Privacy Policy

1. Definitions

• “the Hospital”, “we” means Hug & Heal Co., Ltd., operator of Hug & Heal Pet Hospital & Community.
• “the website” means hugandheal.co.th and all pages under that domain.
• “you” means a visitor to or user of the website, a person who contacts us, requests an appointment, or subscribes to our newsletter.
• “PDPA” means the Personal Data Protection Act B.E. 2562 (2019) and its subordinate regulations.
• “personal data” means information relating to a person that enables that person to be identified, directly or indirectly, as defined in the PDPA.

2. Scope

This policy applies to personal data we collect through the website, and through enquiries or appointment requests you send us using the channels on it.

It does NOT apply to (1) the medical records created when you bring a pet to the hospital for treatment — those are governed by the consent form and notice provided at the point of care — or (2) third-party websites, applications or services linked from our website, whose privacy practices we do not control and are not responsible for.

3. Personal data we collect

We collect only what we need:

• Newsletter sign-up: your email address, chosen language, where on the site you subscribed, the dates you subscribed and confirmed, plus technical browser information (user agent) and the page you subscribed from (referrer).
• Contact / appointment-request form: your name, email address, phone number (if you provide one), your preferred contact channel, the message you send, the language used, the date and time, plus user agent and referrer.
• Website usage: information from cookies and similar technologies — such as pages viewed, time on page, and approximate device information — but only in the categories you consent to (see section 6).
• Anything you volunteer: any text or information you choose to put in a message box, which may include details about your pet.

The website is not designed to collect sensitive personal data under section 26 of the PDPA. Please avoid submitting such data through the message boxes on the site.

The website has no public user accounts and takes no payments, so we do not hold passwords or payment card details.

4. Where the data comes from

• Directly from you, when you complete a form, subscribe, or contact us.
• From your use of the website, via cookies and analytics tools, subject to your consent.
• From the service providers we use to run the website, to the extent set out in section 8.

5. Purposes and legal bases

We process your personal data for the following purposes, on the following legal bases:

• To reply to your enquiry and act on your appointment request — legitimate interest and/or steps taken at your request prior to entering into a contract.
• To send you our newsletter, pet-health articles and event news — consent, which you may withdraw at any time.
• To analyse and improve the website — consent (analytics cookies).
• To keep the website secure and prevent abuse and automated submissions — legitimate interest.
• To comply with applicable law, or with an order of a government authority or a court — legal obligation.
• To establish, exercise or defend legal claims — legitimate interest.

If we later wish to use your data for a purpose that is not compatible with those above, we will tell you and obtain your consent first.

6. Cookies

The website uses three categories of cookies. You can accept or reject the non-essential categories in the cookie consent banner, and change your choice later.

• Strictly necessary — required for the site to work, for example to remember your consent choice. These cannot be switched off.
• Analytics — helps us understand overall site usage through Google Analytics. Runs only with your consent.
• Marketing — used to measure and present relevant content. Runs only with your consent.

7. How long we keep your data

• Newsletter subscribers: for as long as you remain subscribed, then deleted or anonymised within 12 months of you unsubscribing.
• Contact / appointment enquiries: no longer than 2 years from your last contact, unless the enquiry becomes part of your service history, in which case the hospital's medical-records retention period applies.
• Cookie data: for the lifetime of each cookie.

After those periods we delete, destroy or anonymise the data, unless we must keep it to comply with a legal obligation or to establish or defend a legal claim.

8. Disclosure of personal data

We treat your personal data as confidential. To provide the services described above, we may disclose it, only as far as necessary, to:

• Website and database infrastructure providers: Supabase (database and authentication) and Vercel (website hosting).
• Email delivery provider: Resend, for newsletter confirmation emails and internal notification emails.
• Analytics and maps providers: Google (Google Analytics and Google Maps), subject to your consent.
• Our professional advisers, such as lawyers or auditors, as necessary and under a duty of confidentiality.
• Government or regulatory authorities, where we are required by law or by court order to do so.

We do not sell, rent or trade your personal data to third parties for their own marketing.

9. International transfers

Some of the providers in section 8 process or store data on servers outside Thailand — our database is hosted in the Singapore region, and our hosting, email and analytics providers may process data in the United States or other regions.

Where that happens, we transfer only what is necessary and put appropriate safeguards in place as required by the PDPA.

10. Children's data

This website is not intended to collect personal data from children. If you are a parent or guardian and believe your child has sent us personal data, please contact us using section 14 and we will delete it.

11. Security measures

We maintain appropriate security measures to prevent unauthorised or unlawful access to, use, alteration or disclosure of personal data — including encrypted connections (HTTPS), restricting access to staff who need it, and database-level access controls.

However, no transmission over the internet can be guaranteed to be completely secure, so we cannot absolutely guarantee the security of data you send us over the internet.

12. Your rights

Under the PDPA you have the right to:

• access your personal data and obtain a copy of it;
• have your personal data transferred to another data controller;
• object to the collection, use or disclosure of your personal data;
• request erasure, destruction or anonymisation of your personal data;
• request that we suspend use of your personal data;
• have inaccurate, out-of-date or misleading data corrected;
• withdraw a consent you have given, without affecting processing already lawfully carried out; and
• lodge a complaint with the Personal Data Protection Committee if we fail to comply with the law.

To exercise any of these rights, contact us using section 14. We will consider your request and respond within the period required by law. You can unsubscribe from the newsletter immediately using the unsubscribe link in every email.

13. Changes to this policy

We may update this policy from time to time to reflect changes in the law or in our services. The updated version will be published on this page with a new “last updated” date.

14. Contact us

If you have questions or wish to exercise your rights under this policy, please contact:

• Data controller: Hug & Heal Co., Ltd.
• Address: 22 Ratchaphruek Rd., Bang Phrom, Taling Chan, Bangkok, 10170
• Email: contact@hugandheal.co.th
• Phone: 02-124-3941