Privacy Policy
Introduction
Craft clinic is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you visit our website or use our services. We comply with the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand.
1. Data We Collect
We may collect the following types of personal data:
- Identity data: full name, date of birth, gender, ID or passport number
- Contact data: phone number, email address, LINE ID, home address
- Medical data: health history, medications, allergies, treatment records, before and after photographs
- Financial data: payment method and transaction records (we do not store full card details)
- Technical data: IP address, browser type, device information, cookies, and website usage data
- Communications: messages sent to us via LINE, email, website forms, or in person
2. How We Use Your Data
We use your personal data to:
- Provide and manage your aesthetic treatments safely
- Communicate appointment confirmations, reminders, and follow-up care instructions
- Process payments and maintain financial records
- Comply with our legal and regulatory obligations under Thai medical law
- Improve our services and website experience
- Send you relevant promotions or updates (only with your consent; you may opt out at any time)
3. Medical Data — Special Category
Your medical information is treated as sensitive personal data under the PDPA. We collect and use it solely for the purpose of providing safe clinical care. We will never sell, share, or use your medical data for marketing purposes without your explicit written consent.
4. Photography & Image Consent
Before and after photographs are collected only with your written consent. You may withdraw consent at any time by contacting us, and we will remove your images from all public-facing materials within 30 days of your request.
5. Data Sharing
We do not sell your personal data to third parties. We may share your data with:
- Trusted medical suppliers or laboratories directly involved in your care
- Payment processors (e.g. banks, payment gateway providers)
- Website and IT service providers who assist in operating our website (under strict data processing agreements)
- Regulatory authorities or law enforcement where required by law
6. Data Retention
We retain medical records for a minimum of 5 years following your last treatment, as required by Thai medical regulations. Website usage data is retained for up to 12 months. You may request deletion of non-medical personal data at any time.
7. Your Rights (PDPA)
Under the Personal Data Protection Act, you have the right to:
- Access a copy of the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal and medical retention requirements)
- Withdraw consent for marketing communications at any time
- Lodge a complaint with the Personal Data Protection Committee of Thailand
8. Cookies
Our website uses cookies to improve your browsing experience, analyse website traffic, and remember your preferences. You can control cookie settings through your browser. By continuing to use craftclinicbkk.com, you consent to our use of cookies.
9. Security
We implement appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, or loss. However, no internet transmission is completely secure, and we cannot guarantee absolute security.
10. Contact — Data Enquiries
To exercise your rights or raise a privacy concern, please contact our Data Controller:
Email:
Address:
CP Tower 3, Phaya Thai, Bangkok, Thailand