Privacy Notice for Websites and Applications
of
Bumrungrad Hospital Public Company Limited and Its Affiliated Companies

   

1. Definitions

 

2. Personal Data Collected by the Company

2.1 General Personal Data
 

1) Personal Information, e.g., title, rank, position, first name, middle name, last name, age, date of birth, gender, photograph, nationality, country of residence, national identification card number, passport number, signature, marital status, and other similar information.

2) Contact Information, e.g., address, mobile phone number, home telephone number, email address, and other contact details.

3) Service-Related Information, e.g., appointment information, administrative service records, accommodation information, complaints, suggestions, service inquiries, and other information relating to the provision of the Company's services.

4) Information Appearing in Relevant Legal Documents, e.g., copies of national identification cards, passports, house registration documents, driving licenses, government official identification cards, name or surname change certificates, marriage certificates, divorce certificates, birth certificates, and other relevant supporting documents.

5) Information Relating to Individuals Connected with Patients, e.g., contact persons, emergency contacts, spouses, parents, children, relatives, beneficiaries, guarantors, guardians, attorneys-in-fact, legal representatives, custodians, curators, or other related persons, including their personal information such as names, relationships, national identification card numbers, passport numbers, contact information, and other related information or documents.

6) Financial Information and Healthcare Benefit Information, e.g., billing and payment information, credit card or debit card information, bank account details, healthcare entitlement information, health insurance information, life insurance information, accident insurance information, group insurance information, medical reimbursement information, payer information, and other related information.

7) Marketing and Customer Relationship Management Information, e.g., newsletter subscriptions, promotional registrations, participation in marketing activities, seminar registrations, membership program, benefit program, survey responses, and other related information.

8) User Account and Electronic System Usage Information, e.g., username, password, account registration information, login information, authentication information, information received from third-party service providers or social media accounts that you choose to use for login or connection with the Company's services (such as LINE, Facebook, or WhatsApp), including personal information that you choose to share through such accounts, e.g., name, email address, telephone number, profile picture, and other related information.

9) Automatically Collected Information, e.g., access time, device ID or other unique identifiers, IP address, MAC address, Cookie ID, information relating to the use of websites, applications, and electronic systems, log data, browser type and version, operating system information, language preferences, settings, device name and model, network provider, approximate location, time zone, duration of use, and other technical and usage-related information.

2.2 Sensitive Personal Data
   

3. Source of Your Personal Data

 

4. Purposes and Legal Bases 

4.1 The Company processes your Personal Data for the following purposes:
 

1) For the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract, including account registration and management, identity verification, patient registration, appointment booking and access to services through the Company’s websites, applications, or digital platforms, the purchase of products and services, payment processing, issuance of related documents, as well as contacting, coordinating with, and handling your requests in connection with such services.

2) For the legitimate interests of the Company, including the administration and security of information systems, prevention and detection of unauthorized use, technical analysis and troubleshooting, monitoring, analyzing, and evaluating the use of websites, applications, and digital services in order to develop, improve, and enhance service efficiency, providing assistance and responding to inquiries, receiving and handling complaints, risk management, internal audits, fraud prevention, and the establishment, exercise, or defense of legal claims.

3) To comply with applicable laws, including compliance with laws, regulations, notifications, requirements, or other legal obligations relating to the Company’s business operations, disclosure or submission of information to governmental authorities, regulatory authorities, or other authorities as required by law, and compliance with court orders or lawful orders issued by competent authorities.

4) To prevent or suppress dangers to life, body, or health of individuals, including contacting emergency contacts and taking necessary actions to protect the vital interests of patients or other individuals.

5) Where you have provided your consent, the Company will process your Personal Data for the purposes specified in each consent, including sending marketing communications, health-related articles, notifications, promotions, privileges, or marketing activities, analyzing your use of websites, applications, products, and services in order to develop and present content, products, or services that may be of interest to you, and the use of cookies or similar technologies in accordance with the Company’s Cookie Notice.
 

4.2 The Company may process your Sensitive Personal Data for the following purposes:
 

1) For the provision of healthcare services, medical diagnosis, and medical treatment, including patient registration, appointment scheduling, access to medical services, telemedicine or remote medical consultation services, health assessments, and the management of your healthcare services.

2) For the review, evaluation, and improvement of healthcare quality, quality of care, patient safety, and disease prevention or control, which may contribute to public health benefits, including statistical analysis, data analytics, and service performance evaluation, to the extent permitted by applicable law.

3) For the establishment, exercise, or defense of legal claims, including handling disputes, complaints, compensation claims, and legal proceedings relating to the Company’s services.

4) To prevent or suppress dangers to your life, body, or health, or that of another person, including taking necessary actions in emergency situations to protect vital interests relating to life, body, or health.

5) Where you have provided your explicit consent, the Company will process your Sensitive Personal Data for the purposes specified in each consent, including receiving health data from health devices or health applications that you choose to connect to the Company’s services, such as Apple Health or other health platforms, disclosing health information to healthcare providers, medical personnel, insurance companies, or other persons specified and authorized by you for the purpose of providing services or fulfilling your requests, and analyzing health information together with service usage information in order to provide health-related communications, benefits, or offers in accordance with your consent.

 

5. Use of Artificial Intelligence (AI) and Digital Technologies to Support Services

 

6. Disclosure of Your Personal Data

 

7. Cross-Border Transfer of Personal Data

 

8. Processing of Personal Data of Minors, Incompetent Persons, and Quasi-Incompetent Persons

 

9. Cookies and Related Technologies

 

10. Retention Periods

 

11.    Security Measures

 

12. Data Subject Right

12.1 Under the Personal Data Protection Law, you have the following rights:

1) Right to Withdraw Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal data at any time, unless such withdrawal is restricted by law or contractual obligations. The withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal.

2) Right of Access: You have the right to request access to and obtain a copy of your personal data in the possession of the Company, as well as to request disclosure of how such personal data was obtained where you did not provide the data directly to the Company.

3) Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to request that the Company transfer such data to another data controller where technically feasible and permitted by law. (The Company may charge a reasonable fee permitted by law and based on actual costs incurred.)

4) Right to Object: You have the right to object to the collection, use, or disclosure of your personal data in circumstances prescribed by law. The Company may reject your request where there are legitimate grounds for processing as permitted by law.

5) Right to Erasure: You have the right to request the deletion, destruction, or anonymization of your personal data in circumstances prescribed by applicable law.

6) Right to Restriction of Processing: You have the right to request that the Company temporarily suspend the processing of your personal data in circumstances prescribed by applicable law.

7) Right to Rectification: You have the right to request that the Company correct, update, complete, or rectify your personal data to ensure that such data is accurate, current, complete, and not misleading.

8) Right to Lodge a Complaint: If you have concerns regarding the Company's processing of your personal data and believe that such processing may affect your rights under applicable data protection laws, you have the right to lodge a complaint with the Personal Data Protection Committee or any competent authority as prescribed by law.

 

13. News and Notification Settings

 

14. Links to Third-Party Websites, Applications, or Services

 

15. Privacy Notice Updates

 

16. Contact Us

 
BUMRUNGRAD HOSPITAL PUBLIC COMPANY LIMITED
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
 
Data Protection Officer
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
Email: [email protected]
 
 

 

Privacy Notice for Patients
of
Bumrungrad Hospital Public Company Limited and Its Affiliated Companies

 

1. Definitions

 

2. Personal Data Collected by the Company

2.1 General Personal Data
 

1) Personal information, e.g., title, rank, position, first name, middle name, last name, age, date of birth, gender, photograph, nationality, country of residence, national identification card number, passport number, signature, marital status, and other similar information.

2) Contact information, e.g., address, mobile telephone number, home telephone number, email address, and other contact details.

3) Service-related information, e.g., appointment and administrative service records, room accommodation information, complaints, suggestions, service inquiries, communications relating to the Company's services, and other information relevant to the provision of healthcare and related services.

4) Information appearing on legal documents, e.g., copies of national identification cards, passports, house registration documents, driver's licenses, government official identification cards, certificates of name or surname change, marriage certificates, divorce certificates, birth certificates, and other related documents.

5) Information relating to persons associated with the patient, e.g., contact persons, emergency contacts, spouses, parents, children, relatives, beneficiaries, guarantors, guardians, attorneys-in-fact, legal representatives, curators, protectors, or other related persons, including their names, relationship with the patient, identification information (in ID card/passport), contact details, and other relevant information or supporting documents.

6) Financial and healthcare benefits information, e.g., billing and payment information, credit card or debit card information, bank account details, healthcare entitlement information, health insurance, life insurance, accident insurance, group insurance coverage, medical reimbursement claims, information relating to responsible payers, and other related information.

7) Public relations, marketing, and customer relationship management information, e.g., newsletter subscription information, promotion registration information, participation in marketing activities, seminar registration information, membership program information, benefits program information, survey responses, and other related information.

8) User account and electronic system usage information, e.g., usernames, passwords, account registration information, login information, authentication information, information received from third-party identity providers selected by you, website, application and electronic system usage information, including IP Address, Cookie ID, Device ID, Log Data, Browser Type, online appointment information, and other digital service usage information.

9) Other Information, e.g., audio recordings, photographs, video recordings from closed-circuit television (CCTV) systems, access and exit records, security-related information, and other related information

3. Source of Your Personal Data

4. Purposes and Legal Bases

1) For the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract, such as the administration of healthcare entitlements and related benefits, billing, issuing invoices or receipts, communication and coordination in relation to products and/or services, the provision or delivery of services as requested by you, the collection of payments for products and/or services, and the exercise of rights and performance of obligations under the relevant contract.

2) For the Company's legitimate interests, such as identity verification, sending medical appointment reminders, collecting information of persons who may be contacted in case of emergency or where a patient is unable to provide information on his or her own behalf, monitoring and reviewing contractual performance, after-sales services, customer relationship management, sending and following up on service satisfaction surveys, verifying and confirming identity in relation to transactions or contractual arrangements, financial audits, verification of transaction accuracy, payment processing, refunds, compensation payments, monitoring compliance with the Company's policies, internal audits, investigations, inquiries, inspections, obtaining advice in connection with the establishment of legal claims or proof in legal proceedings, where your personal data may be disclosed to lawyers, legal and tax advisors, external auditors, internal auditors, financial auditors, and other advisors for such purposes, CCTV recording for security purposes within buildings or premises, and security management.

3) For the provision of medical services, healthcare, and compliance with laws applicable to healthcare facilities, such as patient registration, identity verification, medical appointment scheduling, administration of healthcare services, communication and coordination with patients or related persons, administration of healthcare entitlements, reimbursement of healthcare benefits, billing for services, and compliance with applicable requirements, laws, professional standards, ethics, and codes of professional conduct.

4) For compliance with other applicable laws, such as collecting personal data as required by law, disclosing or submitting personal data to government authorities as required by law, and complying with applicable laws, regulations, orders of competent authorities, and court orders.

5) To prevent or suppress danger to life, body, or health, such as contacting relevant persons in emergency situations.

6) Where you have provided your consent, the Company will process your personal data for the purposes specified in the relevant consent, including analyzing information relating to your purchase of products and/or services in order to provide or send public relations materials, notifications, promotions, campaigns, or invitations to participate in activities of the Company that may be beneficial to you and aligned with your interests through the channels you have provided to the Company.
 

1) For compliance with legal obligations and for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, medical treatment, and the management of health systems and services, including medical history taking, diagnosis and treatment, medication dispensing, laboratory testing and analysis, disclosure of information to relevant external healthcare providers for treatment purposes, processing of genetic data for identity verification or verification of biological relationships in connection with organ transplantation, as well as compliance with professional standards, medical ethics, and codes of professional conduct.

2) For the purposes of reviewing, assessing, and improving the quality of medical treatment, quality of care, patient safety, and the control and prevention of communicable diseases, which contribute to public health benefits.

3) Where necessary for the establishment, compliance with, exercise, or defense of legal claims, such as the collection of patients’ medical expenses, issuance of invoices, requesting patients to settle outstanding amounts stated in invoices, issuance of receipts, and verification of the billing and payment of patients’ medical expenses.

4) To prevent or suppress danger to life, body, or health, such as making contact in emergency situations.

5) For research, statistical purposes, and medical data analysis, including the development, improvement, and evaluation of the Company's services, products, or operations, subject to applicable legal requirements and appropriate data protection measures.

6) Where you have provided your explicit consent, the Company will process your Sensitive personal data for the purposes specified in the relevant consent, including:

a) Disclosure of your health data to hospitals or other healthcare providers for the purpose of referring you for medical treatment in non-emergency cases.

b) Disclosure of your health data and medical certificates to insurance companies for the reimbursement of healthcare benefits.

c) Disclosure of your health data, medical reports, or medical certificates to embassies, employers, affiliated organizations, government authorities, or any persons or legal entities designated by you and for which your consent has been obtained, for the purpose of carrying out your requests, exercising or obtaining benefits or entitlements, billing or payment of service fees, or for any other purposes specified by you.

d) Disclosure of your health data or related information to insurance companies, at your request or with your consent, for the purpose of carrying out any activities relating to your insurance policies or insurance benefits.

e) Disclosure of your health data to third parties, such as family members, relatives, companions, or close contacts, upon request by such persons, where your consent has been obtained or where such disclosure is made at your request.

f) Disclosure of your health data, medical certificates, or health records to airlines for the purpose of certifying your fitness to travel by air.

g) Disclosure of your health data and related information to the Company's partners or affiliated organizations for the purpose of developing medical products and services.

h) Processing of your health data, biological samples, and data derived from such biological samples, and data disclosure to external laboratories for research and academic purposes.

i) Carrying out a de-identification process to transform identifiable data and biological samples into data and biological samples that can no longer identify the data subject, for research and academic purposes.

j) Disclosure of your health data or other medical information, as necessary, to healthcare quality accreditation and certification bodies for the purposes of evaluating, certifying, and maintaining the quality standards of patient care and healthcare services provided by the Company, such as the Healthcare Accreditation Institute (Public Organization) (HA), Joint Commission International (JCI), Bureau Veritas, and the International Organization for Standardization (ISO).

k) Analysis of information relating to the purchase of products and/or services, including health data, in order to present or send public relations information, notifications, promotions, campaigns, or invitations to participate in the Company's activities that may be beneficial to you and correspond to your needs, through the channels you have provided.

5. Use of Artificial Intelligence (AI) and Digital Technologies to Support Services

6. Disclosure of Personal Data

7. Cross-Border Transfer of Personal Data

8. Processing of Personal Data of Minors, Incompetent Persons, and Quasi-Incompetent Persons

9.     Retention Periods

10.     Security Measures

11. Data Subject Right

1) Right to Withdraw Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal data at any time, unless such withdrawal is restricted by law or contractual obligations. The withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal.

2) Right of Access: You have the right to request access to and obtain a copy of your personal data in the possession of the Company, as well as to request disclosure of how such personal data was obtained where you did not provide the data directly to the Company.

3) Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to request that the Company transfer such data to another data controller where technically feasible and permitted by law. (The Company may charge a reasonable fee permitted by law and based on actual costs incurred.)

4) Right to Object: You have the right to object to the collection, use, or disclosure of your personal data in circumstances prescribed by law. The Company may reject your request where there are legitimate grounds for processing as permitted by law.

5) Right to Erasure: You have the right to request the deletion, destruction, or anonymization of your personal data in circumstances prescribed by applicable law.

6) Right to Restriction of Processing: You have the right to request that the Company temporarily suspend the processing of your personal data in circumstances prescribed by applicable law.

7) Right to Rectification: You have the right to request that the Company correct, update, complete, or rectify your personal data to ensure that such data is accurate, current, complete, and not misleading.

8) Right to Lodge a Complaint: If you have concerns regarding the Company's processing of your personal data and believe that such processing may affect your rights under applicable data protection laws, you have the right to lodge a complaint with the Personal Data Protection Committee or any competent authority as prescribed by law.

12. Privacy Notice Updates

13. Contact Us

 
 

1. Definitions
 

2. Personal Data Collected by the Company

The Company will collect, use, disclose, and/or transfer your personal data, which includes but is not limited to the following:
 
2.1  General Personal Data

1. Personal information, e.g., name, surname, title, nationality, gender, age, date of birth, photograph, identification number, tax identification number, professional license number, etc.
2. Contact information, e.g., telephone number, fax number, address, email address, etc.
3. Work Information, e.g., occupation, job title, etc.
4. Financial information, e.g., bank account number, etc.
5. Information appearing on legal documents, e.g., a copy of an identification card, a copy of a professional license, a copy of any license, etc.
6. Other information, e.g., pictures or videos from CCTV footage.

2.2 Sensitive Data
 

3. Source of Your Personal Data
 


4. Purposes and Legal Basis for Processing 

We will process your personal data for the following purposes, under the corresponding legal bases:

1. For the fulfilling of a contract to which you are a party, or to take steps at your request prior to entering into a contract, such as procurement selection processes, pre-contractual qualifications review, contract negotiation or execution, communication for the sale of goods and/or services, fulfillment of contractual obligations, invoicing or payment for goods or services, delivery or receipt of goods or services, etc.
2. For legitimate interests, such as procurement, acceptance of goods or services, contract performance monitoring, product or service quality verification, identity verification for transactions or legal agreements, performance evaluations, investigations, audits, consultations regarding the establishment of legal claims, or proceedings in legal processes. This may include disclosure of your personal data to attorneys, legal or tax advisors, auditors, internal or financial auditors, and other consultants for such purposes; disclosure to external service providers for accounting, financial, or IT system services; and the use of CCTV footage for building or premises security.
3. For compliance with legal obligations applicable to the Company’s operations, such as accounting and financial activities, including audits, debt collection, issuance of tax invoices, and transaction records as required by law; the collection of personal data as mandated by legal provisions; the disclosure or submission of data to government authorities as required by law; compliance with legal provisions, regulations, court orders and/or orders of authorized officials; payment of legally required fees; and the establishment or exercise of legal claims or rights in judicial proceedings.
4. For the prevention or mitigation of danger to life, body, or health, such as emergency contact or the control and prevention of communicable diseases.

5. Disclosure of Personal Data
 


6. Cross-border Data Transfer
 

7. Retention Periods
 

8. Security Measures
 

9. Your Rights as a Data Subject

9.1 Under the Personal Data Protection Law, you have the following rights:

1. ) The right to request access to or obtain a copy of your personal data that the Company collects, uses, or discloses.
2. ) The right to receive or request the transfer of your personal data in a structured, commonly used, and machine-readable format, and to transmit such data to another party as requested. (The Company reserves the right to charge a reasonable fee based on actual costs incurred.)
3. ) The right to object to the collection, use, or disclosure of your personal data, as permitted by law.
4. ) The right to request the deletion, destruction, or anonymization of your personal data, as required by law.
5. ) The right to request the suspension of the use of your personal data, unless there are legal limitations that prevent the Company from complying with your request.
6. ) The right to withdraw your consent at any time, unless restricted by law or contract. Withdrawal of consent will not affect the lawful processing of personal data conducted prior to the withdrawal.
7. ) The right to file a complaint with the authorized supervisory authority under the Personal Data Protection Law if you believe the Company has not complied with applicable laws.

10. Amendment to this Privacy Notice
 

11. Contact Information
 

 
BUMRUNGRAD HOSPITAL PUBLIC COMPANY LIMITED
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
Data Protection Officer (DPO)
Email: [email protected]
 
   
 

We, Bumrungrad Hospital Public Company Limited, an internationally accredited and multi-specialty hospital, and its affiliated companies* (hereinafter referred to as the “Company” or “We,” as the case may be), as the data controllers under the Personal Data Protection Act B.E. 2562 (A.D. 2019) (“PDPA”), are aware of the importance of protecting the Personal Data of the shareholders and the relevant persons (hereinafter referred to as “You” or “Data Subject”). We, therefore, announce this Privacy Notice (the "Notice") to inform you of the protection of your Personal Data that is collected, used, disclosed, and transferred (collectively “Processing”) by the Company to any other relevant persons.

We ensure that Processing your Personal Data will be secured by our appropriate and sufficient security measures. We will not process your Personal Data for purposes other than those specified in this Notice unless you consent.


1. Definitions

"Personal Data" refers to any information that identifies or can be used to identify you, which is collected by the Company as specified in this Notice.

“Sensitive Data” refers to Personal Data classified as sensitive data under the PDPA that the Company is permitted to collect, use, and disclose with your explicit consent, e.g., the information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, a natural person’s sexual orientation or criminal record, or data concerning health, disabilities, trade union membership, genetic data, biometric data, and other data processed to identify a natural person uniquely.


2. Personal Data Collected, Used, and Disclosed by the Company

The Company will collect, use, or disclose your General Personal Data, which includes, but is not limited to, the following:

1. Personal information, e.g., first name, last name, title, national identification card number, copy of passport/visa, age, date of birth, gender, and nationality.
2. Contact information, e.g., address, mobile phone number, and email address.
3. Financial and investment information, e.g., shareholder reference number, share certificate number, number of share(s), bank account number, and dividend payment.
4. Other, e.g., capture or video from meeting and conversation records from the meetings.

3. Source of Your Personal Data

We may collect Personal Data you voluntarily release to us, such as your disclosure as a shareholder, or from other sources, e.g., broker and Thailand Securities Depository Co., Ltd. (TSD)


4.  Purposes and Legal Bases

We will process your Personal Data based on legal bases as provided below:

4.1 We rely on contractual obligations to process your Personal Data, such as follows:

1. ) To communicate with you as a shareholder;
2. ) To verify your registration relating to the shareholders’ meetings;
3. ) To process the meeting registration system and voting;
4. ) To close the share registry book for determining your rights to attend the shareholders’ meetings, your rights to receive dividends, or from time to time for checking of shareholders list;
5. ) To convene a shareholders’ meeting and to send the invitation letter or other documents to the shareholders; and
6. ) To pay dividends to the shareholders.

4.2 We rely on legal obligations, such as follows:

1. ) To treat you, as a shareholder, according to your rights and responsibilities under the laws;
2. ) To call and convene annual shareholders’ meetings or extraordinary shareholders’ meetings in accordance with the laws;
3. ) To collect, disclose, and report your Personal Data to the regulatory authorities, e.g., Securities and Exchange Commission (SEC), Stock Exchange of Thailand (SET), Thailand Securities Depository Co., Ltd. (TSD), Department of Business Development (DBD), as well as to comply with the orders of the court and competent governmental authorities;
4. ) To count the votes and to process the vote counting; and
5. ) To prepare and disclose the related party transaction report.

4.3 We rely ona legitimate interest to process your Personal Data, such as follows:

1. ) To verify your or your proxy’s identity at the shareholders’ meeting;
2. ) To prepare the minutes of the shareholders’ meeting and to witness your attendance;
3. ) To take pictures and record videos of the events at the meeting places and the attendants, in which your photographs or movements may appear. This includes the record of conversations during the meeting;
4. ) To secure the inner and outer building and the premises whereby the surveillance cameras may collect your pictures;
5. ) To prevent and investigate fraudulent actions, money laundering, criminal offenses, or any other unlawful activities;
6. ) To investigate, verify facts, establish/exercise the legal claims, or be used as evidence in the legal proceeding.
7. ) To disclose your opinions and suggestions to the directors, the executives, the committees, and other relevant parties for further utilization or to fulfill your request, such as nominating a director or proposing an agenda item.

5. Disclosure of Your Personal Data

We will not disclose your Personal Data for a purpose other than those specified herein unless having been consented to do so.

We may disclose your Personal Data to our group of companies and affiliates or third parties to take out loans from banks, for investment, license applications, arrange the shareholders’ meetings, count the votes, process vote counting results, pay dividends, audit accounts, seek for legal advice, prosecute, and perform other activities to complete the purposes as specified herein for the sake of our business operation. We will ensure that the aforementioned third parties handle your Personal Data in accordance with this Notice and the applicable laws.

Where it is necessary to disclose your Personal Data to any governmental or regulatory agency such as the SEC, SET, TSD, or DBD, in order to comply with the laws or orders of governmental or compliance authorities, we reserve the right to do so without your prior consent.


6. Retention Periods & Security Protection Measures

1. 1 We will retain your Personal Data for as long as necessary to fulfill the purposes specified in this Notice. We may retain your Personal Data as long as agreed on in the contract or per accounting standards, prescription periods, legal obligations, or establishment or exercise of a legal claim as permitted by the law.
2. 2 We have an examination system for deletion or destruction of Personal Data in the event of the expiration of the retention period or if such Personal Data is unrelated to or beyond the necessary collection specified by this Notice.
3. 3 We will retain your Personal Data in the form of documents, electronic files, computer systems, or other means with appropriate Personal Data security measures against loss, unauthorized or unlawful access, use, change, modification and disclosure.
4. 4 We have limited access to your Personal Data and adopted technology to secure your data from cyber-attacks and unauthorized access to our computer and electronic systems. We further ensure that any processing of your Personal Data by data processors or other third parties will occur under appropriate and stringent monitoring.

7.Data Subject’s Right

7.1 Under the PDPA, you, as the Data Subject, are entitled to:

1. ) Request access to, or copies of, your Personal Data processed by the Company.
2. ) Request transfer of your Personal Data, in a form collected by us and readable, usable, and disclosable in an electronic format, to another party (the Company reserves the right to charge you a fee, the amount of which is at our discretion.)
3. ) Object to the collection, use, and disclosure of Personal Data to the extent permitted by law.
4. ) Have your Personal Data deleted, destroyed, or anonymized by any method permitted by law.
5. ) Sequester your Personal Data from further use by any method unless the law provides otherwise.
6. ) Withdraw your consent given us at any time unless otherwise restricted by law or contracts. Your withdrawal will not extend to Personal Data to which you have granted consent for Processing.
7. ) File a complaint with the competent officer authorized under the PDPA if you believe we have violated, or do not comply with, the PDPA.

7.2 We will endeavor to procure or maintain the accuracy and completeness of your Personal Data. When there is a change or modification to your Personal Data or when you detect that your Personal Data is incorrect, you have the right to make corrections to it.

7.3 The exercise of your rights specified above must comply with the law. We reserve the right to refuse any request on grounds permitted by law. If we deny your request, the request and reasons for denial will be recorded in the Personal Data processing record as required by law.

7.4 To exercise your right, you may contact us via the contact information provided hereunder. We will process your request and then inform you of the result within 30 days from the date of receiving your request. Where we refuse your request, you will be notified accordingly.


8. Amendment

We reserve the right to alter, adjust, and modify this Notice to comply with applicable guidelines, laws, and regulations. If such changes occur, we will inform you of the amended, adjusted, or modified content in the designated channel as soon as it becomes effective. New Notice will only apply to you upon your service use after the revision.


9. Contact Information

Should you wish to exercise any legal rights as specified above or have any questions, concerns, suggestions, or complaints about our Notice, you can contact us via the following channels:

BUMRUNGRAD HOSPITAL PUBLIC COMPANY LIMITED
33 Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok
Data Protection Officer (DPO)
Email: [email protected]


 

 

1. Personal Data Collected by the Hospital

The Hospital will collect your personal data through its CCTV system, which may include:

• Still images and video footage of individuals
• Vehicles and license plate numbers
• Objects that may identify an individual (if captured in the footage)
• Information relating to date, time, and location

Such data will be recorded while you are present in areas of the Hospital where CCTV cameras are installed, both inside the buildings and around the premises. The Hospital will collect this data only within the scope and purposes specified in this Notice. Where required by law, the Hospital will obtain your consent through appropriate procedures before collecting such data.
 

2. Purpose and Legal Basis of Collection

The Hospital may record, store, duplicate, process, update, or disclose CCTV images and video footage for the following purposes:

• To ensure the safety and security of the life, body, and property of employees, customers, visitors, and other individuals on the Hospital premises.
• To prevent, detect, and monitor irregularities, damages, or unlawful activities that may occur within the Hospital premises.
• To support investigations by governmental authorities or other competent agencies, including compliance with court orders.
• To serve as evidence in disciplinary investigations, dispute resolution, or internal investigations conducted by the Hospital.
• To establish, exercise, or defend legal claims to protect the rights and interests of the Hospital and relevant individuals.
• To verify identity or manage control access to areas in compliance with law requirements or security regulations.
• To facilitate a safe and secure environment for service users and all individuals present on the premises.

The Hospital installs CCTV cameras only in necessary areas for security and operational purposes. Cameras are not installed in private areas such as restrooms, changing rooms, or staff break areas, in order to protect individuals’ privacy rights.

CCTV cameras operate 24 hours a day, every day. The Hospital has installed clear notification signs in areas under surveillance to ensure transparency in data collection and compliance with personal data protection principles.

The processing of such data is based on the following legal bases:

• Legitimate Interest: The Hospital’s legitimate interest in maintaining security and protecting the rights of individuals and property, without affecting the fundamental rights and freedoms of the data subjects.
• Vital Interest: To prevent or mitigate harm to the life, body, or health of individuals.
• Legal Obligation: To comply with applicable laws and regulations.

3. Retention Period

The Hospital will retain your personal data for a period of 30 days. In the event of a dispute or investigation, the Hospital may retain the relevant personal data until the dispute or investigation is fully resolved or concluded.

 

4. Disclosure and/or Transfer of Personal Data

The Hospital will keep CCTV data confidential and will not disclose or transfer such data to external parties, except for security purposes or to comply with applicable laws. The Hospital may disclose and/or transfer your personal data to the following individuals, legal entities, or agencies:

• Government and law enforcement authorities, such as courts, police officers, investigative agencies, or regulatory authorities with legal powers.
• Authorized external service providers selected appropriately, such as security system providers, domestic cloud service providers, or technical service providers involved in the installation and maintenance of CCTV systems. The Hospital will enter into contracts or data processing agreements with these service providers to ensure that your data is adequately protected.
• Contractual partners or legal representatives of the Hospital, when it is necessary to use the data to establish, exercise, or defend the Hospital’s legal rights or claims.

5. Cross-Border Transfer of Personal Data

In certain cases, the Hospital may need to transfer CCTV data to cloud service providers or data processors located outside Thailand, solely for the purpose of data storage or system maintenance. Such transfers will be carried out under the following conditions:

• The Hospital will transfer data only to countries that provide an adequate level of personal data protection as required under Thai law; or
• If the destination country does not provide an adequate level of data protection, the Hospital will enter into data protection agreements with the foreign recipient to ensure that your personal data is protected to a standard equivalent to that required under Thai law.

 

6. Security Measures

The Hospital implements technical, organizational, and physical measures to prevent unauthorized access to, use, alteration, or disclosure of CCTV data. Such measures include restricting access to authorized personnel only, storing data in systems protected by passwords and security controls, and regularly monitoring and reviewing these security measures.


7. Your Rights as a Data Subject

As a data subject, you have the following rights with respect to your personal data held by the Hospital, to the extent permitted by law:

•  To withdraw your consent for the collection, use, or disclosure of your personal data.
•  To request access to, or copies of, your personal data, or to request disclosure regarding how your personal data was obtained.
•  To request the transfer of your personal data to another person or organization.
•  To object to the collection, use, or disclosure of your personal data.
• To request the erasure, deletion, or anonymization of your personal data.
• To request the restriction of the collection, use, or disclosure of your personal data.
• To request the correction of your personal data to ensure it is accurate, up-to-date, complete, and not misleading.

​
8. Contact Us

Bumrungrad Hospital Public Company Limited
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
Phone            +66 2011 2555
Email:             [email protected]
 
Data Protection Officer (DPO)
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
Email:             [email protected]
 

Privacy Notice for Meetings, Seminars, and Activities
of
Bumrungrad Hospital Public Company Limited and Its Affiliated Companies

 

1. Definitions

 

2. Personal Data Collected by the Company

2.1 General Personal Data
 

1) Personal Information, e.g., title, rank, position, first name, last name, age, date of birth, gender, photograph, nationality, national identification number, passport number, signature, and other related information.

2) Contact Information, e.g., address, telephone number, email address, social media account information, or other communication channels.

3) Organization and Professional Information, e.g., organization name, department, position, professional field, professional license number, and other related information.

4) Registration and Participation Information, e.g., registration information, participant category, participation history, attendance confirmation information, venue access records, survey responses, and other information related to the Activities.

5) Information Appearing on Relevant Legal Documents, e.g., copies of national identification cards, passports, employment certificates, powers of attorney, driver's licenses, government official identification cards, certificates of name and/or surname change, and other related information or documents.

6) Financial Information, e.g., registration fee payment information, receipt details, taxpayer identification number, bank account details, billing and payment information, and other related information.

7) Public Relations, Marketing and Relationship Management Information, e.g., subscriptions to newsletters and public relations materials, promotion registrations, participation in marketing activities, seminar registrations, membership programs, privilege programs, survey responses, and other related information.

8) Electronic System Usage Information, e.g., username, login information, IP Address, Cookie ID, Device ID, Log Data, Browser Type, and information relating to the use of websites, applications, or online registration systems.

9) Other Information, e.g., audio recordings, photographs, video recordings, CCTV footage, security-related information, and access records relating to event venues.

 

3. Source of Your Personal Data

 

4. Purposes and Legal Bases

4.1 The Company will process your personal data based on legal bases as provided below:
 

1) To process your requests prior to participation in the Activities and to perform a contract (if any), including registration, identity verification, administration of participation in the Activities, preparation of documents, meals, souvenirs, facilities, or related services, communications relating to the Activities, payment processing, issuance of receipts and tax-related documents, and any other activities related to the organization and management of the Activities.

2) For the Company's legitimate interests, including relationship management with Activity participants, business partners, sponsors, and other relevant parties; preparation of statistics; analysis, evaluation, and improvement of the quality of the Activities; protection of the safety and security of premises, personnel, assets, and participants; as well as public relations, corporate communications, and the publication of photographs, video recordings, or information relating to the Activities through the Company's website, social media channels, annual reports, or other media.

3) To comply with applicable laws, regulations, orders, or requirements of competent governmental authorities, including the collection of Personal Data as required by law, disclosure or submission of Personal Data to governmental authorities as required by law, compliance with legal provisions, regulations, lawful orders, and court orders.

4) Where consent is required by law, or where the Company elects to rely on consent as a legal basis, the Company may process your Personal Data for purposes such as sending news, information about Activities, promotions, privileges, marketing communications relating to the Company's products and services, or for other purposes of which you have been informed and to which you have provided your consent.

1) Where the Company has obtained your explicit consent, to provide facilities, meals, or services that are appropriate for your specific requirements, as well as for other purposes that have been notified to you and for which your explicit consent has been obtained.

2) To prevent or suppress danger to a person's life, body, or health, including the provision of assistance in emergency situations.

3) To comply with applicable laws, regulations, orders, or requirements of competent governmental authorities, where such processing is required or permitted by law.

 

5. Disclosure of Personal Data

 

6. Cross-Border Transfer of Personal Data

 

7. Retention Periods

 

8. Security Measures

 

9. Data Subject Right

9.1 Under the Personal Data Protection Law, you have the following rights:
 

1) Right to Withdraw Consent: You have the right to withdraw your consent to the collection, use, or disclosure of your personal data at any time, unless such withdrawal is restricted by law or contractual obligations. The withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal.

2) Right of Access: You have the right to request access to and obtain a copy of your personal data in the possession of the Company, as well as to request disclosure of how such personal data was obtained where you did not provide the data directly to the Company.

3) Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format and to request that the Company transfer such data to another data controller where technically feasible and permitted by law. (The Company may charge a reasonable fee permitted by law and based on actual costs incurred.)

4) Right to Object: You have the right to object to the collection, use, or disclosure of your personal data in circumstances prescribed by law. The Company may reject your request where there are legitimate grounds for processing as permitted by law.

5) Right to Erasure: You have the right to request the deletion, destruction, or anonymization of your personal data in circumstances prescribed by applicable law.

6) Right to Restriction of Processing: You have the right to request that the Company temporarily suspend the processing of your personal data in circumstances prescribed by applicable law.

7) Right to Rectification: You have the right to request that the Company correct, update, complete, or rectify your personal data to ensure that such data is accurate, current, complete, and not misleading.

8) Right to Lodge a Complaint: If you have concerns regarding the Company's processing of your personal data and believe that such processing may affect your rights under applicable data protection laws, you have the right to lodge a complaint with the Personal Data Protection Committee or any competent authority as prescribed by law.
 

 

10. Privacy Notice Updates

 

11. Contact Us

 
BUMRUNGRAD HOSPITAL PUBLIC COMPANY LIMITED
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
 
Data Protection Officer
33 Sukhumvit Soi 3 (Nana Nua), Sukhumvit Road, Khlong Toei Nua, Vadhana, Bangkok 10110
Email: [email protected]