Privacy Policy

1. Introduction

HubSwitch Co., Ltd. ("Company", "we", "us") is committed to protecting your personal data. This policy explains how we collect, use, disclose, and protect your personal information in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and international data protection standards.

2. Data We Collect

2.1 Data You Provide Directly

• Name, email address, phone number
• Company/clinic information (name, address, registration number)
• Payment information (processed through our payment provider Omise)

2.2 Data Collected Automatically

• IP address, cookies, and browser information
• Website and application usage behavior
• Device information (type, operating system)

3. Purpose of Data Processing

• To provide HubSwitch Pro services as subscribed
• To improve and develop our services
• To communicate about services, updates, and promotions
• To comply with applicable laws and regulations

4. AI Processing

In-app AI assistant (Nong)

Questions you type in the app are sent to Hubswitch's own AI server (self-hosted on the company's private infrastructure) solely to generate a response — no data is sent to any third-party AI provider, and the app does not store conversations on your device.

Automated document reading (OCR)

Delivery-note photos you take in the app are sent through our servers to an external AI service (Google Gemini) solely to automatically read the product line items. This is used for goods receipt only. The app requests your consent before first use, and that provider offers an equivalent level of data protection.

5. Data Disclosure

We will not disclose your personal data to third parties except in the following cases:

• With your explicit consent
• To comply with laws, court orders, or government authorities
• To necessary service providers (e.g., payment processors, cloud hosting) under data protection agreements

6. Your Rights

Under PDPA, you have the following rights:

• Right to access your personal data
• Right to rectify inaccurate data
• Right to erasure (Right to be Forgotten)
• Right to withdraw consent
• Right to object to data processing

7. Data Retention

We retain your personal data throughout your service period and for 5 years after termination, or as required by law. Financial data is retained for 7 years in accordance with tax regulations.

8. Security Measures

We implement appropriate security measures including data encryption (SSL/TLS), access controls, and regular security reviews. Your data is stored on Google Cloud Platform infrastructure.

9. Staff Mobile Application (HubPro Staff)

HubPro Staff is a work tool for clinic personnel. It requires an account issued by the clinic, offers no self-service sign-up, and is not a patient-facing app. In addition to Section 2, it collects the following, always after asking the user's permission:

• Location — captured only when the user taps clock-in/clock-out, to confirm attendance was recorded at the branch. Stored as coordinates attached to that attendance record. No background tracking; never shared with other users.
• Camera and photos — used to scan GS1/EAN barcodes on stock boxes and to photograph delivery notes as evidence of goods received. Photos are attached to that goods-received note.
• Patient information entered by staff — patient name and HN entered by a dentist or assistant on a materials requisition, to link materials used to a treatment case. This is sensitive personal data under PDPA and is accessible only to personnel of the same clinic.
• Notification token — used to deliver work alerts to the device, such as a requisition being ready or an order being confirmed.
• Biometrics (fingerprint/face) — used only to unlock the app. Processed by the device operating system; never transmitted off the device and never stored by us.

Tenant isolation: all data is scoped to the clinic that issued the account; a user of one clinic cannot see another clinic's data. To exercise the deletion rights in Section 5, contact your clinic administrator or contact us directly using the channels in Section 11.

10. Customer Mobile Application (HubPro Customer)

HubPro Customer is a personal app for the general public. You create the account yourself with an email address and a password; it is not issued by a business, and it is not linked to any clinic's records. In addition to Section 2, it collects the following, always after asking your permission:

• Camera — used to read barcodes and QR codes so an item can be identified and added to your inventory. The camera reads the code only; no photograph is taken, stored or uploaded.
• The inventory you create — item name, quantity, category, storage location, expiry date, barcode and any note you write. These can describe medicines and health-related supplies, which is sensitive personal data under PDPA, so they are visible only to your own account.
• Biometrics (fingerprint/face) — used only to unlock the app. Processed by the device operating system; never transmitted off the device and never stored by us.
• Notification token — issued by the operating system and kept in the device's secure storage so the app can raise expiry reminders on the device itself. We do not send push notifications to this app from our servers, and the token is not transmitted to us.

Where this data is stored: the inventory you create is held in Google Cloud's asia-southeast1 region (Singapore). Your sign-in identity (email address and user ID) is held in Firebase Authentication, which Google operates on multi-region infrastructure that may include servers outside Thailand. You can request deletion from inside the app — Profile, then Delete account — or through the channels in Section 11; see the account and data deletion page for what is removed and what is retained.

On-device barcode scanning (Android only)

The app uses Google ML Kit to read barcodes and QR codes. Camera images are processed entirely on your device and are never sent to Google. ML Kit does, however, send metrics about the performance and utilization of those functions to Google for measurement, debugging and improvement. Those metrics contain no image content and do not identify you. We state this because Google requires the app developer to inform users of it (developers.google.com/ml-kit/terms). The iOS build does not use ML Kit.

11. Contact Us