PDPA notice

Data controller

TM3P TECH Co., Ltd.
Address: [REGISTERED ADDRESS — Bangkok, Thailand]
Company registration: [COMPANY REGISTRATION NUMBER]
Privacy contact: privacy@tm3p.tech
Data Protection Officer: dpo@tm3p.tech

The clinic you book with is a joint controllerfor your medical records. We act as a data processor on the clinic’s instructions for that data.

Data we collect

• Identity: full name, phone, email, date of birth, gender
• Thai national ID or passport number (column-level encrypted)
• Appointment records and visit history
• SOAP notes written by your doctor and the patient summary sent to you
• Payment metadata (cards are tokenized by Omise / Stripe — we do not store card numbers)
• LINE User ID when you sign in with LINE
• Preferred locale and the timestamp of your PDPA consent

Purposes of processing

• Manage bookings — create, confirm, reschedule, cancel
• Send LINE notifications about appointments, queue position, and visit summaries
• Process deposit payments
• Translate your doctor’s notes into your preferred locale (AI via Vercel AI Gateway)
• Comply with Thai financial, accounting, and public-health regulations

Third-party processors

We rely on the following sub-processors:

• Supabase (US / Singapore) — database and authentication
• Vercel (US) — hosting and request processing
• Omise (Thailand) — PromptPay payments
• Stripe (Ireland / Singapore) — cards and Alipay+ / WeChat Pay
• LINE Corporation (Japan) — messaging and LIFF
• Anthropic (US) via Vercel AI Gateway — visit-note translation

Cross-border transfers are protected under PDPA §28 via Standard Contractual Clauses and per-processor adequacy assessments.

Your rights

Under PDPA you have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate records
• Erasure — request deletion (we erase personal data and retain only medical-record data the law requires us to keep)
• Object & withdraw consent — withdraw at any time (prospective; not retroactive)
• Lodge a complaint with the Personal Data Protection Committee (PDPC)

Send rights requests to: dpo@tm3p.tech. We respond within 30 days.

Retention

• Appointment + medical records: 10 years (Thai medical records regulations)
• Payment records: 7 years (tax / accounting law)
• LINE login data: until you unsubscribe
• PII you ask us to erase: removed immediately; only a reference identifier is kept

Changes to this notice

We may update this notice from time to time. The “Last updated” date above marks the latest change. Continued use after an update constitutes acceptance.