1 · Who we are
Icellaré is the regenerative-medicine practice of ATGenes Co., Ltd.: a Thai company registered in Bangkok. We operate two clinics: the Bangkok flagship at 102 Phutthamonthon Sai 1, Bang Ramat, Taling Chan, Bangkok 10170, and the Phuket sanctuary at 9 Komarapat Road, Talad Yai, Muang Phuket, Phuket 83000. For the purposes of this notice we are the Data Controller for the personal data you provide through this website and through our clinical services.
Our Data Protection Officer (DPO) can be contacted at dpo@icellare.com or by post at the Bangkok address above marked Attn: DPO.
2 · What data we collect
We collect only the data we need to respond to your enquiry, provide the clinical service you have asked for, or operate this website lawfully.
- Identification and contact data: your name, email address, phone number, country of residence, and, where you choose to share it, your preferred LINE / WhatsApp handle.
- Enquiry content: the message you submit through our contact form, including any health-related context you choose to share with us at that stage.
- Clinical data (patients only), medical history, examination findings, laboratory and imaging results, treatment notes, prescriptions, and consent records. Held only after you enter our clinical care under a separate, written consent.
- Website technical data: your IP address, approximate geographic location, browser and device type, referring URL, and pages visited. Used in aggregate to operate and improve the site.
- Cookies: see our Cookie Policy for a category-by-category breakdown.
We do not knowingly collect data we do not need. We do not buy marketing lists, and we do not enrich your data with third-party broker profiles.
3 · Why we process it (lawful basis)
Under both PDPA and GDPR every act of processing must rest on a lawful basis. Ours are limited to the following:
- Consent: for newsletter subscriptions, optional marketing, and any processing of sensitive health data outside the clinical setting. You can withdraw consent at any time.
- Contract / pre-contractual steps: for responding to your enquiry, scheduling consultations, and delivering the clinical care you have engaged us for.
- Legal obligation: for retaining clinical records, incident reports, and tax / accounting documents for the periods required by Thai law.
- Vital interests: for emergencies where you are unable to consent and processing your data is necessary to safeguard your life or health.
- Legitimate interests: for site security, fraud-prevention, and aggregated analytics; weighed and documented against your rights and freedoms before the processing begins.
- Public interest in public health (Article 9(2)(i) GDPR / PDPA equivalent), for the limited cases where we contribute de-identified data to peer-reviewed clinical research with appropriate ethics oversight.
4 · How we use your data
- To respond to enquiries and book consultations.
- To deliver the clinical service you have engaged Icellaré for and to maintain a complete, accurate medical record.
- To send you appointment reminders, follow-up communications, and, only with your separate opt-in consent, our infrequent newsletter.
- To improve the safety and efficacy of our protocols through internal clinical review and, where applicable, externally reviewed research using de-identified data only.
- To meet regulatory obligations under the Medical Council of Thailand, the Thai Food and Drug Administration (TFDA), and our accrediting bodies.
- To detect and prevent abuse of this website, including bot traffic and form-spam.
5 · Who we share your data with
We do not sell your data. We share it only with the recipients below, only to the extent necessary, and only under a written confidentiality / data-processing agreement.
- Our clinical team: physicians, nurses, laboratory scientists, and administrative staff involved in your care.
- Our technology providers: limited to: our website host (Vercel Inc., USA), our transactional email provider, our calendaring system, our electronic medical record system, and our laboratory information system. Each operates under a data- processing agreement that mirrors the rights set out in this notice.
- Regulators and accrediting bodies: only when legally required (e.g. a TFDA inspection, a Medical Council enquiry, a court order).
- External clinicians you refer or are referred to, only with your written authorisation in each instance.
6 · International transfers
Most processing happens in Thailand. Some processors, notably our website host, operate from jurisdictions outside Thailand and the European Economic Area, including the United States. Where such a transfer occurs, we rely on one of the following safeguards:
- A European Commission adequacy decision covering the recipient country;
- Standard Contractual Clauses (the EU Commission's 2021 SCCs) combined with a Transfer Impact Assessment;
- Your explicit consent after being informed of the risks of the transfer (used only as a last resort).
Under the Thai PDPA, equivalent safeguards apply. We will provide a copy of the relevant Standard Contractual Clauses on request.
7 · How long we keep your data
- Enquiry data from website forms, 24 months from last interaction, then deleted or anonymised.
- Clinical records: held for the period required by Thai law for medical records of the type concerned, which generally extends well beyond a single course of treatment. Then archived under restricted access for a further period before secure destruction.
- Accounting and tax records: held for the period required by the Thai Revenue Code (currently 5 years).
- Marketing consent: until you withdraw it.
- Website technical data and cookies: see our Cookie Policy for category-by-category retention.
8 · Your rights
You have the following rights over the personal data we hold about you. Most can be exercised by writing to our DPO at dpo@icellare.com:
- Right of access: to be told whether we are processing your data and to receive a copy.
- Right to rectification: to have inaccurate data corrected.
- Right to erasure: to have your data deleted where the lawful basis no longer applies. This right is limited where we are required by Thai law to retain clinical records.
- Right to restriction of processing: to pause processing while an objection or correction is being resolved.
- Right to data portability: to receive your data in a structured, machine-readable format and to have it sent to another controller where technically feasible.
- Right to object: to processing based on our legitimate interests, and to direct marketing at any time.
- Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint: with the Personal Data Protection Committee (Thailand) or, if you are in the European Economic Area, your local supervisory authority. We would, however, appreciate the opportunity to address your concern directly first.
We will respond to verified requests within 30 days. We may ask you to verify your identity before acting on a request, this is itself a safeguard for your data.
9 · Security and breach response
We protect your data with measures appropriate to its sensitivity: encryption in transit (TLS 1.2 or above) and at rest for all clinical systems, role-based access controls, audit logging, signed data-processing agreements with every processor, periodic penetration testing of our public-facing systems, and a documented Incident Response procedure.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the risk is high. We will also publish a non-identifying summary on this page.
10 · Cookies and tracking
Our use of cookies and similar tracking technologies is covered in full by our Cookie Policy. The short version: we do not use third-party advertising cookies; any non-essential cookies require your opt-in.
11 · Children's data
Our services are directed at adults. We do not knowingly collect personal data from children under the age of 16 through this website. Where Icellaré provides clinical care to a minor (for example, paediatric stem-cell banking), the relevant data is collected from a parent or legal guardian under written consent and is governed by the same standards described in this notice.
12 · Changes to this policy
We may update this notice from time to time. The latest version is always published at this URL with the “Last updated” date at the top of the page. Material changes will be notified to active patients and newsletter subscribers separately.
13 · Contact us
Questions about this notice, or about any data we hold about you, should be addressed to:
- Email: dpo@icellare.com
- Post: ATGenes Co., Ltd. (Attn: DPO), 102 Phutthamonthon Sai 1, Bang Ramat, Taling Chan, Bangkok 10170, Thailand
- Phone: +66 80 856 5999 (Bangkok) · +66 93 596 2651 (Phuket)