Privacy Policy
Privacy Policy
Soma Health
Last updated: 10/08/28 | Version 1.0
A note on how to read this policy
We have written this policy the same way we write our consent forms: each section opens with an IN SHORT summary in plain language, followed by the full wording. The IN SHORT text is there to help you. If there is ever a conflict between the summary and the full wording, the full wording applies.
1. Who we are
IN SHORT: Soma Health is a licensed medical clinic in Bangkok. We are responsible for the personal information we hold about you, and we have a Data Protection Officer you can contact at any time.
1.1 This Privacy Policy is issued by Soma Health, Co., Ltd., trading as Soma Health, with its registered office and clinic at 4th Floor, Erawan Bangkok, 494 Phloen Chit Rd, Lumphini, Pathum Wan, Bangkok 10330, Erawan Bangkok (“Soma Health“, “we“, “us“, “our“).
1.2 For the purposes of the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA“), Soma Health is the Data Controller in respect of the personal data described in this policy.
1.3 Our Data Protection Officer can be reached at:
- Email: [it@somahealth.com]
2. Scope of this policy
IN SHORT: This policy covers our website, our clinic, and every other way you interact with us.
2.1 This policy applies to personal data we collect:
- through this website and any Soma Health microsite, landing page, or booking form;
- when you enquire about, book, attend, or receive any consultation, assessment, treatment, programme, or membership;
- when you contact us by telephone, email, LINE, WhatsApp, or social media;
- when you attend an event, webinar, or partner activity we host or co-host;
- when you apply for a role with us or work with us as a supplier or partner; and
- when we receive information about you from a third party, as described in Section 4.
2.2 Our website may contain links to third-party sites. We are not responsible for their privacy practices, and this policy does not apply to them.
3. The information we collect
IN SHORT: We collect ordinary details like your name and contact information, and — if you become a patient — sensitive health information such as your medical history, test results, genetic and laboratory data, and clinical images. Health data receives extra protection under Thai law and we treat it accordingly.
3.1 Identity and contact information. Full name, title, date of birth, gender, nationality, passport or national ID number, photograph for identification, home and billing address, email address, telephone numbers, emergency contact and next of kin, preferred language, and messaging handles.
3.2 Financial and transactional information. Payment card details (processed by our payment providers — we do not store full card numbers), bank details for refunds, invoices, receipts, package and membership balances, insurance policy details, and claim correspondence.
3.3 Sensitive Personal Data (health and related information). Where you become a patient of Soma Health, we collect and generate:
- Clinical Information — medical, surgical, family, and lifestyle history; presenting concerns; allergies; current and past medications and supplements; physicians’ and nurses’ notes; diagnoses; treatment plans; consent records; and clinical correspondence;
- Laboratory Information — blood, urine, stool, saliva, and tissue test results; biomarker and biological-age panels; imaging and diagnostic reports;
- Genetic Information — where you undertake genetic or epigenetic testing with us;
- Biometric Information — body composition, cardiorespiratory and functional testing data, and any biometric identifiers we use;
- Service Information — the services, treatments, programmes, and products you receive, dates of attendance, and treating clinicians; and
- Clinical images — photographs, scans, and video recorded for clinical documentation and outcome tracking.
3.4 Website and technical information. IP address, device and browser type, operating system, referring URL, pages viewed, time on page, and similar analytics data collected through cookies and comparable technologies (see Section 7).
3.5 Marketing and communications data. Your preferences for receiving marketing from us, your responses to our communications, and your interactions with our social media accounts.
3.6 Recruitment data. Where you apply to work with us: CV, qualifications, references, right-to-work documentation, and interview records.
3.7 We do not knowingly collect personal data from anyone under 20 years of age other than where a patient is a minor treated with the consent of a parent or legal guardian, in accordance with Section 20 of the PDPA.
4. Where we obtain your information
IN SHORT: Mostly from you directly. Sometimes from doctors who refer you, from laboratories that test your samples, or from your insurer or employer.
We obtain personal data:
- directly from you — when you complete a form, book an appointment, attend a consultation, or contact us;
- from your representatives — a family member, personal assistant, concierge, or travel coordinator acting on your behalf;
- from referring and treating healthcare providers — hospitals, clinics, and physicians who refer you to us or to whom we refer you;
- from laboratories and diagnostic partners — including our accredited laboratory and testing partners in Thailand and overseas;
- from your insurer, employer, or corporate programme sponsor — where they are arranging or funding your care;
- from our technology providers — including our electronic medical record, booking, payment, and analytics systems; and
- from publicly available sources — for verification and anti-fraud purposes where appropriate.
5. Why we use your information, and our legal basis
IN SHORT: We use your information to give you safe, high-quality care; to run our clinic; to meet our legal obligations; and — only with your consent — to send you marketing.
Under the PDPA we must have a lawful basis for each use of your personal data. Ours are set out below.
| What we use it for | Legal basis under the PDPA |
|---|---|
| Assessing your eligibility, screening you, and deciding whether we can safely offer you a service (including declining under our “no-go” policy) | Sensitive data: explicit consent (s.26) and preventive/ occupational medicine and medical diagnosis and treatment by a health professional bound by confidentiality (s.26(5)(a)). Other data: contract (s.24(3)) |
| Providing consultations, assessments, treatments, and programmes; recording and maintaining your medical record | Explicit consent (s.26); s.26(5)(a); contract (s.24(3)); vital interests (s.24(2)) |
| Communicating with you about your appointments, results, and aftercare | Contract (s.24(3)); legitimate interests (s.24(5)) |
| Taking payment, issuing invoices and receipts, managing packages and memberships, and collecting unpaid amounts | Contract (s.24(3)); legal obligation (s.24(6)); legitimate interests (s.24(5)) |
| Submitting and supporting insurance claims and third-party payer billing on your behalf | Your consent; contract (s.24(3)) |
| Maintaining medical records for the periods required by law | Legal obligation (s.24(6)); s.26(5)(a) |
| Quality assurance, clinical audit, incident investigation, complaint handling, and improving our services | Legitimate interests (s.24(5)); explicit consent for sensitive data (s.26) |
| Managing our business — accounting, tax, insurance, IT security, and professional advice | Legal obligation (s.24(6)); legitimate interests (s.24(5)) |
| Responding to regulators, courts, and law enforcement | Legal obligation (s.24(6)) |
| Establishing, exercising, or defending legal claims | Legitimate interests (s.24(5)); s.26(5)(d) |
| Sending you newsletters, offers, and clinic updates | Your consent (s.19), which you may withdraw at any time |
| Anonymised statistics, service planning, and research | Data is anonymised so that it no longer identifies you; where it is not, we seek your separate consent |
5.2 Research. We do not use your identifiable clinical data for research, publication, or third-party studies without your separate, specific, written consent. Where we contribute to research, we use anonymised or aggregated data unless you have consented otherwise.
5.3 Marketing use of images. We never use your photographs, before-and-after images, testimonials, or case details in marketing or on social media without your separate written consent, which is distinct from your clinical consent and which you may withdraw at any time.
6. Sensitive Personal Data and consent
IN SHORT: Health, genetic, and biometric data are “sensitive” under Thai law. We ask for your explicit consent before collecting them, and you can withdraw that consent.
6.1 Health, genetic, biometric, racial or ethnic origin, and religious data are Sensitive Personal Data under Section 26 of the PDPA. We collect and use them on the basis of your explicit consent, given through our Patient Consent Form, and on the further bases set out in Section 5.
6.2 You may withdraw your consent at any time by writing to our Data Protection Officer. Withdrawal takes effect prospectively — it does not affect processing already carried out lawfully, and it does not require us to delete records we are legally obliged to retain (see Section 11). We will tell you if withdrawing consent means we can no longer provide a particular service.
7. Cookies and website analytics
IN SHORT: Our website uses cookies. Only the strictly necessary ones run automatically; everything else needs your permission, which you can change at any time.
7.1 We use the following categories of cookies:
- Strictly necessary — required for the site to function, including security and session management. These do not require consent.
- Functional — remember your preferences, such as language.
- Analytics — help us understand how visitors use the site (currently: [Google Analytics 4 / other — confirm]).
- Marketing and advertising — used to measure campaigns and show relevant advertising (currently: [Meta Pixel / Google Ads / LINE — confirm]).
7.2 When you first visit our website you will see a cookie banner allowing you to accept or reject non-essential categories. You can change your choices at any time via [link to Cookie Settings] or through your browser settings.
7.3 We do not use website analytics or advertising cookies to infer or target based on your health conditions.
8. Who we share your information with
IN SHORT: We share your information only where it is necessary, and — for the categories in your consent form — only with the people you have ticked.
8.1 Within Soma Health. With the clinicians, nurses, technicians, and administrative staff involved in your care or in the administration of your account, on a need-to-know basis. All staff are bound by confidentiality obligations.
8.2 Categories you have authorised. Where you have indicated your consent in our Patient Consent Form, we may disclose your information — only to the extent necessary for the stated purpose — to:
- your family members;
- your employer, for medical certificates or insurance support;
- hospitals or medical departments to whom you are referred for further care;
- your embassy or consulate, for travel, repatriation, or consular assistance;
- your life, health, or travel insurance company; and
- any other person or entity you have specified in writing.
You may add or remove any of these categories at any time by writing to our Data Protection Officer.
8.3 Service providers and processors. We use carefully selected providers who process data on our instructions under written data processing agreements, including:
- our electronic medical record and clinic management system;
- laboratory, diagnostic, imaging, and pathology partners;
- pharmacy and specialist product suppliers;
- payment processors, banks, and insurance claim administrators;
- cloud hosting, email, collaboration, and IT support providers;
- accounting, audit, tax, legal, and insurance advisers; and
- website, CRM, and communications platforms.
8.4 Health Information Exchange (HIE). We participate in, or may in future participate in, secure Health Information Exchange arrangements that allow clinical information to be shared electronically between your treating clinicians and authorised healthcare providers. HIE systems may also allow emergency medical personnel to access clinically relevant information about you where this is necessary in an emergency. Participation is subject to the consent you give in our Patient Consent Form and to the security requirements of the relevant HIE operator. [Confirm the specific HIE(s) — e.g. Health Link operated by the Digital Government Development Agency — before publication.]
8.5 Legal and regulatory disclosures. To regulators including the Ministry of Public Health, the Medical Council of Thailand, the Thai FDA, the Personal Data Protection Committee, tax authorities, courts, and law enforcement, where required or permitted by law.
8.6 Business transactions. To a prospective purchaser, investor, or successor in the event of a reorganisation, merger, or sale of all or part of our business, subject to appropriate confidentiality protections.
8.7 We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
9. Transfers outside Thailand
IN SHORT: Some of your information may be sent abroad — for example to our Swedish cell-therapy partner or to cloud services hosted overseas. We only do this with proper legal safeguards in place.
9.1 Your personal data may be transferred to, or accessed from, countries outside Thailand, including:
- Sweden and the European Economic Area — in connection with our partnership with Cellcolabs AB, including product traceability, pharmacovigilance, and quality obligations;
- Malaysia — where you receive services from, or are referred to, Soma Health Malaysia;
- Singapore, the United States, and other jurisdictions — where our cloud, laboratory, or software providers host or process data.
9.2 We make such transfers in accordance with Sections 28 and 29 of the PDPA and the Personal Data Protection Committee’s notifications of 25 December 2023 (in force 24 March 2024), relying on one or more of: transfer to a destination with adequate data protection standards; standard contractual clauses; binding corporate rules; your explicit consent after being informed of the risks; necessity for the performance of a contract; or necessity to prevent danger to life, body, or health.
9.3 Where data is transferred to or from Malaysia, we also comply with the cross-border transfer requirements of the Malaysian PDPA and the Personal Data Protection Guidelines No. 03/2025 on Cross-Border Personal Data Transfer.
9.4 You may request details of the safeguards applied to a particular transfer by contacting our Data Protection Officer.
10. How we protect your information
IN SHORT: We use technical and organisational security measures appropriate to the sensitivity of medical data, and we require the same of our suppliers.
10.1 We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These include access controls and role-based permissions, encryption in transit and at rest, multi-factor authentication, audit logging, secure storage of paper records, staff confidentiality undertakings and training, vendor due diligence, and incident response procedures.
10.2 No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours of becoming aware of it where required by Section 37(4) of the PDPA, and will notify you where the breach is likely to result in a high risk to you. Where the Malaysian PDPA applies, we will notify the Malaysian Personal Data Protection Commissioner and affected individuals in accordance with Section 12B of that Act.
11. How long we keep your information
IN SHORT: Medical records are kept for at least 20 years. Other records are kept only as long as we need them.
11.1 Medical records. We retain your Clinical, Laboratory, Genetic, Service, and related information for a minimum period of 20 years from the date of your last service, in both paper and electronic form. This period reflects the consent you give in our Patient Consent Form, our obligations under the Sanatorium Act B.E. 2541 (1998) and associated regulations, the long-term follow-up expected in regenerative and longevity medicine, and the periods during which claims may be brought against us.
11.2 Financial and tax records. Retained for at least 10 years, as required by Thai accounting and revenue legislation.
11.3 Marketing data. Retained until you withdraw consent or opt out, and then only as a suppression record so that we do not contact you again.
11.4 Website and analytics data. Retained for up to [26 months].
11.5 Recruitment data. Retained for [12 months] after the conclusion of the recruitment process unless you consent to us keeping it longer.
11.6 At the end of the applicable period we securely destroy, delete, or irreversibly anonymise the data.
12. Your rights
IN SHORT: You have the right to see, correct, move, restrict, object to, and in some cases delete the information we hold about you. Contact our Data Protection Officer and we will respond within 30 days.
Subject to the conditions and exemptions in the PDPA, you have the right to:
| Right | What it means |
|---|---|
| Access (s.30) | Obtain confirmation of whether we hold data about you, and a copy of it |
| Portability (s.31) | Receive certain data in a machine-readable format, or have it sent to another controller where technically feasible |
| Object (s.32) | Object to processing carried out on the basis of legitimate interests, public task, or for direct marketing |
| Erasure (s.33) | Ask us to delete or anonymise data where it is no longer necessary, where you withdraw consent, or where processing is unlawful |
| Restriction (s.34) | Ask us to suspend use of your data in defined circumstances |
| Rectification (s.35) | Have inaccurate or incomplete data corrected or updated |
| Withdraw consent (s.19) | Withdraw consent at any time, with prospective effect |
| Complain (s.73) | Lodge a complaint with the Personal Data Protection Committee |
12.2 Limits on these rights. Some rights are qualified. In particular, we may be unable to delete clinical records that we are legally required to retain, or that we need to defend a legal claim. Under Section 33 of the PDPA a clinical entry that has been made cannot simply be erased on request; where a record is factually inaccurate we will correct it and, where appropriate, add an annotation recording your disagreement. We will always explain our reasoning if we cannot fully meet a request.
12.3 How to exercise your rights. Write to our Data Protection Officer at [dpo@somahealth.com]. We may ask you to verify your identity. We will respond within 30 days of receiving a valid request, and will tell you if we need longer.
12.4 Complaints. We would like the chance to resolve any concern first. If you remain dissatisfied you may complain to:
- Office of the Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society — www.pdpc.or.th
- Personal Data Protection Department (JPDP), Malaysia — www.pdp.gov.my, in respect of data processed in Malaysia.
13. Automated decision-making
IN SHORT: No machine decides your treatment. Clinical decisions are always made by a qualified clinician.
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Where we use software tools to support risk scoring, biological-age calculation, or clinical decision support, the output is reviewed and interpreted by a qualified clinician before any decision affecting you is taken.
14. Changes to this policy
We may update this policy from time to time. The current version is always available at [URL] and is dated at the top. Where a change materially affects how we use your personal data, we will notify you directly — by email or at your next visit — and, where required, seek fresh consent.
This policy should be read together with our [Terms and Conditions] and the Patient Consent Form you sign before treatment.