Privacy Policy

1. Personal Data We Collect

We may collect the following categories of personal data:

• Data you provide to us directly — Contact and consultation requests: name, email address, phone number, profession or medical specialty, clinic or hospital affiliation, and the content of your message when you submit our contact form or request a consultation.
• Data you provide to us directly — Email correspondence: any personal data you include when you email us at doctorbranding.office@gmail.com.
• Data you provide to us directly — LINE Official Account: your LINE display name, profile picture, and the content of messages you send when you contact us via our LINE Official Account (@doctorbranding).
• Data collected automatically — Usage and device data: IP address, browser type and version, device type, operating system, pages visited, time and date of visit, time spent on pages, and referral source. This data is collected through cookies and Google Analytics (see Section 5).
• Sensitive data — We do not intentionally collect sensitive personal data (such as health data, religious beliefs, or biometric data) through this Website. Please do not submit patient information or other sensitive personal data through our contact form.

2. How We Collect Your Personal Data

We collect personal data:

• Directly from you, when you fill in our contact form, email us, or message us on LINE.
• Automatically, through cookies and similar technologies when you browse the Website.

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and on the following legal bases under the PDPA:

• Responding to your enquiry or consultation request — Contractual necessity / steps prior to entering into a contract (Section 24(3) PDPA).
• Providing our services and managing our client relationship with you — Contractual necessity (Section 24(3) PDPA).
• Improving our Website, content, and services through analytics — Legitimate interest (Section 24(5) PDPA).
• Sending you information about our services where you have requested it — Consent (Section 19 PDPA), which you may withdraw at any time.
• Complying with legal obligations — Legal obligation (Section 24(6) PDPA).
• Establishing, exercising, or defending legal claims — Legitimate interest (Section 24(5) PDPA).

4. Disclosure of Your Personal Data

We do not sell your personal data. We may disclose your personal data to the following categories of recipients, only to the extent necessary:

• Service providers (data processors): our Website and its backend database are hosted on infrastructure provided by Lovable and Supabase. Personal data submitted through the Website is stored on this infrastructure.
• Analytics providers: Google LLC, in connection with Google Analytics (see Section 5).
• Messaging platforms: LY Corporation (LINE), when you communicate with us via our LINE Official Account, subject to LINE's own privacy policy.
• Professional advisers and authorities: lawyers, accountants, or government authorities where disclosure is required by law or necessary to protect our legal rights.

5. Cookies and Google Analytics

This Website uses cookies and similar technologies. Cookies are small text files placed on your device that help the Website function and help us understand how visitors use it.

We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors interact with our Website. Google Analytics uses cookies to collect information such as your IP address, device information, and browsing behaviour on our Website. This information may be transmitted to and stored on Google servers outside Thailand.

You can manage your cookie preferences through the "Cookie settings" link on our Website, configure your browser to refuse cookies, or opt out of Google Analytics using Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). Disabling cookies may affect some Website functionality.

6. Cross-Border Transfers of Personal Data

Our hosting, database, analytics, and messaging service providers may store or process personal data on servers located outside Thailand, including in the United States and the European Union. Where we transfer personal data outside Thailand, we take reasonable steps to ensure that the destination or recipient provides an adequate standard of data protection as required by the PDPA, or that another lawful basis for the transfer applies (such as your consent or contractual necessity).

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy:

• Enquiries that do not lead to an engagement: up to 2 years from our last contact with you, after which the data is deleted or anonymised.
• Client data: for the duration of our engagement and up to 10 years thereafter, in line with applicable legal limitation periods and accounting requirements.
• Analytics data: retained in accordance with our Google Analytics retention settings.

8. Your Rights Under the PDPA

Subject to the conditions set out in the PDPA, you have the right to:

• Access your personal data and request a copy of it.
• Rectify personal data that is inaccurate or incomplete.
• Erase or anonymise your personal data.
• Restrict the use of your personal data.
• Object to the processing of your personal data.
• Data portability — receive your personal data in a commonly used machine-readable format and have it transmitted to another controller, where applicable.
• Withdraw consent at any time, where processing is based on consent (withdrawal does not affect processing carried out before withdrawal).
• Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe we have violated the PDPA.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including access controls and the security measures provided by our hosting and database providers. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

To exercise any of the rights above, please contact us at doctorbranding.office@gmail.com. We will respond to your request within 30 days. We may need to verify your identity before acting on your request.

10. Children's Privacy

Our Website and services are directed at medical professionals and businesses. We do not knowingly collect personal data from anyone under the age of 20 without the consent required by law. If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Links to Other Websites

Our Website may contain links to third-party websites and platforms (such as LINE, Facebook, and Instagram). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. Material changes will be communicated through the Website. We encourage you to review this page periodically.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, or wish to exercise your rights, please contact:

Doctor Branding Bangkok, Thailand Email: doctorbranding.office@gmail.com LINE: @doctorbranding