What information does this policy cover?
This policy covers the Keenix website, enquiries and demo requests, and data related to accounts and use of Keenix for clinics.
For patient and employee data that a clinic imports or records in the system, the clinic determines what is collected, how it is used and who can access it. Keenix processes that data to provide the service and follow the clinic’s instructions. The responsibilities of the clinic and Keenix must be fully specified in a contract or data processing agreement before actual use.
Keenix may act as data controller for information used to run its own business, such as demo enquiry details, account administrators and contacts, billing information, website usage data and technical logs.
Data that may be involved
Depending on how the service is used, data may include:
- Names, phone numbers, email addresses, usernames and login information for clinic owners, account administrators, employees and contacts.
- Clinic and branch details, services, appointments, sales, payments and information used to manage the clinic.
- Patient information, such as names and contact details, treatment and service history, existing medical conditions, drug allergies, photographs and related documents recorded using the clinic’s forms.
- Pet and owner information for veterinary clinics, such as medical history, weight, vaccinations and contact details.
- Employee information, roles, access permissions, assigned branches and records entered in the system.
- Documents, images and files uploaded by clinic users.
- Subscription, payment, invoice and support enquiry information.
- Technical data, such as IP addresses, device and browser types, usage times and event logs needed to provide the service and investigate problems.
Health data and medical history may be sensitive personal data. Clinics must establish appropriate purposes, lawful bases, notices to data subjects and access permissions before entering this information.
How data is used
Data controlled by Keenix may be used to:
- Create and maintain accounts, respond to demo enquiries and provide service information requested by contacts.
- Manage subscriptions, fees, payments, accounting documents and related communications.
- Provide support, resolve problems, maintain security and prevent misuse of the service.
- Comply with the law, exercise rights or handle related claims.
Data processed by Keenix on behalf of a clinic is used only as necessary to provide the contracted service and follow the clinic’s lawful instructions. This includes storing, displaying, searching and managing data through the functions the clinic chooses. Under current practice, Keenix does not use patient or employee data for marketing, product development, analysis across clinics or AI training. Any such change of purpose requires clear notice of the scope and lawful basis, and the necessary agreements before use begins.
Lawful bases and clinic responsibilities
When using data for its own business, Keenix relies on the lawful basis applicable to each purpose, such as fulfilling a service request or agreement, meeting legal obligations, or another basis permitted by law.
For data controlled by the clinic, the clinic is responsible for informing patients and employees, determining lawful bases, obtaining consent where necessary, setting retention periods and responding to rights requests. Keenix will assist within the scope of its services and the processing instructions the clinic is entitled to give.
Disclosures and service providers
Keenix uses external providers as necessary to deliver the service. The data sent depends on each provider’s role and the functions the clinic uses. Relevant providers and roles include:
- Google Cloud Platform runs the API and background tasks, including logs and encryption key management. Request data may be processed while providing the service. Google states that data may be processed in countries where Google or its contractors maintain facilities, unless applicable service provisions allow a selected storage region.
- MongoDB Atlas is the main database for account information, clinic organisation details, records entered by clinics and system transactions.
- Cloudflare R2 and Cloudflare Images store uploaded files and images, serve media and deliver some content.
- Stripe manages checkout and subscriptions. It may receive customer or clinic identifiers, subscription details, amounts, transaction status and payment information entered by users. Stripe has its own privacy notice and may act as a data controller for some purposes, such as fraud prevention and legal compliance.
- Google Analytics is disabled on this version of the marketing website. If enabled, it will measure traffic and marketing results according to the settings and choices provided. Patient and health data will not be sent to Analytics. Analytics data will not be used for product development or AI training.
- Resend may be used for transactional email. Recipient details and the content needed to send the message may pass through this service.
These providers may process data inside or outside Thailand, depending on the services and settings used. If a clinic connects its own external service, such as LINE, data transmission also follows that provider’s settings and terms.
We may disclose data where required by law or necessary to protect rights, maintain safety or provide the contracted service. Where a clinic connects an external service, use and disclosure through that service also depend on the clinic’s choices and the provider’s terms.
Data retention and deletion
Keenix keeps data only as necessary for its purposes, contracts and applicable law. For data processed on behalf of a clinic, the clinic also determines retention during active use. Post-termination and other retention periods are listed below.
| Data type | Retention period |
|---|---|
| Patient, employee, file and clinic operational data | While the organisation account is active and according to the clinic’s instructions. After service termination, the clinic has 30 days to export data; data is then deleted from the main system within 60 days of termination. |
| Clinic data backups | Deleted according to the backup cycle and expired no later than 90 days after deletion from the main system, unless needed for system recovery or incident management. |
| Administrator account and service contact details | For the customer relationship and no more than 2 years after it ends, unless needed for a dispute or legal matter. |
| Demo enquiries and prospective customers who have not subscribed | 12 months after the last contact, followed by deletion or anonymisation, unless the data subject requests earlier deletion or the law requires otherwise. |
| Support and complaint records | 2 years after the matter is closed, unless a dispute or legal obligation remains. |
| Security and access logs | 180 days, unless related to an ongoing investigation or unresolved claim. |
| Payment, accounting and tax documents | As required by accounting and tax law. Legally required tax documents are kept for at least 5 years; other records are deleted or anonymised when no longer needed. |
| Google Analytics user and event data, if enabled | 14 months for user and event data if enabled. Aggregated reports may not be subject to this routine deletion. |
Some data is currently marked for deletion before permanent removal. Deleting a record from the screen does not immediately remove backups. Database, backup and file deletion follows the periods above and the data processing agreement.
Data subject rights
Depending on the lawful basis and legal exceptions, data subjects may exercise applicable rights, including access or copies, correction, deletion or destruction, restriction, objection, receipt or transfer of data, withdrawal of consent and complaints.
For requests involving patient or employee data controlled by a clinic, contact the clinic that collected it first. The clinic can request agreed assistance from Keenix. For data controlled by Keenix, send your request and details needed to verify your identity to [email protected]. We will consider and respond to requests under applicable law.
Security and data breaches
Keenix will provide technical and organisational measures to prevent unauthorised access, use, alteration or disclosure. For administrator permissions, support access, backup and recovery, and coordination channels, seeSecurity informationand the relevant agreements. If an incident involves data controlled by a clinic, Keenix will notify and coordinate with the clinic under the duties and timeframes required by law or agreement.
Cookies and website usage data
Google Analytics is disabled on this version of the marketing website. If enabled, it may use cookies or online identifiers to measure visits, pages viewed, traffic sources, campaigns, browsers, devices and website events. This data is used only for marketing measurement, not product development or AI training. Analytics events should not contain patient or health data or personally identifying text. If enabled, user and event data retention will be set to 14 months, with notices and controls to choose and change non-essential cookie settings as required by law. Non-essential tags will remain off until a cookie choice is made. Maps and external services are explained in theCookie Policy
Policy changes and contact
When this policy changes, Keenix will display the revision and effective date on the website or another appropriate channel. Changes affecting users’ rights or duties will be notified in the manner and timeframe required by law or agreement.
Service provider: Clinical Technology Co., Ltd., legal entity registration number 0105566065006. Address: 222/5 Everest The Function Maliwan, Moo 16, Ban Pet, Mueang Khon Kaen, Khon Kaen 40000, Thailand.
For personal data enquiries or requests, contact [email protected].