PRIVACY POLICY

Effective date: 19 October 2026

At Ponsarin Clinic, we respect your privacy and are committed to handling your personal information with care, confidentiality and transparency.

As a doctor-led aesthetic and medical clinic located in Chiang Mai, Thailand, we understand the importance of protecting personal information, particularly information relating to your health and medical history.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact our clinic or receive our services. It describes our practices; reading this notice or providing information does not, by itself, constitute consent to optional analytics, advertising or unrelated uses of your information.

1. Information We Collect

We may collect personal information when you contact our clinic, request an appointment, complete a medical history form or receive our treatments and services.

Personal and contact information

  • Full name.

  • Email address.

  • Telephone number.

  • Preferred communication platform.

  • Appointment details and treatment enquiries.

Medical and health information

To provide appropriate medical and aesthetic services, we may collect:

  • Medical history and existing health conditions.

  • Allergies and medication history.

  • Previous aesthetic or medical treatments.

  • Relevant health information required for treatment assessment.

  • Treatment records and consultation notes.

Medical information is collected to support treatment assessment, patient safety and continuity of care. We do not routinely collect patient photographs as part of our standard medical history process.

Website usage information

When you visit our website, technical and usage information may be collected, including your IP address, browser and device information, timestamps, referral information, pages visited and website interactions. Cookie and advertising identifiers may also be involved, depending on the technology and your choices. Section 8 explains our analytics, advertising technologies and cookie controls.

2. How We Collect Your Information

Direct communication

When you contact Ponsarin Clinic through WhatsApp, LINE, email, Facebook Messenger, Instagram Direct Messages or WeChat.

Medical history forms

Before receiving certain treatments, you may be asked to complete a medical history form through Google Forms. This helps our medical team assess your suitability for treatment and identify relevant health considerations.

In-clinic consultations

Additional personal and medical information may be collected during consultations and treatment appointments.

Website technology

Our website is hosted on Squarespace. Website usage information may be processed through Squarespace Analytics, including its currently enabled Activity Log, Meta Pixel and the active Conversions API connection, as described in section 8.

3. How We Use Your Personal Information

We may use personal information to:

  • Respond to enquiries and provide information about our services.

  • Arrange, confirm and manage appointments.

  • Conduct medical consultations and treatment assessments.

  • Maintain patient records and treatment histories.

  • Provide appropriate aftercare and follow-up communication.

  • Manage customer relationships and improve our services.

  • Send promotional information, special offers and clinic updates where permitted.

  • Maintain website functionality and understand website performance.

  • Measure the effectiveness of advertising where permitted.

  • Comply with applicable legal and regulatory obligations.

We process personal information only where an appropriate legal basis applies. Where consent is required, we request it for the relevant purpose. Consent for optional website analytics or advertising is separate from consent for medical care and from consent to receive direct marketing messages.

4. Medical Information and Patient Confidentiality

Your medical information is particularly sensitive and is handled with appropriate confidentiality.

Medical history and treatment-related information may be accessed by authorised medical professionals and clinic personnel who require it to provide or support your care.

We use medical information for treatment assessment, patient safety, treatment planning, medical record management and appropriate follow-up care.

We do not use your medical history for promotional purposes without obtaining any consent required by applicable law. We do not disclose your medical information to unrelated third parties for their independent marketing purposes. These statements do not mean that consent permits disclosure of health information to advertising platforms where their terms prohibit it; the Meta restrictions described in section 8 continue to apply.

Where required by law, we obtain explicit consent for processing sensitive personal information, including health information, unless another lawful exception applies.

5. Appointment and Communication Platforms

Our website provides direct links to external communication platforms, including WhatsApp, LINE, email, Facebook Messenger, Instagram Direct Messages and WeChat.

When you contact us through one of these platforms, the service provider may also process your information under its own privacy policy. Our website's cookie controls do not control activity within those external platforms.

We encourage you to avoid sending unnecessary sensitive medical information through general messaging services. Where detailed medical information is required, our team may direct you to an appropriate medical history form or ask you to provide it during your consultation.

6. Google Forms and Medical History Records

Ponsarin Clinic uses Google Forms to collect medical history information from patients. Information submitted through these forms may be processed and stored using Google's services.

Access is intended to be limited to authorised personnel who require the information for legitimate clinical or administrative purposes. Google may process or store information outside Thailand; section 10 addresses international transfers.

For information about Google's processing, see Google's Privacy Policy.

We encourage patients to provide accurate and complete medical information to support appropriate treatment assessment and patient safety.

7. Marketing Communications

We may send information about treatments, clinic updates, special offers and promotional activities through email, WhatsApp, LINE or other communication channels. We obtain consent for marketing communications where required by applicable law.

You may withdraw consent to receive promotional communications at any time by contacting us through your preferred communication channel or emailing info@ponsarinclinic.com.

Withdrawing marketing consent does not affect necessary appointment confirmations, treatment-related communications or other processing supported by an appropriate legal basis. Changing website cookie preferences is separate from unsubscribing from direct marketing messages.

We do not sell personal information to third parties for their marketing purposes.

8. Cookies, Website Analytics and Advertising Measurement

Our website uses cookies and similar technologies. Cookies are small data files that may be stored on your device. Different technologies support necessary functions, analytics and advertising measurement.

Necessary cookies

Necessary cookies support core website functionality, security and remembering your cookie choices. These remain enabled.

Performance and Analytics

Squarespace Analytics helps us understand website traffic, referral sources, page visits and general website use. Our Squarespace Activity Log is currently enabled. It provides a separate view of recent individual visits and related technical information, including IP addresses, approximate locations and referrers, alongside aggregate traffic reports.

Cookie preferences concern optional analytics and advertising technologies. They are separate from necessary hosting and security processing and do not replace the information about our enabled Activity Log provided here. Declining optional cookies should not be understood as stopping all personal-data processing.

Advertising measurement through Meta

Our website uses Meta Pixel, and our Meta dataset has an active Conversions API connection. Pixel enables collection of website events from the browser, while Conversions API enables website events to be sent through a server connection. We use these technologies for advertising measurement.

Depending on the event and integration, information shared with Meta may include page or event information, timestamps, browser or device information, IP addresses and cookie or advertising identifiers. Meta may associate information it receives with information it holds and use it for measurement, personalisation and advertising purposes under its applicable terms and privacy policy.

A page visit or contact-button click does not establish that a message was sent or an appointment confirmed.

Your cookie choices

Our cookie controls are configured as opt-in and are designed to record and manage your preferences for optional Performance and Analytics and Advertising cookies and similar technologies.

You can select Accept all, Decline all or Manage cookies. You can choose analytics and advertising separately. To change your choices or withdraw optional-cookie consent later, select Cookie Preferences on the website and save your new choices.

Your choices specify which optional analytics and advertising purposes you agree to. The controls are designed to manage those preferences; they are not a general switch for every use of personal information described in this policy.

Preferences relate to the browser and device you use. You may need to make your choices again on another browser or device or after clearing browser storage. Declining optional cookies does not prevent browsing our public pages or using our contact links.

For Meta's own advertising choices, see Meta's advertising preferences guidance. These controls are separate from our website's cookie choices.

Health information and restricted advertising uses

Cookie consent does not authorise sending medical histories, message contents, treatment details or other prohibited health information to Meta. It does not remove Meta's Health & Wellness restrictions. Event names, conversion rules and audience criteria must not reflect or imply prohibited health information. Any advertising measurement or audience use must remain within applicable law and Meta's permitted uses.

For further provider information, see Squarespace's cookie information, Meta's Privacy Policy and Meta's Business Tools Terms.

9. Sharing Your Personal Information

We may share personal information with service providers where necessary to operate our clinic, maintain our website, communicate with patients or provide our services. Recipients may include:

  • Squarespace, for website hosting, analytics and related services.

  • Google, for medical history forms and related storage.

  • Communication platforms used to manage enquiries and appointments.

  • Meta, for website event processing through Pixel and Conversions API, as described in section 8.

  • Other providers supporting our clinic's operations.

Website event sharing with Meta is separate from messages you choose to send through Meta's messaging services. Optional-cookie choices are not consent to disclose patient records or medical information for advertising.

Where appropriate, we require service providers to handle personal information in accordance with applicable data-protection requirements. A provider may also process information for purposes described in its own terms and privacy policy. We remain responsible for our own collection, use and disclosure of personal information.

We may disclose information where required by law, regulatory obligations or lawful requests from relevant authorities. We do not sell patient information to third parties.

10. International Data Transfers

Some third-party services used by Ponsarin Clinic may process or store personal information outside Thailand. These include website hosting and analytics, cloud storage, medical history forms, communication platforms and advertising measurement services, including Squarespace, Google and Meta.

Where personal information is transferred internationally, we will take the steps required by applicable data-protection laws to ensure that transfers are conducted on an appropriate legal basis and with applicable safeguards.

A provider's privacy policy may explain its international processing in more detail. Transfers involving medical history or other health information are also subject to the additional requirements applicable to sensitive personal information. Consent to website cookies is separate from any consent or other legal basis applicable to clinical records and their international transfer, and does not authorise otherwise prohibited health-data disclosures.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, managing appointments, maintaining patient records and meeting applicable legal obligations. Medical records may be retained for periods required by applicable medical and healthcare regulations.

Where personal information under our control is no longer required and there is no legal obligation or other lawful basis to retain it, we will take appropriate steps to securely delete, destroy or anonymise it.

Website, analytics and advertising information does not have one universal retention period. Retention depends on the category of information, purpose, provider settings and terms, and applicable requirements. In particular:

  • Cookies: Squarespace publishes different lifetimes for different cookies in its cookie information. A cookie's expiry is not a deletion deadline for information already received by a provider.

  • Squarespace Activity Log: Our Activity Log is currently enabled. Squarespace documents a rolling seven-day window for individual visits shown in the Activity Log. This window is separate from aggregate analytics reporting and does not establish a seven-day deletion period for all analytics, hosting records or backups.

  • Meta Event Data: Subject to its Business Tools Terms, section 4, Meta states that it may retain Event Data for up to two years. This provider-level period is not a retention setting selected by our clinic and does not describe every category of information Meta holds; other categories are subject to the applicable Meta terms and policies.

Withdrawing consent does not automatically erase information already lawfully processed. You can contact us to request deletion or exercise other applicable rights concerning information we control. Providers' processing is also subject to their applicable policies and rights procedures. We do not promise a deletion period that has not been confirmed for the relevant category of information.

12. Data Security

We take reasonable organisational and technical measures to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.

Access to personal and medical information is intended to be restricted to authorised personnel who require it for legitimate clinical or administrative purposes. However, no method of electronic transmission or digital storage can be guaranteed to be completely secure.

Please contact us if you have concerns about the security or confidentiality of your personal information.

13. Your Privacy Rights

Subject to applicable law, including Thailand's Personal Data Protection Act (PDPA), you may have the right to:

  • Request access to your personal information.

  • Request correction of inaccurate or incomplete information.

  • Request deletion in circumstances permitted by law.

  • Withdraw consent where processing is based on consent.

  • Object to certain processing activities.

  • Request restriction of processing in applicable circumstances.

  • Request transfer of your personal information where legally applicable.

  • Lodge a complaint with the relevant data-protection authority.

For optional website cookies, use Cookie Preferences to change or withdraw your choices. For other personal-data requests, contact info@ponsarinclinic.com.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing supported by another applicable legal basis. Certain requests may be subject to legal obligations, including medical-record retention requirements.

Health information is subject to additional protection under the PDPA. Consent for optional cookies is not consent for medical treatment or unrestricted health-data disclosure.

14. Third-Party Websites

Our website may link to external websites, communication platforms and other services. They operate independently and may have their own privacy policies and controls. Please review their policies before providing personal information.

These external policies do not replace our responsibilities for processing that we control. Our website's cookie preferences do not control your activity after you leave our website for an external service.

15. Changes to This Privacy Policy

We may update this policy to reflect changes in our services, website functionality, processing practices or applicable requirements. Updates will be published on this page with a revised effective date. Where required, we will provide further notice or request consent for a new purpose.

16. Contact Us

If you have questions about this policy, how your information is handled or how to exercise your privacy rights, contact:

Legal operator: Pornsarin Prateepchinda, operating Ponsarin Clinic as an individual business.
162/2 Chang Khlan Road, Mueang Chiang Mai, Chiang Mai 50100, Thailand
Official contact for privacy and personal-data requests: info@ponsarinclinic.com
Telephone / WhatsApp: +66 84 249 8294
LINE Official Account: Ponsarin Clinic — @jmz4414k

Our team will respond as soon as reasonably practicable, subject to any response periods required by applicable law.