Privacy Policy

1. Introduction

HubSwitch Co., Ltd. ("Company", "we", "us") is committed to protecting your personal data. This policy explains how we collect, use, disclose, and protect your personal information in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and international data protection standards.

2. Data We Collect

2.1 Data You Provide Directly

• Name, email address, phone number
• Company/clinic information (name, address, registration number)
• This website does not take payments or ask for card or bank details

2.2 Data Collected Automatically

• IP address, cookies, and browser information
• Website and application usage behavior, including the page from which you send a form and any campaign tags (utm) in that page's address
• Device information (type, operating system)

2.3 Messages you send to our LINE Official Accounts

When you send a message to one of the company's LINE Official Accounts, LINE forwards it to our system. We keep the user identifier LINE assigns to you for our account, the message's reference ID, its text (up to 2,000 characters), the time it was sent and whether it has been passed on. We do not request your display name or profile picture from LINE, and we do not keep images, stickers or files you send; for a message that is not text we record only its type. We use this so that a member of our team can read and answer you: the system sends a copy of the message to our customer-service mailbox and may reply automatically with a standard message. This data is stored in the company's database on Google Cloud, located in the United States, and kept as described in section 7. Messages sent through LINE are also subject to LINE's own privacy policy. You can exercise the rights in section 6 over this data by contacting us as described in section 12.

3. Purpose of Data Processing

• To provide HubSwitch Pro services as subscribed
• To improve and develop our services
• To communicate about services, updates, and promotions
• To comply with applicable laws and regulations

4. AI Processing

Nong, the AI assistant — what is sent for processing

When you type a question to Nong, your question, part of the recent conversation, and the information the system retrieves to answer it are sent through the Company's servers (Google Cloud, Singapore region) to be processed by outside providers: OpenRouter, Inc. (United States), which forwards the request to a provider running the language model — currently a DeepSeek model; the provider and the country where it is processed can differ from one request to the next. And Google Cloud (Vertex AI), Singapore region, to turn text into numbers used to find the information for the answer. Before sending, the system automatically removes common formats of national ID numbers, phone numbers, hospital numbers (HN) and email addresses; it may not catch every format, and it does not remove people's names. Please do not type names or health information about patients or anyone else. The Company asks these providers not to keep the data or use it to train models. For questions or to exercise your rights under the personal data protection law, contact the Data Protection Officer at dpo@hubswitch.com

Automated document reading (OCR)

Delivery-note photos you take in the HubPro Staff app are sent through our servers (Google Cloud, Singapore region) to Google's services solely to automatically read the product line items. This is used for goods receipt only. Google Cloud Vision first reads the text in the photo. Google states that Cloud Vision does not guarantee that data remains within a particular location or region, so we cannot state the country where this step is processed. The text it reads is then sent to Google Gemini (Vertex AI) in Google Cloud's Singapore region to identify the product line items. If Cloud Vision is unavailable, the photo itself is sent to Gemini in the Singapore region instead. Before the first scan on each device, the HubPro Staff app asks for consent. Please avoid capturing personal data, such as patient details, in the photo.

Chat on this website — what happened before 18 September 2026

From the launch of the chat on this website until 18 September 2026, messages visitors typed into the chat window, together with part of the earlier conversation, were sent to Anthropic (United States) to generate replies. National ID numbers, phone numbers, email addresses and card numbers were not removed before sending, and the chat window did not say where messages went. On 18 September 2026 the Company stopped sending messages to Anthropic and began removing those formats before sending. Since the night of 20 September 2026 the chat sends requests through OpenRouter, set to route only to providers that do not retain data (Zero Data Retention), and the chat now shows a notice before the first message. For questions, contact the Data Protection Officer at dpo@hubswitch.com.

Searching on the Discover page

When you type a search on the Discover page, the system first tries to remove email addresses, card numbers, Thai national ID numbers and phone numbers in common formats, and may not catch every format. It then sends the search through the company’s servers to Google Cloud (Vertex AI) in the Singapore region, to work out what kind of service you are looking for and to rank the results. We do not record the words you type. We record only the kind of service the system identified and the number of results, not linked to you, to count usage, and delete it automatically after 90 days. Before 18 September 2026 the system also recorded the search text; we deleted all of those records on 3 October 2026. Deleted data remains in the database’s recovery copy for no more than 7 further days.

5. Data Disclosure

We will not disclose your personal data to third parties except in the following cases:

• With your explicit consent
• To comply with laws, court orders, or government authorities
• To necessary service providers (e.g., cloud hosting, AI processing, reading text from receipt photos, email delivery, app error monitoring)

6. Your Rights

Under PDPA, you have the following rights:

• Right to access your personal data
• Right to rectify inaccurate data
• Right to erasure (Right to be Forgotten)
• Right to withdraw consent
• Right to object to data processing

7. Data Retention

We retain your personal data throughout your service period and for 5 years after termination, or as required by law. Financial data is retained for 7 years in accordance with tax regulations.

8. Security Measures

We implement appropriate security measures including encryption of data in transit (SSL/TLS), access controls, and regular automated security checks. The database this website uses is the company's database on Google Cloud, located in the United States. It holds, for example, what you submit through the forms on this website (such as the contact form, newsletter sign-up, resource downloads and requests for access), messages you send to the company's LINE Official Accounts (see section 2.3), records of the cookie choices you make on this website (including your IP address and browser information), and, if you have an account, your account details and records of your sign-in activity. Google encrypts the data in this database before writing it to disk. Submissions through the forms named above, and LINE messages, are also emailed to our team so that we can respond. The servers that run this website are in Google Cloud's Singapore region. If you sign in on this website, your sign-in identity is held in Firebase Authentication, which Google states processes data exclusively in the United States. You can exercise the rights in section 6 over this data by contacting us as described in section 12.

9. Staff Mobile Application (HubPro Staff)

HubPro Staff is a work tool for clinic personnel. It requires an account issued by the clinic, offers no self-service sign-up, and is not a patient-facing app. In addition to Section 2, it collects the following, always after asking the user's permission:

• Location — captured only when the user taps clock-in/clock-out, to confirm attendance was recorded at the branch. Stored as coordinates attached to that attendance record. No background tracking; never shared with other users.
• Camera and photos — used to scan GS1/EAN barcodes on stock boxes and to photograph delivery notes as evidence of goods received. Photos are attached to that goods-received note.
• Patient information entered by staff — patient name and HN entered by a dentist or assistant on a materials requisition, to link materials used to a treatment case. This is sensitive personal data under PDPA and is accessible only to personnel of the same clinic.
• Notification token — used to deliver work alerts to the device, such as a requisition being ready or an order being confirmed.
• Biometrics (fingerprint/face) — used only to unlock the app. Processed by the device operating system; never transmitted off the device and never stored by us.

Tenant isolation: all data is scoped to the clinic that issued the account; a user of one clinic cannot see another clinic's data. To exercise the deletion rights in Section 6, contact your clinic administrator or contact us directly using the channels in Section 12.

10. Customer Mobile Application (HubPro Customer)

HubPro Customer is a personal app for the general public. You create the account yourself with an email address and a password; it is not issued by a business, and it is not linked to any clinic's records. In addition to Section 2, it collects the following, always after asking your permission:

• Camera — used to read barcodes and QR codes so an item can be identified and added to your inventory. When reading a code, the camera reads the code only; no photograph is taken, stored or uploaded. An image leaves the device only when you choose to photograph a receipt (see “Reading receipts” below).
• The inventory you create — item name, quantity, category, storage location, expiry date, barcode and any note you write. These can describe medicines and health-related supplies, which is sensitive personal data under PDPA, so they are visible only to your own account.
• Biometrics (fingerprint/face) — used only to unlock the app. Processed by the device operating system; never transmitted off the device and never stored by us.
• Notification token — issued by the operating system and kept in the device's secure storage so the app can raise expiry reminders on the device itself. We do not send push notifications to this app from our servers, and the token is not transmitted to us.

Where this data is stored: the inventory you create is held in Google Cloud's asia-southeast1 region (Singapore). Your sign-in identity (email address and user ID) is held in Firebase Authentication, which Google states processes data exclusively in the United States. You can request deletion from inside the app — Profile, then Delete account — or through the channels in Section 12; see the account and data deletion page for what is removed and what is retained.

On-device barcode scanning (Android only)

The app uses Google ML Kit to read barcodes and QR codes. Camera images are processed entirely on your device and are never sent to Google. ML Kit does, however, send metrics about the performance and utilization of those functions to Google for measurement, debugging and improvement. Those metrics contain no image content and do not identify you. We state this because Google requires the app developer to inform users of it (developers.google.com/ml-kit/terms). The iOS build does not use ML Kit.

Product names from Open Food Facts

When you scan a barcode that our own product registry does not recognise, and that you have not named in the app before, the app asks Open Food Facts — a public, open database of food products — whether it knows that barcode. The request goes directly from your device to world.openfoodfacts.org. It contains the barcode number and a fixed identifier for the app. It does not contain your name, email address, account ID or inventory; as with any request over the internet, Open Food Facts receives your device's IP address. If it knows the product, the app shows you its name as a suggestion from Open Food Facts, which you can use, change or ignore; if you save it, the name becomes part of your inventory described above. Open Food Facts is run by a non-profit association in France and its servers are in France, so this request leaves Thailand. Open Food Facts handles it under its own privacy policy.

Product names suggested this way come from Open Food Facts and are made available under the Open Database License (ODbL).

Reading receipts

When you choose to photograph a receipt to add items to your inventory, the image is sent to our server and passed to Google Cloud Vision (Google LLC) to read its text. We call Google's global endpoint (vision.googleapis.com), so the image may be processed on servers outside Thailand. We do not keep the receipt image. The item names and prices read from it are shown to you first, and saved to your inventory only for the items you confirm.

Crash and performance data

The app may send anonymised crash reports and performance diagnostics to Sentry (sentry.io), a third-party service acting as our data processor, so that we can detect and fix failures. These reports contain the device model, operating system version, app version and the technical context of the error. They do not contain the contents of your inventory, your messages, or any payment information.

11. Administrator Mobile Application (HubSwitch AMS)

HubSwitch AMS is the mobile app that HubSwitch platform administrators use to run the HubSwitch platform. Accounts are issued by HubSwitch Co., Ltd.; there is no sign-up in the app, and the app is not intended for clinics, patients or consumers. Users must be 18 or older. In addition to Section 2, the app processes the following:

• Account and sign-in — your work email address and HubSwitch user ID. Sign-in uses Firebase Authentication (Google), with your password or, in the Android version where the app offers it, with your Google account: the app passes Google's sign-in token to Firebase and keeps no Google session. That token also carries your Google account's name and profile-picture link, which Firebase receives and may keep with your sign-in record; the app itself does not show or store them. If you add two-factor sign-in, Firebase also keeps your authenticator-app factor. Sign-in tokens are kept in the device's secure storage (iOS Keychain / Android Keystore).
• Approvals and alerts — the approve/reject decisions and alert acknowledgements you make, with the time you took to act. We use these records to run the platform, to keep an audit trail, and to improve HubSwitch's decision-support and automation.
• MAES commands and Knowledge questions (AI) — the text you type in the MAES command console and the questions you ask in Knowledge are sent to HubSwitch servers and processed by our AI service provider, Anthropic (Claude), to produce a reply. Before your first command or question, the app shows a notice and asks for your permission; when you allow it, the app also records this at HubSwitch, and if you later withdraw consent on a device that holds that record, the app asks HubSwitch to withdraw it. MAES can be switched to another AI model, DeepSeek or K3 (the switch is one setting shared by the app and the HubSwitch web console; in the app it asks before switching). While MAES runs on such a model, or if HubSwitch turns on its fallback for when Claude fails, the commands you type go through OpenRouter to the company that runs the model in use, such as DeepSeek or Moonshot AI. These features are available only to HubSwitch MAES super-administrators.
• Product photos and barcodes (Capture) — Capture has two modes. Barcode (the default): the camera reads the product's barcode on the device — in the Android version with Google's ML Kit barcode scanning (the model built into the app), in the iOS version with Apple's camera framework. Only a code that carries a product number (GTIN) is sent, together with the lot, expiry date and serial number printed in the same code; it goes from your phone directly to HubSwitch's product-catalog lookup, without your sign-in token or user ID. Photo: when you choose to photograph a product box or label, the photo is sent through HubSwitch servers to HubSwitch's own image-matching service, which returns the matching product(s) with a confidence score. Capture does not change any records. Photos and scanned codes are not used for advertising and are not sold. If we enable a third-party text-recognition (OCR) provider for photos, we will name it in this policy before it is enabled.
• Diagnostic logs — app events and errors, the server addresses the app calls with their response status and time, device model, operating-system and app version, a random installation ID created by the app, and a random ID for each app session. Before a log entry leaves the device, the app replaces the values of fields named like passwords, tokens, keys or personal details (such as email, phone, name or address) with a placeholder, and replaces email addresses, phone numbers, long numbers and labelled hospital numbers (HN) in the text with placeholders. The text you type in MAES and Knowledge, photos and scanned codes are not put in the logs. The logs are sent to HubSwitch with your sign-in token and sign-in events record your user ID, so the logs are linked to your account; they are used to operate, secure and fix the app, and are kept for up to 90 days.
• Notification token — your device's push token, registered with HubSwitch together with the device platform and its operating-system build number, so we can send you platform alerts. Delivery uses Firebase Cloud Messaging (Android). Push notifications are not yet available in the iOS version; when they are, delivery will use Apple Push Notification service.
• Biometrics (Face ID, Touch ID, fingerprint) — used only to lock the app when it opens and when you return to it. By default your device passcode can be used instead; if you choose "biometric only" in Settings, only a fingerprint or face enrolled at that time opens the app. A device with no screen lock is not let in, and the lock screen always offers to sign out and sign in again with your password. The check is done by the device's operating system; we never receive or store biometric data.
• Device permissions and on-device storage — the camera is used only for Capture (barcode scans and product photos). The app does not record audio (the iOS version carries a microphone permission text only because its camera component requires one) and does not access your location, contacts or files. Sign-in tokens, your user ID and email address, the random installation ID, the push token and your AMS PIN (a 6-digit confirmation PIN, kept only as a salted hash, checked on the device and never sent) are kept in the device's secure storage. Diagnostic logs waiting to be sent, your notice and consent choices (kept per account under your user ID) and simple preferences (such as notifications on/off and the app-lock mode) are kept in the app's own storage without additional encryption. Each product photo you take is saved as a file in the app's private cache folder while it is identified. From app version 1.3.0 the app deletes it once identification has finished, and deletes any photos left from earlier versions (or from an identification interrupted by closing the app) the next time you open Capture. Version 1.2.0 and earlier leave the photo there until the operating system clears the cache or the app is removed.
• App updates — the app checks Expo's update service for new versions, sending a random installation ID and the app's platform and version.

We do not sell this data, show advertising or track you across other companies' apps or websites. Google (Cloud and Firebase), Anthropic, Apple and Expo process data on our behalf. OpenRouter and the model companies it passes MAES commands to receive those commands to produce MAES's reply. In the Android version, Google's ML Kit also collects data about its own use, such as device information and performance metrics, which Google uses for its own diagnostics and usage analytics. Data may be processed outside Thailand, for example on Google Cloud servers in Singapore and by our AI service provider, which may process data in the United States. While MAES runs on DeepSeek or K3, or through the fallback for when Claude fails, OpenRouter (United States) forwards your commands to a company running that model; that company and the country where it processes them can differ from one request to the next. We use these providers under contracts and safeguards appropriate to the Thai Personal Data Protection Act (PDPA). To delete your account, open Settings → Delete My Account in the app and confirm with your AMS PIN to send a deletion request to HubSwitch; we act on it within 30 days, and you can cancel it in the app until we approve it. For an administrator account, our Data Protection Officer decides what is removed. Records we must keep by law may be retained, with your personal details removed where possible. You can also email dpo@hubswitch.com. For support: support@hubswitch.com.

12. Contact Us