This policy explains how the Healthi Life app for iOS (the "App") handles your personal data. It applies to the App only. Our website and in-person services are covered by the privacy policy at https://healthi-life.com/privacy.
We wrote it to be read in a few minutes. If anything is unclear, contact us (section 12).
1. Who we are
The data controller is Longrich Company Limited (Thai company registration no. 0105567220757), operating as Healthi Life ("Healthi Life", "we", "us").
- Address: 94 Soi Charoen Mit, Phra Khanong Nuea, Watthana, Bangkok 10110, Thailand
- Email: contact@healthi-life.com
- Phone: +66 91 999 1744
We act under the Thailand Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
2. What the App does
The App lets you create an account and send booking requests to our House of Longevity. Our team reviews each request and confirms or declines it. The App does not take payments, does not show ads and contains no advertising or tracking software.
3. The data we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, email, phone number | You, when you sign up or book | Account and contact about your bookings |
| Sign-in data (email and password; your phone number if you sign in by SMS code; or the identifier, name and email shared by Google, Apple or Facebook) | You, or Google / Apple / Meta when you choose them | Secure sign-in |
| Booking requests: service chosen, preferred date and time slot, notes (up to 500 characters), status | You, and our team when they confirm or decline | Handle your booking |
| Notification token for your device | Your device, if you allow notifications | Tell you when a booking is confirmed or declined |
| Consent record: policy version, date accepted, marketing choice | The App | Prove and respect your choices |
| Technical logs (error and security logs from our service providers) | Automatically | Keep the App secure and working |
We do not collect your location, contacts, photos, health records, payment details or advertising identifiers through the App.
4. Health-related information (sensitive data)
The service you choose and the notes you write may reveal information about your health. Under section 26 of the PDPA, this is sensitive data. We process it only with your explicit consent, which you give through a separate checkbox before your first booking, and only to review, schedule and prepare your visit.
Please keep notes short and practical. Your full medical history is collected in person, under our separate consent forms, not through the App.
5. Why we use your data and on what legal basis
| Purpose | Legal basis (PDPA) |
|---|---|
| Create and manage your account | Contract (s.24(3)) and your consent |
| Receive, review, confirm or decline booking requests | Contract (s.24(3)); explicit consent for health-related information (s.26) |
| Send booking updates by push notification and email | Contract (s.24(3)) |
| Send news and offers by email | Your optional marketing consent (s.19), off by default |
| Keep the App secure, prevent misuse, fix errors | Legitimate interest (s.24(5)) |
| Comply with the law and respond to authorities | Legal obligation (s.24(6)) |
We do not sell your data and we do not use it for automated decisions about you.
6. Who receives your data
We share data only with service providers that run the App for us, under contract, and only what each one needs.
| Provider | Role | Data | Location |
|---|---|---|---|
| Google LLC — Firebase (Authentication, Firestore database, Cloud Functions) | Hosting, database, sign-in; sends the SMS verification code if you sign in with your phone number | All App data, including your phone number for SMS sign-in | Database and functions in Singapore (asia-southeast1); sign-in and SMS services may process data in the United States |
| Google LLC — Google Sign-In | Sign-in, if you choose it | Name, email, account identifier | United States |
| Meta Platforms, Inc. — Facebook Login | Sign-in, if you choose it | Name, email (if you share it), Facebook user identifier | United States |
| Apple Inc. — Sign in with Apple, Apple Push Notification service | Sign-in, if you choose it; delivery of notifications | Name, email or relay email, identifier; notification token and message | United States |
| Slack Technologies, LLC | Internal tool our team uses to confirm or decline requests | Booking request, your name and contact details | United States |
| Klaviyo, Inc. | Booking emails; marketing emails if you opt in | Name, email, booking status and details (service, date, time slot, confirmed time) | United States |
| Expo (650 Industries, Inc.) | Push notification delivery | Notification token and message | United States |
Our own physicians and guest services team access booking requests only to handle your visit. We may also disclose data where the law requires it.
7. Transfers outside Thailand
Some providers above store or process data in Singapore and the United States. These countries may not offer the same level of protection as Thailand. We transfer data there with your consent (PDPA s.28) and because it is needed to provide the App you asked for. We choose providers that commit by contract to protect personal data and use encryption in transit.
8. How long we keep your data
| Data | Kept for |
|---|---|
| Account data | Until you delete your account |
| Booking requests | Until you delete your account, or 24 months after the requested date, whichever is earlier |
| Copies of booking requests in Slack | Up to 12 months, then deleted |
| Booking emails in Klaviyo | Up to 24 months |
| Consent records | 3 years after your account ends, to prove what you agreed to. Kept under a pseudonymous key, without your name, email or booking details |
| Security logs | Up to 90 days |
If you come to the House of Longevity, your medical records are created and kept separately, as Thai law requires. They are not stored in the App.
9. Your rights
Under the PDPA you can:
- access your data and get a copy;
- correct data that is wrong or incomplete;
- delete your data, or ask us to anonymize it;
- restrict or object to some uses;
- receive your data in a common format (data portability);
- withdraw consent at any time. Withdrawal does not affect what we did before. If you withdraw a required consent, we can no longer handle new booking requests through the App;
- complain to the Personal Data Protection Committee (PDPC), Thailand: https://www.pdpc.or.th.
To use these rights, email contact@healthi-life.com. We reply within 30 days.
Marketing: turn it off in the App settings or with the unsubscribe link in any email.
10. Deleting your account in the App
Go to Account → Delete account. This permanently deletes your account, your profile and your booking requests from our database, removes the copies of your requests posted to our team's Slack channel, and asks Klaviyo to erase your email profile. It cannot be undone.
Backups and system logs that may still hold fragments of this data are overwritten within the periods in section 8.
11. Security
Data is encrypted in transit. Access to the database is restricted by security rules so that each guest sees only their own requests. Staff access is limited to the people who handle bookings. No system is perfectly secure; if a breach puts your rights at risk, we will notify the PDPC and you as the PDPA requires.
12. Contact and Data Protection Officer
- Data Protection Officer: Vincent, privacy@healthi-life.com
- Email: contact@healthi-life.com
- Post: 94 Soi Charoen Mit, Phra Khanong Nuea, Watthana, Bangkok 10110, Thailand
13. Age
The App is meant for adults. You must be at least 20 years old, or have consent from a parent or legal guardian, to create an account.
14. Changes to this policy
We will update this policy when the App or the law changes. The version date at the top always shows the current version. If a change affects how we use your data, we will tell you in the App and ask for your consent again where needed.
