Privacy Policy

Last updated: 24 July 2026

1. Who we are

Target150 is operated by Knightsbridge Co., Ltd. ("Target150", "we", "us", "our"), a Knightsbridge Group company. For the purposes of the PDPA and the GDPR, we are the data controller responsible for the personal data described in this policy.

Address: 622 Emporium Tower, Sukhumvit 24, Klongton, Klongtoey, Bangkok 10110, Thailand
Email: contact@target150.com
Phone: +66 2 664 7488

2. Information we collect

Information you give us

• Enquiry & consultation details — when you use our contact form we collect your name, email address, phone number, the treatment you are interested in, and the content of your message.
• Appointment & patient information — if you become a patient, we collect the information needed to provide care, including identity and contact details, date of birth, and scheduling information.
• Account information — if you are given access to our patient portal (members.target150.com), we hold your login credentials in secured form.
• Correspondence — records of your communications with us by email, phone, messaging, or in person.

Information we collect automatically

• Usage & device data — when you visit our website we record the pages you view, the referring site, approximate location (derived from your IP address), and device/browser type, so we can understand how the site is used and keep it working. Your IP address is used to derive an approximate city/country and is not used to identify you personally.
• Cookies & similar technologies — see Cookies & analytics below.

3. Health & special-category data

As a medical clinic we may process information about your health, medical history, laboratory results, treatment protocols, and clinical notes. Under both the PDPA and the GDPR this is sensitive / special-category personal data and receives heightened protection.

We collect and use health data only where you have given explicit consent, or where processing is necessary for the provision of medical care by or under the responsibility of our healthcare professionals, or to protect your vital interests. Access to clinical records is restricted to the medical and support staff who need it to care for you, and all such staff are bound by professional confidentiality obligations.

4. How we use your information

• To respond to your enquiries and arrange consultations;
• To provide, personalise, and follow up on medical treatment and care;
• To manage appointments, patient accounts, invoices, and payments;
• To communicate with you about your care, our services, and administrative matters;
• To operate, secure, and improve our website and services, including measuring how the site is used;
• To comply with medical record-keeping, tax, and other legal obligations under Thai law; and
• To protect the rights, safety, and property of our patients, staff, and clinic.

We do not sell your personal data, and we do not use your health information for advertising.

5. Legal bases for processing

Where the GDPR or the PDPA applies, we rely on one or more of the following legal bases:

• Consent — for optional analytics cookies, marketing communications, and (as explicit consent) the processing of your health data;
• Performance of a contract — to deliver the treatment and services you request;
• Legitimate interests — to secure and improve our website and run our clinic efficiently, balanced against your rights;
• Legal obligation — to meet medical record-keeping, accounting, and regulatory requirements; and
• Vital interests — to protect your life or health in an emergency.

Where we rely on consent, you may withdraw it at any time (see Your rights); this does not affect processing carried out before withdrawal.

6. Cookies & analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — remember your cookie choice and keep the site functioning.
• Analytics (optional) — we use Google Analytics to understand how visitors use the site in aggregate. These cookies only run if you accept them.

When you first visit, a banner lets you Accept or Decline analytics. We operate Google Consent Mode, and for visitors in the EU, UK, and EEA analytics are switched off by default until you choose to accept. Declining does not remove any functionality. You can change your choice at any time by clearing this site's cookies and local storage in your browser, which will make the banner reappear.

7. How we share information

We share personal data only as needed, and only with parties who are obliged to protect it:

• Our healthcare professionals and staff involved in your care;
• Service providers (data processors) who help us operate — for example website and IT hosting, our patient-management system, email delivery, and analytics (Google) — acting on our instructions under contract;
• Laboratories and clinical partners where necessary to deliver a treatment or test you have requested;
• Professional advisers such as lawyers, accountants, and insurers, where necessary; and
• Authorities, where we are required to disclose by law or to protect vital interests.

We do not sell or rent your personal data to anyone.

8. International transfers

We are based in Thailand. Some of our service providers (for example, analytics and email infrastructure) may process data on servers located outside Thailand or outside your country. Where personal data is transferred across borders, we take steps to ensure it remains protected to a standard consistent with the PDPA and, where applicable, the GDPR — including relying on adequacy decisions or appropriate contractual safeguards.

9. How we protect your data

We apply organisational and technical safeguards appropriate to the sensitivity of the data, including encryption of data in transit (HTTPS across all our sites), access controls that limit clinical records to authorised staff, secured credential storage, and network protections on the systems that hold patient information. No system can be guaranteed perfectly secure, but we work continuously to protect your information and to detect and respond to risks.

10. How long we keep it

We keep personal data only for as long as necessary for the purposes described above. Medical records are retained for the period required by applicable Thai medical record-keeping and healthcare regulations. Enquiry and website-analytics data are kept for a shorter period appropriate to their purpose, after which they are deleted or anonymised.

11. Your rights

Subject to the conditions and exemptions in the applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), where the law permits;
• Restrict or object to certain processing;
• Data portability — receive your data in a portable format;
• Withdraw consent at any time where we rely on it; and
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by law. If you are in Thailand and are not satisfied with our response, you may complain to the Office of the Personal Data Protection Committee (PDPC). If you are in the EU or UK, you may complain to your local data protection authority.

12. Children

Our website and services are directed to adults. Where we provide care to a minor, we do so through, and with the consent of, a parent or legal guardian, and we handle any such data with corresponding care.

13. Third-party links

Our site may link to or embed third-party content (for example, an embedded Google Map on our contact page, or videos). Those third parties have their own privacy practices, and this policy does not cover them. We encourage you to review their policies.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and, where the change is significant, we will take reasonable steps to notify you. Please review this page periodically.

15. How to contact us

If you have any question about this policy or about how we handle your personal data, please get in touch — we are happy to help.

This policy is provided for transparency and does not constitute legal advice. Target150 is committed to handling your data lawfully and responsibly under the PDPA and, where applicable, the GDPR.