YOUR INFORMATION
Privacy Policy
Last updated: 7 November 2026
Thai Vara Ltd. (“Thai Vara”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information. This policy explains how we collect, use, store and protect personal information when you visit our website, contact us about our services or receive a treatment.
1. Who we are
Thai Vara Ltd. is the data controller responsible for deciding how and why your personal information is used.
Business: Thai Vara Ltd.
Registered office: Sovereign Place, Hatfield, AL9 5ET, United Kingdom
Privacy contact: thaivara.ltd@gmail.com
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Personal information we collect
When you submit an enquiry, we may collect your name, email address, telephone number (if provided), preferred contact method, treatment of interest and the contents of your message. Please do not include sensitive medical or health information in the general website contact form.
If you arrange or receive a treatment, we may also keep relevant appointment and service information and communications with you.
3. Health information and treatment consent
Before providing a treatment, we may ask you to complete and sign a separate paper-based health and treatment consent form. This may ask about relevant medical conditions, injuries, allergies, pregnancy, medication or other health circumstances that may affect the suitability or safety of a treatment.
Health information is special category personal data under the UK GDPR. We collect it directly from you on a separate form before your treatment begins; we do not request it through the general website contact form. We will identify an appropriate Article 6 lawful basis and an applicable Article 9 condition before processing it. Where we rely on consent, we will ask for your explicit consent separately and explain how it will be used.
Completed paper forms are stored securely in physical records, with access limited to authorised people who need the information for treatment-related purposes. We will retain these records only for as long as necessary for treatment safety, administration and applicable legal obligations. When no longer required, paper records will be securely destroyed. You may withdraw consent where consent is the basis for processing; this does not affect processing already carried out lawfully. If essential information is unavailable, we may be unable to provide a treatment safely.
4. How we use your information
- To respond to your enquiries and requests for information.
- To discuss service availability, location and suitable treatments.
- To arrange and manage appointments and provide services.
- To assess relevant treatment safety considerations where necessary.
- To maintain necessary business, accounting and legal records.
- To protect our business, customers and website.
We do not currently use enquiry details to send promotional or marketing emails.
5. Our lawful bases for processing
Depending on the purpose, we rely on one or more of the following UK GDPR lawful bases:
- Contract and pre-contractual steps (Article 6(1)(b)): to respond to an enquiry, take steps at your request before entering into a service arrangement, and provide an agreed service.
- Legitimate interests (Article 6(1)(f)): where necessary for proportionate business administration, customer communications, website security and the establishment or defence of legal claims. We consider your rights and interests before relying on this basis.
- Legal obligation (Article 6(1)(c)): where processing is necessary to meet legal requirements, such as applicable tax and accounting duties.
For health information, we will also identify an applicable Article 9 condition. Where we rely on explicit consent under Article 9(2)(a), we will obtain it separately from general treatment acceptance. We will not assume that signing this Privacy Policy alone constitutes explicit consent to process health information.
6. Who we share information with
We do not sell, rent or trade your personal information. We may share limited information with service providers that help us operate our website and receive enquiries:
- Formspree: our website contact form uses Formspree to receive and process the information you submit so that we can respond to your enquiry.
- Vercel: our website is hosted by Vercel. Technical information may be processed to deliver, maintain and secure the website.
We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims. Service providers may use sub-processors and may process information in other countries. Where a restricted international transfer takes place, we will ensure an appropriate transfer mechanism and safeguards are in place as required by data protection law.
7. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal requirements. Our intended approach is to review general enquiry records and delete them when no longer needed (normally within 12 months after the last contact if no service follows). Appointment, financial and health records are retained only for the period necessary for the relevant service, safety, claims handling and legal obligations. The exact retention period may vary depending on the record and circumstances.
8. How we protect information
We use reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Paper health forms are kept in secure physical storage and access is restricted. No method of electronic transmission or storage can be guaranteed to be completely secure.
9. Cookies and website technologies
Our website may use technologies that are strictly necessary for its operation, delivery and security. We do not currently use analytics or advertising tracking tools on this website. If we introduce non-essential cookies or similar technologies, we will update this policy and provide consent controls where required by law. You can also manage cookies through your browser settings.
10. Your rights
Depending on the circumstances, you may have the right to request access to your personal information, ask us to correct or erase it, request restriction of processing, receive certain information in a portable format, object to processing based on legitimate interests, or withdraw consent where we rely on consent. These rights are subject to legal conditions and exemptions.
To exercise your rights, contact thaivara.ltd@gmail.com. We may need to verify your identity before responding and will respond within the time limits required by law.
11. Children's privacy
Our website and services are intended for adults. We do not knowingly collect personal information from children through the website without appropriate authorisation.
12. Third-party websites
Our website may contain links to third-party websites. We are not responsible for their privacy practices or content. Please review their privacy policies before providing personal information.
13. Changes to this policy
We may update this Privacy Policy to reflect changes to our business, website, services or legal requirements. The latest version will be published on this page with a revised update date.
14. Contact and complaints
If you have questions or concerns about how we use your personal information, please contact:
Thai Vara Ltd.
Sovereign Place, Hatfield, AL9 5ET, United Kingdom
Email: thaivara.ltd@gmail.com
You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint. We encourage you to contact us first so that we can try to resolve your concern.