Data Partner Policy: LANTAMED

• LantavaFix Clinic is the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). The clinic decides why and how your data is collected and used. • LANTAMED is the data processor. It provides the systems to the clinic and processes data only on the clinic’s instructions.

• The booking system behind lantavafix.com/booking • Patient accounts at my.lantamed.com and api.lantamed.com • The clinic staff system: appointments, cases, bills and certificates • The QR verification page for certificates

• Booking details: name, phone, email, service, date and time • Account details: first and last name, date of birth, phone, email, and national ID or passport number once your identity is verified • A Google account you choose to connect: email, name and profile picture (we never see or store your Google password) • Treatment records, bills, receipts, certificates, loyalty points, coupons and messages you send to the clinic

You can connect a Google account right after booking, before you have a clinic patient number (HN). Such an account only shows bookings you made yourself, member benefits and coupons. Treatment records, bills and certificates become visible only after clinic staff verify your identity and link your account to your patient record. If you book for someone else, your account is not linked to that person’s treatment records.

• Uses data only to provide the system to the clinic • Does not sell data, use it for LANTAMED’s own advertising, or disclose it to other clinics • LANTAMED administrators access data only when needed to maintain or fix the system • Third-party services receive only the data they need to work, as listed below

• Data is stored on servers operated by LANTAMED in Thailand • All traffic is encrypted with HTTPS • Sign-in uses one-time codes, Google or passkeys — no guessable passwords • Clinic staff access is limited by role • Every certificate carries a QR code so recipients can confirm it was issued by the clinic

Medical records are kept according to the clinic’s privacy policy and Thai law. If you close your my.lantamed.com account, the account and Google connection are deleted, but medical records the clinic must keep by law remain with the clinic. If the clinic stops using the system, LANTAMED returns or deletes the data as the clinic instructs.

LANTAMED notifies the clinic without delay if it becomes aware of a personal data breach. The clinic notifies the Personal Data Protection Committee and affected individuals as required by law.

You may request access, correction, deletion or a copy of your data, withdraw consent, or object to processing. Please send requests to the clinic as the data controller. Requests sent to LANTAMED are forwarded to the clinic. LantavaFix Physiotherapy Clinic 486/2 Moo 3, Sala Dan, Ko Lanta, Krabi 81150 Email: [email protected] Phone: +66 98 094 6349

Official links are only lantavafix.com and domains ending in .lantamed.com. Neither the clinic nor LANTAMED will ever ask for your OTP code by phone or chat. Please report suspicious links or messages to the clinic.