This is your explicit consent under Thailand's PDPA §26 for us to store and share sensitive information you choose to include in booking notes - things like allergies, medical conditions, or skin sensitivities. This consent is asked for right at the booking step, not buried at signup, so you always know what you are agreeing to.
Part 1 - What information this covers
Under PDPA §26, the following information you might share in booking notes counts as Sensitive Personal Data:
- Health information (medical conditions, treatments, medications)
- Allergy and sensitivity information (skin, food, environmental, product)
- Disability information
- Pregnancy and reproductive health information
- Anything else you voluntarily disclose that falls within PDPA §26
Part 2 - Two consent modes, you choose
2.1 Per-booking mode (default)
By ticking the "I CONSENT" box at the booking step, you agree to Veyya Life (Thailand) Limited:
- Storing your Sensitive Personal Data for this specific booking only
- Encrypting it with field-level AES-256
- Sharing it with the assigned provider for this booking only
- Deleting it when the booking is complete
2.2 Opt-in persistence mode
You can also tick a second box to say yes to us:
- Retaining your Sensitive Personal Data in your encrypted profile for future bookings
- Automatically sharing it with the assigned provider on each future booking
- Deleting everything immediately if you withdraw consent
- Auto-deleting all retained data 90 days after account closure
Part 3 - What your provider must do
Providers who receive your Sensitive Personal Data are bound under their Service Provider Agreement or Business Provider Agreement and Data Processing Agreement to:
- Use it only for safe delivery of your specific service
- Not screenshot, photograph, copy, or export it
- Not share it with anyone else
- Not retain it beyond 7 days after your booking is complete
- Report any incident to us within 24 hours
Part 4 - Withdrawing consent
Under PDPA §19, you can withdraw any consent given here at any time, with the same ease as giving it - via Account Settings › Privacy and Consent › Notes for Providers.
What happens when you withdraw:
- Per-booking mode · withdrawal takes effect from the next booking; already-shared notes for active bookings continue for the standard 7-day provider access window
- Persistence mode · withdrawal triggers immediate deletion of all retained health notes in your profile
- The consent event is logged in the audit trail (retained per PDPA §78)
Withdrawal does not affect the lawfulness of processing that happened before you withdrew.
Part 5 - Security and retention
- Encryption · Field-level AES-256, separate from at-rest encryption
- Access · Restricted to the assigned provider for the booking window + 7 days; admin access requires business justification logged in the audit trail
- Retention · Per-booking mode: deleted on booking completion. Persistence mode: until withdrawal or account closure + 90 days
- Not shared with · Other providers, third parties, analytics services, or backups beyond 90 days post-deletion
Part 6 - Related documents
- Customer Privacy Notice
- Customer Terms and Conditions
- Annex R (PDPA Retention Schedule v2.1) - available on request from dpo@veyya.com
Get in touch
- Data Protection Officer · dpo@veyya.com
Veyya Life (Thailand) Limited · Bangkok, Thailand
Version history
v1.0 (3 July 2026) - Initial version created per Pattra Advisory feedback requiring §26 Customer consent captured in a separate document. Two-mode structure (per-booking default, opt-in persistence) per Founder decision.