Privacy Policy

Effective Date: May 2026

Last Updated: 20 August 2026

Dr. Top Hair Hospital is a brand operated by Doctor Top Hair Hospital Co., Ltd., a company registered under the laws of the Kingdom of Thailand, registration number 0105560218382, with its registered office at 65/204 Rama 9 Road, Huai Khwang, Huai Khwang, Bangkok, Thailand.

Throughout this document, references to “we,” “us,” “our,” or “Dr. Top Hair Hospital” refer to Doctor Top Hair Hospital Co., Ltd..

This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with our website drtop.com and the medical services provided at our clinic locations in Bangkok, Thailand. This policy applies to all visitors, patients, and users of our services, regardless of their country of residence.

We are committed to protecting your personal data in accordance with the Thailand Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). Where applicable, we also observe the principles of the EU General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”) for individuals located in those jurisdictions.

1. Data Controller

The data controller responsible for your personal data is Doctor Top Hair Hospital Co., Ltd..

For any questions or requests regarding your personal data, please contact:

  • Email: [email protected]
  • Phone/WhatsApp: +66 92 246 2848
  • Address: Silom Shanghai Building, Soi Silom 17, Silom, Bang Rak District, Bangkok 10500, Thailand

2. Personal Data We Collect

2.1 Information You Provide

  • Name, email address, phone number, WhatsApp contact, and country of residence when you submit an assessment form, contact form, or inquiry.
  • Medical photographs and health information you share for hair transplant assessment purposes.
  • Payment and billing information when you book a procedure or pay a deposit.
  • Travel and accommodation details when you provide them for international patient coordination.

2.2 Information Collected Automatically

  • Device information (browser type, operating system, screen resolution).
  • IP address and approximate geographic location.
  • Pages visited, time spent, referral source, and interaction data via cookies and analytics tools.
  • UTM parameters and campaign source data for marketing attribution.

2.3 Sensitive Personal Data

Under the PDPA, health-related information is classified as sensitive personal data. We collect health information (including photographs of your scalp and hair condition, medical history relevant to hair transplant candidacy, and treatment records) only with your explicit consent and solely for the purpose of providing medical assessment and treatment services.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

  • To respond to your inquiries and provide hair transplant assessments.
  • To schedule consultations, procedures, and follow-up appointments.
  • To coordinate travel, accommodation, and logistics for international patients.
  • To process payments and maintain financial records.
  • To send appointment reminders and post-operative care instructions.
  • To improve our website, services, and patient experience through analytics.
  • To comply with applicable laws, regulations, and medical record-keeping requirements.
  • To send marketing communications (only with your explicit consent; you may opt out at any time).

4. Legal Basis for Processing

Under the PDPA, we process your personal data based on one or more of the following legal grounds:

  • Consent: Where you have given explicit consent, particularly for sensitive data such as health information and for marketing communications.
  • Contractual necessity: Where processing is necessary to perform or prepare a contract for medical services.
  • Legal obligation: Where processing is required to comply with Thai medical regulations or other applicable laws.
  • Legitimate interest: Where processing is necessary for our legitimate business interests, provided these do not override your rights.
  • Vital interest: In rare cases, where processing is necessary to protect your life or health.

5. Data Sharing and Disclosure

We do not sell your personal data to third parties. We may share your personal data with:

  • Our medical team and clinic staff for treatment purposes.
  • Third-party service providers who assist in website hosting, analytics (Google Analytics), email communication, and payment processing. These providers are contractually required to protect your data.
  • Partner hotels and transportation providers (only information necessary for your travel coordination, and only with your consent).
  • Government authorities or regulators when required by law.

6. International Data Transfers

As we serve international patients and use global technology providers, your personal data may be transferred to and processed in countries outside of Thailand. When we transfer data internationally, we ensure appropriate safeguards are in place in accordance with Section 28 and Section 29 of the PDPA. For individuals in the EU/EEA, we rely on Standard Contractual Clauses or other approved transfer mechanisms under the GDPR.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. In general:

  • Medical records: Retained for a minimum of 10 years as required by Thai medical regulations.
  • Marketing data: Retained until you withdraw your consent.
  • Website analytics data: Retained for up to 26 months.
  • Financial and tax records: Retained as required by Thai tax law.

8. Your Rights

Under the PDPA (and where applicable, the GDPR and CCPA), you have the following rights:

  • Right to access: Request a copy of the personal data we hold about you.
  • Right to correction: Request correction of inaccurate or incomplete data.
  • Right to deletion: Request deletion of your data, subject to legal retention requirements.
  • Right to restriction: Request that we limit how we process your data.
  • Right to data portability: Request your data in a structured, machine-readable format.
  • Right to object: Object to processing based on legitimate interest or for direct marketing.
  • Right to withdraw consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. Cookies

Our website uses cookies and similar technologies. For details on what cookies we use and how to manage your preferences, please see our separate Cookie Policy at drtop.com/cookie-policy.

10. Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, or disclosure. These include encryption of data in transit (SSL/TLS), access controls, and regular security assessments.

11. Children’s Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us so we can delete it promptly. Under the PDPA, processing of personal data of minors under 10 years of age requires parental or guardian consent.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be posted on this page with a revised “Last Updated” date.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: [email protected]
  • Phone/WhatsApp: +66 92 246 2848
  • Address: Silom Shanghai Building, Soi Silom 17, Silom, Bang Rak District, Bangkok 10500, Thailand

You also have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand if you believe your data protection rights have been violated.