Privacy Policy | BeWellAsia

Website: www.bewellasia.co
bewellasia.co is a registered trademark operated by NFNT Co., Ltd.

In this Privacy Policy, "bewellasia.co", "we", "us", and "our" refer to NFNT Co., Ltd., unless stated otherwise.

1. Scope and purpose

This Privacy Policy explains how we collect, use, disclose, transfer, and protect personal data when you:

visit our website,
create an account or purchase services through our platform,
communicate with us, or
otherwise use our services (together, the "Services").

This Privacy Policy is intended to comply with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and applicable Thai laws.

2. Our service model

bewellasia.co operates an online platform that facilitates access to diagnostic and health-related services provided by third-party laboratories, clinics, phlebotomy providers, and related partners ("Service Providers").

Depending on the specific service flow:

NFNT Co., Ltd. acts as a data controller for platform operations, including account management, customer support, payment facilitation, platform security, and analytics.
Service Providers typically act as independent data controllers for their professional and clinical services, including sample collection, laboratory testing, interpretation of results, issuance of medical documents, and regulatory record-keeping.
In limited cases, Service Providers may act as data processors for NFNT Co., Ltd., strictly according to contractual instructions and applicable law.

bewellasia.co does not provide medical diagnosis or treatment.

3. Definitions

Personal Data: Information relating to an identified or identifiable individual.
Sensitive Personal Data: Includes health data and other categories protected under the PDPA.
Processing: Any operation performed on personal data, including collection, use, disclosure, storage, transfer, or deletion.

4. Personal data we collect

4.1 Data you provide

Account data: name, email, phone number, address, date of birth or age, login credentials.
Order and service data: selected services, appointment preferences, order or voucher references.
Communications: emails, messages, call records or notes.
Payment facilitation data: transaction references and payment status (full payment card details are handled by payment processors).

4.2 Data received from Service Providers

Health and test-related data: laboratory results, reference ranges, specimen details, provider notes (where applicable).
Fulfilment data: appointment confirmations, collection status, service completion status.

4.3 Data collected automatically

Device and usage data: IP address, browser type, device identifiers, timestamps, pages visited.
Cookies and similar technologies (see Section 11).

5. Purposes and lawful bases for processing

We process personal data only where permitted under the PDPA, including:

Provision of Services: To operate the platform, manage accounts, process orders, issue vouchers, and provide support. Lawful basis: Contract necessity.
Payments and fraud prevention: To facilitate payments, reconcile transactions, and prevent fraud. Lawful basis: Contract necessity; legitimate interests; legal obligation.
Legal and regulatory compliance: To comply with applicable laws, accounting, and tax requirements. Lawful basis: Legal obligation.
Platform security and improvement: To ensure system security, analytics, audits, and service improvement. Lawful basis: Legitimate interests; legal obligation.
Marketing communications (optional): To send updates or promotions where permitted. Lawful basis: Consent (where required) or legitimate interests, subject to opt-out.

6. Sensitive personal data (health data)

Health data is classified as Sensitive Personal Data under the PDPA. bewellasia.co will:

obtain explicit consent where required,
limit access to authorised personnel and Service Providers,
process such data primarily to deliver the requested Services.

Where PDPA exceptions apply (e.g. emergencies), processing may occur as permitted by law.

7. Disclosure of personal data

We may disclose personal data to:

Service Providers for service fulfilment,
technology and operational vendors acting under appropriate safeguards,
professional advisors and authorities where legally required,
parties involved in corporate restructuring or transactions.

We do not sell personal data.

8. Cross-border data transfers

Personal data may be transferred outside Thailand (e.g. cloud infrastructure or support services). Such transfers are carried out in accordance with the PDPA, using appropriate safeguards or other lawful mechanisms.

9. Data retention

We retain personal data only for as long as necessary to:

provide the Services,
comply with legal and regulatory obligations,
resolve disputes.

Retention periods vary by data category. Data is deleted or anonymised when no longer required, unless retention is legally required.

10. Data security

We implement appropriate administrative, technical, and physical safeguards to protect personal data. No system is completely secure.

11. Cookies and similar technologies

We use cookies to enable site functionality, enhance user experience, measure usage, and support security. You may manage cookies through browser settings. Disabling cookies may affect functionality.

12. Your PDPA rights

You have the right to:

access and obtain copies of your data,
correct inaccurate data,
request deletion or restriction,
object to certain processing,
request data portability (where applicable),
withdraw consent at any time,
lodge a complaint with the Personal Data Protection Committee (PDPC).

13. Contact us

To exercise your rights or ask questions, contact: info@bewellasia.co

14. Children

Our Services may be used for individuals under 20 years of age. Where the recipient of a service is under 20, bewellasia.co will collect and process personal data, including sensitive personal data such as health data, only with the explicit consent of a parent or legal guardian, as required under applicable Thai law.

If we become aware that personal data of a minor has been collected without valid consent, we will take appropriate steps to stop processing and delete or anonymise such data, unless retention is required or permitted by law (for example, to comply with legal obligations or to resolve disputes).

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Updates will be published on this page.