Privacy Policy — Konkai Health

1. Who We Are

Konkai Health ("we", "us", "our") is a medical tourism referral service based in Thailand. We help international patients book appointments at partner hospitals and clinics in Thailand. Our website is konkai.health.

2. Data We Collect

When you use our appointment booking service, we collect the following personal data:

- Personal information: Full name, email address, phone number, date of birth, nationality

- Identity document: Passport scan (for hospital registration)

- Appointment preferences: Preferred hospital/clinic, medical department, preferred dates, timing preferences, notes

- Technical data: IP address (for security and fraud prevention)

- Analytics data: Page views and booking funnel interactions (with consent for EU visitors; see Section 11)

3. Why We Collect It

We collect your data for the following purposes:

- To facilitate your appointment request with the hospital or clinic you select

- To communicate with you about your appointment (verification, confirmation, updates)

- To share your details with the hospital so they can process your appointment

- To improve our service through anonymised analytics

Legal obligation: Record retention as required by Thai Revenue Code Section 87/3

4. Who We Share Your Data With

We share your personal information with:

Your personal data may be shared with:

• ‍Partner hospitals and clinics: The hospital or clinic you select receives your appointment details and passport scan for registration‍
• Cloudflare: Website hosting, CDN, and file storage (Cloudflare R2)
• Render: Application hosting‍
• Postmark: Transactional email delivery (retains message content for up to 45 days)‍
• Sentry: Error monitoring (PII is scrubbed before transmission)‍
• PostHog: Analytics (EU visitors must opt in; non-EU visitors can opt out)

We do not sell your personal data to third parties.

6. Cross-Border Transfers

Your data may be processed outside Thailand through our service providers (Cloudflare global network, Render US, Postmark US). These transfers are protected by:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (AES-256)
• Service provider security certifications and data processing agreements

• ‍Management links: Expire 90 days after appointment completion or cancellation‍
• Appointment records: Retained for 63 months (5 years + 3 months) from appointment completion, for commission verification and tax compliance (Thai Revenue Code Section 87/3)‍
• After retention period: All remaining personal data is permanently deletedPassport files
• Passport files are automatically deleted 90 days after your appointment is completed or cancelledUnverified appointment requests
• Unverified appointment requests are automatically deleted 48 hours after submission if the email is not verifiedAppointment records
• Appointment records (excluding passport files) are retained for service and compliance purposes. Contact us to request deletion.

7. Data Retention

8. Your Rights

Under PDPA (Thailand) and GDPR (EU), you have the right to:

• Access your personal data
• Export your data in a portable format
• Rectify inaccurate data
• Erase your personal data (right to be forgotten)
• Withdraw consent for analytics cookies via the "Manage cookies" link, or for data processing by contacting us

To exercise any of these rights, email [email protected] with your reference code (KH-XXXXXX). We will respond within 30 days.

You also have the right to lodge a complaint with:

• Thailand: Office of the Personal Data Protection Committee (PDPC)
• EU: Your local data protection supervisory authority

9. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

10. Minimum Age

Our service is intended for adults (18+). Booking on behalf of minors requires parent or guardian consent.

11. Cookies and Analytics

We use PostHog for anonymised website analytics on our appointment booking pages. This helps us understand how patients use our service and improve the experience. PostHog does not receive any personally identifiable information.

We do not use advertising cookies or third-party tracking. You can manage your cookie preferences at any time via the "Manage cookies" link in the page footer.

12. Security Measures

We protect your data with:

• AES-256 encryption at rest for all personal data fields
• Encrypted file storage for passport documents
• Encrypted sessions
• HTTPS enforcement on all connections
• Rate limiting on all form submissions
• Two-factor authentication for administrative access
• PII scrubbing before error reporting

13. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via our website. The "Last updated" date at the top of this page indicates the most recent revision.

14. Contact

For privacy-related questions or to exercise your data rights:

Email: [email protected]