1. Data controller
Mongkhondee Clinic is the data controller for the clinic's services. Our contact details and address appear at the end of this notice.
2. Categories of personal data
- Identity and contact details
- Appointment, payment, treatment entitlement and supporting documents
- Health data: symptoms, treatment history, test results, medication and other medical record information
- Contact through the website, phone, email, LINE and social media
- Technical and security data from using our systems
3. Legal basis and purposes
We process data on the legal basis appropriate to each case: performing a contract or your request, complying with the law, preventing or suppressing danger to life, body or health, legitimate interests, and consent where required.
Health data is sensitive personal data. We use it only as far as needed for diagnosis, treatment, managing health services, protecting vital interests, or other cases the law permits.
4. Sources, recipients and transfers
Data may come from you, your legal representative or carer, or health providers and organisations you authorise. It may be shared only as necessary with medical staff, laboratories, system processors, relevant contractors or government agencies as required by law. Any transfer abroad follows the conditions set by law.
5. Retention
Data is kept for as long as needed for treatment, operations, establishing or defending legal claims, and the periods required by law or professional standards. When no longer needed, it is deleted, destroyed or anonymised as appropriate.
6. Your rights
- Access and obtain a copy of your data, or have it transferred where the conditions are met
- Have inaccurate data corrected; request erasure, restriction or object to processing
- Withdraw consent, without affecting processing that was lawful before withdrawal
- Lodge a complaint with the Personal Data Protection Committee office
7. Exercising your rights
Contact the clinic stating the right you wish to exercise and information to verify your identity. We will consider and respond within the legal time frame. Some requests may be limited where the clinic has a legal duty or a lawful ground to refuse.
