Effective date: [to be set at launch]
Last updated: [to be set at launch]
OrbaHealth ("we," "us") processes your personal data in compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). The data controller is OrbaHealth. Formal Thai entity registration is pending, and this document will be updated with the registered entity name and address upon incorporation.
We collect the following categories of personal data: (a) identity information from your intake form (name, date of birth, sex, contact details); (b) health data from uploaded lab reports (biomarker values, lab names, report dates); (c) wellness questionnaire responses (lifestyle, medical history, health goals); (d) consent records and timestamps; (e) usage data (pages visited, features used, session duration); (f) recordings of consultation and qualification calls.
Under Thailand's Personal Data Protection Act B.E. 2562 (2019), we process your data based on: (a) explicit consent you provide during onboarding for health data processing; (b) contractual necessity for delivering our wellness analysis services; (c) legitimate interest for service improvement and security purposes. Health data is classified as sensitive personal data under Section 26 of the PDPA and is processed only with your explicit consent.
All of the following data uses are required for us to deliver our service. You cannot opt out of individual items while remaining a customer, but you may withdraw consent entirely at any time by requesting account deletion. We do not sell your personal data to third parties.
We retain your personal data for as long as your account is active and for a reasonable period thereafter to fulfill legal obligations. Health data and lab results are retained for the duration of your account plus 5 years to support longitudinal wellness tracking. Call recordings are retained for 12 months unless needed longer for quality or training purposes. You may request earlier deletion at any time. Anonymized and aggregated data may be retained indefinitely for research and service improvement.
As a data subject under the PDPA, you have the right to: (a) access your personal data and obtain a copy; (b) correct inaccurate or incomplete data; (c) request deletion of your data; (d) request data portability in a machine-readable format; (e) object to or restrict certain processing activities; (f) withdraw consent at any time without affecting the lawfulness of prior processing. To exercise these rights, see Contact Us below.
We implement appropriate technical and organizational measures to protect your personal data, including: encryption of data in transit and at rest, access controls limiting data access to authorized personnel, regular security assessments, and secure hosting infrastructure. Despite these measures, no system is completely secure, and we cannot guarantee absolute data security.
Your data may be processed using cloud infrastructure located outside Thailand, solely for the purposes disclosed in this policy and consented to by you. Where such transfers occur, we ensure adequate data protection safeguards are in place as required by the PDPA, including contractual obligations with service providers to maintain equivalent levels of data protection.
OrbaHealth services are intended for adults aged 20 and older, which is the age of majority under Thai law (Civil and Commercial Code §19). We do not knowingly collect or process personal data from individuals under 20 years of age. If we become aware that we have collected data from a minor without verified parental consent, we will delete it.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of the breach, and notify affected data subjects without undue delay, in accordance with PDPA §37.
For questions about this privacy policy, to exercise your data rights, or to raise a concern about how we handle your personal data, contact us at hello@orba.health. We will work to resolve concerns promptly and will respond to data rights requests within 30 days as required by the PDPA. You also have the right to file a complaint directly with the Personal Data Protection Committee (PDPC) of Thailand.