ONE PEN is open for pre-order · Launch price ฿990 · ships early January 2027launch price ฿990See ONE PEN
TH

Privacy policy

Version dated 21 October 2026 · effective from publication on medo-logy.com

This policy explains how we collect, use, disclose and protect your personal data under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) when you use medo-logy.com, place an order, collect Nº 07, talk to Hari, or contact us.

1. Data controller

Rodsaniyom Dee Kern Keed Co., Ltd. (distributor of medology products), 12/1 Choeng Noen, Mueang Rayong, Rayong, Thailand · hello@medo-logy.com · +66 90 569 9669 · LINE @medology

For anything about your personal data (including the rights in section 8), email hello@medo-logy.com with the subject “PDPA”.

2. What we collect, why, and on what legal basis

  • Orders and delivery — name, phone, email, delivery address, courier note, items, amount paid and order status · to take your order, deliver it, keep you updated, issue receipts and look after you afterwards · basis: performance of a contract (s. 24(3)) and accounting and tax obligations (s. 24(6))
  • Payment — handled by Stripe. We never see or store your card number; we receive only the result, the method and a transaction reference · basis: contract and legal obligation
  • Nº 07 · Continued care — phone number, how many items you have bought, product, where you bought it, lot number, receipt photo (for in-store purchases), and — only if you choose to give them — gender and age range · to count your items, confirm genuine purchases, prevent double claims, and for anonymised analysis to improve our products · basis: contract (programme terms) and consent (s. 19) for gender and age range
  • Hari (AI helper) — your questions and Hari’s answers, the page you asked from, and a hash of your IP address (never the full IP) · to answer, prevent abuse and improve the knowledge base · basis: legitimate interests (s. 24(5)) · Hari does not need your name, number or personal health details — please don’t send them
  • Problem reports (adverse reactions) — product, lot, what you noticed, when it started, and any contact detail you give. This may be health data, a sensitive category · to follow up, work with the manufacturer and keep products safe · basis: your explicit consent before sending (s. 26), and where necessary to prevent harm to life or health (s. 26(1))
  • Hair check — your six answers (gender and age range, what you notice, how long, related factors, what you have tried, your goal), which may relate to health · processed on your device to show your summary, and stored only if you ask us to send it with your email or LINE ID · basis: explicit consent (ss. 19 and 26)
  • Stores, partners and corporate gifts — organisation, contact person, phone, email and request details · to reply and quote · basis: steps at your request before a contract (s. 24(3))
  • Contacting us — what you send by LINE, email or phone · to help you · basis: contract or legitimate interests
  • Newsletter — email or LINE ID · hair knowledge at most once a month · basis: consent, which you can withdraw at any time

If you don’t give the details needed for an order, we may not be able to deliver it. Anything marked “optional” is always your choice and never affects your purchase.

3. Where data comes from

Mostly from you directly; also from our payment provider (payment result), couriers (parcel status) and stores that sell our products (when you register an in-store purchase for Nº 07).

4. Who we share it with

We do not sell personal data. We share only what is needed with service providers that process it for us under contracts requiring protection:

  • Stripe — payments
  • Supabase — database and file storage (Singapore region)
  • Netlify — website hosting and server functions
  • Resend — order and summary emails
  • LINE (LY Corporation) — team alerts and LINE OA messaging
  • Anthropic — language processing for Hari’s answers (only the conversation text — never your name or order data)
  • Couriers — name, phone and address for delivery
  • The manufacturer (Cosmed Innovation Co., Ltd.) — de-identified problem reports and lot numbers for quality checks, unless you agree to share more
  • Authorities — where the law requires or a lawful order applies

5. Transfers outside Thailand

Some of these providers process data outside Thailand (for example Singapore, the United States and Japan). We choose providers with appropriate data-protection standards and rely on contractual safeguards under sections 28 and 29 of the PDPA.

6. How long we keep it

  • Orders and accounting records — at least 5 years from the close of the accounts, under the Accounting Act B.E. 2543 (2000) and the Revenue Code (longer if an authority orders it)
  • Nº 07 account — while you are a member and for 2 years after your last purchase · receipt photos for 1 year after checking
  • Hari logs — 12 months
  • Problem reports — 5 years, for product-safety follow-up
  • Hair check and newsletter — until you withdraw consent, or 2 years after our last contact
  • Store and company enquiries — 2 years after last contact if no contract follows

After that, we delete, destroy or de-identify the data.

7. Security

We use encryption in transit (HTTPS), role-based access (only staff who need the data for their work), change logs, and keep system keys on the server only. If a breach puts your rights at risk, we notify the PDPC Office within 72 hours and tell you without delay where the risk is high.

8. Your rights

  • Access your data and get a copy, or ask how we obtained data collected without your consent
  • Receive or transfer your data in a commonly used, machine-readable format
  • Object to collection, use or disclosure
  • Ask us to delete, destroy or de-identify it
  • Ask us to restrict its use
  • Ask us to correct it and keep it accurate, current and complete
  • Withdraw consent at any time, without affecting processing done before
  • Complain to the Personal Data Protection Committee Office (www.pdpc.or.th)

Send requests to hello@medo-logy.com. We may need to confirm who you are, and we act within 30 days of receiving the request. Some rights may be limited by law — for example records we must keep for accounting.

9. Minors

This site and our products are not aimed at anyone under 20. If you are under 20, please ask a parent or guardian to order or consent for you. U-TURN is not for children or pregnant women.

10. Cookies and browser storage

We use your browser’s local storage only for what the site needs to work — your cart and light/dark mode. It stays on your device and is not sent to us. We do not currently use analytics or marketing cookies; if we ever do, we will ask first and update this policy.

10.1 Site analytics (only if you accept)

If you tap “Accept” on the notice, we record first-party usage of our own site: pages opened, active time on each page, how far you scrolled, what you clicked, checkout steps and the time spent on each, the referring site, campaign, device type, language and approximate country/city — tied to a random browser ID. We do not store IP addresses and never record what you type into forms. The purpose is to improve the site and products (consent basis); we keep it for up to 25 months and never sell or share it. If you order, the random ID may be linked to that order to understand the purchase journey. Change your mind any time by clearing this site’s data in your browser or emailing hello@medo-logy.com. If you tap “Decline”, no usage is recorded.

10.2 Order history (CRM)

We keep every order (items, amount, status, delivery address, note and transfer slip), grouped by mobile number, to deliver, provide after-sales care, count Nº 07 and analyse sales (contract and legitimate-interest bases), for the periods in section 6.

11. Changes

We may update this policy as the law or our services change. The latest version, with its date, is always on this page. For significant changes we will tell you in advance on the site or through the contact details you gave us.