Privacy Policy

SITA Clinic is the brand name of a medical facility. SITA WELLNESS CLINIC Provides medical services, healthcare and skin care, as well as information and communication via online channels.

Data Controller: The operator of Sitah Wellness Clinic is a medical institution in accordance with the relevant license. You can contact the clinic regarding personal information through the channels listed below.

This policy applies to the collection and processing of data through the website, online contact channels, and the clinic's services within the specified limits.

Sita Clinic collects only the necessary and appropriate information for the purpose. The information may vary depending on the nature of the contact or the service you receive.

2.1 Identity and contact information

For example, name, surname, age, date of birth, phone number, email address, and information necessary for identity verification or communication. If the law or service requires identity verification, the clinic may request additional information as necessary.

2.2 Contact and Appointment Information

For example, details of inquiries, requests for services, appointment dates and times, contact history, and messages sent to the clinic via website, phone, email, LINE, or other communication channels.

2.3 Health and medical information

In the case of seeking consultation or medical services, the clinic may be required to retain the following information:

• Health history, symptoms, and concerns about the skin or health
• Medical history, medication use, and related products
• History of drug allergies, hypersensitivity to substances, or medical contraindications
• Data from examinations and assessments by doctors
• Care plans, medical records, and follow-up information
• Photographs of the skin or areas related to the evaluation and follow-up of treatment

This information may be sensitive personal data under the law. The clinic will process it when there is a legal basis in place and provide appropriate safeguards.

2.4 Transaction and payment information

For example, details of the services received, payment details, receipts, information for issuing accounting documents, and information necessary for compliance with tax or financial laws.

2.5 Website usage data

For example, IP address, device type, browser, operating system, website visited, date and time of use, and information from cookies or similar technologies as used in actual practice.

2.6 Review information and promotional materials

If you voluntarily provide comments, reviews, photos, videos, or stories about your experience with the clinic, the clinic may collect and use the information for the purposes and within the scope stated, and with your consent or in accordance with applicable legal bases.

In general, clinics receive information directly from you, such as filling out forms, contacting us, scheduling an appointment, or providing information to doctors and staff during service.

In some cases, the clinic may receive information from parents, legal representatives, individuals you have appointed, or other medical personnel and agencies when necessary and with legal basis. Certain technical information may also be obtained from the website system or related technology providers.

4.1 Service and appointments

To receive inquiries, contact back, arrange appointments, verify identity, coordinate service reception, and provide necessary information regarding the appointment or ongoing care.

4.2 Evaluation and medical services

To conduct a history taking, assess, diagnose, plan care, record treatment, monitor results, and review care guidelines based on the individual's needs.

4.3 Service management

To prepare documents for service, payment, accounting, inventory control, and operations necessary for the clinic's services.

4.4 Security and Quality Improvement of Service

To maintain the security of the system, prevent unauthorized access to data, check for technical problems, handle complaints, and improve operations.

4.5 Public Relations and Marketing

To send you news, articles, knowledge, activities, or promotional information through the channel of your choice. The clinic will use appropriate legal bases and obtain consent when required by law. You can withdraw consent for marketing based on consent by not affecting your normal service reception.

The collection, use, or disclosure of information may be carried out based on the legal basis relevant to each purpose, including:

• Compliance with contracts or before entering into contracts For example, accepting appointments and managing the services you request.
• Compliance with the law For example, the preparation and keeping of documents as required by law
• Legitimate benefits For example, maintaining the security and safety of the website and system, taking into account the rights of the data owner.
• Consent For activities that require consent, such as the use of images or stories for publicity purposes
• Specific legal basis for health information For example, diagnosis, medical services, and health management under the conditions prescribed by law.

The clinic will consider the legal basis to be consistent with the type of information and purpose, and does not consider visits to the website or services as an automatic consent for all activities.

Sithaklinik places special emphasis on maintaining the confidentiality of health and medical information. In some cases, doctors may need to use photos of the skin or images of the relevant areas to support assessment, compare data during follow-up, and consider adjustments to treatment plans.

If the clinic intends to use photos, videos, treatment information, or the stories of patients on its website, social media platforms, or promotional materials, it will consider this separately from the purpose of the treatment and seek consent in accordance with the law, providing information about the intended use and scope of dissemination beforehand.

Refusal to allow the use of images or stories for advertising will not affect the right to receive regular medical services.

You can view the public content of the website without having to provide personally identifiable information through the contact form. However, certain contact, appointment, or service requests may require information to identify you, coordinate, and assess your health.

If you do not provide the necessary information, the clinic may not be able to complete the appointment, provide advice, or provide certain services in a complete or safe manner. The staff will consider explaining the reasons and scope of the necessary information as the case may be.

The clinic will limit the disclosure of information to what is necessary based on the relevant purpose and legal basis. Your information may be disclosed to individuals or agencies such as:

• Doctors and clinical staff who are responsible for providing care or services
• Medical facilities, laboratories, or other medical professionals when necessary and with legal basis in place.
• Website providers, appointment systems, data storage systems, or related information technology
• Payment, account, and transaction providers
• Government agencies, regulatory authorities, or legal authorities in cases where disclosure is required by duty or necessity.

The clinic will determine the scope of access to and use of data based on its duties and needs, and will also take measures to ensure that the relevant data processors have the necessary protection measures as required by law.

Sithaklinik has contact channels such as LINE, phone, email, and social media to facilitate inquiries and appointments. When you contact us through an external platform, some of your information may also be subject to the privacy policy of that platform provider.

We recommend avoiding sending unnecessary health information or sensitive personal information through public channels, such as comments under posts. If you must submit health information in response to an inquiry, the clinic will use the information within the legal framework, and you should use channels that are suitable for the sensitivity of the information.

The website may use cookies or similar technologies to support its operation and improve the user experience. Examples of possible types include:

• Necessary cookies: For basic website functionality and security
• Cookies for usage analysis: For studying the patterns of visits and the effectiveness of the website if such tools are used.
• Marketing cookies: For measuring the effectiveness of advertising or promotional activities, if the website installs and uses this type of tool.

For cookies that require consent, the clinic will obtain consent before using it as required by law. It has also provided a suitable method for managing consent. You can control or delete cookies through your browser. However, closing certain necessary cookies may affect the functionality of the website.

The use of online communication systems, cloud services, or certain types of technology providers may involve the storage or processing of data on systems located outside Thailand.

If data is sent or transferred abroad, the clinic will operate under the conditions and safeguards stipulated by law, as well as considering the suitability of the data recipients and the relevant security measures.

Sithaklinik sets the period of data retention based on necessity and proportionality, considering the purpose of caring for the service recipients, legal obligations, and the security of the data. The normal period for each type of data is as follows:

• Medical records, health information, and skin photos are part of the treatment: Normal retention period 10 years since the last service received For continuity in care and monitoring, in all cases records will not be kept below the legal minimum for relevant medical records, which requires them to be kept and accessible for inspection. Not less than 5 years from the date of preparation If there are specific requirements for longer retention periods, use the legal timeframe.
• Contact information and request for appointment for those who did not receive service: Normally 2 years from the last contact Except when it is necessary to retain it for the handling of complaints or legal claims, appointment information that is part of the medical record will be subject to the criteria of the medical record.
• Transaction documents, receipts, and accounting documents: Not less than 5 years from the date of closing the account Or longer than required by tax laws, accounting regulations, or orders from the authority with authority to make such determinations.
• Information for sending newsletters or marketing based on consent: Keep and use until consent is withdrawn, or normally not longer than 2 years since the last contact or interaction Unless there is a need to continue the retention, evidence of granting or withdrawing consent may be retained for the period necessary to prove compliance with the law.
• Photos, videos, and reviews that are permitted for use in advertising: Retain and use only to the extent and for the period specified in the specific consent for that activity. Upon the termination of the purpose or withdrawal of consent, the conditions of the law shall be followed, separate from the photographs that are part of the medical record.
• Website work and security logs (Server/Security Logs): Normally 90 days from the date of recording Unless it is necessary to investigate a safety incident or there are legal requirements to keep it for longer.
• Cookies and website analytics data: Store according to the age and purpose of each cookie disclosed in the cookie settings system; information that requires consent resides under the user's choice and is not stored beyond what is necessary.

The clinic will review the necessity of storing information periodically and, when the period expires without any necessity or legal basis for further storage, will delete, destroy, or render the information unidentifiable in an appropriate manner. This may require storing information only to the extent necessary for compliance with laws, prosecution, or the establishment, exercise, or defense of legal claims.

Sita Clinic places importance on protecting information from loss, access, modification, use, or disclosure without permission. The clinic will implement appropriate technical and organizational measures based on the risk and nature of the information, such as restricting access rights based on duties, maintaining the security of information systems, and assigning responsibilities for confidentiality.

Such measures will be reviewed and updated as necessary and in accordance with legal requirements.

Under the terms and conditions set forth by law, you may have the following rights:

1. Withdraw consent When processing relies on consent
2. Access and request copies of data Including requesting information regarding the acquisition of data in cases where the law requires it.
3. Edit the information To be accurate, up-to-date, and not cause misunderstandings.
4. Delete, destroy, or make the individual unrecognizable When the legal requirements are met
5. Request to suspend the use of the data In cases where the law prescribes
6. Object to the processing of data According to the relevant conditions and legal grounds
7. Request or transfer data When the data and system meet the legal requirements
8. Complaints To the regulatory authorities if it is deemed that the processing is not in accordance with the law

You can contact the clinic to exercise your rights via the end of the notice to prevent the disclosure of information to unauthorized parties. The clinic may request additional information as necessary to verify your identity.

The clinic will consider and process requests within the timeframe set by law, and provide a reason if all or part of the request cannot be fulfilled. Some types of rights may be subject to restrictions, such as the need to retain medical records or documents under the law.

If you have previously consented to receive marketing communications or allowed the use of photos, videos, reviews, or stories for promotional purposes, you can contact the clinic to withdraw your consent in accordance with legal requirements.

Withdrawal of consent does not have retroactive effect on processing that was lawfully carried out before the withdrawal of consent. If the data has been published on an external platform, the clinic will manage the data under the legal control and consider the relevant publication-related actions as appropriate.

If the service involves minors or persons with legal representatives, the clinic will consider the collection and use of data in accordance with applicable legal regulations.

In cases where consent from the governing authority or legitimate representatives is required, the clinic will comply with the conditions prescribed by law.

Sita Clinic may revise or update this policy to align with the law, technology, operating practices, and services of the clinic.

When changes occur, the clinic will publish the latest version on its website and provide additional information as appropriate. If the changes require notification or additional consent under the law, the clinic will comply with those requirements.

If you have any questions about our policies, the use of your information, or wish to exercise your legal rights, you can contact Sitaklinik as follows:

If you wish to exercise your rights regarding medical records or health information, the clinic may need to verify and confirm your identity before proceeding with the request for the protection of personal information.