Privacy Policy

This is an English translation. If it differs from the Thai version, the Thai version governs.

AIB Clinic is a chat system that clinics and healthcare providers hire us to set up. We are not a healthcare provider, we don't provide medical services, and we don't own the relationship between you and the clinic — the clinic you message is the data controller of your personal data, and we are a data processor acting on that clinic's instructions.

1. Who provides this service

AIB Clinic is a service of Elegant Digital Co., Ltd.. For personal data matters, contact us at [email protected]

Under Thailand's Personal Data Protection Act (PDPA), the roles are split as follows:

• The clinic you message = data controller — decides what is collected and what it's used for
• AIB Clinic = data processor — runs the system and processes data only as the clinic instructs

If you want to exercise your rights over your data, you can contact the clinic directly, or contact us and we'll coordinate with the clinic for you.

2. Data we collect

We collect only what's needed to answer chats and pass work on to the clinic's team:

• Chat messages, both what you type and what the system replies
• Your public name and profile picture on the account you message from (Facebook, Instagram or LINE), so the clinic's team knows who they're talking to — we don't access your friends list, posts or any other data in your account
• Images you send in the chat
• The name and phone number you provide yourself when you ask the team to contact you, or when the clinic's team records them in that chat
• Necessary technical data, such as when messages were sent, which channel you used, and the domain name of the web page where the chat box was opened

What we don't collect: your social media passwords · credit card or payment details (the chat system doesn't take payments) · your location

3. Health information — what to know before you type

Health information is sensitive data under the PDPA. Our system is configured to never diagnose, never promise treatment results, and never recommend medication. Cases that need a doctor's judgement are always handed off to the clinic's team.

If you describe symptoms or send health-related images in the chat, those messages and images are stored in the chat history like any other message, and the clinic's team will see them. We recommend sharing only what's needed to book or ask a question — detailed matters are better discussed with a doctor directly.

Some clinics enable preliminary assessment from photos, for example a photo of your face sent in for advice. The system always explains the purpose and asks for your consent first. The photo is used only for the clinic's team and doctors to make a preliminary assessment. Any advice given is guidance based on that clinic's doctors' criteria, not a diagnosis — an actual result requires an in-person examination by a doctor at the clinic. If you don't consent, the system won't assess the photo and will suggest booking a visit with a doctor instead.

4. How we use data

• To answer your questions about that clinic's services, fees, conditions and appointment availability
• To hand off to the clinic's team when a case needs a person, and let the team continue in the same chat
• To let the clinic's team look back at chat history to follow up on open items
• To improve the system's answers for that clinic

We don't use your data for advertising, don't sell or exchange data with third parties, and don't use one clinic's chats for another clinic — each clinic's data is kept separate.

5. Who can see your data

• The team at the clinic you message — sees only that clinic's own chats
• The AIB Clinic team — access limited to what's needed to maintain the system and fix problems
• Anthropic, provider of the Claude model used to generate answers — chat messages are sent to it for processing to generate a reply, and are not used to train the model
• Wasabi, our file storage provider — stores only images sent in chats, kept private
• Meta (Facebook, Instagram) and LINE — as owners of the channel you choose to message through, your messages are also subject to that platform's policies

Beyond this, we disclose data only when required by law or by order of a government authority.

6. Where data is stored

Chat messages are stored on our server located in Bangkok, Thailand · Images sent in chats are stored privately in file storage in the Singapore region, viewable only through temporary links that expire after 24 hours.

Processing to generate answers takes place on the model provider's servers, which are located outside Thailand — this cross-border transfer is limited to what's necessary to provide the service you are using.

7. How long data is kept

• While the clinic uses our service: chat history and images are kept for no more than 12 months from the latest message in each conversation, then deleted
• When the clinic stops using our service: all of that clinic's chat data is deleted within 90 days
• Names and phone numbers recorded by the clinic's team are the clinic's own data, and the clinic decides whether to keep or delete them

8. Asking us to delete your data

You can ask for your chat history to be deleted at any time, without waiting for the periods above. There are 2 ways:

• Say in the chat with that clinic that you want your conversation history deleted, or
• Email [email protected] with the name of the clinic you messaged, the channel you used (Facebook / Instagram / LINE / website), and the account name you messaged from

We will verify your identity, coordinate with the clinic as data controller, and complete the request within 30 days of receiving it, then confirm the result by reply to the email you contacted us from.

9. Your rights under the PDPA

You have the right to access and obtain a copy of your data, have it corrected, have it deleted or its use restricted, have it transferred, and object to its processing · You can exercise these rights through the same channels as section 8 · If you're not satisfied with how your request was handled, you have the right to complain to the Office of the Personal Data Protection Committee (PDPC), Thailand's data protection regulator.

10. Security

• All data is transmitted over encrypted HTTPS
• Images in chats are stored privately and can only be opened through a temporary link generated by the system
• Data is separated by clinic — one clinic's account cannot access another clinic's data
• Back-office accounts are issued to individuals, and clinic owners can revoke their own staff's access themselves

No system is 100% secure, but if a data breach affecting you occurs, we will notify the clinic concerned without delay.

11. Website chat box

The chat box embedded on clinic websites does not use tracking cookies and contains no advertising scripts · The system stores your latest conversation in your own browser (localStorage) so you can pick up where you left off when you return to the same page — this data stays on your device, and you can remove it by clearing the site's data in your browser.

12. Children and young people

This service is designed for adults contacting healthcare providers. If a minor needs to book an appointment or ask a question, a parent or guardian should make the contact or be present.

13. Changes to this policy

If we make changes, we will update the date at the top of this page. For changes that significantly affect your rights, we will notify you through the clinic you are in contact with.