Privacy Policy

Ovio Wellness Limited is the intended operating-company name used in this pre-launch policy. Before services launch, the registered legal operator must be confirmed as the data controller responsible for the processing described here. This draft does not represent that the proposed company name has already been registered.

For privacy questions or requests, contact our privacy contact at info@oviowellness.com or +66 98 296 1357. Our correspondence address is 50 Sukhumvit 15, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand.

Laboratories and other providers may have independent legal responsibilities for some processing. Contact us for information about relevant recipients, their roles and available privacy notices.

We receive information from you through website forms, bookings, email, WhatsApp, LINE, telephone and consultations. We also receive information generated by our doctors and nurses, test information from our laboratory, payment confirmations from processors and technical information from your website use. Where another person books for you or a guardian acts for you, they may provide information on your behalf; we verify authority where appropriate.

Depending on your interaction, we collect:

• Identity and contact information, such as name, date of birth, telephone number, email and necessary identity-verification information.
• Home-visit details, including address, location and building-access instructions.
• Appointment, package, payment, refund and receipt records, including transaction references and bank details where needed for a refund.
• Health information, including symptoms, relevant history, allergies, medicines, consultation notes, procedure records, blood-test requests and results, prescriptions, medicine-supply records, certificate assessments and sensitive sexual-health information, including PEP/PrEP care.
• Communications, complaints, follow-up records and preference or consent records.
• Technical information, such as IP address, device/browser information, cookie identifiers and website interactions, subject to your applicable tracking choices.

Health information is sensitive personal data. Please provide only information relevant to your request and avoid sending another person’s records without authority. Consultation calls are not audio/video recorded at launch; clinical and administrative staff may keep written notes.

We use personal information only where an applicable lawful basis is available. Accepting our terms or reading this policy does not, by itself, provide consent for every processing activity.

Where we rely on legitimate interests, we assess whether those interests are overridden by your rights. Where explicit consent is required, we request it separately and explain the purpose. Withdrawal does not affect processing already lawfully carried out or processing we must continue on another valid basis.

Some contact, location and clinical information is necessary to book or safely provide a requested service. If you do not provide it, we may be unable to proceed. Optional marketing or tracking choices are not a condition of receiving care.

Authorised doctors, nurses and clinic administrators may access information needed for their duties. Administrative staff may see health information submitted to shared enquiry channels for coordination and follow-up. The responsible doctor has final authority over clinical advice and procedure approval. Access should be limited by role and need; authorisation is not unrestricted access to every record.

We share necessary information with:

• NGD Lab Thailand: patient and test details and samples needed for laboratory testing and reporting.
• 75health: the health-record and CRM service used to store and manage customer and medical records.
• Google Workspace: business email and associated enabled business services.
• WhatsApp and LINE: communications through those channels, including information you choose to send there.
• Payment processors and banking providers: payment processing, transaction verification and refunds.
• Website hosting, IT and support providers: operation, support and protection of our services.
• DataFast: website analytics (pages viewed, where visitors came from, device, browser and approximate location), through a first-party address on our own domain.
• respond.io: the messaging platform behind our website chat widget, and where enquiries sent through our contact form are recorded as leads with a note of the message and its source.
• Authorised dispensing and delivery personnel: the prescription, supply and contact details necessary to provide medicines, with access limited to their duties.
• Regulators, public authorities, professional advisers and others where disclosure is required or permitted by law, including appropriate clinical referrals and legal claims.

We do not use medical conditions or test results to target promotions at launch. Health records and test results must not be supplied to advertising platforms for marketing.

75health is reported to host its primary production infrastructure in the United States. Google Workspace, communications platforms and other technology providers may also process information outside Thailand. We will not use an overseas service for personal information unless an applicable Thai PDPA transfer basis and appropriate safeguards have been established. These may include legally recognised contractual safeguards where applicable. Please contact our privacy contact for information about the locations, recipients and safeguards relevant to your data. Acceptance of this policy is not blanket consent to international transfers.

You may contact us through your preferred available channel. Health information you send through email, WhatsApp or LINE is processed through that platform as well as by Ovio. Those providers’ own terms and privacy notices may apply to their independent processing.

Results are emailed as encrypted, password-protected files with a secure password set by Ovio. Contact us if you need help accessing them. We may verify identity before disclosing records or restoring access. Please keep your contact details current and tell us if you believe results were sent to the wrong recipient. A channel preference does not waive Ovio’s security responsibilities.

We may contact you for booking confirmations, preparation instructions, results, clinically appropriate follow-up and critical findings. Necessary service communications are distinguished from promotions.

We send general promotional messages by email, WhatsApp or LINE only after a separate, optional opt-in for the relevant channels, such as a choice on our website or in a bot conversation. Entering your email, talking to a bot, making a booking or accepting our terms does not by itself enrol you in marketing.

General promotions may cover our services, including PEP and PrEP where advertising is permitted. We do not target you using your diagnoses, test results, sexual-health history or use of PEP/PrEP. Promotional content remains subject to applicable healthcare and medicine-advertising requirements.

You may unsubscribe using the link in promotional emails, reply STOP to promotional WhatsApp or LINE messages, or contact info@oviowellness.com. We will stop direct marketing to which you object and take the steps needed to honour your channel choices. If you ask to stop all marketing, the request applies across our marketing channels. We may retain a minimal suppression record to avoid contacting you again.

Stopping marketing does not stop necessary appointment, results, payment or safety communications. Consent to treatment is separate from marketing permission.

Our website uses a small number of cookies and similar technologies. Some remember your choices while you use a feature, such as a booking request. Others measure how the website is used. We use DataFast, a website analytics service, which sets first-party cookies on your device to count visitors, visits and pages and to see which pages and campaigns lead people to contact us. The chat widget provided by respond.io stores a small item in your browser. Each one, and how long it lasts, is listed in our Cookie Policy.

We do not use advertising cookies, and we do not use Google Analytics or Meta Pixel. There is currently no cookie preferences panel on this website. You can block or delete cookies in your browser settings; the website still works if you do, and blocking analytics does not affect your ability to request care.

We do not send the contents of forms or messages to our analytics service, and we do not treat health-information submissions as permission for advertising tracking. If we add tools or a consent control, we will update this policy and the Cookie Policy first.

We retain information for the time needed for its purpose, applicable legal recordkeeping, clinical continuity and the establishment, exercise or defence of legal claims. We do not adopt indefinite retention solely because someone has not requested deletion.

Customer and medical records are normally retained for five years from the last appointment. We keep them longer where required by law or justified by an applicable clinical or legal recordkeeping obligation, including rules relating to minors and legal claims. Five years is our proposed baseline, not a representation that every record can legally be deleted at that point.

Enquiries that do not lead to an appointment are kept only as long as needed to answer the enquiry, resolve follow-up or complaints and meet applicable obligations. Unnecessary chat attachments and duplicate records are removed when no longer needed for those purposes. Payment and tax records follow applicable accounting and tax retention requirements.

Marketing contacts are used while valid consent remains in place and the purpose continues. After withdrawal, we stop marketing and retain only evidence or suppression details needed to demonstrate and respect your choice. Cookie and analytics retention follows the settings disclosed in the cookie preferences panel. Security logs and backups are retained for the period needed for security, recovery and legal obligations, with deletion through the applicable maintenance cycles.

When retention is no longer justified, information is securely deleted or anonymised, subject to documented backup cycles and legal holds. Deletion requests may not require immediate deletion of records we must lawfully retain; we will explain relevant restrictions.

We apply appropriate organisational and technical safeguards proportionate to the information and risks, including role-appropriate access, confidentiality controls and protected result delivery. No system can guarantee absolute security. We investigate suspected incidents and make notifications when required by law.

Do not send complete payment-card details through email or chat. Contact us promptly if you suspect unauthorised access or disclosure involving your information.

Subject to applicable conditions and exceptions, Thai data-protection law provides rights to request access and a copy, correction, deletion or anonymisation, restriction, portability where applicable, and to object to certain processing, including direct marketing. You may withdraw consent where we rely on it and complain to the competent Thai personal-data-protection authority.

To make a request, contact info@oviowellness.com with enough information for us to locate the relevant record. We may reasonably verify your identity and authority. We respond within applicable statutory periods and explain any lawful refusal, restriction or need for further information. Requests are not limited to customers who continue purchasing services.

Our default service offering is for adults aged 18 and above. Where a minor receives care, we verify relevant parental or guardian authority and obtain any required consents under applicable law, including additional requirements that may apply to persons aged 18 or 19. A parent or guardian’s presence does not automatically settle all confidentiality or disclosure questions. Records of different family members remain separate, including after a package transfer.

We update this notice when relevant practices change and show the effective date. Where a new purpose requires additional notice or consent, we provide it before the relevant processing.

Privacy requests: info@oviowellness.com | +66 98 296 1357. Correspondence: 50 Sukhumvit 15, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand.