About Us

Data Protection Policy Chiangmai Ram Hospital Public Company Limited

Chiangmai Ram Hospital (“the Hospital”) has established this Data Protection Policy regarding personal data you provide during service requests, website visits, or mobile application usage. This policy also covers information relating to you that is transmitted or referred by third parties.

“Personal Data” refers to any information relating to an identified or identifiable natural person, whether directly or indirectly, excluding deceased individuals.

Collection of Personal Data

1. The Hospital collects your directly or indirectly identifiable personal data for your legitimate benefit and for a duration reasonably necessary to provide healthcare services when you submit information or request services via websites, applications, or other channels (such as doctor appointments, online transactions, newsletter subscriptions, special assistance requests, offline registration counters, voluntary surveys, email correspondence, employment applications, and other direct communication channels).

2. The Hospital may receive your personal data from third parties, including affiliated business networks, authorized representatives, hospital service providers, and government agencies.

Categories of Personal Data Collected The types of personal data collected depend on the circumstances and services requested. Collected data is processed to complete requested online or offline transactions and medical services:

1. Identification Data: Name, photograph, gender, date of birth, passport number, national identification card number, or other official identification identifiers.

2. Contact Details: Residential address, telephone number, and email address.

3. Financial & Payment Data: Billing records, credit/debit card information, and bank account details.

4. Service & Admission Data: Appointment history, personal details of relatives/emergency contacts, accommodation preferences, dietary requirements, and supplementary service requests.

5. Marketing Participation Data: Registration details for hospital events, campaigns, or programs.

6. Statistical Data: Patient volumes and website traffic analytics.

7. Website Navigation Data: Log data and tracking information derived from website access.

8. Health & Clinical Records: Physical and mental health reports, health maintenance documentation, laboratory test results, and clinical diagnoses.

9. Medication Data: Medication history, current prescriptions, and documented adverse drug reactions/allergies.

10. Feedback & Treatment Outcomes: Patient feedback, ratings, and reported clinical results.

The Hospital does not collect or process sensitive personal data (such as race, religious beliefs, or criminal records) unless explicitly required by applicable laws or authorized by your prior consent.

Purposes of Processing Personal Data The Hospital utilizes your personal data for the following purposes:

1. Providing and delivering comprehensive hospital and medical services.

2. Managing appointments, dispatching hospital announcements, and recommending relevant medical services.

3. Coordinating patient data transfers to ensure swift referrals.

4. Verifying patient identity.

5. Sending appointment reminders and medical assistance notifications.

6. Administering and offering eligible privileges and benefit programs.

7. Managing marketing, sales promotions, and customer relations (e.g., campaigns, products, services, and partner offerings).

8. Establishing customer communication channels to address inquiries and complaints.

9. Conducting patient satisfaction surveys, market research, and statistical analysis to innovate and improve healthcare products and services.

10. Managing accounting and financial processes (e.g., payment verification, billing, invoice validation, and refund processing).

11. Ensuring safety, facility security, and patient protection during hospital stays.

12. Processing employment applications and human resource management.

13. Enforcing hospital internal policies and operational rules.

14. Complying with statutory requirements, regulatory mandates, court orders, subpoenas, or lawful government agency requests.

15. Fulfilling other objectives supporting the aforementioned purposes or as periodically consented to by you.

Disclosure of Personal Data The Hospital may disclose or transfer your personal data to domestic or cross-border third parties under strict security measures and statutory compliance:

1. Business partners (e.g., insurance companies, healthcare alliance centers, and loyalty reward partners).

2. Banking institutions and payment processors (e.g., credit/debit card operators).

3. Security and safety personnel.

4. Immigration and customs departments.

5. Government authorities, law enforcement, and regulatory bodies as authorized or required by law.

Third-Party Links Hospital platforms may contain hyperlinks directing to external websites. This Privacy Policy does not apply to third-party domains. The Hospital holds no responsibility or liability for personal data processing conducted outside our operational control.

Data Retention and Security Safeguards

1. Personal data is retained for the duration necessary to satisfy the objectives stated in this policy, comply with statutory obligations, or support legal proceedings.

2. The Hospital implements appropriate technical and administrative security measures to protect collected personal data against unauthorized access, loss, misuse, or alteration.

Data Subject Rights

1. Right to Withdraw Consent: Revoke previously granted processing consent at any time during the data retention period.

2. Right of Access: Request access to, obtain copies of, or inquire about the source of non-consented personal data.

3. Right to Rectification: Request corrections to inaccurate personal data or supplement incomplete records.

4. Right to Erasure: Request the deletion or destruction of personal data under statutory conditions.

5. Right to Restriction of Processing: Request the suspension or restriction of personal data processing under specified circumstances.

6. Right to Data Portability: Request the transfer of your personal data to another data controller or directly to yourself where technically feasible.

7. Right to Object: Object to the collection, use, or disclosure of personal data under statutory grounds.

Requests to exercise data subject rights or report processing beyond agreed purposes can be formally submitted directly to the Hospital.

Policy Amendments and Contact Information The Hospital periodically reviews this Data Protection Policy to remain aligned with regulatory developments. Material changes will be published on the hospital website: [https://www.chiangmairam.com/contactus](https://www.chiangmairam.com/contactus).

• Inquiries & Complaints: chiangmairam@rachiangmairam.com

• Effective Date: June 1, 2022

(Pichaya Somboonsin, M.D.)

Executive Director

Chiangmai Ram Hospital Public Company Limited