Petcharavej Hospital Privacy Notice
The hospital will collect personal data with clear objectives, scope, and methods that comply with the law and are fair. In collecting data, it will be done only to the extent necessary for the hospital’s operations and only for the hospital’s stated purposes. Furthermore, the hospital will ensure that data owners are aware and will obtain explicit consent before the data collection.
3. Purpose of Data Collection or Use
The hospital will collect or use personal data of data owners for the benefit of its operations, such as medical care, financial transactions, procurement, marketing, public relations, contract execution, the hospital’s activities, coordination with others, or to enhance the efficiency of its operations, such as database creation, analysis, and development of the hospital’s processes. And for any other purposes not prohibited by law and/or to comply with relevant laws or regulations related to the hospital’s operations. Data will be stored and used only for the duration necessary for the notified purposes or as prescribed by law.
The hospital will not take any action different from the specified purposes of data collection unless
4. Disclosure of Personal Data
The hospital will not disclose the personal data of data owners to any third party without consent and will disclose according to the objectives that have been informed unless
4.1 The hospital may disclose the personal data of the data owners under legal provisions, such as disclosure to government agencies, state agencies, or supervisory bodies.
4.2 This includes cases where there's a request for data disclosure by legal authority, for instance, data requests for legal proceedings or litigations.
4.3 Requests from private entities or other external individuals related to legal processes.
4.4 The hospital may disclose the personal data of the service users to individuals, other entities, or legal entities (which may be called "data recipients") who need to use, disclose, or exchange such data as follows
In any case where the hospital uses or discloses such information to other related individuals or agencies, the hospital will operate within the framework of personal data protection laws. Furthermore, there will be an agreement with the data recipients to prevent unauthorized use or disclosure of the information and to ensure it is used only for the intended purpose.
5. Guidelines for Personal Data Protection
The hospital will implement various measures, including measures to maintain the security of personal data that complies with laws, regulations, standards, and best practices for personal data protection. These measures are provided to the hospital’s staff and other relevant individuals. Additionally, the hospital supports and promotes awareness among its personnel regarding their duties and responsibilities in collecting, storing, using, and disclosing personal data. The hospital’s staff must adhere to policies and practices set by the hospital to ensure the proper and effective adherence to data protection laws and policies.
6. Retention and Destruction of Personal Data
The hospital will retain the personal data of service users for as long as necessary to achieve the hospital’s objectives, as has been communicated, or for the period as mandated by law, or as long as the service user provides their consent. When there’s no longer a need to retain the data, or if a service user withdraws their consent, or if they don’t request the hospital to keep their personal data, the hospital will proceed to delete or destroy the personal data, or anonymize the data so that it can’t be used to identify the individual any longer
7. Rights of Personal Data Owners
Personal data owners have the following rights
(1) The right to revoke consent for the processing of personal data that has been previously given. Revoking consent does not impact the collection, use, or disclosure of personal data that consent was already given for.
(2) The right to access personal data and request copies, as well as the right to disclose how the data was obtained without their consent.
(3) The right to correct any inaccurate personal data.
(4) The right to delete personal data.
(5) The right to suspend the use of personal data.
(6) The right to transfer personal data.
(7) The right to oppose the processing of personal data.
(8) The right to lodge a complaint regarding personal data protection.
- Data owners can exercise the above rights by submitting a written request to the hospital. The hospital will inform the data owner of the outcome of their request within 30 days from the receipt of said request
- However, the hospital may refuse some or all of the data owner’s rights if dictated by law. For example, if acting upon your request would affect the rights and freedoms of others, contradict the law, or if the request is unreasonable. The hospital will provide an explanation if there are any limitations in addressing your rights request.
8. Review and Modification of the Personal Data Owner’s Privacy Announcement Policy
The hospital may periodically revise or amend this policy to align with legal requirements, changes in the hospital’s operations, as well as suggestions and feedback from various entities. The hospital will announce any changes clearly before implementing them.
9. Hospital Contact Information
Data Protection Officer (DPO) Details
Petcharavej Hospital, 2469/13, New Phetchaburi Road, Bang Kapi Subdistrict, Huai Khwang District, Bangkok 10310. Tel. 0-2318-0080, 1390, 229 (DPO).
This policy is effective from June 1, 2022 onwards.