This Privacy Policy explains how Renova Wellness Co., Ltd. (บริษัท รีโนวา เวลเนส จำกัด) ("we", "us", "the Clinic") collects, uses, stores, and protects your personal information when you use the KORE mobile application and related services (together, the "Service").
We are the data controller for the information described in this policy. If you do not agree with this policy, please do not use the Service.
1. Who we are
| Data controller | Renova Wellness Co., Ltd. (บริษัท รีโนวา เวลเนส จำกัด) |
|---|---|
| Registered address | 16 Soi Mee Suwan 3, Phra Khanong Nuea, Watthana, Bangkok 10110, Thailand 16 ซอยมีสุวรรณ 3 แขวงพระโขนงเหนือ เขตวัฒนา กรุงเทพมหานคร 10110 |
| system@korephysio.com |
2. Information we collect
2.1 Information provided by you or by the Clinic
Your account is created by clinic staff. The following may be recorded:
- Identity: title, first name, middle name, last name, nickname, date of birth
- Contact: email address, telephone number, postal address
- Emergency contact: name, telephone number, relationship to you
- Accessibility needs: whether you require ground-floor room access
- Profile photo, where you or the Clinic provide one
2.2 Health information
- Underlying diseases and medical conditions
- Allergies
- Current medications
- Treatment records and clinical notes recorded by your physiotherapist
- Treatment plans, assigned exercises, and your progress
- Appointment history, including attendance and cancellations
- Documents and files uploaded to your record by the Clinic
2.3 Transaction information
- Treatment packages purchased and sessions remaining
- Invoices, receipts, and the payment method recorded (cash, credit card, or QR payment)
We do not collect or store payment card numbers in the application. Payment is taken at the Clinic; the app records only that a payment occurred and by which method.
2.4 Information collected automatically
- Push notification token and device platform (iOS or Android), if you enable notifications
- Authentication tokens and your email address, stored securely on your device to keep you signed in
- Technical log data generated when the app communicates with our servers, including IP address and timestamps
2.5 What we do not collect
- We do not use analytics, advertising, or tracking software
- We do not track you across other companies' apps or websites
- We do not collect your location
- We do not access your contacts, photos, microphone, or camera unless you explicitly choose to upload something
- We do not sell your personal information
3. How we use your information
| Purpose | Legal basis under the PDPA |
|---|---|
| Providing physiotherapy care and maintaining your clinical record | Explicit consent; vital interests; preventive or occupational medicine |
| Scheduling, confirming, and reminding you of appointments | Performance of a contract |
| Processing payments, packages, and issuing receipts | Performance of a contract; legal obligation |
| Sending push notifications you have enabled | Consent |
| Keeping records required by healthcare regulations | Legal obligation |
| Securing the Service and preventing misuse | Legitimate interest |
4. How we share information
We share personal information only as follows:
- Clinic staff — administrators and physiotherapists involved in your care, on a need-to-know basis
- Service providers — acting on our instructions under contract:
- Google Cloud — application hosting and database
- Google Workspace — delivery of account and appointment emails
- Firebase Cloud Messaging — push notifications to the mobile app
- Cloudflare — DNS, and object storage for images and documents you or the Clinic upload
- Vercel — hosting for the staff web application
- Legal and regulatory bodies — where required by law, court order, or a lawful request
- Professional advisers — auditors or legal counsel, where necessary and under a duty of confidentiality
We do not share your information with advertisers or data brokers, and we do not sell it.
5. International transfers
Our application servers and database are hosted in Singapore (Google Cloud region asia-southeast1). Uploaded images and documents are stored with Cloudflare, and email is delivered through Google Workspace; both may process data outside Thailand.
Where personal information is transferred outside Thailand, we take steps to ensure it receives an adequate level of protection as required by the PDPA.
6. How long we keep your information
| Category | Retention period |
|---|---|
| Medical and treatment records | Counted from your last visit, for the period required of healthcare providers by Thai law |
| Invoices and financial records | For the period required by Thai tax and accounting law |
| Account and contact details | Until your account is closed, subject to the retention periods above |
| Push notification tokens | Deleted when you disable notifications, sign out, or close your account |
When a retention period ends, we delete the information or irreversibly anonymise it so that it can no longer be linked to you.
7. Closing your account
KORE accounts are created for you by the Clinic — the app has no self-registration. To close your account and stop using the Service, contact us at system@korephysio.com, or ask reception on your next visit. We will confirm once it is done and will respond within the period required by law.
When we close your account:
- Your access to the app ends and all sessions are signed out
- Your sign-in credentials are removed, so the account can no longer be used
- Your push notification tokens are deleted and we stop sending you messages
- Contact details held for use of the app are deleted or anonymised
8. Your rights
Under the PDPA you have the right to:
- Access your personal information and request a copy
- Rectify information that is inaccurate or incomplete
- Erase your information, where no legal retention obligation applies
- Restrict or object to certain processing
- Data portability — receive your information in a machine-readable format
- Withdraw consent at any time, without affecting processing already carried out
- Lodge a complaint with the Personal Data Protection Committee of Thailand
To exercise any of these rights, contact system@korephysio.com. We will respond within the period required by law. We may ask you to verify your identity first.
9. Push notifications
If you enable notifications, we send appointment reminders and exercise prompts. You can turn them off at any time in the app, or in your device settings. Disabling notifications does not affect any other part of the Service.
10. Security
We protect your information using measures including:
- Encryption of all traffic between the app and our servers (HTTPS/TLS)
- Authentication tokens stored in the device's secure keychain
- Role-based access controls limiting staff access to what their role requires
- Audit logging of access to and changes made to records
No system is completely secure. If a data breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.
11. Children
The Service is not intended for children under 20. Where a minor receives treatment, the account is managed by a parent or legal guardian, whose consent is obtained before any personal data is processed.
12. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will change, and where the change is significant we will notify you in the app or by email.
13. Contact us
Questions about this policy or about how we handle your information:
| system@korephysio.com | |
| Postal address | 16 Soi Mee Suwan 3, Phra Khanong Nuea, Watthana, Bangkok 10110, Thailand 16 ซอยมีสุวรรณ 3 แขวงพระโขนงเหนือ เขตวัฒนา กรุงเทพมหานคร 10110 |