Privacy Policy

Introduction

TPP Healthcare International Co., Ltd., the operator of MedPark Hospital (hereinafter referred to as the “Hospital”, “MedPark”, “us” or “we”, as the case may be), is committed to protecting your privacy. The following statement sets out the manner in which we treat your personal data, including the collection, use, disclosure (collectively referred to as “processing”), and protection of personal data that you provide to us while visiting our website at https://www.medparkhospital.com, using the MedPark Hospital application, or receiving services from us. This Privacy Policy (the “Policy”) covers any information that can directly or indirectly identify you (“Personal Data”), whether obtained directly from you or transferred from a third party. With respect to your health-related Personal Data, in addition to complying with this Policy, we will comply with the provisions of applicable laws, rules, notifications, orders, or regulations of the relevant competent authorities, including any amendments thereto. As the data controller of your Personal Data under the Personal Data Protection Act B.E. 2562 (A.D. 2019) (“PDPA”), we have issued this Policy, which forms an integral part of the terms and conditions governing the provision of our website and services. Each use of such services shall be deemed your acknowledgment and acceptance of this Policy.

Personal Data Collection

We collect your Personal Data only to the extent necessary. Where you voluntarily provide Personal Data to us, whether to request our services through our website or through any other channel of the Hospital — for example, doctor appointments, online registration, subscription to our newsletter, as well as offline transactions such as patient registration at the Hospital’s registration counter — we will collect and process such Personal Data in accordance with this Policy, including Personal Data received through our representatives, service providers, or governmental agencies, where you have granted consent for such disclosure or where disclosure is required or permitted by law.

Personal Data Collected by the Hospital

The categories of Personal Data collected depend on the purposes of processing under this Policy. The Personal Data that we collect directly from you or from third parties includes, but is not limited to, the following:

  • Identification information, e.g., name, photograph, gender, date of birth, passport number, national ID card number, or other identifiers.
  • Information relating to education, training, and employment, e.g., educational and training records, certificates of qualification or academic transcripts, grades or grading levels, education level, language proficiency, and professional license information.
  • Contact information, e.g., address, telephone number, email, and other social media accounts.
  • Information regarding contracting parties and counterparties.
  • Service information, e.g., doctor’s appointment records, Personal Data of family members, room requirements, and other additional services.
  • Information on news subscriptions and marketing activities, e.g., seminar enrollment and promotion registration.
  • Statistical information, e.g., number of patients and website visits.
  • Information obtained from your use of our website, e.g., IP address, cookies, and online doctor appointments.
  • Health information, including reports relating to your physical and mental health, healthcare, laboratory test results, and diagnoses.
  • Information relating to medication use and drug allergies.
  • Feedback and treatment outcomes provided by you.
  • Other information, e.g., images and/or audio recorded through thermal scanners, closed-circuit television (CCTV), photographs, and image and audio recordings of conversations.
  • We will not collect or use your sensitive Personal Data, including information regarding religious beliefs or criminal records, except as required by applicable regulations and laws, or with your explicit consent.

Purposes of Processing Personal Data

We may process your Personal Data based on your consent, the performance of a contract between us, or any action necessary for our legitimate interests, for the following purposes:

  1. Purposes relating to the provision of medical services, including:
    • Providing or delivering our services and facilitating your access thereto, whether online or offline;
    • Arranging doctor’s appointments, sending information, and introducing the Hospital’s services;
    • Coordinating and transferring information to affiliated hospitals and other medical facilities to facilitate and expedite patient referrals;
    • Verifying the identity of patients;
    • Sending appointment reminder messages or offers of assistance from us;
    • Other purposes that support the performance of the above purposes or that you have consented to from time to time.
  1. Purposes relating to our legitimate interests, including:
    • Recording images of persons entering the Hospital or receiving services through our CCTV system, including the exchange of identification cards before entering the premises, for security within the Hospital area;
    • Risk management, internal audit, and internal organizational administration, including transfer of Personal Data to affiliated companies under our Binding Corporate Rules for the protection of Personal Data;
    • Complying with laws, requirements, rules, regulations, or any requests from governmental agencies, for instance, compliance with subpoenas, court orders, or other lawful requests.
  1. Purposes relating to our marketing activities, for which we will process your Personal Data only where you have given your explicit consent, including:
    • Facilitating and presenting lists of benefits and privileges;
    • Marketing, sales promotion, and customer relationship management, such as sending information regarding promotions, products and services, promotional programs, and business partners;
    • Conducting customer satisfaction surveys, market research, and statistical analysis to improve our products and services or develop new products and services;
    • Serving as a channel for communication, answering inquiries, or responding to complaints relating to the use of our services, e.g., issues concerning service use or any losses incurred.

Disclosure of Your Personal Data

We may disclose or transfer your Personal Data to third parties, whether located within or outside Thailand, where such countries maintain an adequate standard of personal data protection and in accordance with the principles of personal data protection prescribed by law. We will implement the necessary and appropriate measures or comply with applicable regulations and laws, for the purposes specified above. Recipients of such disclosure may include:

  • Affiliated hospitals, group companies, business counterparties, and business alliances;
  • Agents, service providers, or business counterparties providing services to us or acting on our behalf, e.g., laboratory analysis service providers, radiology centers, and information technology service providers;
  • Business partners, e.g., insurance companies, alliances participating in loyalty and privilege programs, and other companies involved in providing services to you or supporting the purposes stated above;
  • Banks and payment service providers, e.g., credit or debit card companies;
  • Security and safety officers or agencies;
  • Immigration and customs authorities;
  • Governmental agencies, regulatory agencies, and other agencies as permitted or required by law.

Links to Third-Party Websites

Our website may contain links to third-party websites. If you follow these links, this Policy does not extend to such third-party websites. Accordingly, any processing of your Personal Data by a third party is beyond our control. Please be informed that we are not associated with, and assume no responsibility for, the acts of any such third party.

Retention of Personal Data and Security Measures

We retain your Personal Data for as long as is necessary for the purposes set out in this Policy, or as required by law, or for the establishment, exercise, or defense of legal claims. Upon expiration of such period, if you do not consent to our continued processing of your Personal Data, we will destroy such Personal Data in accordance with our data destruction procedures without delay. We will adopt appropriate technical and administrative measures to protect and secure the Personal Data we collect, in accordance with the information security standards of the NIST Cybersecurity Framework, to prevent unauthorized access to, alteration, use, or disclosure of your Personal Data. We further limit access to your Personal Data, whether stored electronically or in documentary form, to personnel who have a need to process such data. And to keep Personal Data in locations with access-control systems and restricted access for documentary records.

Data Subject’s Rights

You may contact us, our Data Protection Officer, or the relevant officer to submit a request to exercise any of the following rights:

  • You have the right to access your Personal Data retained by us, including to obtain a copy of such Personal Data and to request the transfer of Personal Data that you have provided to us to another data controller or to yourself.
  • You have the right to object to, or request suspension of, the collection, use, or disclosure of your Personal Data.
  • You have the right to request that we rectify any inaccurate Personal Data or supplement any incomplete Personal Data, and may request the deletion or destruction of, or the disclosure of the source of, your Personal Data collected with no prior consent.
  • Where you find that our personnel or we have used or disclosed your Personal Data in a manner inconsistent with the consent you have given, or have otherwise processed such Personal Data without a lawful basis, you have the right to file a complaint with the Personal Data Protection Committee.
  • You have the right to withdraw your consent to the processing of Personal Data that you have provided to us at any time during the period in which your Personal Data remains with us, unless the withdrawal of such consent is restricted by law or by a contract for your benefit.
  • However, the withdrawal of your consent to the processing of any Personal Data may lead to insufficient data to achieve the stated purposes. It may cause inconvenience to you in receiving our services.

Amendment to this Privacy Policy

We may review and amend this Privacy Policy from time to time in accordance with changes to our services and operations, feedback and comments received from you, and relevant legal requirements. The latest version of this Policy will be published on our website to inform you of the measures we apply to protect your Personal Data.

Contact Us

Should you wish to contact us, or have any questions, wish to request further information regarding the collection, use, or disclosure of Personal Data, exercise your rights as a data subject, withdraw your consent, or file any complaint, you may contact the Company through the following channels:

TPP Healthcare International Co., Ltd.
MedPark Hospital
Address: 3333 Rama IV Rd, Khlong Toei, Bangkok 10110
Tel: 02-023-3333

Data Protection Officer
Email: [email protected]

When making any such request, please provide us with the following information:

  • Your name, surname, and national ID card number or passport number;
  • The subject matter of your inquiry and details of any issue encountered;
  • A telephone number and address at which you can be contacted, together with your email address.