection measures in place, including agreements among network healthcare facilities, to prevent any unlawful or unauthorized processing of your personal data. 1.3 Patient referral between healthcare facilities (Refer) Where the Company requests or receives a request to transfer a patient from one healthcare facility to another for continued treatment, or to admit a patient from another facility for treatment at the Company’s facilities, the Company will follow its standard patient referral procedure. Your personal data will be used solely for the purpose of the referral and for no other purpose.	Identity data Contact data Health data Financial data	1. Necessary for the performance of the medical treatment contract to which you are a party with the Company (Section 24(3)) 2. For sensitive personal data: compliance with laws relating to medical diagnosis and treatment, such as the Healthcare Facilities Act B.E. 2541 (1998) and the Medical Profession Act B.E. 2525 (1982) (Section 26(5)(a)) 3. For sensitive personal data: to prevent or suppress a danger to life, body or health where the data subject is unable to give consent, such as emergency care or patient referral between hospitals (Section 26(1))
2. Research and analysis to improve the quality of care without identifying the data subject The Company may use your personal data for studies and analysis to improve the quality of medical care. Results will be reported only in aggregate form that does not identify any individual, and the Company will keep such data strictly confidential.	Statistical data	Legitimate interest of the Company in analyzing statistical data that does not identify individuals, in order to develop and improve the organization’s medical care and services (Section 24(5))
3. Disclosure to insurance companies with which you or the Company hold a contract, for insurance claims or reimbursement of medical expenses The Company needs to disclose your personal data to the insurance company in order to perform the contract you or the Company has entered into with that insurer, for the purpose of processing claims or reimbursement of medical expenses. The Company will not disclose your personal data to any unrelated party.	Identity data Contact data Health data	With your explicit consent to disclose your health data to the insurance company for insurance claims or reimbursement of medical expenses (Section 26)
4. Disclosure to the party who referred you for examination or who pays on your behalf, where you have consented to the disclosure Where a government agency, private organization or state enterprise has referred you to the Company for examination or treatment, or pays for your services, the Company will disclose your examination and treatment results, which are sensitive personal data, to that party only if you have consented to such disclosure. If you have not given consent, the Company will deliver the results directly to you.	Identity data Contact data Health data	With your explicit consent to the disclosure of your personal data (Section 26)
5. Linking electronic medical record databases between healthcare facilities through an information network With your consent, the Company will enter your personal data into a networked computer system so that you can receive consultations and manage your information through our application. To maximize the benefit to you, the system will link electronic medical record databases across network healthcare facilities, allowing you to view the personal data held by those facilities on your electronic devices. The Company has agreements with network healthcare facilities to protect your personal data in accordance with the PDPA.	Identity data Contact data Health data	With your explicit consent to the disclosure of health data between healthcare facilities (Section 26)
6. Marketing purposes of the Company The Company may collect, use and process your personal data to analyze your health status and to contact you with medical information, promotions, products and services, as you have consented.	Identity data Contact data Newsletter subscription and marketing activity data	Only after you have given consent for the Company to use your health data for marketing purposes (Section 26)

Other than the purposes stated above, the Company will not use your personal data for any other purpose, except where permitted by the PDPA, for example:

With your consent (Section 24), or with your explicit consent where sensitive personal data is used (Section 26)
For research or statistics, with appropriate safeguards to protect the personal data, rights and freedoms of the data subject (Section 24(1))
To prevent or suppress a danger to life, body or health (Section 24(2))
For the performance of a contract between the Company and you (Section 24(3))
For the performance of a task carried out in the public interest by the Company (Section 24(4))
For the legitimate interests of the Company or of another person or juristic person, except where such interests are overridden by the fundamental rights of the data subject (Section 24(5))
To comply with legal obligations of the Company (Section 24(6))
To prevent or suppress a danger to life, body or health where sensitive personal data is used and the data subject is unable to give consent for any reason (Section 26(1))
For the establishment of legal claims (Section 26(4))
For public health or other social protection purposes, with appropriate measures to protect the fundamental rights and interests of the data subject (Section 26(5)(b))
Where necessary to comply with laws on labor protection, medical welfare and social security (Section 26(5)(c))

Scope

Definitions

“Personal data” means any information relating to a person that enables the identification of that person, whether directly or indirectly, but does not include information of deceased persons in particular.

“Sensitive personal data” means personal data relating to race, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data (such as facial recognition, iris recognition or fingerprint data), or any other data that similarly affects the data subject as prescribed by the Personal Data Protection Committee.

“Medical treatment data” means the following information:

Dates of treatment
History of drug allergies and adverse drug reactions
History of food allergies
Diagnoses, procedures and surgeries
Blood test results, laboratory results, pathology biopsy results, radiology images and radiology reports
Medications prescribed by physicians
Other information, such as symptoms, physician recommendations and diagnostic details

“Processing” means collecting, using or disclosing.

“Data controller” means a person or juristic person with the authority to make decisions regarding the collection, use or disclosure of personal data.

“Data processor” means a person or juristic person who collects, uses or discloses personal data on the instructions of, or on behalf of, a data controller. Such a person or juristic person is not a data controller.

“Bangkok Dusit Medical Services Group” means companies within the network of Bangkok Dusit Medical Services Public Company Limited, both existing and future, whether registered in Thailand or abroad, including Bangkok Dusit Medical Services Public Company Limited itself.

“Samitivej Group” means companies within the network of Samitivej Public Company Limited, both existing and future, whether registered in Thailand or abroad, including Samitivej Public Company Limited itself.

“Network healthcare facilities” means healthcare facilities within the group or network of Samitivej Public Company Limited and Bangkok Dusit Medical Services Public Company Limited, operating in Thailand and abroad.

Responsibilities

Practices

1. Personal Data We Collect
The personal data the Company collects from you falls into the following categories:

Identity data (Personal data), such as first name, last name, national ID number, facial photograph, sex, date of birth, passport or other identification numbers
Contact data, such as address, phone number and email
Financial data, such as billing information, credit or debit card details, receipts and quotations
Marketing data, such as information used to register for newsletters and marketing activities
Statistical data, such as anonymized data, number of patients and website visits
Technical data from website use, such as IP address, browser type, cookie data, time zone settings, operating system, device platform and technology used to access the website, and the Online Appointment System
Health data, such as medical treatment records, reports on physical and mental health, healthcare of service recipients, laboratory test results, diagnoses, information on medication use and drug allergies, food allergy history, blood test results, laboratory results, pathology biopsy results, radiology images and reports, prescribed medications, information necessary for providing medical services, feedback and treatment outcomes

2. Sources of Personal Data
The Company collects your personal data from the following sources:

1. Personal data obtained directly from you:

1.1 If you are a patient: the Company obtains your personal data when you contact us about our services, or when you register for medical and other services in person at the Company, including registration through electronic channels.

1.2 If you are a vendor of the Company: the Company obtains your personal data when you contact us to provide services, or when the Company collects your personal data as a service provider under contract with the Company.

2. Personal data obtained indirectly:

2.1 People close to you, such as relatives or your spouse

2.2 Persons you have authorized to act on your behalf in dealing with the hospital

2.3 Network healthcare facilities, where you have consented to them disclosing your personal data

2.4 Individuals, juristic persons, government agencies, private organizations or state enterprises that referred you for examination, treatment or services with the Company, or that pay for services on your behalf

3. Disclosure or Sharing of Personal Data
The Company will not disclose your personal data to third parties, except where permitted by law and necessary for operations. The Company may disclose personal data in the following cases:

3.1 To government agencies, competent authorities or any person where required or authorized by law, including in compliance with court orders.
3.2 To persons or juristic persons where necessary for the performance of a contract or for your benefit as the data subject. The Company requires such persons to keep your personal data confidential and protect it to the standards set by the PDPA. These include, but are not limited to:

Network healthcare facilities within the Samitivej Group and the Bangkok Dusit Medical Services Group, to the extent necessary to provide examination, treatment and medical services to you. The Company will disclose only the necessary personal data and will keep it confidential in accordance with its duties under applicable laws, such as the Healthcare Facilities Act B.E. 2541 (1998), the National Health Act B.E. 2550 (2007) and the Medical Profession Act B.E. 2525 (1982).
Insurance companies, or their claims administration service providers
Healthcare facilities receiving patient referrals
Parties who referred you for examination, treatment or services, or who pay for services on your behalf
Data processors necessary for the Company’s operations, such as contractors or providers of laboratory testing, data preparation, telecommunications, computer systems, payment or technology outsourcing services

3.3 The Company may store personal data on cloud computing systems provided by third parties located in Thailand or abroad. The Company has entered into contracts with such providers with due care, taking into account the security measures the cloud computing provider applies to protect personal data.

4. Data Retention Period

The Company follows the medical record retention standards of the Healthcare Facilities Act B.E. 2541 (1998), as most recently amended. Medical records are retained for a minimum of 5 years and no more than 10 years from the date of the last visit. After 10 years, original records, copies and electronic medical records will be destroyed.
Where the Company must comply with the law or a court order, or establish legal claims in any dispute resolution process, the Company may retain personal data for the applicable statutory limitation period or until the dispute is finally resolved, as the case may be.

5. Data Storage and Processing Safeguards

The Company stores personal data with measures no less stringent than required by law and with appropriate systems to protect and secure it, such as Secure Sockets Layer (SSL) protocols, firewalls, passwords and other technical measures for encrypting data transmitted over the internet. Personal data in paper form is stored in locations with restricted access controls.
The Company restricts access to personal data by employees, agents, business partners and third parties. Third-party access is permitted only as specified or instructed, and such third parties are obligated to maintain confidentiality and protect personal data.
The Company implements technological measures to prevent unauthorized access to its computer systems.
The Company has review procedures in place to destroy personal data that is no longer necessary for its operations.
For sensitive personal data, the Company implements security measures for both paper and electronic records covering access and usage control, maintains operational and backup systems with contingency plans, and conducts regular system risk assessments.

6. International Transfer of Personal Data

In some cases, the Company may need to transfer your personal data abroad. The Company may do so after informing you of the purpose of the transfer and obtaining your consent. The Company will inform you of any potentially inadequate personal data protection standards in the destination country.
The Company may transfer your personal data abroad without your consent where the transfer is necessary for the performance of a contract to which you are a party, to take steps at your request before entering into such a contract, or as otherwise provided under the PDPA.

7. Cookie Policy

When you visit the Company’s website, we use cookies to ensure you have the best possible experience. Cookies are small files that store information on the computer or mobile device you use to access the website, through the web browser of your choice.
The Company uses cookies to recognize your visits to the website, making it easier for us to remember how you use it. This information is used to tailor the website to your needs and make it faster and more convenient to use. At times, the Company may engage third parties for this purpose, which may involve the use of your IP address and cookies for analysis, data linking and processing for marketing purposes. You can manage your cookie settings when you enter the Company’s website and choose whether or not to allow cookies to be used for analysis, data linking and processing for marketing purposes.

8. Rights of the Data Subject

As a data subject, you have the right to request the Company to take the following actions regarding your personal data, to the extent permitted by law:

Right to withdraw consent: You may withdraw your consent to the processing of personal data you have consented to at any time while the Company holds your personal data.
Right of access: You may access your personal data, request a copy of it, and request the Company to disclose how it obtained personal data for which you did not give consent.
Right to rectification: You may request the Company to correct inaccurate data or complete incomplete data.
Right to erasure: You may request the Company to delete your data on certain grounds.
Right to restriction of processing: You may request the Company to restrict the use of your personal data on certain grounds.
Right to data portability: You may request that the personal data you provided to the Company be transferred to another data controller or to yourself on certain grounds.
Right to object: You may object to the processing of your personal data on certain grounds.

To exercise any of the rights above, please contact our Data Protection Officer (DPO) / Personal Data Protection team at:

Bangkok Dusit Medical Services Public Company Limited (Samitivej Chinatown Hospital)
624 Yaowarat Road, Samphanthawong, Samphanthawong District, Bangkok 10100
Call Center: 02-118-7893
Email: [email protected]

9. Changes to This Privacy Policy
The Company may review and update this privacy policy from time to time to improve the protection of personal data. We will notify you whenever the policy changes.

10. Contact Us
For enquiries or to exercise any rights relating to your personal data, please contact the data controller at: