Privacy
Updated:
This page explains what we do with the information you give us.
Who is responsible
Bamboo Medical Services Co., Ltd., 31 Soi 13, Sirimangkalajarn Road, Suthep, Mueang Chiang Mai, Chiang Mai 50200, Thailand, decides what happens to your booking.
D&D Clinic and the doctor who takes your call keep the clinical record of the consultation, and are responsible for that record separately from us. We hold the booking; they hold the medical notes.
That split decides who to come to. A complaint about the booking, the payment, this website or an email we sent is ours. A complaint about your consultation or your medical record is theirs. Write to us anyway and we will pass it on and keep you in the loop.
Email realdoc@bamboo.co.th about anything on this page.
We have not appointed a data protection officer. Neither the PDPA nor the GDPR requires one of a service this size, and the address above reaches the person who would do the job. If that changes, this page changes with it.
What we collect when you book
Your name, so the doctor knows who they are talking to.
Your email address, to send you the confirmation and the link to the call.
Your age and your gender, because the doctor needs both.
The country you will be in, because it decides what the call can produce.
Your time zone, so that every time we show you is your own.
What you would like to talk about, so that your doctor is not starting from nothing.
That last one is information about your health. Under the GDPR it is special category data and under Thailand's Personal Data Protection Act it is sensitive personal data. We treat it that way: only your doctor and the office that runs the bookings can read it, it is never shown on a page, and it travels in exactly one email: the one that tells your doctor about the call.
Two different rules let us hold all this. Your name, your email address and the time you picked, we hold because you asked us to book you a call. What you wrote about your health, we hold because a doctor needs it to treat you, and because everyone who can read it is bound by medical confidentiality.
We never ask you to agree to any of that, and that is on purpose. Agreeing to something only means anything if you are able to say no. Somebody who needs to see a doctor cannot really say no, so putting a tick box here would be offering you a choice you do not actually have.
For anyone who needs the references: GDPR Article 6(1)(b) and PDPA section 24(3) for the booking, GDPR Article 9(2)(h) and PDPA section 26(5)(a) for the health information.
What we collect when you pay
Your card never touches this website. The payment is taken by Payso, a Thai payment provider, who send us back only whether it succeeded, the amount and a reference.
Payso hold what a payment business has to hold: the card, the amount, and the contact details you give at their payment page, along with the address of the device you paid from. They are told what the charge is for in the plainest possible terms (a consultation) and they are never told your reason for booking, your age, your gender or the link to your appointment.
On a card statement the charge reads REALDOC CONSULT. That is deliberate: a card statement is read by whoever shares the card, and it says nothing about a doctor.
What you send your doctor
Once your booking is confirmed you can send your doctor documents — test results, a referral letter, a list of the medicines you take, a photograph of what is worrying you. Nothing asks you to, and plenty of calls happen without it.
Anything you do send is information about your health, so it is treated exactly as what you wrote on the form is: special category data under the GDPR, sensitive personal data under Thailand's Personal Data Protection Act, held because a doctor needs it in order to treat you. Same references as above, GDPR Article 9(2)(h) and PDPA section 26(5)(a).
Two people can open it: the doctor taking your call, through a link of their own, and the office that runs the bookings. It is never attached to an email, so nothing you send passes through our email provider at all, and there is no address on this website that leads to a file — those two doors are the only way in.
It is deleted when what you wrote about your health is deleted, 30 days after the call, by the same nightly job. Keep your own copy: this is not your medical record and we are not keeping it as one. Until the call you can also remove anything you have sent, from the page you sent it from.
What we collect when you simply visit
Our server keeps ordinary web logs, including your IP address, for security and to find faults.
We use Fathom Analytics to count visits. Fathom sets no cookie, builds no profile of you, and does not follow you to other websites. It is sent the path of the page you are on and a short list of marketing parameters; it is not sent the rest of the address, so the private link to your booking never reaches it.
We run no advertising, no advertising pixels and no social media trackers, anywhere on this site.
Who else sees your information
Your doctor. All of it.
The office at Bamboo Medical Services, to run the booking and answer you if you write to us.
Postmark, in the United States, who deliver our email. That is your name and your email address, and, in the one email that goes to your doctor, your reason for booking.
Payso, to take the payment, as set out above.
Hetzner, who run the server this site and your booking sit on, in Singapore.
Daily, in the United States, who carry the video call itself. They pass the picture and the sound between you and your doctor and do not record either. They are never told your name, your reason for booking or anything else about you. The call is set up under a reference, and that is all they hold.
We do not sell your information. We do not share it for advertising. Nobody receives it who is not in that list.
If the business were ever sold or merged, your booking would go with it, and whoever took it on would be bound by this notice as we are. We would say so here before it happened.
The call itself
Your consultation is not recorded. No audio or video of it is kept by us, by the clinic or by the service that carries the call. What survives the call is your doctor's written notes, which are their clinical record and are covered above. We ask you not to record it either.
The link in your email
The link we send you is the only thing needed to open your booking, and that page carries your name, your email address and your appointment. Treat it like a password. Do not forward the email, and do not post the link anywhere. We never put it in a web address that reaches anybody else.
Our doctors' calendars
To know when a doctor is free, we read the busy times of their own calendar. We see blocks of time and nothing else: not what they are doing, not who with. This involves no patient information at all, and is mentioned here only as a reassurance.
Where it is kept, and for how long
Your payment stays in Thailand: Payso is a Thai company and so is the bank behind it. Three things do leave. Your booking sits on a server we rent from Hetzner, a German company, in their data centre in Singapore; our email goes through Postmark in the United States; and the call itself is carried by Daily, also in the United States. Under the PDPA each of those is a transfer abroad, and each is made on the contractual terms those companies publish for it. If you are in Europe the journey runs the other way and is covered the same way.
What you wrote about your health is erased 30 days after the call, along with your age and your gender, which nothing after the call needs. The rest of the booking (who you are, when the call was, what you paid) is kept for 5 years, because Thai accounting law wants the transaction, and is then deleted outright. A job runs every night and does the deleting, so it is not a promise somebody has to remember to keep.
Your doctor's clinical record of the consultation is a separate thing, held by them and by the clinic for as long as they are required to keep it.
What you can ask us to do
You can ask to see what we hold, to have it corrected, to have it deleted, to have us stop using it, or to have a copy sent somewhere else. We do not rely on your consent for any of it, so there is nothing for you to withdraw; if you want us to stop, say so and we will tell you what we are still obliged to keep, and why.
Email realdoc@bamboo.co.th and we will answer.
If you are not satisfied, you can complain to a regulator: in Thailand, the Personal Data Protection Committee; in the EU or the UK, your national data protection authority.
Some of this has limits. A doctor's clinical record of a consultation that happened cannot simply be deleted on request, because keeping it is a legal obligation on them.
Children
This service is for adults. We do not knowingly collect anything about anyone under 18.
Changes
If this notice changes, the date at the top changes with it.