1. Data controller
- Controller
- Veluxe Clinic (Veluxe Medical Co., Ltd.)
- Address
- 147 Avenue Project, Jed Yod–Chang Khian Road 9/25 (C4), Chang Phueak, Mueang Chiang Mai 50300, Thailand
- Telephone
- 092-456-9498
- veluxecliniccnx@gmail.com
- LINE
- @veluxeclinic
2. What we collect
| Category | Details | When |
|---|---|---|
| Identity and contact | Name, phone number, LINE or Facebook account used to contact us | Booking form or when you message us |
| Appointment data | Treatment of interest, preferred date and time, prior treatment history | When booking |
| Health data (sensitive) | Medical conditions, allergies, current medication, pregnancy status, skin condition and treatment history | On the form, or during consultation |
| Before-and-after photographs | Images of the face or treated area | Only with your separate, explicit consent each time |
| Payment records | Amount, method and receipt number | At the clinic |
What this website does not collect
The booking form on this website has no database and stores nothing on any server. Your entries are assembled into a text message in your own browser and sent to our LINE Official Account only when you press send. If you close the page first, the data is gone with no copy retained.
We do not collect national ID numbers, passport numbers or payment card details through this website.
3. Purposes and legal basis
| Purpose | Legal basis (PDPA) |
|---|---|
| Contacting you to confirm, change or remind you of an appointment | Performance of a contract, s.24(3) |
| Assessing, diagnosing and safely providing medical treatment, including use of health data | Explicit consent, and preventive or therapeutic medical treatment, s.26(5)(a) |
| Creating and retaining medical records | Legal obligation, s.24(6), under the Sanatorium Act |
| Issuing receipts and tax accounting | Legal obligation, s.24(6) |
| Publishing before-and-after images for promotion | Separate explicit consent, s.19, which you may refuse without affecting your treatment |
| System security and prevention of misuse | Legitimate interest, s.24(5) |
Withdrawing consent — you may withdraw at any time via the contacts in section 9. Withdrawal does not affect processing already carried out lawfully, and does not apply to records we are legally required to retain, such as medical records.
4. Disclosure to others
We do not sell, rent or trade your personal data for marketing. Data may be disclosed only to:
- Clinic staff directly involved in your care.
- Necessary service providers — messaging platforms (LINE Corporation, Meta), our website host and accounting providers, who process data only on our instructions.
- Government authorities where required by law, court order or lawful request.
- Medical emergencies, to prevent harm to your life or health.
When you contact us through LINE or Facebook, your data is also subject to that platform's own privacy policy, which is outside our control.
5. How long we keep it
| Category | Period |
|---|---|
| Booking form data on this website | Not retained at all |
| Chat history and appointment data | 2 years from last contact |
| Medical records | At least 5 years from last treatment, as required by Thai law |
| Before-and-after photographs | The medical record period, or until you withdraw consent, whichever is shorter |
| Accounting and tax documents | 5 years, under the Revenue Code |
6. Your rights
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — have data deleted or anonymised, except where law requires retention.
- Restriction — suspend use of your data while accuracy is verified.
- Objection — object to certain processing, including direct marketing.
- Portability — receive your data in a machine-readable form or have it transferred.
- Withdraw consent — at any time.
- Complain — to the Personal Data Protection Committee of Thailand.
Contact us using section 9. We respond within 30 days and may ask you to verify your identity first. There is no charge.
7. Cookies
This website uses only cookies strictly necessary for basic function. We do not use advertising cookies, do not track you across other websites and do not build marketing profiles. You can refuse or delete cookies in your browser settings. Embedded content such as Google Maps may set its own cookies under that provider's policy.
8. Security
- All pages are served over encrypted HTTPS.
- Access to patient data is limited to staff who need it for their duties.
- All staff are bound by professional confidentiality obligations.
- Physical records are kept in access-controlled areas.
No system is perfectly secure. If a personal data breach occurs that poses a high risk to your rights, we will notify you and the Personal Data Protection Committee as required by law.
9. Minors and contact
We do not provide aesthetic procedures to anyone under 18 without the presence and consent of a parent or legal guardian.
- veluxecliniccnx@gmail.com
- Telephone
- 092-456-9498, daily 10:00 to 20:00
- LINE
- @veluxeclinic
If you are not satisfied with our response, you may complain to the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society, Thailand.