Privacy Policy

Who we are

The data controller is:

• Healthcare facility licence: ฆสพ. ๒๘ / ๒๕๖๕

• Address: 7/2-3 Changloa Road, Haiya, Mueang Chiang Mai, Chiang Mai 50100, Thailand

• Phone: +66 53 200 201 · WhatsApp: +66 91 797 7888 · LINE: @kitchaclinic

• Privacy matters: [email protected]

• Appointments: [email protected]

• Opening hours: daily 09:00–20:00 (Thailand time, GMT+7); closed 31 December, 1 January and 13–15 April

We have not appointed a Data Protection Officer. Please send privacy questions and requests to [email protected].

What personal data we collect

2.1 Information you give us when you contact us

You do not have to give us any information. If you do not give us a way to contact you, we cannot reply to your request or arrange an appointment.

2.2 Information we collect at the clinic and during treatment

• Registration

  Details such as your name, date of birth, nationality, ID card or passport number, address, phone numbers and email address, and insurance details if you use insurance.

• Health and treatment

  Information such as your medical history, medicines and allergies, dental examination findings, diagnoses, treatment plans and the treatment you receive, notes written by our dentists and staff, consent forms, prescriptions and lab orders.

• Images and scans

  X-rays (including 3D CBCT scans), intraoral scans and digital models, and clinical photos and videos of your teeth and face taken for diagnosis, treatment planning and records.

• Appointments and payments

  Your appointments, attendance, invoices, receipts and payments.

• CCTV

  Images of you when you are in areas of the clinic covered by CCTV cameras (section 15).

2.3 Information collected automatically when you use the website

• Technical data

  Your IP address, browser and device type (user agent), the pages you visit and the time of your visit. This is seen by our hosting provider and by Cloudflare (our network and security provider), and is recorded with each form submission.

• Form submission details

  When you send a form we record the page you sent it from, the date and time, your IP address and browser type, and the treatment you selected on our homepage.

• How you found us

  Our website notes how you arrived (for example from a Google ad and the name of the ad campaign, Google search, Facebook/Instagram, LINE or another website) and the first page you opened on our site. If you send a form, this is added to your enquiry so that we know which channels bring patients to us.

  • If you have not accepted statistics (analytics) cookies, this is kept only for the current browser tab and is gone when you close it.

  • If you accept statistics cookies, it is remembered in your browser for up to 90 days, so that an enquiry sent on a later visit can still show how you first found us.

• Cookies and similar technologies

  See section 6.

2.4 Information from other sources

• People acting for you

  If a family member or someone else books or asks on your behalf, they give us your name and contact details. Please make sure they have your permission.

• Insurers, agencies and other providers

  Your insurer, an insurance or medical travel agency, or a dentist or doctor who refers you may send us your details, including health information needed for your care or claim.

• Our patient system

  Our own systems copy your name, contact details and appointments from our patient record system so that staff can call you, send reminders and answer your questions.

Health information and treatment records

Information about your health — such as your symptoms, medical history, the treatment you are interested in or receive, dental photos, scans and X-rays — is sensitive personal data under section 26 of the PDPA.

• Why and on what basis we use it

  We use health information to give you dental care: to answer questions about your treatment, assess your case, plan and provide treatment, follow up after treatment, and keep your records. This is permitted by section 26(5)(a) of the PDPA (preventive medicine, medical diagnosis and the provision of health care), and our dentists and staff are bound by professional confidentiality. This applies whether you give the information through a website form, live chat, LINE, WhatsApp, Messenger, email or phone, or at the clinic.

• Why we need to know who you are

  Health information must be matched to the right person and the right record. To give advice about your own case we therefore need your name and a way to contact you. If you prefer not to identify yourself, we can only give general information.

• Where your records are kept

  Your patient record, including X-rays and scans, is kept in the clinic's own patient record and imaging systems on servers at the clinic in Thailand, with backup copies on clinic-controlled storage. Clinical photos are kept in the clinic's photo system, which stores the photo files in the clinic's Google Workspace storage. Access is limited to authorised dentists and staff, and access to clinical photos is logged.

• Dental laboratories

  When your treatment needs a crown, bridge, veneer, denture, aligner or similar appliance, we send the dental laboratory what it needs to make it: your name or case number, the prescription, impressions or digital scans, and photos where needed. Photos shared with a laboratory through our photo system are sent by a protected link that expires (at most 14 days) and is watermarked, and each opening is logged.

• Referrals

  If you need care that we do not provide at the clinic (for example treatment under general anaesthesia in a hospital), we send the hospital or specialist the information needed for your care, with your agreement.

• Insurance

  If you ask us to bill your insurer directly, we send the insurer what it needs for your claim (section 5).

• What we do not do

  We do not put health information into advertising or analytics tools. We do not use it for any other purpose without your explicit consent, unless the law allows or requires it.

• Please do not send us health information about another person unless you are their parent or legal guardian or have their permission.

• Health information that forms part of your patient record is kept for the period in section 8 and cannot be deleted on request before then.

Why we use your data and our legal basis

We do not sell your personal data. We do not put your form or chat details, or anything you tell us about your health, into advertising tools. We do not use remarketing, that is, we do not build advertising audiences from visitors to our website or show ads to people because they visited our treatment pages.

Who we share your data with

We share personal data only as needed for the purposes above:

• Clinic staff and dentists

  Those who need it to answer you or treat you.

• Dental laboratories

  Those that make your crowns, bridges, veneers, dentures, aligners or other appliances (section 3).

• Hospitals and specialists

  When we refer you, with your agreement (section 3).

• Insurance companies

  When you use insurance and ask us to deal with your insurer — for example April, Cigna, Allianz and International SOS, with whom the clinic arranges direct billing. We share only what the insurer needs for your claim, such as your identity, treatment details and costs. If an insurance or medical travel agency arranged your visit, we share with it only what is needed for that arrangement.

• Authorities

  When the law requires it, for example the Ministry of Public Health, courts, police or tax authorities.

• Others at your request or with your permission

  For example a person or organisation you ask us to send information to.

• Your calendar provider

  For example Apple, Google or Microsoft, if you add our appointment calendar link to your calendar (section 13). You choose this provider, and it handles your calendar under its own privacy terms.

• Service providers who process data for us

  (data processors):

  • Website hosting

    A hosting provider in Thailand stores the website and its database, including copies of form submissions.

  • Google

    Google Workspace (the clinic's email accounts appointment@ and [email protected], file storage for clinical photos, and documents used by staff); Gmail (delivers website form messages to our mailbox); Google Drive (website backups); Google Analytics, Google Ads, Google Tag Manager, Google Maps (map on our website) and Google Fonts.

  • OpenAI

    An AI service that helps staff summarise, sort and prioritise emails, chat messages and call transcripts, turns selected call recordings into text, and sorts clinical photos by view (sections 14 and 16). We send only what is needed for each task.

  • SMS provider

    An SMS gateway (911itwist) sends appointment reminders and other text messages from the clinic to your phone.

  • Meta Platforms

    Meta Pixel (advertising measurement); WhatsApp, Facebook Messenger and Instagram if you contact us there.

  • LINE

    LY Corporation, if you contact us on LINE.

  • Pancake

    Live chat on our website and the inbox we use to manage messages sent to us on LINE, Facebook Messenger, Instagram and WhatsApp.

  • Discord

    A messaging service that our staff use for internal communication, including alerts about patient messages that need attention. These internal messages may include your name and patient number (HN). The service is provided by Discord Inc., outside Thailand.

  • CleanTalk

    Anti-spam checks of form submissions (your IP address, email address, message and browser signals are checked against CleanTalk's service).

  • Cloudflare

    Content delivery network, security and cookie-less web analytics; secure remote access to some clinic systems; and, for the appointment calendar service, bot protection on the registration form (Turnstile, which processes your IP address and device information).

  • TranslatePress

    Machine translation of our own web page text. It does not receive the information you enter in forms.

  • IT and software support

    Companies that maintain our patient record, imaging and phone systems may see personal data when they fix a problem.

Cookies and similar technologies

Cookies are small files stored by your browser. We also use similar browser storage ("local storage" and "session storage"). You can choose which optional cookies to allow in our cookie banner and change your choice at any time using the cookie settings option on our website. Strictly necessary items are always on. Analytics and advertising cookies are used only if you accept them.

Until you accept, our Google tags run in Google's "consent mode" with analytics and advertising storage set to "denied": they do not set or read analytics or advertising cookies. In this mode Google may still receive limited signals without cookies (for example that a page was viewed). If you arrived from a Google ad, the ad-click identifier may be carried in the page address while you move between pages of our website, so that the visit can be measured without cookies. The Meta Pixel does not run until you accept advertising cookies.

The appointment calendar pages (connect.kitchadentalclinic.com) set no cookies of their own and use no Google, Meta or other analytics or advertising tags. They store only your language choice in your browser (kpc-lang) and use Cloudflare Turnstile to block automated abuse of the registration form. Cloudflare may set short-lived security cookies, as on our website.

When analytics or advertising tags run, the address of the page you are viewing is sent to Google or Meta. Page addresses can show the type of treatment you are reading about. We do not send your name or message content to analytics or advertising tools. If you accept advertising cookies and send a form that includes an email address, that email address may be sent to Google in a scrambled (hashed) form to measure our ads. We do not send your phone number to Google. We do not send your contact details to Meta.

You can also block or delete cookies in your browser settings, and learn more about Google's use of data at policies.google.com/technologies/partner-sites and about Meta's at facebook.com/privacy/policy.

International transfers

Our website is hosted in Thailand. Our patient record, imaging, phone and CCTV systems and our appointment calendar service run on the clinic's own servers in Thailand. Some of our service providers (including Google, OpenAI, Meta, LINE, Pancake, Discord, CleanTalk and Cloudflare), and the calendar provider you choose for our appointment calendar service, store or process data on servers outside Thailand. Some of these countries may not have data protection standards equal to Thailand's. We transfer data abroad only as permitted by sections 28–29 of the PDPA, for example:

• where it is needed to perform our contract with you or to take steps you asked for (such as replying to your message through the app you chose);

• under the providers' standard data processing terms and other appropriate safeguards; or

• with your consent (for analytics and advertising cookies), or your explicit consent (for the appointment calendar service, section 13).

How long we keep your data

When data is no longer needed, we delete or anonymise it, unless we must keep it for legal reasons or legal claims.

How we protect your data

We use reasonable technical and organisational measures, including:

• encrypted connections (HTTPS/TLS) between your browser and our website and online services;

• patient record, imaging, phone and CCTV systems that run on the clinic's own network, with access limited to authorised staff;

• clinic systems that staff use from outside the clinic protected by Cloudflare sign-in limited to clinic accounts, or available only from inside the clinic's network;

• activity logs of who opened clinical photos and of staff actions in the appointment calendar service;

• regular backups of clinic systems to clinic-controlled storage, and daily website backups stored in Google Drive;

• security and anti-spam services (Cloudflare, CleanTalk and the security tools of our hosting provider);

• for the appointment calendar service: personal calendar links and email addresses are stored only as one-way codes (hashes); the staff page can only be opened from inside the clinic's network, and every view and cancellation is logged with the staff member's name;

• confidentiality duties of our dentists and staff.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours where required by law, and tell you without delay if the risk is high.

Messages you send through WhatsApp, LINE, Messenger, Instagram or email are also governed by those services' own security and privacy terms.

Your rights under the PDPA

Under the PDPA you have the right to:

1. 1

   Withdraw consent

   At any time, as easily as you gave it — for example by changing your cookie choices.

2. 2

   Access

   Get a copy of your personal data, and ask how we obtained data you did not consent to.

3. 3

   Data portability

   Receive your data in a commonly used electronic format, or ask us to send it to another organisation where technically possible.

4. 4

   Object

   To processing based on our legitimate interests (for example CCTV or call recording), and to direct marketing at any time.

5. 5

   Erasure

   Ask us to delete, destroy or anonymise your data when there is no longer a reason to keep it.

6. 6

   Restriction

   Ask us to stop using your data for a period while a request is checked or in other cases set by law.

7. 7

   Rectification

   Ask us to correct data that is inaccurate, out of date or incomplete.

8. 8

   Complain

   To the Office of the Personal Data Protection Committee (PDPC), Thailand — www.pdpc.or.th.

Some rights have legal limits. For example, we cannot delete patient records that the law requires us to keep, and we may refuse to release CCTV images or call recordings that show other people unless they can be protected.

For the appointment calendar service you can also use the channels in section 13.

Children's personal data

Our website is meant for adults. If a patient is under 20 years of age, a parent or legal guardian should contact us and give any consent needed. For children under 10, consent must always come from the parent or legal guardian (PDPA section 20). If you believe a child has sent us personal data without permission, please contact us and we will delete it where appropriate.

For the appointment calendar service, see "Children" in section 13.

Links to other websites

Our website links to other services (for example Google Maps, WhatsApp, LINE, Facebook, Instagram and YouTube). Those services have their own privacy policies, and we are not responsible for how they handle your data.

Appointment calendar service (KDC Connect)

This section applies only if you choose to use our appointment calendar service at connect.kitchadentalclinic.com. The service is optional. Not using it does not affect your appointments or treatment.

• We use what you enter only to compare it with the details in your patient record. We do not store the email, name or date of birth you type.

• If the details match exactly one patient, the calendar link is sent only to the email address in your patient record. The page shows the same message whether or not the details match, so it does not reveal who is a patient.

• your patient number (HN), the status of your calendar link, the language you chose, and the channel you came from (for example the website, a QR code or an email from the clinic);

• one-way codes (hashes) of your calendar link and of the email address in your patient record. They cannot be turned back into the link or the email. We use them to recognise your link and to notice when the email in your record changes;

• your consent: which version of the consent text you agreed to, and when;

• the result of each identity check (matched or not, and the HN if matched);

• a record of each link email: HN, date and whether it was sent (not the email address or the message);

• when a calendar last fetched your link, how many times, and the type of calendar (Google, Apple, Microsoft or other);

• one-way codes (hashes) of IP addresses, email addresses and HNs, used only to limit repeated attempts;

• an activity log of registrations, automatic cancellations and staff actions.

The service does not save your appointments. It keeps only a temporary copy in memory, refreshed from the clinic's appointment system about every 10 minutes and never written to disk, and builds your calendar from it each time your calendar app checks the link.

• The service runs on the clinic's own server in Thailand.

• Cloudflare carries the service's internet traffic, including requests for your calendar link, and protects the registration form against automated abuse (Turnstile), which processes your IP address and device information.

• Google (Google Workspace) delivers the email with your calendar link, sent from [email protected].

• Your calendar provider (for example Apple, Google or Microsoft) fetches the appointment details and stores them in your calendar under its own privacy terms. You choose this provider.

• Authorised counter staff and the clinic owner can see the names and HNs of registered patients, only from inside the clinic's network, so that they can cancel links on request. Every view and cancellation is logged with the staff member's name.

Cloudflare, Google and your calendar provider may process data outside Thailand (section 7).

• when you register again and add the new link to a calendar;

• when the email address in your patient record changes or is removed;

• when no calendar has fetched the link for 90 days.

A new link that is not added to any calendar within 7 days expires; your existing link keeps working. Withdrawing consent does not affect your appointments or treatment, or anything done before you withdrew.

Phone calls and call recordings

CCTV

Email, SMS and chat messages

Google API Services and data use

This section explains how the clinic's own software tools access, use, store and share data that they receive from Google APIs.

More detail: KDC Web Tools privacy policy

Changes to this policy

We may update this policy when our services, systems or the law change. The "Last updated" date at the top shows the latest version. If we make significant changes, we will show a notice on the website.

This policy is available in English, Thai and Chinese. If the versions differ, the Thai version prevails.

Contact the clinic

• Kitcha Dental Clinic, 7/2-3 Changloa Road, Haiya, Mueang Chiang Mai, Chiang Mai 50100, Thailand

• Privacy matters: [email protected]

• Appointments: [email protected]

• Phone: +66 53 200 201 · WhatsApp: +66 91 797 7888 · LINE: @kitchaclinic

• Daily 09:00–20:00 (closed 31 December, 1 January and 13–15 April)