This notice explains how Beyond Nova Sàrl handles personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the 'PDPA') when clinics in Thailand use MCS Clinic. Read it together with our Privacy Policy and our Data processing summary. For data covered by the PDPA, this notice applies where they differ.
In short: the clinic decides what it records about its patients and is responsible for that data. We store and process it only to run the Service for the clinic, keep each clinic's data separate from every other clinic's, and help the clinic answer patients who exercise their rights.
Who is responsible for what
Patient data. For the records a clinic keeps in its workspace (patients, appointments, treatment notes, photos, consent forms, invoices and messages with patients), the clinic is the data controller. It decides why and how that data is processed, and it must have a lawful basis for doing so.
For that data, Beyond Nova Sàrl is the clinic's data processor. We process it only on the clinic's documented instructions: the subscription agreement, our Data processing summary and the settings the clinic chooses in the product. We do not sell patient data or use it for our own marketing.
Clinic account data. For the data we need to run our own business (clinic owner and staff accounts, sign-in records, billing and subscription details, support requests, and visitors and contacts on our websites), Beyond Nova Sàrl is the data controller.
Where personal data comes from
Clinic staff enter most patient data themselves. A clinic also receives personal data through the channels it connects to its workspace: LINE (as a lead source and booking channel), WhatsApp, Facebook Messenger, Instagram and the clinic's website forms, as well as leads and bookings taken by phone, at walk-in or by referral. The messages, names, profile details and contact details that people send through these channels are stored in the clinic's workspace.
The clinic decides which channels to connect and can disconnect them at any time. Channel providers such as LINE and Meta (for WhatsApp, Messenger and Instagram) handle messages under their own terms before the messages reach the Service.
Lawful bases
For patient data, the clinic chooses the lawful basis: for example, performing its contract with the patient (section 24(3)), a legal obligation such as keeping medical records (section 24(6)), or consent (section 19). The Service is a tool the clinic uses on that basis.
For clinic account data, we rely on performing our contract with the clinic (section 24(3)), our legal obligations such as accounting and tax records (section 24(6)), and our legitimate interest in keeping the Service secure and improving it (section 24(5)). We ask for consent where the PDPA requires it, for example for optional marketing.
Health data and explicit consent
Health information, medical records, treatment photos and similar data are sensitive personal data under section 26 of the PDPA. A clinic may collect them only with the patient's explicit consent, unless another exception in section 26 applies, for example where the law requires the processing for medical diagnosis or treatment. The clinic is responsible for obtaining that consent and keeping a record of it.
The Service helps clinics do this. Signed consent forms are stored with the template version, the signature, the time and any witness. Marketing and photo consent are recorded on the patient's record and can be cleared when the patient withdraws it, so staff know to stop processing that relied on it.
Your rights under the PDPA
Under the PDPA, you have the right to be informed about how your personal data is used; to access it and obtain a copy; to data portability; to object to processing; to ask for erasure or anonymisation; to restrict processing; to have inaccurate data corrected; and to withdraw consent at any time. Withdrawing consent does not affect processing that took place before. You may also complain to the Personal Data Protection Committee (PDPC).
Patients: the clinic that treats you holds your record and decides on your request, so please contact the clinic directly. If you contact us instead, we pass your request on to the clinic. We help clinics respond: staff can view and correct patient records in the product, and on the clinic's instruction we provide a copy of a patient's data in a machine-readable format or delete it.
Clinic owners, staff and website visitors: email [email protected] from the address linked to your account. We confirm the request comes from you and respond within 30 days. Our Privacy Policy explains how deletion works.
We may refuse or limit a request where the PDPA allows it, for example where the law requires us to keep the data, as with invoices and tax records. If we do, we tell you why.
Transfers outside Thailand
Beyond Nova Sàrl is based in Switzerland. The Service and some of our service providers (for hosting, payments, email and AI features) may process data outside Thailand, including in Switzerland, the United States and other regions where we or they operate. When data covered by the PDPA is transferred abroad, we rely on the safeguards in sections 28 and 29 of the PDPA, such as contractual protections with our service providers, and we apply the same security measures wherever the data is processed.
Retention
Patient data is kept for as long as the clinic keeps it in its workspace. Each clinic decides how long to keep medical records under Thai law. When a workspace is deleted, its data is removed from our live systems straight away, and copies in our encrypted backups expire within 14 days. We keep clinic account and billing data while the account is active and afterwards for as long as the law requires, for example for accounting and tax. Security logs are kept for 180 days.
Conversations with the Luna demo on our website are kept for 90 days and then deleted. If you leave your email there, we keep it with your questions as an enquiry until you ask us to remove it or we no longer need it to follow up.
How we protect data
Each clinic's data is kept in its own database schema, which is accessed through a database role of its own, so one clinic's data stays separate from every other clinic's. Within a clinic, row-level security in the database limits staff to the branches they are allowed to see, and access in the product depends on each person's role.
Data is encrypted in transit over HTTPS. Channel access tokens, integration credentials and other secrets are stored encrypted. The database is backed up every night and before every update, and the backups are encrypted and kept apart from our servers. Views of and changes to patient records, sign-ins and administrative actions are written to audit logs, so a clinic can see who opened or changed a record and when.
Personal data breaches
If we become aware of a breach affecting a clinic's patient data, we tell the clinic without undue delay and give it what it needs to notify the PDPC within 72 hours of becoming aware of the breach, and to inform affected patients where the risk to them is high. For data we control, we notify the PDPC within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to anyone's rights and freedoms, and we inform the people affected without delay where the risk is high.
Contact
For PDPA questions or requests, write to our data protection contact at [email protected]. Clinics that need a signed data processing agreement can request one at the same address.
Beyond Nova Sàrl, Avenue de la Gare 2, 1003 Lausanne (UID CHE-209.245.388). Thailand office: Exchange Tower, 388 Sukhumvit Rd, Khlong Toei, Bangkok 10110, Thailand.