Privacy Notice

Privacy notice

How we collect, use and disclose the personal data of patients, guardians and users of Thai Cleft Link and the primary care app.

What we collect Identity, contact and health data needed for treatment Why To treat and follow up patients. Never sold, never used for ads Who sees it Only the teams caring for the patient, by role and area Your rights Access, correct, delete, object, or withdraw consent

Last updated 3 November 2026

Data controller

The Princess Sirindhorn IT Foundation Craniofacial Center, Chiang Mai University (“the Center”, “we”) is the data controller for Thai Cleft Link and the primary care app. We process personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) and the Chiang Mai University Privacy Policy.

This notice covers only the data recorded in these two systems. It does not cover the medical records of individual hospitals, which follow each hospital’s own policy.

Data we collect

Patients and guardians

IdentityName, national ID number, date of birth, sex, nationality, hospital number (HN)
ContactAddress, home location on a map, phone number
GuardianName, relationship to the patient, national ID number and contact details
Health data (sensitive)Diagnoses, treatment and surgical history, clinical photographs, speech, development and hearing assessments, appointments and home-visit records
Travel reimbursementJourney details and the bank account for payment, only for those who claim
Consent formsSigned by the patient or guardian

System users (clinical and administrative staff)

AccountName, organisation, position, role, email and username
Activity logSign-in times, records viewed or changed, and IP address

Where the data comes from

  • Patients or guardians, directly, during treatment or a home visit
  • Staff of network hospitals and primary care units caring for the patient
  • Information systems of the hospitals caring for the patient, such as appointment and surgery data

Purposes and legal bases

Purpose Legal basis
Diagnosis, care planning, appointments and referral between network hospitals and primary care units Preventive medicine, medical diagnosis and treatment (Section 26(5)(a)) and explicit consent (Section 26)
Home visits, following up missed appointments, and finding new patients in the community Preventive medicine and medical treatment (Section 26(5)(a)) and public interest in public health (Section 26(5)(b))
Paying travel costs and financial support to patients and families At the data subject’s request (Section 24(3)) and consent
Reports, statistics and dashboards to improve the network’s quality of care Public task (Section 24(4)), using aggregated or de-identified data where possible
Medical research Research or statistics (Sections 24(1) and 26(5)(d)), with approval from a human research ethics committee
Managing user accounts, controlling access and auditing use to keep data secure Legitimate interest (Section 24(5)) and legal obligation (Section 24(6))

We do not sell personal data, and we do not use it for advertising or marketing.

Disclosure

We disclose only what each purpose above requires, to:

  • Network hospitals and primary care units caring for that patient. Each user sees data according to their role and organisation; community teams see only patients in their assigned area.
  • System and infrastructure providers processing data on our behalf, under agreements that require confidentiality and security.
  • Government authorities where required by law or a lawful order.

Every user must accept the Center’s terms for the use of electronic data, which limit use to patient care and forbid disclosure to anyone else without permission.

Retention

We keep patient data for as long as treatment and follow-up continue — for cleft lip and palate this can run into adulthood — and afterwards for as long as the law or regulations on medical records require. Account data is kept while the account is active, and activity logs only as long as security review needs them. After that, data is deleted, destroyed or de-identified.

Security

Only approved users can sign in; access is limited by role and organisation
Data travels over encrypted connections (HTTPS)
Access and changes are logged and can be audited
Regular backups, stored on Chiang Mai University servers

Your rights

Patients, guardians (where the patient is a minor) and users have the right to:

Access their data and obtain a copy
Have inaccurate or outdated data corrected
Have their data transferred
Object to, or restrict, the use of their data
Have their data deleted, destroyed or de-identified
Withdraw consent at any time, without affecting processing already done

Withdrawing consent may stop the network from coordinating care continuously. Some requests can be limited where the law allows, for example for data that must be kept as a medical record. We will respond within 30 days of receiving a request. If you believe your data is not being processed lawfully, you may complain to the Personal Data Protection Committee.

Cookies

Thai Cleft Link uses only necessary cookies: one to keep you signed in, one to protect against request forgery (CSRF), and one to remember the language you chose. We use no advertising or tracking cookies. Map pages inside the system load Google Maps, which is covered by Google’s privacy policy.

Changes to this notice

We may update this notice when the systems or the law change. The latest version is always published on this page with its date.

Contact us

To exercise your rights or ask about your personal data, contact:

Princess Sirindhorn IT Foundation Craniofacial Center, Chiang Mai University
Tawan Kangwanpong Building, 3rd floor, Maharaj Nakorn Chiang Mai Hospital
110 Inthawarorot Road, Suthep, Mueang Chiang Mai, Chiang Mai 50200, Thailand
Phone 053-935177, 053-934011 · Email scfc@cmu.ac.th