Version 1 · Effective from 1 June 2022 · Last updated 1 October 2026
Mind and Mood Clinic Co., Ltd. (the “Clinic”, “we” or “Mind & Mood Clinic”) understands that matters of the mind are among the most personal of all. We therefore place the highest priority on confidentiality and on protecting your personal data. This Privacy Notice explains how we collect, use, disclose and safeguard your personal data, and the rights available to you under the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA”).
The Clinic provides specialised mental health services, including psychiatric treatment, Cognitive Behavioral Therapy (CBT) and child development care. This Notice applies to personal data we collect through our website www.mindandmood.clinic, our LINE Official Account @mindandmoodcbt, telephone, email, our telemedicine service, when you receive services at the Clinic, and through the CCTV system within the Clinic.
1Who this Notice applies to
- visitors and users of the Clinic’s website;
- persons who make enquiries or book appointments;
- patients, whether seen at the Clinic or by telemedicine, including patients who are minors;
- parents, legal representatives, emergency contacts, persons accompanying patients, and anyone entering the Clinic premises; and
- doctors, psychologists, staff, job applicants, suppliers and service providers of the Clinic.
2Personal data we collect
| Data subject group | Personal data collected |
|---|---|
| Website visitors | IP address, browser type and version, operating system, pages visited, date and time of visit, and data obtained through cookies. |
| Enquirers and persons booking appointments | Full name, LINE display name and user ID, telephone number, email address, preferred appointment date and time, preferred doctor, and the initial concern you choose to tell us. |
| Patients | Full name, date of birth, age, sex, national ID or passport number, address, contact details, occupation, emergency contact details, health insurance information (if any), appointment and payment history, and health data as described in section 3. |
| Telemedicine patients | Identity verification data before the consultation, such as an image of your national ID card and a photograph of your face; video and audio of the consultation (only where recorded as described in section 4); consultation notes; connection dates and times; and device and connection data necessary to provide the service. |
| Persons entering the Clinic premises | CCTV video footage, with the date and time of recording. |
| Parents and representatives | Full name, relationship to the patient, contact details, and documents evidencing authority to act on the patient’s behalf. |
| Staff, applicants and suppliers | Full name, educational and employment history, professional licence, contact details, taxpayer identification number, bank account details for payment, and information contained in contractual documents. |
3Health data and other sensitive personal data
To provide accurate and safe care, the Clinic must collect health data, which is sensitive personal data under the law, including:
- medical history, symptoms, treatment and medication history, and drug allergies;
- psychiatric and psychological assessment results, screening tools and questionnaires you complete;
- diagnoses, treatment plans, therapy notes, prescriptions and medical certificates;
- information on a child’s development, behaviour and learning, for our Child Development service; and
- information about family, relationships and other personal matters you share during therapy, to the extent necessary for your care.
The Clinic processes health data for medical diagnosis, the provision of health care and medical treatment, under the responsibility of professionals bound by a legal duty of confidentiality, in accordance with section 26 (5) (a) of the PDPA. In an emergency where you are unable to give consent, we may process your data to prevent or suppress a danger to the life, body or health of you or another person. For any purpose other than your care, such as sending information to a third party at your request, we will always obtain your explicit consent first.
Your treatment information is subject to duties of confidentiality under the law governing the medical profession, the Mental Health Act B.E. 2551 (2008), the National Health Act B.E. 2550 (2007) and the Criminal Code. The Clinic will not disclose your treatment information to your employer, school or family members without your consent, unless required by law or where necessary to prevent a serious danger to your life or the life of another person.
Where the patient is a minor, the Clinic will obtain the consent of the person exercising parental authority where required by law. In doing so, our doctors will also take into account the best interests and privacy of the minor.
For your privacy, we recommend sharing only the basic information needed to book an appointment via LINE or other online channels, and discussing the details of your concerns directly with your doctor at your appointment.
4Telemedicine and CCTV
Telemedicine. The Clinic provides consultations and follow-up care by video in accordance with the Ministry of Public Health Notification on Standards for Healthcare Facility Services Using Information Technology Systems B.E. 2564 (2021) and the guidelines of the Medical Council of Thailand. When providing this service:
- before your consultation begins, the Clinic will verify your identity to ensure that your treatment information is not disclosed to anyone else;
- doctors provide the service from a private setting and record the consultation in your medical record, just as for an in-clinic visit;
- if video or audio of the consultation is recorded, the Clinic will inform you before each session begins, and the recording will be kept as part of your medical record;
- data transmitted through the system is encrypted both in transit and at rest; and
- for your own privacy, we recommend joining from a place where others cannot overhear you, using your own device and internet connection.
CCTV. The Clinic operates CCTV cameras in common areas such as the entrance, reception and corridors, for the safety of patients, staff and property, with signs displayed where cameras are in use. The Clinic does not install CCTV cameras in examination rooms, consultation rooms or toilets. CCTV footage is accessible only to authorised persons and is disclosed only where necessary, for example to investigate an incident or at the request of officers acting under the law.
5Sources of personal data
- Directly from you, for example when you book via LINE or telephone, complete a registration form or assessment, or speak with a doctor or psychologist.
- Records made during examination, treatment and therapy by the Clinic’s doctors and staff.
- From parents or legal representatives, where the patient is a minor or unable to provide information themselves.
- From hospitals or other healthcare facilities that refer you to us or share in your care, with your consent or as necessary for your treatment.
- Automatically when you use our website, through cookies and similar technologies.
- Recorded by our telemedicine system and by CCTV within the Clinic.
6Purposes and lawful bases for processing
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries, booking, confirming and reminding you of appointments. | Contract (pre-contractual steps) |
| Taking your history, assessment, diagnosis, therapy, treatment, prescribing and follow-up. | Contract; section 26 (5) (a) |
| Providing consultations and follow-up care by telemedicine, including identity verification before the consultation. | Contract; legal obligation; section 26 (5) (a) |
| Preparing and retaining medical records. | Legal obligation; section 26 (5) (a) |
| Issuing medical certificates, treatment summaries or other documents at your request. | Contract; explicit consent where the document is sent to a third party |
| Referral to, or coordination of continuing care with, hospitals or other healthcare facilities, including the V Mind And Mood psychiatric department at Vibhavadi Hospital. | Section 26 (5) (a); explicit consent |
| Charging for services, issuing receipts and preparing accounting and tax records. | Contract; legal obligation |
| Preparing documents for insurance claims at your request. | Explicit consent |
| Acting in an emergency where there is a risk of danger to your life or the life of another person. | Prevention or suppression of a danger to life, body or health |
| Protecting the safety of persons and property within the Clinic by CCTV. | Legitimate interests |
| Improving service quality and compiling statistics in a form that does not identify individuals. | Legitimate interests |
| Maintaining the security of our information systems and website, and retaining computer traffic data as required by law. | Legal obligation; legitimate interests |
| Sending mental health articles, news and activities. | Consent |
| Establishing, exercising or defending legal claims. | Legitimate interests; section 26 (4) |
Where we process your personal data on the basis of consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
7Cookies
Our website uses cookies to ensure the website functions correctly, to remember your preferences and to understand how the website is used overall. The cookies we use fall into two categories:
- Strictly necessary cookies — required for the basic operation of the website and which cannot be disabled.
- Analytics cookies — which help us understand which pages are visited so that we can improve our content and user experience.
Our website does not use cookies to collect your health data. You may configure your browser to refuse or delete cookies at any time. Refusing certain cookies may however cause parts of the website to function incompletely.
8Disclosure of personal data
We do not sell your personal data. We disclose personal data only to the extent necessary, and only to the following recipients:
- the Clinic’s doctors, psychologists and staff involved in your care;
- parents or legal representatives, where the patient is a minor or incapacitated, as required by law;
- hospitals or other healthcare facilities sharing in or receiving a referral for your care, including Vibhavadi Hospital, with your consent or where necessary in an emergency;
- insurers or other payers of treatment costs, only at your request or with your consent;
- Holistic Development Center Co., Ltd., an affiliated company, as a provider of support services such as email systems and administration, subject to a duty of confidentiality and without access to your medical records;
- external service providers acting for the Clinic, such as medical record and information system providers, telemedicine platform providers, CCTV system providers, website hosting providers, LINE, and our accounting firm;
- professional advisers, such as auditors and legal counsel; and
- government authorities, healthcare regulators, courts or officers acting under the law, where the Clinic is under a legal obligation to disclose.
We require all recipients to maintain confidentiality and to process personal data only for the specified purposes and within the framework of the PDPA.
9Cross-border transfers
The Clinic may use cloud services, email services, telemedicine platforms or the LINE application, whose providers may store data on servers located outside Thailand. In such cases, we will ensure that adequate personal data protection measures are in place as required by the PDPA.
10Retention periods
| Category of data | Retention period |
|---|---|
| Medical records and treatment data, including telemedicine consultations | At least 5 years from the date the record is made, as required by the Healthcare Facilities Act B.E. 2541 (1998), and longer where necessary for continuing care or legal claims. |
| Telemedicine identity verification data | Kept together with the medical record. |
| CCTV footage | Up to 30 days from the date of recording, unless needed to investigate an incident or as evidence under the law. |
| Enquiry and appointment data where no service was received | 1 year from the most recent contact. |
| Accounting and tax documents | 10 years from the date of the document. |
| Applications from unsuccessful candidates | 1 year from the date the application is received. |
| Data used for sending news | Until you withdraw your consent. |
| Website computer traffic data | At least 90 days, as required by the Computer-Related Crime Act. |
Upon expiry of these periods, we will delete, destroy or anonymise the personal data.
11Security measures
We maintain appropriate organisational, technical and physical security measures, such as restricting access to medical records to the doctors and staff involved in your care, password controls and access logs, storage of documents in controlled areas, private consultation rooms, encryption of data in our telemedicine system, restricted access to CCTV footage, and confidentiality obligations imposed on all staff and external service providers.
In the event of a personal data breach, we will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you.
12Your rights as a data subject
Subject to the conditions set out in the law, you have the following rights:
- the right to withdraw consent, where we process your data on the basis of consent;
- the right to access and obtain a copy of your personal data, including a copy of your medical records;
- the right to data portability;
- the right to object to the collection, use or disclosure of your personal data;
- the right to request erasure, destruction or anonymisation of your personal data;
- the right to request restriction of the use of your personal data;
- the right to request rectification so that your personal data is accurate, up to date and not misleading; and
- the right to lodge a complaint with the Office of the Personal Data Protection Committee if you consider that we have not complied with the law.
Please note that the Clinic may be unable to delete medical records before the end of the legally required retention period, and may refuse access to certain information where disclosure would affect the rights or safety of another person, in which case we will give you our reasons. You may exercise these rights using the contact details in section 14. We will consider your request and inform you of the outcome within 30 days of receipt.
13Consequences of not providing personal data
Certain health and identification data is necessary for accurate and safe diagnosis and treatment, and for the preparation of medical records as required by law. If you do not provide it, the Clinic may be unable to provide appropriate examination, treatment or therapy to you.
14How to contact us
If you have any questions, wish to exercise your rights as a data subject, or wish to make a complaint about the protection of your personal data, please contact us at:
| Data controller | Mind and Mood Clinic Co., Ltd. |
| Address | 94 Soi Phaholyothin 32, Phaholyothin Road, Chan Kasem, Chatuchak, Bangkok 10900, Thailand |
| Taxpayer identification number | 0105559021112 |
| contact@holistic.co.th | |
| Telephone | +66 (0)2561 0210-11 · +66 (0)6 1401 2274 |
| LINE Official | @mindandmoodcbt |
| Website | www.mindandmood.clinic |
You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) if you consider that our processing of your personal data does not comply with the law.
The channels above are not for emergencies. If you or someone close to you is in crisis or at risk of harm, please call 1669 (emergency medical services) or 1323 (Department of Mental Health hotline), available 24 hours a day.
15Changes to this Notice
We may review and update this Notice from time to time to reflect changes in the law and in our services. The current version will be published on our website together with its effective date. We encourage you to review this Notice periodically.