PRIVACY POLICY.

This Privacy Policy explains how EOI Digital Limited ("BangkokClinics", "we", "us" or "our") collects, uses, shares and protects your personal information when you use the BangkokClinics website, tools and introduction service (the "Service"). BangkokClinics is an independent directory and concierge introduction service, not a medical provider.

EOI Digital Limited, a company registered in Hong Kong, is the data controller of the personal information described here, including under Thailand's Personal Data Protection Act (PDPA).

Privacy officer. The privacy officer role is held by EOI Digital Limited. You can reach it at hello@bangkokclinics.io for any privacy question, request or complaint.

This policy applies to personal information we collect through the Service. Clinics handle your information under their own policies once you are in contact with them, within the limits of their agreement with us described below.

Information you provide. When you take the quiz, run a face scan, send an enquiry or contact us, we collect what you enter: your name, email address, phone number or messaging handle (for example WhatsApp or LINE), country and age band.

Your request details. The clinic you enquired about, treatments of interest, budget band, travel window, face zones and skin concerns you select, face-scan scores if you choose to submit them, and any message or notes you write.

Information collected automatically. Basic technical data such as IP address, device and browser type, pages viewed and referring pages, collected through standard server logs and privacy-friendly analytics to keep the Service working and secure.

Cookies and similar technologies. Small files and local storage used to remember your progress and preferences and to measure aggregate usage. See "Cookies and analytics" below.

Before we save your request, the form asks you to tick two separate boxes. Neither is ticked in advance, and you can refuse:

• I agree to my treatment interests and face-scan scores (health information) being used to match me with clinics.
• I agree to my contact details and request being shared with the clinics I'm matched with or choose.

Under the boxes we also tell you: "Your data is stored securely on servers in Japan and shared only with the clinics you're matched with." See "International transfers" below.

What we collect. Name, email, phone or messenger ID, country, age band, treatment interests, budget, travel dates, notes, and face-scan scores. Your photo is never uploaded.

Why. To match you with clinics and pass your request to the clinics you are matched with or choose.

How long. Up to 2 years after our last contact with you, or until you withdraw consent, whichever comes first, unless the law requires us to keep it longer.

Your choice. You can refuse. Without these consents we cannot match you or introduce you to clinics. You can withdraw at any time from your results page or by emailing us.

We keep a record of which consents you gave, the version of this wording, and when. You can withdraw any consent at any time using the link on your results page or by emailing us. Withdrawal does not affect processing already carried out.

Details such as the treatments, face zones or skin concerns you are interested in, and face-scan scores, may reveal information about your health. Under Thailand's Personal Data Protection Act (PDPA) and the GDPR this is sensitive information that receives extra protection.

We process it only to match you and introduce you to clinics, and only with your separate, explicit consent.

The optional face scan runs entirely in your browser. The photo itself is never uploaded to or stored on our servers. Only the numeric, non-identifying scores it produces are saved with your results, and only if you choose to submit them. We do not use the scan for facial recognition or to identify you.

We use your information to:

• match you with suitable clinics and generate your results
• contact you about your request and follow up on your enquiry
• pass your request to the clinics you are matched with or choose, as described below
• operate, maintain, secure and improve the Service and prevent misuse or fraud
• comply with legal obligations and enforce our Terms

Where the PDPA or the GDPR applies, we rely on:

• Your consent: for processing health-related details, for sharing your request with clinics, and for any marketing messages.
• Steps at your request: to provide the matching and introduction service you ask for.
• Legitimate interests: to operate, secure and improve the Service, where your rights do not override those interests.
• Legal obligation: to meet record-keeping, tax and other legal requirements.

With your consent, we share your name, contact details and request with the clinics you are matched with or choose, so they can contact you directly. If the clinic you enquired about is not one of our partners, we may introduce you to a similar partner clinic, and we tell you when we do.

Every partner clinic signs an agreement with us that requires it to use your data only to respond to your enquiry and provide your care, not for unrelated marketing; to keep it secure; to tell us within 24 hours of any data breach; to delete enquiry data of patients who do not book within 12 months; and to act on your requests to access, correct or delete your data, or to withdraw consent.

We share only what the clinic needs. Your face-scan photo is never shared, because we never have it.

Service providers. We use trusted providers to run the Service: cloud hosting and database infrastructure, an email delivery provider, a business messaging provider (WhatsApp Business, by Meta) that notifies the clinics you are matched with or choose, and privacy-friendly analytics. They process personal data only on our instructions, under contractual safeguards.

Legal and safety. We may disclose information where required by law, to respond to lawful requests, or to protect the rights, safety and property of you, us or others.

Business transfers. If we are involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

We do not sell your data. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Our database is hosted in Japan (Tokyo). Our website, email and analytics providers may process data in the United States and other countries. The clinics we introduce you to are in Thailand. This means your information is likely to be stored and processed outside your home country, in countries whose data protection laws may differ from yours.

We transfer your data abroad only where it is needed to provide the matching and introductions you ask for, we tell you about it on the form before you submit, and we use appropriate safeguards such as contractual protections with our providers and clinics. Japan is recognised by the EU and UK as providing adequate protection.

We use a small number of cookies and similar technologies that the Service needs to work, and to understand aggregate usage so we can improve it. You can control cookies through your browser settings; blocking some may affect how the Service works. We use privacy-friendly analytics and minimise tracking.

We keep your enquiry and matching records for up to 2 years after our last contact with you, or until you withdraw consent, whichever comes first. Records we must keep by law, such as records of treatments we invoiced a clinic for, are kept for the period the law requires. When information is no longer needed we delete or anonymise it.

We use reasonable technical and organisational measures to protect your information against loss, misuse and unauthorised access, including encrypted connections, access controls and per-patient access codes for results pages. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects you, we will notify you and the authorities where the law requires.

Depending on where you live, you may have some or all of these rights:

• access a copy of the information we hold about you
• correct information that is inaccurate or incomplete
• delete your information
• restrict or object to certain processing, including direct marketing
• receive your data in a portable format
• withdraw consent at any time, without affecting processing already carried out
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects

To exercise a right, use the withdraw link on your results page or email hello@bangkokclinics.io. We respond within the time the applicable law requires and may need to verify your identity first. When you withdraw consent or ask us to delete your data, we also ask the clinics that received it to delete it.

Data controller. EOI Digital Limited is the data controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

Disclosure to clinics. Recipients: the partner clinics you are matched with or choose (named on your results page). Purpose: responding to your enquiry and providing consultations, treatment and aftercare. Items: name, contact details, country, age band, request details and face-scan scores. Retention by the clinic: until the purpose is achieved and at most 12 months for patients who do not book, or as medical law requires for patients who do.

Sensitive data. We collect health-related (sensitive) data only with your explicit consent, and you can withdraw it at any time.

Transfer abroad. Your data is stored in Japan and may be processed in the United States by our service providers, as described in "International transfers". We transfer data outside Thailand only where needed to provide the service you asked for, with appropriate safeguards.

Your rights. You have the rights listed above, including to withdraw consent, to ask us to delete your data, and to ask us to stop or restrict processing.

Complaints. You can contact our privacy officer at hello@bangkokclinics.io, or lodge a complaint with Thailand's Personal Data Protection Committee (PDPC, www.pdpc.or.th).

You may lodge a complaint with your local data protection authority. If you are a California resident, we do not sell or share your personal information as defined under California law, and we will not discriminate against you for exercising your rights.

We send messages about your enquiry. If we send optional updates or marketing, you can opt out at any time using the unsubscribe link or by emailing hello@bangkokclinics.io. You can also ask us to stop contacting you through any channel at any time.

Our quiz and matching use automated logic to suggest clinics and treatments. These suggestions are informational and have no legal or similarly significant effects on you; a human concierge and, ultimately, a licensed clinician are involved before any treatment decision.

The Service is for adults aged 18 and over and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us information, contact hello@bangkokclinics.io and we will delete it.

The Service links to third-party sites and services, including clinics and messaging platforms, which we do not control. This policy does not cover their practices; please review their own privacy policies.

We may update this policy from time to time. The current version always lives on this page, with the updated date shown at the top. Where the law requires, we will ask for your consent again or give you additional notice. If this policy is available in several languages and they differ, the English version applies.

For any privacy question or request, contact our privacy officer, EOI Digital Limited, at hello@bangkokclinics.io.