Privacy policy

1. Who we are

IV Drip Koh Lanta (“we”, “us”) is a mobile IV therapy service on Koh Lanta, Krabi, Thailand. The business responsible for your personal data (the “data controller”) is [BUSINESS NAME], [BUSINESS ADDRESS].

This policy explains what personal data we collect when you visit ivdripkohlanta.com or book a treatment, why we collect it, and your rights under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). For any privacy question, email [EMAIL] or call +66 [PHONE].

2. What we collect

When you book. Bookings are made by WhatsApp, phone or email. We collect what you send us, usually:

• your name and phone number or WhatsApp account
• where you are staying (hotel, villa or area) so the nurse can find you
• the drip you are interested in, the number of people and the time you would like
• anything else you choose to tell us in your message

Health information. Before any treatment, our nurse asks about your health, medicines and allergies, and checks your blood pressure and other vital signs. This is sensitive personal data under the PDPA. We only collect it with your explicit consent, which we ask for before treatment, and we use it only to decide whether a drip is safe for you and to care for you.

Payment. If you pay by card or bank transfer, the payment is handled by the bank or payment provider. We keep a record of the amount, date and method, but not your full card details.

On this website. The booking form on our contact page does not send anything to us or store anything on this website. It only prepares a WhatsApp message on your own device, which you choose whether to send. Like most websites, our web server keeps short technical logs (such as IP address, browser type and pages requested) for security and to keep the site running.

3. How we use it and why we are allowed to

• To arrange and provide your treatment (contract): replying to you, booking a time, sending a nurse and taking payment.
• To keep you safe (explicit consent, and vital interests in an emergency): the health check, choosing a suitable drip, recording what was given, and calling emergency services (1669) if needed.
• To meet legal duties (legal obligation): keeping treatment and accounting records required by Thai law.
• To run and protect this website (legitimate interests): security and fixing problems.

We do not sell your personal data, and we do not use it for advertising. We only send you marketing messages if you ask us to, and you can stop them at any time.

4. Cookies and analytics

This website does not use advertising cookies or tracking tags, and it does not currently use Google Analytics or any similar analytics service. The site may set essential cookies needed for it to work, for example for site administrators who log in.

Some pages show a Google Maps map, and WhatsApp links open WhatsApp. When you use these, Google or WhatsApp (Meta) may collect data under their own privacy policies. If we add analytics in future, we will update this policy and ask for your consent where the law requires it.

5. Who we share it with

Only the people who need it to provide your treatment can see your data: our nurses and the staff who handle bookings. We also use a small number of service providers:

• WhatsApp (Meta) and our phone and email providers, for messages with you
• our website host, which stores this website and its server logs
• banks and payment providers, to process payments
• hospitals, clinics or emergency services, only if you need further medical care, or in an emergency
• government authorities, only when Thai law requires it

Some of these providers, such as WhatsApp and Google, may store data outside Thailand. Where they do, we rely on the safeguards allowed by the PDPA, such as the provider’s own data protection commitments.

6. How long we keep it

• Booking messages and contact details: as long as needed to arrange your treatment and answer follow-up questions, then deleted within 12 months unless you book again.
• Health check and treatment records: [RETENTION PERIOD] after your treatment, to meet our medical and legal duties.
• Payment and accounting records: as long as Thai tax and accounting law requires.
• Website server logs: a short period, normally no more than 90 days.

7. How we protect it

Health information is only seen by the nurse treating you and the staff who need it. Records are kept on password-protected devices or in locked storage, and we delete or anonymise data when we no longer need it. No system is perfectly secure, but we take reasonable steps to protect your data and will tell you and the authorities about a serious breach as the PDPA requires.

8. Your rights

Under the PDPA you have the right to:

• ask for a copy of your personal data, and ask how we got it
• have incorrect or incomplete data corrected
• have your data deleted, or its use restricted, where the law allows
• object to how we use your data
• receive your data in a common electronic format, or have it sent to someone else
• withdraw your consent at any time. This does not affect anything we did before you withdrew it, but we may then be unable to provide treatment.

To use any of these rights, email [EMAIL]. We will reply within 30 days. If you are not happy with our reply, you can complain to the Office of the Personal Data Protection Committee (PDPC), Thailand: www.pdpc.or.th.

9. Children

If a booking is for someone under 20 (the age of majority in Thailand), a parent or guardian must make the booking and give consent for the health check and any treatment.

10. Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows when it was last updated. If we make important changes, we will make them clear on this page.