1. Introduction
Enserv Holding Co., Ltd. (registration number 0135555008651) and Ensif Encare Co., Ltd. (registration number 0135555008723) are companies engaged in the healthcare and health technology business. We uphold ethical business practices and respect our customers’ privacy. Therefore, we have established this Privacy Notice for Encare Application Services (“Privacy Notice”) to inform our customers (“you”) about our practices regarding your personal data. This Notice explains why we collect, use, and disclose your personal data, the types of personal data we collect, the purposes for processing, disclosures to third parties, details of our security measures to protect your personal data, data retention periods, and your rights as a data subject under the Personal Data Protection Act B.E. 2562 (2019), including applicable laws and regulations (“Personal Data Protection Law”).
This Privacy Notice applies to personal data we collect as a data controller for Encare Application Services (“Services”) through the Encare application, our official LINE for Business account (@encare) (“Application”), our website (“Website”), and our service points located at various locations (“Service Points”).
You acknowledge and agree that Ensif Encare is solely responsible for the services provided by the Encare Application business operator as required by law. Enserv Holding Co., Ltd. has no involvement in the provision of such services.
2. Contact Us
If you have any questions or require further information regarding this Privacy Notice, please contact our Data Protection Officer.
Contact Channels:
- LINE: @encare ( [Insert LINE Official Account link] )
- Phone: [Insert phone number]
- Email: [Insert email address]
- Address: Enserv Encare Co., Ltd. 1339 Pracharat 1 Road Wong Sawang Subdistrict, Bang Sue District Bangkok, Thailand
3. Purpose of Collecting, Using, and Disclosing Personal Data
We will collect, use, and disclose (collectively referred to as “process”) your personal data only to the extent necessary and lawful. We will process your personal data only when there is a legal basis that permits us to do so. This includes processing your personal data to fulfill a contract we have with you, comply with our legal obligations, serve our legitimate interests, prevent or mitigate harm to the life, body, or health of you or others, perform duties for public interest purposes of the company, exercise state authority, act based on your consent, and/or under other legal bases as specified by data protection laws.
In addition, the law prohibits us from collecting sensitive personal data, including but not limited to information about race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disabilities, union membership, genetic data, biometric data, or other similar data that could affect you in a comparable way. Unless we obtain your explicit consent, we will not collect or use such data without your explicit consent, except where permitted by data protection laws.
3.1 To Fulfill the Contract We Have with You
We will process your personal data to provide the services you have registered for, requested, and/or to fulfill the agreements or contracts you have entered into with us. This includes, but is not limited to, the following purposes:
- To register and log in to our services.
- To verify registration, confirm and authenticate your identity, and validate your contact channels.
- To deliver the services you have registered for, cater to your preferences and interests, provide requested services, and/or fulfill the contracts made with us.
- To communicate information about related products and services, including sending service invoices, purchase orders, payment reminders, and receipts.
- To process payments for services and associated fees.
- To provide compensation, rewards, and other benefits.
- To address inquiries, provide support, deliver information, handle complaints, and resolve issues.
- To support the company’s business operations, such as analysis, surveys, performance measurement, and improving and maintaining existing services to ensure smooth operation.
- To compensate you for any damages incurred.
- To inform you of changes to our services and service agreements.
3.2 Legal Obligations the Company Must Comply With
As we are obligated to comply with applicable laws and orders from authorized legal entities, we are required to collect, use, and disclose your personal data for various purposes, including but not limited to the following:
- To comply with personal data protection laws and other relevant laws.
- To comply with healthcare facility laws and other related regulations.
- To comply with other laws (e.g., the Computer-Related Crime Act, the Electronic Transactions Act, the Consumer Protection Act, and other laws we are required to follow).
- To comply with regulations and/or orders from authorized legal entities (e.g., court orders, directives from government agencies, or orders from authorized officials).
3.3 For the Legitimate Interests of Ourselves and Third Parties
We will process your personal data to serve our legitimate interests while balancing our benefits or those of other individuals or entities with your fundamental rights concerning personal data. This includes, but is not limited to, the following purposes:
- To prevent fraud and corruption, enforce our terms, conditions, and policies, and/or exercise legal claims as permitted by applicable laws.
- To maintain the security of our data and service networks and notify you of suspicious activities, such as unusual login attempts to your account.
- To study how our customers use our products and services to improve service standards, plan and monitor marketing campaigns, analyze, and enhance the services you use to better meet your needs.
- To develop new products that suit customer needs and define customer segments for new products or services.
- To present our products, services, and benefits to you based on your preferences and information. If you do not wish to receive these offers via email, you can opt-out by clicking the “Unsubscribe” button included in the email or by notifying us through other channels, such as emailing Enservencare@gmail.com.
- To facilitate communication, record images, or audio during meetings, training, recreational events, or exhibitions.
- To anonymize personal data to make it unidentifiable.
3.4 Actions Based on Your Consent
In certain cases, the processing of personal data requires your consent as mandated by personal data protection laws. These purposes include, but are not limited to, the following:
- The necessity to collect sensitive personal data.
- To send updates, deals, and promotions from our business partners and to advertise content based on your information and interests.
- To transfer or transmit your personal data to another country that may not have adequate personal data protection standards (unless permitted by personal data protection laws without requiring consent).
- If you are a minor, an incompetent person, or a quasi-incompetent person, consent must be obtained from your parent, guardian, custodian, or legal representative, as applicable (unless personal data protection laws allow such processing without consent).
4. Personal Data We Collect
We collect various types of personal data. The collection, use, and disclosure of your personal data may vary depending on the products and/or services you use or have used in each country. To provide an overview of the data we collect, we have categorized it as follows:
Personal Information
- Title
- First name, Last name
- Gender
- Age
- Date of birth
- Religion
Identification Information
- National ID number
- Passport number
- Copy or photo of your national ID card or passport
- Facial photograph
- Other identification numbers
Contact Information
- Mailing address
- Email address
- Phone number
Location Information
- GPS data, geographical location
Social Media Account Information
- Social media account details
- Social media platforms (e.g., LINE, Facebook)
- Your profile data
- Social media interactions with us
Service Information
- Appointment details
- Static/dynamic images for security purposes
- CCTV recordings
- Conversation recordings
- Voice recordings
- Photographs, videos
Health Information
- Medical records
- History of drug/food allergies
- Physical examination results, treatment outcomes, diagnoses
- Laboratory test results
- Radiographic images
- Photos/videos/audio from medical procedures
- Medical certificates
- Body composition data (e.g., body fat mass, visceral fat, bone mass)
- Other personal health information (e.g., weight, height, blood type, heart rate, blood pressure, glucose levels, drug allergies)
Financial Information
- Payment and payment verification details
Biometric Data
- Facial scan data for electronic identity verification
- Fingerprints for signature purposes
Device, Software, and Technical Details
- IP address
- Device identification numbers or other device-specific identifiers
- Technical specifications and unique identifiers, such as logs, device IDs, device types, network usage, connection details, access data, access date and time, session duration, cookies, search history, browsing history, and other unique device identifiers
Market Research Data
- Customer survey responses
Other Information
- Any information you provide to us through any channel
5. Sources of Personal Data
We collect personal data directly from you when you provide it to us and automatically when you access our website, application, or interact with us.
Additionally, we may receive your personal data from our partners and other sources. This is conducted in accordance with legal procedures and only in cases permitted by law. The details are as follows:
(1) Sources of Personal Data Provided Directly by You
- Registration and Identity Verification: When you register for services, verify your identity, update your personal information, or make specific requests related to our services at our healthcare facilities, physical locations, websites, or applications.
- Medical Services: When you receive medical services at our healthcare facilities or through telemedicine services provided by us.
- Communication: When you interact with us at our healthcare facilities, physical locations, websites, applications, email, phone, or through our social media channels.
- Surveys and Marketing Campaigns: When you participate in our surveys or promotional activities.
- Payment for Goods and Services: We collect payment-related information when you make transactions for our goods and services.
(2) Sources of Personal Data Collected Automatically
We collect personal data automatically when you interact with us, access our services, or visit our healthcare facilities, physical locations, websites, applications, or online systems. This includes:
- Your service usage data.
- Your communication data with us.
- Information related to your devices used to interact with us.
- Static or motion images captured by closed-circuit television (CCTV).
(3) Sources of Personal Data Not Collected Directly from You
We may receive your personal data from the following sources:
- Close Relations: Such as relatives, spouses, or legal guardians.
- Authorized Representatives: Individuals authorized by you to act on your behalf in communicating with us.
- Network Healthcare Facilities: In cases where you have consented for network facilities to disclose your personal data to us.
- Entities Involved in Your Service Usage: Individuals, legal entities, or organizations, whether governmental, private, or state enterprises, who have referred you for medical services, paid for your services, or invited you to participate in our services or activities.
Additionally, we may verify the accuracy of information provided by you during registration with third parties for security and fraud prevention purposes.
6. Sharing and Disclosure of Personal Data
We may share your personal data with external individuals or organizations for the purposes outlined in this Privacy Notice. The categories of entities with whom we may share your personal data include:
- Healthcare professionals or health consultants providing services within this program.
- Government agencies, authorized entities, or individuals as required or authorized by law, including compliance with court orders.
- Individuals or legal entities with whom we need to comply with contractual obligations or act in your best interests as the data subject. These entities are required to maintain confidentiality and protect your personal data according to data protection laws. Such entities may include, but are not limited to:
- Affiliated medical facilities, as necessary for providing medical examinations and healthcare services. We disclose only the necessary personal data and ensure its confidentiality in compliance with applicable laws, such as the Medical Facility Act B.E. 2541, the National Health Act B.E. 2550, and the Medical Profession Act B.E. 2525.
- Insurance companies or their claim management service providers.
- Referring parties who arrange for your medical examinations or services at our facilities or pay for your services.
- Personal data processors essential to our operations, such as contractors or service providers for identity verification, laboratory tests, logistics, data compilation and analysis, telecommunications, computer systems, payment processing, or technology outsourcing services.
- Cloud computing systems, using third-party providers located in Thailand or abroad. We carefully select and contract with these providers, considering their data security systems to safeguard your personal data.
7. Transfer or Transmission of Personal Data to Other Countries
We may transfer or transmit your personal data from the country where you reside and use our products and/or services to another country where you choose to access and/or subscribe to our products and/or services. In such cases, if we transfer or transmit your personal data to another country, we will comply with applicable laws and obligations related to the processing of your personal data. We will ensure appropriate security standards are in place to guarantee that the company maintains adequate personal data protection standards.
8. Retention Period for Personal Data
We will retain your personal data for the duration of your relationship with us or as long as necessary. The retention period will be at least five years from the date the data is created. However, for the benefit of medical care, we may retain your personal data for up to ten years after the termination of the relationship.
We may be required to comply with laws or regulations established or permitted by other relevant professional councils, or to adhere to court orders, or to establish legal claims for engaging in any dispute resolution process. In such cases, we may retain personal data for the duration specified by the statute of limitations under the applicable laws or regulations, or until the resolution of the dispute, whichever applies.
9. Account Closure and Deletion of Personal Data
We will take appropriate steps to delete, destroy, or anonymize your personal data once it is no longer necessary or after the retention period specified in this policy has expired.
In compliance with data protection laws, you may request to close your account on our website or application, or request the deletion of your personal data. However, this is subject to legal limitations or existing contracts that provide you with ongoing benefits. To proceed, please contact us using the details provided in Section 1 of this notice.
You must provide the necessary information to enable us to process your request. We will review your request as promptly as possible. To facilitate the process, we may require additional personal information to verify your identity and ownership of the account. All actions will be conducted in accordance with the applicable legal requirements.
10. If You Choose Not to Provide Personal Data
We may be required by law or the terms of a contract between you and us to collect personal data. If you choose not to provide such data, we may be unable to offer you our services.
Apart from cases where we use personal data to fulfill contractual or legal obligations, if you do not consent to the use of your personal data, you may still use our services. However, the level of convenience or efficiency in accessing our services may be reduced, as we will not have your consent to utilize your personal data for providing optimal service.
11. Marketing Activities and Promotions
We use your personal data to send you marketing messages if we have received your consent or if it is deemed a “legitimate interest.”
12. Your Rights to Control Personal Data
These rights are legal entitlements that you should be aware of. Once the provisions of the data subject rights under the Personal Data Protection Act become effective, you can exercise your rights under the legal requirements of each country and the current or future revised privacy policies, as well as guidelines established by us. If you are under 20 years of age or legally restricted from acting independently, you can exercise your rights through your parent(s), legal guardian(s), or authorized representative(s) as outlined below:
1. Right to Withdraw Consent
If you have provided your consent for specific purposes, you may withdraw it at any time while your personal data remains with us, unless restricted by law or an agreement that benefits you.
2. Right to Access Personal Data
You have the right to access your personal data under our responsibility. You may request a copy of your personal data or access it through other means we provide. Additionally, you can request us to disclose how we obtained any personal data that you did not consent to provide.
3. Right to Data Portability
You can request us to send or transfer your personal data in an electronic format to another data controller when feasible through automated means. You may also request a copy of your personal data to be transferred directly to another data controller, unless technical limitations prevent us from doing so. This applies to data you have consented to or data necessary for the fulfillment of a contract or your request prior to using our products and/or services. We reserve the right to charge reasonable fees for such requests.
4. Right to Object to Processing
You may object to the collection, use, or disclosure of your personal data if it is based on legitimate interests, public interest, or research purposes. If you raise an objection, we will continue to process your data only if we can demonstrate overriding legal grounds or for the establishment, compliance, or defense of legal claims. You may also object to the processing of your data for direct marketing or scientific, historical, or statistical research purposes.
5. Right to Erasure
You can request the deletion, destruction, or anonymization of your personal data if you believe it was unlawfully processed, is no longer necessary for the stated purposes, or if you have exercised your rights to withdraw consent or object to processing.
6. Right to Restriction of Processing
You may request the temporary suspension of data processing in certain cases, such as while we verify the accuracy of your data or your objection request, or in situations where data must be deleted but you request processing to be suspended instead.
7. Right to Rectification
You have the right to correct, update, complete, or ensure that your personal data is accurate and does not cause misunderstandings. You can also update your data through the MorDee application.
To exercise your data protection rights, you can contact us using the details provided in Section 1 of this notice. We will review and respond to your request within 30 days from the date of receipt.
We reserve the right to deny requests that are unreasonable, unlawful, or practically impossible to fulfill. Furthermore, we may reject requests within the legal limitations. You also have the right to file a complaint with the Personal Data Protection Office or other relevant authorities as specified in the applicable regulations.
13. Cookies and Their Usage
We may collect, use, and disclose cookies and similar technologies when you use our services and products, including accessing our website and application, for the following purposes:
- Protecting you from fraud and enhancing security.
- Analyzing how visitors interact with our website, online services, and other offerings to enable improvements.
- Determining which products, services, and offers may be relevant to you.
- Personalizing the marketing content you see on social media platforms and other websites.
You can decline the collection of data via cookies by adjusting your browser settings. However, this may reduce the optimal performance of the website and application.
14. Children
We do not intend to collect personal information from minors, defined as individuals who have not yet reached the age of majority (i.e., under 20 years old or below the age specified by applicable laws granting legal majority), or who are not considered legally mature through marriage or other conditions as stipulated by applicable laws (“Minors”). Minors are not permitted to register for or purchase our products, goods, and services unless we obtain consent directly from the Minor (as allowed by law), or from a parent or legal guardian authorized to act on the Minor’s behalf, or based on other legal grounds.
If you are a parent or legal guardian and become aware that your child or a Minor under your guardianship has provided personal information to us, please contact us to exercise your rights, within the scope provided by applicable data protection laws and other relevant regulations.
If you are a Minor and need to access our services or products, your parent or legal guardian must provide consent for the submission of your personal information to us by contacting us using the details provided above.
In cases where we are required to obtain consent for the use of a Minor’s personal data for purposes beyond what the Minor may consent to independently under the Civil and Commercial Code and/or applicable laws, we will seek consent from the Minor’s parent or legal guardian, following the provisions set forth by personal data protection laws.
15. Use of Personal Data for Original Purposes
We retain the right to collect and use your personal data that we obtained prior to the effective date of data protection laws concerning the collection, use, and disclosure of personal data. We may continue to collect and use such personal data for the original purposes.
If you no longer wish for us to collect and use your personal data for these purposes, you may manage your consent settings through the application and/or website you are using, or contact us using the details provided in Section 1 of this notice.
16. Changes to the Privacy Notice
This notice may be reviewed, updated, or amended from time to time to align with relevant practices, laws, regulations, and guidelines regarding the processing of your personal data. In certain cases, we may need to seek your consent.
We will provide clear notifications of such updates via our website and/or application, and/or send email notifications to you. If you do not wish to accept any updates to this Privacy Notice, you have the option to discontinue using our services.
Enserv Encare Co.,Ltd
The Privacy Policy was last reviewed on January 14, 2025.
