The price you see is the price you pay · no hidden feesFor clinicsHelp

Privacy policy

What NADMOR stores, why, who can see it, and what you can tell us to do with it — under Thailand’s Personal Data Protection Act (PDPA).

1 · What we store

Account — your email, display name, chosen language, and mobile number if you give one. The password is hashed by our authentication provider; we never see it.
Purchases — the order, the payment, the vouchers, any coupon used, and your points.
Visits — the name and number you entered for whoever is being seen, the time booked, the branch, and the status of the appointment.
Reviews — the score and text you wrote, tied to the voucher you used.

We do not hold your results, your medical history, or any health record. Those stay with the clinic that treated you, and the booking form never asks for them.

2 · Where you are

The “near me” button on the search page asks your browser, and only when you press it. The position that comes back is rounded to about a hundred metres before it is used, and travels only in that page’s own web address — we do not store it. Close the page and it is gone.

3 · Who sees what

You — everything of yours, through your account pages.
The clinic you booked — the name and number for the visit, the package, and the time, and no more than that. No other clinic sees anything of yours.
The public — only reviews that have been checked, and they are shown without the reviewer’s name.
The payment provider — you pay on their page, so a card number never passes through our servers.

That separation is enforced in the database, not on the page: row-level security is on for every table, and a request for somebody else’s row comes back empty rather than fetched and then hidden.

4 · How long we keep it

Orders, payments and vouchers are kept as long as accounting and tax rules require. Your account itself: when you ask us to delete it, the profile and what hangs off it go with it.

Not yet supplied: the retention period in years for each kind of record

5 · Your rights under the PDPA

Ask for a copy of what we hold about you.
Ask us to correct anything wrong.
Ask us to delete your account and what is tied to it.
Ask us to suspend or object to a particular use.
Withdraw a consent you gave, where consent is what we relied on.

Send the request through the contact page. We will confirm it is you before acting on it.

Not yet supplied: the name and contact details of the data controller, and of a data protection officer where one is required

6 · Cookies

This site uses the cookies it needs to work — the ones that remember you are signed in. There are no advertising or cross-site tracking cookies.