Privacy Policy (Thailand)

1. Data Controller

Roles under the PDPA. The healthcare institution using MiraScribe is the data controller for patient data, including dictation audio, transcripts and generated reports. MiraNext GmbH acts as data processor for that data and processes it only on the institution's documented instructions.

MiraNext GmbH is the data controller in its own right only for practitioner account data and service usage data, as described in section 3.

MiraNext GmbH, Innsbrucker Bundesstraße 83a, 5020 Salzburg, Austria.

Contact: support@miranext.ai.

2. Data Protection Officer (DPO)

Our Data Protection Officer is DI David Baumgartner, MSc, MBA, and can be reached at support@miranext.ai or by post at the address of the data controller stated above.

3. Categories of Personal Data Processed

MiraScribe processes only the personal data strictly necessary to deliver its service:

• User account data: name, professional email, job title, organisational affiliation, authentication credentials.
• Consultation metadata: date, time, duration, template used, language selected.
• Audio data: the dictation audio stream, transmitted to the speech-to-text provider for transcription and stored on the practitioner's own device (see section 7).
• Transcripts: full-text transcription of the consultation.
• Structured notes: medical documentation generated from the transcript (history, findings, treatment plan, ICD-10 suggestions).
• Usage data: device and browser identifiers, IP address, diagnostic data.

4. Purposes and Legal Bases for Processing

MiraScribe processes personal data under the following legal bases in PDPA Sections 24 and 26:

• Transcription and structured note generation involving health data (sensitive personal data, Section 26 PDPA): explicit consent or vital public health interest basis.
• Contract performance with users and healthcare institutions: Section 24(3) PDPA.
• Compliance with legal obligations (record-keeping, regulatory surveillance): Section 24(6) PDPA.
• Security, fraud prevention and quality improvement in pseudonymised form: legitimate interest under Section 24(5) PDPA.

5. Recipients and Data Processors

MiraNext GmbH transfers personal data only to contracted data processors. The processors engaged for this Thailand deployment are:

• Google Cloud Platform - application hosting, database and backups in Bangkok (asia-southeast3), and Vertex AI note generation plus Google Speech-to-Text in Singapore (asia-southeast1).
• Deepgram - speech-to-text. The default speech engine on this deployment; processing takes place in Australia.
• ElevenLabs - alternative speech engine, used only where selected; processing takes place in the United States.
• Google Workspace SMTP relay - transactional email such as sign-in codes.
• Crisp - in-product support chat, loaded on all pages of the application.

6. Cross-Border Transfers

Personal data is stored in Thailand. The processing set out below takes place outside Thailand and is carried out pursuant to PDPA Sections 28-29 using appropriate safeguards, including standard contractual clauses, encryption in transit and a transfer impact assessment.

• Singapore - note generation (Vertex AI) and Google Speech-to-Text. Processing is transient and no data is retained there.
• Australia - Deepgram speech-to-text. This carries dictation audio.
• United States - ElevenLabs speech services, only where that engine is selected. This carries dictation audio.
• Support chat provider - content that you enter into the support chat.

7. Retention Periods

Dictation audio is stored on the practitioner's own device, in the browser's local database, so that a recording can be replayed against the resulting report. It is not uploaded to MiraNext servers and is not held in the Bangkok database. Audio is transmitted to the speech-to-text provider for transcription only. Device-held recordings remain until the practitioner deletes them or clears the browser's stored data.

Transcripts and structured notes are retained for the duration of the contract with the healthcare institution and deleted within the period agreed in that contract, unless a longer statutory retention period applies.

Account data is retained for the duration of the contract and applicable limitation periods.

Database backups are retained on a rolling basis in accordance with the database backup configuration and are then deleted.

8. Personal Data Breach Notification

MiraNext GmbH acts as data processor; the healthcare institution using MiraScribe is the data controller. Where a personal data breach occurs, MiraNext GmbH notifies the healthcare institution without undue delay and in any event within 24 hours of becoming aware of it, pursuant to PDPA Section 40.

The healthcare institution, as data controller, notifies the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach, pursuant to PDPA Section 37(4). This does not apply where the breach is unlikely to result in a risk to the rights and freedoms of data subjects. Where notification within 72 hours is not possible, it must be made as soon as possible and in any event no later than 15 days from becoming aware, together with an explanation of the reasons for the delay.

Where a personal data breach is likely to result in a high risk to your rights and freedoms, you are notified of the breach and of the remedial measures taken, without delay.

9. Rights of Data Subjects

Under PDPA Chapter 5 you have the following rights:

• Right of access to personal data (Section 30).
• Right to rectification of inaccurate data (Section 35).
• Right to erasure or destruction (Section 33).
• Right to restriction of processing (Section 34).
• Right to data portability (Section 31).
• Right to object to processing (Section 32).
• Right to withdraw consent (Section 19).

10. How to exercise these rights

Where a request concerns patient data, please address it to the healthcare institution, which is the data controller. MiraScribe holds no structured patient identifiers such as name, hospital number or accession number, so MiraNext GmbH cannot locate a particular patient's records without the institution and will act only on the institution's instructions.

Requests concerning a practitioner's own account data may be sent directly to support@miranext.ai.

11. Complaints

You have the right to lodge a complaint with the Personal Data Protection Committee (PDPC): Office of the Personal Data Protection Committee, 120 Moo 3, Floors 5-7, Ratthaprasasanabhakti Building, Government Complex, Chaeng Watthana Road, Thung Song Hong, Lak Si, Bangkok 10210, Thailand. Telephone +66 2 111 8800. Email saraban@pdpc.or.th.

For inquiries about your personal data: support@miranext.ai.

12. Changes to this Policy

This policy may be updated to reflect changes in law or operations. Updates will be announced on our website.