This Privacy Notice also explains how AnyCura processes patient-related data on behalf of healthcare facility customers using the Service. Unless otherwise expressly stated in writing, healthcare facility customers act as Data Controllers for Patient Data entered into the Service, and AnyCura acts as a Data Processor.
1. Scope of This Privacy Notice
This Privacy Notice applies to: (a) visitors to our website; (b) individuals who request a demo or contact us; (c) customers, prospective customers, and their representatives; (d) account administrators and authorized system users of the Service, including users of partner web and mobile applications; (e) billing contacts and payment-related contacts; (f) personal data processed by AnyCura in the course of operating and supporting the Service; and (g) Patient Data processed by AnyCura on behalf of healthcare facility customers.
This Privacy Notice does not replace any patient-facing privacy notice that a healthcare facility may be required to provide under applicable law.
Clinic OS clinical-history access requires a verified medical facility, a purchased Clinic OS add-on with active access, and the user's organization, branch, role, and clinical permissions. Booking notes and messages may contain health information supplied for the relevant booking or communication purpose and processed under an applicable lawful basis; supplying such information does not grant access to clinical history.
2. Our Role
2.1 AnyCura as Data Controller
AnyCura acts as a Data Controller for personal data relating to website visitors, demo requesters, customer contacts, billing contacts, support requests, account administration, and other business interactions directly involving AnyCura.
2.2 AnyCura as Data Processor
AnyCura generally acts as a Data Processor for Patient Data and related healthcare data entered into the Service by healthcare facilities. In such cases, the relevant healthcare facility determines the purposes and means of processing, and AnyCura processes such data on documented instructions from that healthcare facility, unless otherwise required by law.
3. How Personal Data Is Collected and Processed
We may collect or process personal data through the following methods:
When you create an account, request a demo, subscribe to the Service, complete onboarding, contact us, submit a support request, or otherwise communicate with us.
When you access or use the Service, we may automatically collect certain technical and usage information such as IP address, browser type, device information, operating system, app version and build number, device model, locale and timezone, timestamps, activity logs, interaction data, push notification tokens, and crash, error, performance, or diagnostic information.
We may receive personal data from payment processors, authentication providers, integrated services, or tools used by healthcare facilities, including identity verification technologies where applicable.
We may use cookies and similar technologies as described in Section 10.
Healthcare facilities may submit, store, organize, retrieve, and manage Patient Data through the Service. AnyCura processes such data on behalf of the relevant healthcare facility.
Partners may provide business registration documents, licence or permit information, professional credential details, registry references, affiliation confirmations, advertising approvals, attestations, or other evidence if requested by AnyCura. We may process this information for onboarding, platform safety controls, regulated service prior approval, listing review, fraud prevention, audit, dispute handling, and legal compliance. AnyCura's request, receipt, review, or recording of such evidence does not transfer, reduce, or replace the Partner's responsibility to hold, maintain, and comply with all required licences, permits, registrations, approvals, professional qualifications, authorisations, consents, and insurance.
4. Categories of Personal Data
4.1 Personal Data collected by AnyCura as Data Controller
Depending on the context, we may collect the following categories of personal data:
- identity information, such as name, title, professional or facility-related information
- contact information, such as email address, phone number, and mailing address
- account information, such as username, encrypted password, role, permissions, and account settings
- transaction information, such as subscription details, invoices, billing records, and payment status
- partner compliance evidence and review information, such as business registration details, licence or permit numbers, registry references, practitioner credential information, branch or facility information, affiliation confirmations, advertising approval references, supporting evidence, reviewer notes or decisions, and audit logs
- technical information, such as IP address, browser type and version, device information, operating system, mobile app version and build number, device model, locale and timezone, push notification tokens, crash and error diagnostics, performance information, and access timestamps
- usage information, such as pages viewed, features used, support history, and service communications
4.2 Patient Data processed by AnyCura on behalf of healthcare facilities
Healthcare facility customers may use the Service to process Patient Data, including:
- patient demographic and identification data
- appointment, visit, queue, and scheduling information
- health information, medical records, diagnoses, treatment plans, prescriptions, clinical notes, and related records
- billing, payment, and insurance-related records
- clinical and operational information generated through use of the Service
AnyCura generally does not determine the purposes and means of processing such Patient Data.
5. Sensitive Personal Data and Healthcare Data
Under applicable law, health data, biometric data, and certain other categories of personal data may be treated as sensitive personal data.
The Service may process sensitive personal data where entered or used by healthcare facilities in connection with patient registration, diagnosis, treatment, healthcare delivery, healthcare operations, or related purposes.
Where required by applicable law, such sensitive personal data will be processed based on explicit consent. In other cases, processing may be carried out on the basis of other lawful grounds or exemptions permitted by applicable law.
Clinical records are not automatically used as public advertising content. Publication of identifiable patient images, testimonials, or health information needs a separately disclosed advertising purpose, an applicable lawful basis, and any required specific permission or explicit consent. Permission for booking, messaging, treatment, or clinical-record access does not by itself authorize advertising use.
AnyCura does not intentionally collect or request personal data relating to race, ethnicity, political opinions, religious beliefs, sexual orientation, or criminal records unless such processing is necessary and lawful in the relevant context.
6. Personal Data of Minors
The Service is designed for use by healthcare facilities and authorized personnel, not by minors directly.
Where healthcare facilities process the personal data of minors through the Service, the relevant healthcare facility is responsible for ensuring compliance with applicable law, including any notice, consent, or authorization requirements applicable to minors.
AnyCura may provide reasonable assistance to healthcare facility customers in supporting compliant processing through the Service where appropriate.
7. Data Storage and International Processing
Primary data storage may be provided through infrastructure located in Thailand.
Partner compliance evidence and related review records may be stored in secure cloud object storage and internal databases, with access restricted to authorized personnel and systems.
The mobile applications may temporarily store operational cache on the user's device, such as appointments, bookings, messages, notifications, and related metadata. This local cache is encrypted where supported and is used to keep the Service responsive; it can be cleared by signing out, deleting app data, or uninstalling the application.
Certain supporting services used in connection with the Service may involve processing or temporary caching outside Thailand, depending on the technical architecture of the relevant provider.
Where personal data is transferred internationally, AnyCura will implement appropriate safeguards as required by applicable law and obtain consent where required by law.
8. Purposes of Processing
8.1 Purposes for which AnyCura acts as Data Controller
AnyCura may process personal data for the following purposes:
- creating and managing accounts
- customer onboarding and administration
- subscription management, invoicing, and payment processing
- service delivery and customer support
- communications relating to the Service
- security, fraud prevention, incident detection, and system monitoring
- push notification delivery, mobile app reliability, crash and error diagnostics, performance monitoring, and troubleshooting
- partner onboarding, business information review, regulated service prior approval, platform safety and compliance review, evidence management, listing safety review, and audit recordkeeping
- analytics, troubleshooting, and service improvement
- compliance with legal and regulatory obligations
- marketing communications, where consent is required and has been obtained
8.2 Purposes for which AnyCura processes Patient Data on behalf of healthcare facilities
AnyCura may process Patient Data on behalf of healthcare facility customers for purposes determined by those customers, including:
- patient registration and record management
- appointment, queue, and visit management
- treatment documentation and clinical workflows
- prescription, billing, and operational support
- continuity of care across authorized branches within the same healthcare organization, where enabled by the customer and permitted by applicable law
- secure hosting, storage, backup, retrieval, and technical support of the Service
9. Cross-Branch Access and Sharing
Where the Service supports access to Patient Data across branches, such access is intended only for authorized personnel within the same healthcare organization or clinic group, subject to role-based access controls, audit logging, and the healthcare facility customer's compliance with applicable notice requirements, lawful bases, consent requirements where applicable, and other legal obligations.
AnyCura does not provide open or unrestricted sharing of Patient Data across unrelated healthcare organizations through the Service.
10. Cookies and Similar Technologies
We may use cookies and similar technologies to operate, secure, and improve the Service and our website.
These technologies may be used for purposes such as:
- maintaining session and login functionality
- remembering preferences
- measuring usage and performance
- improving reliability and user experience
You may control cookies through your browser settings. Some cookies are necessary for core functionality and disabling them may affect the operation of the Service.
11. Data Retention
AnyCura retains personal data for no longer than necessary for the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law.
For personal data for which AnyCura acts as Data Controller, retention periods are determined based on business needs, legal obligations, dispute resolution requirements, security considerations, and internal retention standards.
For partner compliance evidence, raw documents are retained only for as long as reasonably necessary for evidence review, audit, fraud prevention, dispute handling, or legal compliance, while structured evidence review records, reviewer notes or decisions, source references, timestamps, and audit logs may be retained for a longer period where necessary to document listing and compliance-related decisions.
For Patient Data processed on behalf of healthcare facility customers, AnyCura retains such data in accordance with the relevant customer's documented instructions, applicable legal retention requirements, backup and disaster recovery practices, and AnyCura's deletion procedures.
When personal data is no longer required, it will be deleted or irreversibly anonymized in accordance with our retention and deletion procedures, subject to applicable law.
12. Data Security
AnyCura implements technical, organizational, and administrative security measures appropriate to the nature of the data and the risks involved.
These measures may include authentication controls, access restrictions, encryption where appropriate, logging and monitoring, backup and recovery measures, incident response procedures, and periodic security reviews.
For mobile applications, these measures may include encrypted on-device operational cache, platform-provided secure key storage, backup exclusion for app cache where supported, and clearing cached Service data after sign-out or app data deletion.
Where compliance documents or evidence artifacts are stored, access may be provided through restricted, time-limited links or internal tools, and access events may be logged for security and audit purposes.
Where AnyCura processes Patient Data on behalf of healthcare facilities, these measures are intended to support the relevant healthcare facility's compliance obligations under applicable law.
While we implement commercially reasonable security measures, no system can guarantee absolute security.
13. Personal Data Breaches
Where AnyCura acts as a Data Controller, AnyCura will assess and respond to personal data breaches in accordance with applicable law, including notification to regulators and, where required, affected individuals.
Where AnyCura acts as a Data Processor for Patient Data, AnyCura will notify the relevant healthcare facility without undue delay after becoming aware of a breach affecting such Patient Data and will provide reasonable assistance to support the healthcare facility's legal obligations.
14. Third-Party Service Providers and Subprocessors
AnyCura may use third-party service providers and subprocessors for services such as cloud hosting, storage, authentication, communications, push notification delivery, crash and error monitoring, diagnostics, analytics, support, and payment processing.
Such providers are engaged subject to appropriate contractual, technical, and organizational safeguards designed to protect personal data in accordance with applicable law.
AnyCura does not sell or rent personal data to third parties for third-party marketing purposes.
15. Third-Party Websites
The Service or our website may contain links to websites or services operated by third parties.
AnyCura is not responsible for the privacy practices, content, or security of third-party websites or services. Your use of such third-party services is governed by their own terms and privacy policies.
16. Your Rights
Where AnyCura acts as a Data Controller, you may have rights under applicable law, subject to applicable conditions and limitations.
Where AnyCura processes Patient Data on behalf of a healthcare facility, requests relating to such Patient Data should generally be directed to the relevant healthcare facility as the Data Controller. AnyCura may assist the relevant healthcare facility in responding to such requests where appropriate.
17. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or the Service.
Where appropriate, we will notify users of material changes through the Service, by email, or by other reasonable means. The updated version will be posted with a revised "Last updated" date.
18. Contact Information
For personal data relating to website visitors, business contacts, account users, billing contacts, and support interactions, AnyCura generally acts as a Data Controller.
For Patient Data entered into the Service by healthcare facilities, the relevant healthcare facility generally acts as the Data Controller, and AnyCura generally acts as a Data Processor unless otherwise expressly stated.
If you have questions or concerns about this Privacy Notice, please contact:
Privacy and Data Protection ContactAnyCurasupport@anycura.comwww.anycura.comAnyCura Partners Mobile Privacy Policy and Notice
This Mobile Privacy Policy and Notice explains how AnyCura collects, uses, discloses, stores, and protects personal data in connection with the AnyCura Partners mobile application.
The Android application supports partner account registration, while the iOS application supports sign-in for existing accounts. Both support authorized partner staff and administrator workflows. Patient clinical-history access and Clinic OS workflows are available only to verified medical facilities with active Clinic OS access, and remain subject to the user's role, branch, and clinical permissions.
1. Scope
This notice applies to personal data processed through the AnyCura Partners mobile application, including booking, scheduling, messaging, notification, service catalog, team, sales, support, and account workflows, and the permitted clinical workflows described below.
The main AnyCura Partners Privacy Notice continues to apply to the broader partner web platform, cloud platform, website, business operations, and patient data processed on behalf of healthcare facility customers.
2. Data We Process in the Mobile Application
Depending on your role and enabled features, the mobile application may process:
- account and workspace information, such as registration name, email address, linked sign-in identifiers, account ID, role, permissions, provider, branch, and language settings
- booking and scheduling information, such as booking requests, confirmed bookings, follow-up bookings, customer or patient names, contact details, requested services, dates, times, statuses, and notes provided for operational handling
- team and business information used in authorized service catalog, staff, schedule, and sales workflows, such as staff names and assignments, service selections, customer transaction amounts, customer payment status, and customer-linked sales records
- Clinic OS clinical-record information, only for verified medical facilities with active Clinic OS access and authorized users: patient identifiers and clinical history, chief complaints, diagnoses, clinical notes, allergies, vital signs, medication and treatment information, and dental records needed for the permitted clinical workflow
- message content and metadata, including conversation previews and notification content needed to display or route partner communications
- device and technical information, such as device model, operating system, app version, build number, locale, timezone, IP address, access timestamps, push notification token, crash reports, error diagnostics, performance diagnostics, and security logs
- support information you provide when contacting AnyCura
3. Clinical Access and Connected Web Tools
Patient clinical-history access and Clinic OS functions are available only to verified medical facilities with active Clinic OS access. Each user also needs the appropriate organization, branch, role, and clinical permissions. Ordinary booking, messaging, and business workflows do not give a non-medical business access to patient clinical records.
Booking notes and messages may contain health information that you or a customer provide. Such content is processed for the relevant authorized booking or communication workflow and applicable lawful basis; it does not grant access to Clinic OS clinical history.
Permitted clinical functions may display or record health information in native app screens or protected first-party web tools. The main AnyCura Partners Privacy Notice also applies to patient data processed on behalf of the healthcare facility; the facility remains responsible for its lawful use and required patient notices.
Use clinical records only for authorized healthcare work and applicable legal obligations. Clinical information is not public marketplace content, and a service booking or active Clinic OS access alone does not authorize access to another organization's patient records.
4. Purposes of Processing
We process mobile application data to:
- authenticate users and maintain secure sessions
- load the correct partner workspace, branch, role, and permissions
- support booking, scheduling, follow-up, messaging, and notification workflows
- support authorized service catalog, team, availability, and sales workflows, and permitted clinical care and recordkeeping for verified medical facilities with active Clinic OS access
- provide customer support
- secure the service, prevent misuse, troubleshoot issues, monitor reliability, and improve performance
- comply with legal, security, audit, and contractual obligations
5. On-Device Cache and Security
The mobile application may temporarily store operational cache on your device, such as bookings, messages, notifications, and related metadata, to keep the application responsive.
Data is transmitted using encrypted connections such as HTTPS/TLS. Authentication tokens are stored using platform-provided secure storage where available, such as iOS Keychain or Android Keystore-backed storage.
Local operational cache is encrypted where supported, protected using platform security features, and can be cleared by signing out, deleting app data, or uninstalling the application.
6. Notification Previews
Notification previews may be limited or generalized to reduce the exposure of customer or patient information on the device lock screen.
Your organization should avoid using mobile notifications to display full message bodies, detailed booking notes, or sensitive service context where a generic notification is sufficient.
7. Service Providers and Sharing
AnyCura may use service providers for cloud hosting, authentication, push notification delivery, crash and error monitoring, diagnostics, support, and security operations.
These service providers are authorized to process mobile application personal data only as needed to provide services to AnyCura or the partner organization and are required to protect the data using appropriate confidentiality, security, and data protection obligations.
AnyCura does not sell or rent mobile application personal data to third parties for third-party marketing purposes.
8. Account and Data Deletion Requests
You can request deletion of your own account in the app under Settings → Login and security → Delete account. Save the result information to check progress after access ends. Removing a staff membership and closing an organization are separate actions.
Without the app, request deletion at support@anycura.com. We verify account ownership before processing; no new account is required. Never send passwords or patient records. The public account-deletion guide explains the steps.
For requests subject to Thailand’s personal-data erasure rules, we act without undue delay and complete the required erasure within 90 days of receipt. We explain any lawful retention and notify you of the outcome. Technically delayed backup erasure requires appropriate safeguards until erasure is finished; a pending task is not reported as completed.
Deletion processes personal account data and login access. Where specific records must be retained for legal, healthcare, financial, security, or dispute obligations, we explain the data category, reason, and retention period or end condition. Processing remains pending until required cleanup and review are resolved.
9. Rights, Retention, and Contact
Personal data is retained only as long as necessary for the purposes described in this notice, unless a longer period is required or permitted by law, contract, audit, security, or dispute-resolution needs.
For requests about partner account access, contact your organization administrator or AnyCura support. For privacy questions, contact AnyCura using the details below.
Privacy and Data Protection ContactAnyCurasupport@anycura.comwww.anycura.com/partners