Vichaiyut Company Limited, operating under the name of Vichaiyut Hospital and Vichaiyut Medical Center, which operates as a large private healthcare facility, recognizes the importance of protecting the personal data of shareholders, proxies, and/or other related parties. Therefore, we would like to provide you with the following information to comply with the Personal Data Protection Act of 2019. This data protection notice will cover the collection, usage, disclosure, and processing of personal data that can directly and/or indirectly identify the shareholders and/or proxies, as detailed below:

The company will undertake the collection, gathering, usage, and disclosure of personal data of shareholders or proxies for the following purposes:

1. For organizing shareholder meetings, confirming the identity of shareholders/proxies, managing shareholder registers, proxy assignments, and other related activities.
2. For sending beneficial information, including shareholder benefits.
3. To notify dividend payments and transfer dividend payments to shareholders.
4. To establish the rights of shareholders.
5. To comply with laws, contracts, or where it is necessary to provide personal data of shareholders for contractual purposes.

For the aforementioned purposes, the company will collect the following personal data:
1. Name, surname, address, occupation, phone number, and email address.
2. Personal data as shown in a copy of the national ID card, house registration, passport copy, and the front page of the bank account book displaying the account number.
3. Personal data of individuals related to the shareholder, such as spouses, children, legal representatives, heirs, attorneys-in-fact, and persons granted power of attorney.
Remarks: For supporting documents related to share transfers and/or power of attorney provided by shareholders or persons granted power of attorney, which may contain sensitive personal information such as blood type, religion, etc., which is unnecessary for the purposes of shareholder registry and shareholder meetings, the company would like to inform that it has no intention of collecting such sensitive personal information. Therefore, before shareholders or persons granted power of attorney submit documents to the company, they may redact or make the sensitive personal information not visible to conceal such information. In cases where shareholders or persons granted power of attorney do not conceal such sensitive personal information, the company reserves the right to conceal the sensitive personal information on the received documents without considering it as collected personal information.

The company will collect, use, disclose, and retain your personal data and that of individuals associated with you throughout the period you hold shares. When you cease to be a shareholder of the company, we will continue to retain information related to you, including personal data, for a necessary period to fulfill the aforementioned purposes. However, in any case, the company will retain your personal data for no more than 10 years from the last contact or until the relationship between you and the company is terminated, unless the company has a legal obligation to retain your personal data for a longer period.

Under the specified objectives and according to the criteria set by law, the company may find it necessary to disclose information to individuals and organizations as follows:
1. The company may disclose personal data to service providers and personal data processors appointed or contracted by the company to manage/ process personal data, such as IT service providers, data recording services, healthcare services, data analysis services, or any other services commissioned by the company.
2. The company may notify financial institutions to provide personal information for financial-related purposes, such as distributing dividends to shareholders.
3. Information may be disclosed to state agencies responsible for supervision and regulation according to the law, or when required to disclose information by law, or related to legal processes, or authorized by relevant laws, such as the Revenue Department, Department of Local Administration, Department of Business Development, etc.
4. Personal information may be disclosed to individuals or organizations to which you have given consent, such as sharing processed images of company activities through various media channels to the general public.
5. Consultants of the company, including legal consultants, lawyers, accounting consultants, auditors, or other experts, both within and outside the company.
6. Personal information may be disclosed to individuals or organizations as per court orders.

The company establishes stringent measures to ensure the security of personal data, aiming to prevent unauthorized access, modification, or disclosure by unauthorized individuals. These measures align with the company's information security policy and data protection policy.

The data subject has rights under Section 3 of the Personal Data Protection Act of 2019 (B.E. 2562).

The company has appointed a Personal Data Control Committee and Data Protection Officers. If shareholders wish to exercise the various rights of the data subject or have any concerns, they can contact the Data Control Committee or Data Protection Officers at:

Vichaiyut Medical Center 53 Setsiri Road, Phyathai, Bangkok 10400 Phone: 0-2265-7777 Email: medcenter@vichaiyut.com

Feel free to reach out to the Data Control Committee or Data Protection Officers if you have any requests regarding your personal data or if you have any questions. They will be available to assist you with any inquiries or concerns you may have in accordance with data protection regulations.

The company may temporarily amend this policy to align with any changes related to the processing of your personal data and in compliance with data protection laws or other relevant regulations. The company will notify you of any significant changes or updates through its website. It is advised to regularly check for modifications to stay informed of the latest version of this policy.
This policy, as amended, shall take effect from June 1, 2022.