Privacy Policy & Cookie Policy

Part 1 — Privacy Policy

Prepared in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and related regulations.

1. Introduction and Scope

YOUNIFY Clinic, including any person processing personal data on the clinic's behalf (collectively, the "Clinic"), is a physician-led integrative medicine and wellness clinic in Bangkok. We are committed to protecting your privacy with transparency, accountability, and respect for your rights as a data subject.

This policy is prepared under the Personal Data Protection Act B.E. 2562 (2019), its ministerial regulations, and the guidelines of the Personal Data Protection Committee (PDPC) of Thailand.

This policy applies to:

• Patients, service users, and enquirers, whether contacting us online or offline
• Visitors to https://younifyclinic.com (including the /en and /zh versions) and the Clinic's digital channels (LINE, WhatsApp, Facebook, Instagram)
• Business partners, suppliers, and service providers who are natural persons
• Employees, staff, and job applicants (covered further in internal policies)
• Any other person whose personal data the Clinic collects

(All of the above are collectively referred to as "you" or the "data subject".)

If you provide another person's data to the Clinic — for example, details of a relative, caregiver, or family member you bring for treatment — you are responsible under Section 25 of the PDPA for informing that person of this notice and obtaining their consent where required by law.

2. Definitions

3. Sources of Personal Data

3.1 Directly from you

• Appointment, consultation, or enquiry forms on younifyclinic.com
• Contact via LINE Official Account (@younifyclinic), WhatsApp (+66 81 556 9696), Facebook Messenger, or Instagram DM
• Telephone calls (+66 81 556 9696) or visits to the Clinic in person
• Health questionnaires, medical history forms, and pre-procedure assessments
• Subscribing to newsletters, health articles, or Clinic events

3.2 From automated systems

• Cookies and tracking technologies on our website (see Part 2)
• CCTV inside and around the Clinic premises
• Medical devices, diagnostic imaging systems (e.g., X-ray, ultrasound, CT/MRI through relevant facilities), and electronic medical record systems
• Chat logs from the Clinic's LINE/WhatsApp channels

3.3 From lawfully authorised third parties

• Relatives, caregivers, or legal guardians (for minors or persons unable to act on their own behalf)
• Referring hospitals, healthcare facilities, or laboratories
• Government authorities with legal powers
• International patient coordinators or medical travel facilitators, where the data subject has given consent

4. Categories of Personal Data Collected

5. Sensitive Personal Data

As a medical facility, the Clinic must collect the following categories of sensitive data, which receive special protection under Section 26 of the PDPA. The Clinic will obtain your explicit consent through a separate form before collection, unless another legal basis applies.

5.1 Health and medical data (s.26)

• Health history, underlying conditions, current medications, and drug/substance allergies
• Complete history of surgery, procedures, and medical treatment
• Physical examination results, laboratory results, and health screening results
• Diagnostic images such as X-ray, ultrasound, computed tomography (CT), magnetic resonance imaging (MRI), and images from image-guided procedures
• Medical records, treatment plans, and follow-up notes
• Health information used in planning procedures, such as pre-assessment for endoscopic procedures, interventional radiology procedures, or surgery

5.2 Genetic and biometric data (s.26)

• Genetic and molecular test data, such as tissue next-generation sequencing (NGS) and blood-based liquid biopsy (ctDNA) results used to support diagnosis and treatment planning in our Precision Oncology service. This is among the most sensitive categories of data; the Clinic will obtain explicit, case-by-case consent and clearly explain the scope of use before every test.
• Before-and-after treatment photographs used for planning and recording treatment outcomes
• Other biometric data that may be used within Clinic systems

⚠️ Before-and-after photos for marketing: Using your before-and-after photographs for marketing, advertising, or publication on our website/social media constitutes processing for a new purpose. The Clinic will request separate consent, independent of your consent for treatment. You may decline without any effect on your right to receive care. Any results shown in such media reflect that individual patient's experience; results vary from person to person.

5.3 Religious data (s.26)

Only where relevant to your care — for example, religious restrictions concerning blood products, medicines, or certain substances — and only with your explicit consent.

5.4 Exceptions where consent is not required (s.26 para 2)

• To prevent or suppress danger to a person's life, body, or health in an emergency
• For preventive medicine, medical diagnosis, and the provision of health services, under the care of professionals bound by professional confidentiality obligations (s.26(5)(a))
• Where necessary for the establishment, compliance, or exercise of legal claims

6. Personal Data of Minors

⚠️ Special requirements for minors (s.19 para 3)

• For persons under 20 years of age (and not married), the Clinic must obtain consent from a person exercising parental authority (parent or legal guardian) before collecting data.
• For persons under 10 years of age, consent must be given solely by the parent or guardian.
• The Clinic will not collect more data from minors than necessary for the service provided.
• If the Clinic later learns it has collected a minor's data without the required parental consent, it will delete that data promptly, unless another legal basis applies.

7. Legal Bases and Purposes of Processing

No use beyond stated purposes (s.27): The Clinic will not use your personal data for purposes not described in this policy unless another legal basis applies.

8. Disclosure of Personal Data

The Clinic will not disclose your personal data to third parties, except:

8.1 Service providers and processors acting on the Clinic's behalf

The Clinic enters into Data Processing Agreements (DPAs) with data recipients as required by Section 40.

8.2 Government authorities

The Clinic may disclose data pursuant to lawful orders or requests — for example, from the Revenue Department, the Ministry of Public Health, the Royal Thai Police, courts, or the PDPC. Where possible, the Clinic will endeavour to notify you in advance, unless prohibited by law.

9. International Data Transfers

The Clinic transfers data abroad in accordance with Section 28 of the PDPA, only where the destination provides adequate data protection standards or appropriate safeguards are in place.

10. Data Retention Periods

After the retention period, the Clinic will delete, destroy, or anonymise the data using secure, standard methods.

11. Data Security and Breach Notification

11.1 Security measures

• Encryption of data in transit (TLS/HTTPS)
• Access controls limiting data to authorised personnel — health and genetic data are restricted to the medical team directly involved in your care
• Regular staff training on data security and professional ethics
• Secure, access-controlled storage of paper records
• Periodic review and testing of security systems

11.2 Personal data breach notification (s.37)

• Notification to the PDPC within 72 hours of becoming aware of a breach, unless the breach poses no risk to data subjects' rights and freedoms
• Notification to affected data subjects without delay where the breach poses a high risk, including the nature of the breach, potential impact, and remedial measures
• All breach incidents are documented as required by law

12. Automated Decision-Making and Profiling

The Clinic uses analytics tools (such as Google Analytics) that may analyse website usage statistically to improve user experience.

The Clinic does not use automated decision-making to determine rights, deny services, or significantly affect you without human review — all medical decisions are always made by the medical team.

Personalised advertising on Google, Facebook, and Instagram is operated by those platforms' algorithms. You can adjust ad settings directly on each platform.

13. External Links

Our website may link to third-party websites or services, including LINE, Facebook, Instagram, WhatsApp, and Google Maps. The Clinic has no control over the privacy practices of those services and recommends reviewing each platform's policy before use.

14. Data Protection Coordinator

The Clinic has designated a person responsible for overseeing personal data protection compliance and coordinating with the PDPC. You may contact them via the channels in Section 18 to:

• Ask about the processing of your personal data
• Submit requests to exercise your rights under the PDPA
• Raise concerns or complaints about personal data protection

15. Your Rights as a Data Subject

You have the following rights under the PDPA, exercisable free of charge unless a request is unreasonable, excessive, or repetitive:

1. Right to be informed (s.23) — to be told how your data is collected, at or before collection
2. Right of access (s.30) — to view or obtain a copy of your personal data, including medical records under the applicable rules
3. Right to rectification (s.35) — to have inaccurate, outdated, or misleading data corrected
4. Right to data portability (s.31) — to receive your data in a machine-readable electronic format for transfer to another controller
5. Right to erasure (s.33) — to have data deleted, destroyed, or anonymised when no longer necessary or when consent is withdrawn; this does not apply to data the Clinic must retain by law (such as medical records)
6. Right to restriction (s.34) — to temporarily suspend processing, for example while data accuracy is verified
7. Right to withdraw consent (s.19 para 5) — at any time, without affecting processing already lawfully carried out
8. Right to object (s.32) — at any time, particularly to direct marketing, which the Clinic will stop immediately upon objection, free of charge and without needing a reason

The Clinic will respond to requests within 30 days of receipt. If a request cannot be fulfilled, we will explain why.

16. Complaints

If you believe the Clinic's processing does not comply with the PDPA, you have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) — Office of the Personal Data Protection Committee, tel. +66 2 142 1033, [email protected]. The Clinic welcomes the opportunity to address your concerns directly first, via the channels in Section 18.

17. Policy Updates

The Clinic may update this policy from time to time to reflect changes in law and practice. The latest version will be published at younifyclinic.com with its effective date. Significant changes will be communicated through appropriate channels.

18. Contact

YOUNIFY Clinic

2F, Room 214, United Center, 323 Silom Rd, Bangrak, Bangkok 10500, Thailand

(BTS Sala Daeng)

Open daily 11:00–20:00

Phone/WhatsApp: +66 81 556 9696

LINE: @younifyclinic

Email: [email protected]

Website: https://younifyclinic.com

Part 2 — Cookie Policy

1. What are cookies?

Cookies are small data files stored in your browser or device when you visit a website. They remember your visit and preferences and help the website function correctly. Cookies cannot access other information on your device.

2. Cookies used on younifyclinic.com

The website does not currently display a cookie consent banner, and it does not provide an on-site panel for switching individual cookie categories on or off. Analytics and advertising cookies are set while you browse. You can refuse or delete them at any time using the controls in section 4 below.

3. Third-party cookies

The website may include cookies from external providers — Google (Analytics/Ads), Meta (Facebook Pixel), and LINE (LINE Tag) — which are governed by each provider's own privacy policy.

4. Managing cookies

You can manage or delete cookies via:

• Browser settings — Chrome, Safari, Firefox, and Edge each provide cookie controls under Settings/Privacy, including blocking or deleting cookies and rejecting third-party cookies
• Google Analytics opt-out — the browser add-on at https://tools.google.com/dlpage/gaoptout stops Google Analytics from collecting data about your visits
• Google ad settings — https://myadcenter.google.com lets you control ad personalisation

Disabling certain cookies may affect some website functions.

*This policy is available in Thai, English, and Chinese. In the event of any inconsistency, the Thai version prevails.*