Privacy Policy
Biocharge Co., Ltd. (“Biocharge”, “we”, “us”) [registration number and registered address to be inserted] operates a health-optimization platform for members in Thailand. This policy explains what personal data we collect, why, and the rights you have under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).
Biocharge is a technology platform. Medical services — including the review and approval of your health interpretations — are provided by licensed physicians practising through licensed medical facilities, not by the platform itself. Your medical record belongs to that clinical side; this policy covers the personal data processed by the platform.
1. Data we collect
- Account & identity data — name, email, phone number, date of birth, sex, and address, collected when you create an account or complete your profile.
- Health data (sensitive personal data) — laboratory results and biomarkers, health intake questionnaires, lab reports you upload, and the interpretations prepared for you. Under PDPA section 26 this is sensitive personal data and is processed only with your explicit consent.
- Payment data — processed by our payment provider (Omise). We store a payment token, your membership status, and transaction history; we never store full card numbers.
- Order data — products you purchase through the marketplace and delivery details.
- Usage & device data — log data, error reports, and basic analytics needed to keep the service secure and working.
2. Consent and lawful basis
We ask for explicit, granular consent before processing your health data, and record each consent event with a timestamp in an audit trail. You may withdraw consent at any time in your account settings or by contacting us; withdrawal does not affect processing already carried out, and some services (such as receiving interpretations) cannot be provided without it. Other data is processed to perform our contract with you (membership, orders), to meet legal obligations, or for our legitimate interests in keeping the service secure.
3. How we use your data
- To deliver your test results and prepare interpretations of them.
- To support physician review: nothing is released to you as an interpretation until a licensed doctor has approved it, and each approval is recorded.
- To generate draft analyses using AI systems. AI output is an aid to the clinical process described above, and the AI providers we use do not train their models on your data.
- To manage membership, billing, and marketplace orders.
- To send service notifications you have opted into.
- To secure, debug, and improve the platform.
We do not sell your personal data, and we do not use health data for advertising.
4. Who we share data with
- Licensed physicians and clinics who review and approve your interpretations.
- Partner laboratories that perform your blood tests.
- Service providers (data processors) — hosting and database infrastructure, payment processing, email delivery, error monitoring, and AI processing — bound by data-processing terms and used only to run the service.
- Authorities where disclosure is required by Thai law.
5. International transfers
Your data is hosted in the Asia-Pacific region (currently Singapore), and some processors operate outside Thailand. Where data leaves Thailand we rely on the PDPA’s transfer safeguards, including contractual protections with each processor.
6. Retention
We keep account and health data for as long as your account is active so your health history remains useful to you. If you delete your account, personal data is deleted or anonymized within a reasonable period, except records we must keep by law (for example tax and payment records) and clinical records retained by the licensed medical facility under medical-records law.
7. Your rights
Under the PDPA you may:
- access and obtain a copy of your personal data;
- correct inaccurate data;
- delete data or ask us to anonymize it;
- receive your data in a portable format;
- object to or restrict certain processing;
- withdraw consent at any time;
- lodge a complaint with Thailand’s Personal Data Protection Committee (PDPC).
To exercise any of these rights, contact us at hello@getbiocharge.com. We respond within the periods required by the PDPA.
8. Security
Health data is protected with encryption in transit and at rest, row-level access controls so each member can only reach their own records, role-based access for clinical staff, and immutable audit trails covering interpretations, approvals, consent events, and data access.
9. Cookies
We use only the cookies needed to sign you in and keep the service working. If we later use advertising or analytics cookies, we will ask for your consent through a cookie banner first.
10. Children
Biocharge is for adults aged 18 and over. We do not knowingly collect data from minors.
11. Changes to this policy
We will notify you of material changes by email or in-app notice before they take effect. The latest version always lives at getbiocharge.com/privacy.
12. Contact
Data controller: Biocharge Co., Ltd. [registration number and registered address to be inserted]. Data protection contact: hello@getbiocharge.com.