Privacy Notice for Patients

1. Data we collect

• Identity: title, name, Thai ID or passport number, nationality, date of birth, sex, address, and the image of your ID card or passport
• Contact and account: phone number, and email (when you sign up online or give it at the shop)
• Health data: symptoms, drug allergies, underlying conditions, current medicines, blood pressure, pulse, weight, height, the doctor’s notes, prescriptions and dispensing
• Video and audio of the telemedicine consultation (in-person examinations at the clinic are not recorded)
• Records of consent and pickup: the text you agreed to, the time, language, the browser or device used, the IP address it connected from, and your signature when you collect the medicine
• Payment: the amount and the payment reference. Card details are entered on the payment provider’s page; we never see or keep your card number
• System use: logs of who accessed the data, and connection data used to check that you are not a bot
• We do not collect the laser code on the back of the card or your religion

2. Purposes

• Create your account, confirm your email and verify your identity
• Examination by a doctor through telemedicine or at the clinic
• Issue a controlled-herb prescription (Phor.Thor. 33), dispense it at the branch, and email you a link to set a password and the Phor.Thor. 33 when you gave an email
• Take payment for the consultation
• Keep medical records as required by law
• Keep the system secure and prevent misuse

3. Legal basis

• Providing the service you request (contract), and complying with the law (healthcare facilities, medical records, controlled herbs)
• Health data and consultation video: your explicit consent (asked on screen before every consultation) and medical purposes
• System security and access logs: our and our patients’ legitimate interests

4. Who can access or receive it

• The examining doctor, the branch staff who register you and dispense, and the staff who check identity documents — only as their work requires
• The point-of-sale (till) system of the branch you chose for pickup: only your name and the Phor.Thor. 33 number, quantity and expiry, to link the sale to the prescription; never your ID number, address or other health data
• Service providers that process data for us, on our instructions: the data centre hosting the system, Cloudflare (network, security and bot checks), the email delivery provider, Stripe (payments), and Google Cloud Translation (live caption translation, when enabled; the text is not stored by the system)
• Government authorities when required by law
• We do not sell your data or use it for marketing

5. Transfers outside Thailand

• Some providers in section 4 (Cloudflare, Stripe, Google and the email delivery provider) may process data outside Thailand. We use providers with data protection standards and data protection terms, and send only what their service needs

6. Retention

• Medical records, consents, Phor.Thor. 33 prescriptions and dispensing records: at least 5 years after your last visit, or longer if the law requires
• Consultation video: 5 years
• Other data: only as long as the purposes above need
• After that, we delete the data or make it impossible to identify you

7. Security

• Encrypted connections (HTTPS), role-based access control on our servers, AES-256 encrypted video, and access logging

8. Your rights

• Access and obtain a copy, data portability, correction, deletion, objection or restriction of processing, and withdrawal of consent (withdrawal does not affect processing done before it)
• Send requests to support@botanic-rx.com. We verify the requester’s identity first and reply within 30 days
• Some data may have to be kept under medical-record law even if you ask for deletion or withdraw consent
• You may complain to the Personal Data Protection Committee (PDPC)

9. Data controller and contact

• Data controller: Botanic RX
• Privacy contact: support@botanic-rx.com