Version 2.1 — 2026-10-17
Privacy Policy
This policy is available in English and Thai only. The English or Thai text is the version you accept.
Privacy update, version 2.1, dated 17 October 2026. Uploaded-document retention is owner-confirmed below. Other record-retention periods and the complete provider list remain pending confirmation; professional legal review is not claimed.
We collect your name, email, optional phone, business details and the project scope you submit. An account is optional for enquiries; account profiles and private project documents are retained where provided. Please do not submit patient information or medical records.
No new card payments are taken on this website, and new enquiries do not send your details to Stripe to create a purchase. Historic payment records, references, amounts and statuses remain private for reconciliation and existing customer obligations. The application does not store card numbers. Existing signed payment events may still update historic records. Provider-held historic data is not erased by disabling website payments.
Access controls remain in place: clients can access only their own authorised projects, bookings, proposals, documents, payment records and credit. Staff access is restricted. Historical documents remain private with short-lived authorised links. New member documents require consent and stay quarantined until safety scanning is connected; no new-document download or approval is available. Only explicitly assigned, identity/licence-validated current reviewers or authorised admins can review case metadata. Internal reviewer notes are not visible to members. Membership is free; no paid subscription. Uploaded-document retention is specified below.
Enquiries are saved in our hosted database to respond and prepare a proposal. Privacy-preserving hashed counters limit abuse without storing raw connection IPs in these counters. Do not put patient or sensitive data in enquiry or assistant messages.
Assistant messages are sent through the hosting platform to its AI model provider to generate replies; uploaded documents are not sent by this assistant. The full provider list and retention periods are unresolved and must not be inferred.
Uploaded licences and business documents — owner-confirmed policy dated 17 October 2026. Operator: บริษัท ไทยกัญญา จำกัด. Privacy contact: info@botanikanya.com.
We collect the business licensing documents you choose to upload, including professional licences, their older versions, filenames, file types and sizes, upload times, consent version and associated case/review details. Use only documents you are authorised to provide. Do not upload patient records.
These documents are used only for private business-document coordination and documentary-readiness review, not treatment or government approval. Files are held in private hosted storage and quarantined. Safety scanning is not connected: new-document download, release and approval remain blocked. Case metadata is accessible only to the owner, authorised administrators and explicitly assigned current identity/licence-validated reviewers; internal notes are not member-visible.
Uploaded licences and business-document files, including all older versions and quarantined copies, are retained while the project is open and deleted within 90 days after project closure. Project closure means the date THAIKANYA Advisory records the case as closed and communicates closure to you. Quarantine does not restart or extend this retention period.
Request deletion at info@botanikanya.com, identifying your account and case without attaching documents. We verify your identity and authority before acting and handle verified deletion requests within 30 days after verification. If applicable law requires retention, we retain only what is necessary for that obligation, restrict its use and explain the reason and applicable period to you where legally permitted; deletion follows when the obligation ends.
Deletion is a staff-managed process; no automatic purge or backup-deletion schedule is currently configured or verified. The complete hosting/provider list and backup expiry remain pending confirmation. We do not promise that a deleted file immediately disappears from provider backups. These operational limitations do not change the owner's 90-day and 30-day commitments.
Uploaded documents are not sent to AI, analytics, external email or government authorities. No new card payments are collected. This document policy does not set retention periods for account profiles, enquiries, review/audit records or historical payment records; those periods remain pending confirmation, and historical contractual and statutory rights remain intact.
Contact info@botanikanya.com for access, correction, deletion or other applicable privacy rights. This is the owner's operational policy, not a claim of professional legal review or verified regulatory compliance. The English and Thai versions are provided; no professional translation is claimed.
Optional free introductory meetings: with your agreement, your name, email and selected meeting time are sent to Google Calendar to create a private business meeting and email invitation with Google Meet. Only available times are shown publicly, never existing event details. Do not include patient information or uploaded licences. Google holds the event and invitation data; this is separate from uploaded-document retention. Calendar-record retention and Google's applicable provider terms remain to be confirmed. A meeting is not treatment, a paid engagement or an agreed project proposal.
Document-retention periods are owner-confirmed. Deletion operations, backup details, other record-retention periods, the complete provider list and legal review still require completion.