Phuket PAO Hospital

1. Collection of Personal Data

The hospital collects your personal data only as necessary. This includes cases where you provide data to the hospital directly, whether to request services through the hospital's website or any other channel — such as doctor appointments, online registration, or newsletter subscription — as well as offline transactions such as patient registration at the hospital's registration counter.

In addition, the hospital may receive your personal data from third parties, such as your family members or persons close to you, hospitals or agencies in the hospital's network — including the hospital's agents or service providers — or government agencies, in cases where you have given consent to such disclosure or where disclosure is required by law.

2. Personal Data Collected

The types of personal data the hospital collects depend on the purpose of collection. The personal data collected directly from you or from third parties includes the following:

1. Identification data, such as name, surname, photograph, gender, date of birth, passport, national ID card number, or other identifying numbers
2. Contact data, such as address, telephone number, and email
3. Service data, such as doctor appointment information, personal data of relatives, room preferences, and other additional services
4. Newsletter subscription and marketing activity data, such as seminar registration and promotion sign-ups
5. Statistical data, such as patient numbers and website visits
6. Data from your use of the hospital's website, such as IP address, cookies, and online doctor appointments
7. Health data, reports relating to your physical and mental health, your healthcare, laboratory test results, and diagnoses
8. Data relating to your medication use and drug allergies
9. Opinions, feedback, and treatment outcomes you provide

2.1 Website Visit Statistics (Web Analytics)

When you visit the website, the system automatically records visit data for analysis and service improvement, including:

• The visitor's IP address
• Approximate location (country/province/city) derived from the IP address
• Pages visited, date and time of visit, referrer, and browser information (User-Agent)
• Pageviews and unique visitors

Legal basis: Legitimate interest, for statistical analysis and website improvement.

Disclosure to third parties: IP addresses are sent to an approximate geolocation service provider (ip-api.com) solely for conversion into geographic location data; no other personal data is transmitted.

Retention period and access: Visit logs are retained for no more than 180 days and are then deleted automatically. Anonymized summary statistics may be retained on an ongoing basis for statistical comparison. Access is restricted to authorized system administrators only.

3. Purposes of Collecting, Using, or Disclosing Personal Data

The hospital collects, uses, or discloses your personal data based on your consent, the performance of a contract between us, or otherwise for the hospital's legitimate interests, for the following purposes:

3.1 Medical service purposes, including:

• Providing or delivering the hospital's services and your access to services, whether online or offline
• Doctor appointments, sending news, and recommending hospital services
• Coordinating and transferring data to network hospitals and other healthcare facilities to expedite patient referrals
• Patient identity verification
• Sending doctor appointment reminders or offers of assistance from the hospital
• Accounting or financial purposes, such as payment verification, billing, and refunds
• Maintaining safety and security, including your safety during hospital stays
• Compliance with hospital regulations
• Compliance with laws, regulations, rules, or requests from government agencies
• Other purposes supporting the above, or as consented to by you from time to time

3.2 Public relations and communication purposes

Used/disclosed only after obtaining your consent, including:

• Offering benefits to members of hospital programs or clubs
• Public relations and communication with patients, such as sending information about promotions and services, including from cooperating agencies
• Satisfaction surveys, opinion research, and statistical analysis to improve or develop services
• Communicating with you and responding to questions or complaints relating to the use of services

4. Persons/Entities to Whom Personal Data May Be Disclosed

1. Network hospitals and cooperating healthcare agencies
2. The hospital's agents/service providers, such as information technology service providers
3. Related organizations, such as insurance companies, loyalty programs, and entities involved in service provision
4. Banks/payment service providers
5. Security officers or security agencies
6. Immigration/customs authorities
7. Government and regulatory agencies as permitted or required by law

5. Retention Period of Personal Data

1. Data is retained only as long as necessary to fulfill the purpose of each data type
2. After that period, data will be deleted/destroyed according to the processes and timeframes set out in the hospital's policy and applicable laws

6. Rights of the Data Subject

To exercise your rights, please contact the Data Protection Officer under Section 8 to submit a request, as follows:

1. Request access to, a copy of, or portability of your own personal data
2. Object to or suspend processing
3. Request correction of inaccurate/incomplete data, or deletion/destruction/disclosure of the data's source in certain cases
4. Lodge a complaint with the Personal Data Protection Committee if data is used/disclosed contrary to your consent or the law
5. Withdraw consent at any time while the data is held by the hospital (except where rights are restricted by law or contract)

Withdrawal of consent may result in insufficient data to provide the services you require and may affect your convenience in receiving services.

7. Security Measures

The hospital applies technical and organizational measures in accordance with personal data protection law, restricts access rights, and protects data against unauthorized loss, access, use, modification, alteration, or disclosure.

8. Contact

9. Changes to this Privacy Policy

This policy may be updated to reflect changes, such as changes in applicable law. Updates will be announced through appropriate channels.