Privacy Policy

"Pai Duay Kan" Application

Last updated: 19 August 2026 Effective date: 19 August 2026 · Version: 1.1

Summary

Topic · Key points

• What we collect — Account information, elderly person information (including health data), location, payment evidence, bank account details only where a refund is requested, booking history, chat messages, and device information

• What we use it for — Identity verification, caregiver matching, booking processing and payment verification, refunds on cancellation, notifications, and security

• Who we share it with — The caregiver you book, and the technology providers we rely on (see Section 7) — we do not sell your data, and we do not use health data for advertising

• Do we track across apps? — No. We do not track your behaviour across other companies' apps or websites

• How to delete your data — You can delete your account yourself in the app at Profile → Settings → Delete account. We delete it within 30 days (see Section 12)

• Contact — nat.sri@mulberrysoft.com (see Section 18)

Mulberry Soft Co., Ltd. (the "Company", "we") is committed to protecting the personal data of users of the "Pai Duay Kan" application, a platform that connects elderly people and their families with caregivers in order to book care services, manage the health and personal information of elderly people, and communicate with caregivers through in-app chat and notifications.

This policy explains how we collect, use, disclose, and protect your personal data in accordance with the Personal Data Protection Act B.E. 2562 ("PDPA"). If you do not agree with this policy, please stop using the application.

1. Information We Collect

We collect the following information when you use the application.

Account information: Full name, phone number, email, date of birth, profile photo, and identity verification data via OTP.

National ID number: We request the national ID number of the primary user in order to verify identity before granting access to an elderly person's health data, to prevent impersonation, and to prevent fake accounts on a platform that delivers services to people's homes. We store only the ID number; we do not store photographs of users' ID cards.

Elderly person information (where you register on someone else's behalf): Full name, date of birth, service address, level of independence, and the relationship to the family member managing the account, as well as health data and blood type, which are sensitive personal data under Section 26 of the PDPA (see the consent conditions in Section 4).

Geolocation data: Latitude/longitude coordinates, used to match users with nearby caregivers. The app requests your location on a per-use basis; there is no continuous or background location tracking.

Payment information: Transfer evidence (payment slips) you upload to confirm payment, made directly through each caregiver's or partner's PromptPay QR code or by bank transfer to their account, together with the amount, transaction reference number, and payment status of each booking. We do not store your credit or debit card details in any circumstances, and we neither receive nor hold your service payments.

Bank account details for refunds: If your booking is cancelled after payment and you are entitled to a refund, we store the bank name, account number, and account name you provide so that we can transfer the refund, together with the refund amount, the transfer evidence, and the refund date. We collect your bank account details only when a refund arises — not in advance at registration or at the time of booking — and use them solely to make the refund and to prepare the related accounting records.

Application usage data: Booking history, chat messages with caregivers, and service ratings and reviews.

Device information: Device model, operating system, device identifier, IP address, and the device token used to deliver notifications.

2. Information Recorded by Caregivers During Service

To confirm that the service actually took place as booked, and to protect both you and the caregiver, the system requires caregivers to record the following information while working. This information relates to you and to the service location.

• Check-in photographs taken at the service location

• The caregiver's location coordinates at the moment each work step is confirmed, which will correspond to your service location

• Work step records, namely the step name, confirmation time, notes, and whether a step was skipped

Requirements for caregivers: Caregivers are permitted to take photographs solely to confirm performance of the work, and are prohibited from photographing the faces of elderly people or others in the home without consent, and from taking any photographs or information outside the application.

Access and deletion: You can view this information on your booking detail page, and you may request the deletion of any photograph you consider inappropriate through the channels in Section 18. We retain photographs and work records for the periods set out in Section 12 for dispute resolution purposes.

3. Legal Bases for Processing

We process your data on the following legal bases.

• Contract — To create your account, process bookings, and provide the services you request

• Consent — For sensitive data (health data, blood type) and access to your location. You may withdraw consent at any time

• Legitimate interest — To prevent fraud, maintain system security, verify service delivery, resolve disputes, and improve service quality

• Legal obligation — To comply with tax and accounting law, the Computer Crime Act, and orders of competent authorities

4. Consent for Sensitive Data and Registration on Behalf of an Elderly Person

Sensitive data: The health data and blood type of an elderly person are sensitive personal data. We will process and disclose such data to the caregiver you book only upon separate explicit consent from you or from the data subject, and will use it only to the extent necessary to deliver care safely.

Consent for sensitive data is a separate item from acceptance of the Terms of Service. You may use certain booking services without giving this consent, but caregivers will not see the elderly person's health data.

Registering on behalf of an elderly person: Where you register or provide information on behalf of an elderly person, you represent that you have obtained that person's consent, or that you hold legal authority (for example as a guardian or curator). We may ask you to produce evidence of such consent or authority, and the elderly person remains the data subject with all rights under the PDPA.

You may withdraw consent at any time through your profile page or the contact channels in Section 18. Doing so may prevent you from using parts of the service.

5. Purposes of Data Use

We use your data to create and verify user accounts; match and process bookings between users and caregivers; verify service and overtime payments; process refunds and transfer them to the bank account you provide when a booking is cancelled; record and confirm caregivers' performance of work; send notifications relating to bookings, payments, and communications between users; prevent fraud and maintain system security; moderate inappropriate content in line with our community standards; resolve disputes; develop and improve service quality; and comply with the law and the orders of competent authorities.

We do not use health data for advertising, marketing, or behavioural analysis for any purpose other than the provision of care services, and we do not store personal health data in iCloud.

6. Permissions on Your Device

• Location (When In Use) — Used to match you with nearby caregivers. The app requests it on a per-use basis while in use and does not track in the background. You may refuse or revoke it in your device settings and enter an address manually instead

• Camera and photo library — Used to take or select a profile photo and payment evidence

• Notifications — Used to notify you of booking status, payments, and account announcements. Can be turned off in your device settings

Refusing any of the above permissions does not deprive you of core features that do not require that permission.

7. Disclosure to Third Parties

We may disclose your data in the following cases.

a. The caregiver/partner you book — Only the information necessary to deliver the service, such as your name, contact number, service address, and relevant health data (subject to the consent described in Section 4). Caregivers are obliged under the Terms of Service to keep such information confidential.

b. External service providers we use (data processors) — We have entered into data processing agreements with each of these providers so that your data receives the same level of protection as set out in this policy.

Provider · Purpose · Country of processing

• DigitalOcean, LLC — Hosting of all application databases, files, and images · Singapore (SGP1 data centre)

• Google Maps Platform (Google LLC)** — Processing coordinates for matching, and displaying maps and routes · United States and other countries where Google operates

• OneSignal, Inc. — Delivering push notifications to your device · United States

• Thaibulksms (Triple S Advance Technology Co., Ltd.)** — Sending OTP verification codes by SMS · Thailand

• Firebase Crashlytics (Google LLC)** — Detecting application errors and crashes · United States and other countries where Google operates

Note on health data: We do not send your health data, blood type, or national ID number to Google Maps Platform, OneSignal, Thaibulksms, or Firebase Crashlytics. Such data is stored and processed solely on DigitalOcean infrastructure as described in Section 8.

c. Government authorities — Where required by law or court order.

d. Merger or business transfer — In the event of a merger, sale, or transfer of the business, in which case we will notify you in advance through the application.

We do not sell your personal data to third parties for marketing purposes, and we do not share your data with any advertising network.

8. International Data Transfers

Your data is stored on DigitalOcean cloud infrastructure at its data centre in Singapore (SGP1), including elderly persons' health data and blood type, national ID numbers, work photographs, and chat messages. In addition, the other providers listed in Section 7 may process some data abroad, except for SMS delivery, which is processed in Thailand.

Where data is transferred abroad, we comply with Section 28 of the PDPA by putting appropriate safeguards in place, namely:

• Data Processing Agreements and Standard Contractual Clauses with every provider

• Encryption at rest and encryption in transit

• Restricting access to sensitive data to staff whose duties directly require it

We do not send your health data, blood type, or national ID number to any provider other than DigitalOcean, and we do not disclose such data to foreign authorities unless required by Thai law or a Thai court order.

9. Use of Google APIs

Our use of information received from Google APIs (including Google Maps Platform) adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Cookies, Tracking Technologies, and No Cross-App Tracking

The application uses basic technologies such as session tokens and usage-analytics identifiers in order to keep accounts secure, prevent abnormal use, remember your settings, and analyse usage to improve the service.

We do not track your behaviour across other companies' applications or websites (no cross-app tracking), and we do not share your data with advertising networks. Accordingly, we do not request permission through App Tracking Transparency.

11. Chat Messages and User-Generated Content

Chat messages between you and caregivers, reviews, and images you upload are stored on our systems in order to provide the service, resolve disputes, and maintain security.

To protect users in line with our community standards, we use automated content screening together with review by our staff, only where content has been reported or where there are reasonable grounds to suspect a breach of the law or of the Terms of Service. The staff who access such data are limited in number and bound by confidentiality obligations. We do not read your chat messages for marketing purposes.

12. Account Deletion and Data Retention Periods

You can request account deletion yourself in the application at Profile → Settings → Delete account, without contacting our staff.

Once you confirm the request, we immediately suspend access to the account and delete or anonymise your personal data within 30 days. Your phone number is released so that it can be used to register again.

Health data, blood type, national ID number, chat messages, and work photographs are deleted at the end of the 30-day period and are not among the data retained thereafter.

Certain categories of data must be retained as required by law, as follows.

Data category · Retention period · Legal basis

• Payment evidence and accounting records — 5 years · Revenue Code / Accounting Act

• Refund bank account details, transfer evidence, and refund amounts — 5 years · Revenue Code / Accounting Act

• Booking and dispute records (excluding health data) — For the applicable limitation period, up to 10 years · Legitimate interest in defending legal claims

• Computer traffic data (logs) — 90 days · Computer Crime Act

• Published reviews — Retained in anonymised form · Legitimate interest in platform trustworthiness

If your account remains active, we retain your data for as long as necessary to provide the service.

13. Data Security

We maintain appropriate technical and organisational measures to prevent unauthorised access to, use of, or disclosure of data, such as encryption in transit and at rest, role-based access restrictions, and access logging, particularly for identity and health data.

However, no method of transmission over the internet or method of storage is 100% secure.

14. Personal Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, insofar as feasible. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay together with remedial guidance, in accordance with Section 37(4) of the PDPA.

15. Minimum Age and Minors

Primary users must be at least 20 years of age and legally capable of entering into juristic acts under Thai law.

We do not intend to collect personal data from minors without the parental consent required by law. If you become aware that a minor's data has been provided without appropriate consent, please notify us and we will investigate and delete such data promptly.

16. Rights of Data Subjects

You have the following rights under the PDPA:

• The right to access and obtain a copy of your personal data

• The right to rectification, to keep your data accurate and up to date

• The right to restrict processing of your data

• The right to data portability, to have your data transferred to another data controller

• The right to erasure or destruction of your data

• The right to object to the processing of your data

• The right to withdraw consent where processing relies on consent

• The right to lodge a complaint with the Personal Data Protection Committee

You can manage some of your data yourself through your profile page, or contact us through the channels in Section 18 to exercise these rights. We will respond to your request within 30 days of receiving it.

17. Changes to This Policy

We may update this policy from time to time and will show the date of the latest update at the top. Where a change is material, we will notify you through the application at least 30 days before it takes effect, and where the change concerns sensitive data we will obtain fresh consent from you.

18. Contact Us

Data controller: Mulberry Soft Co., Ltd. Telephone: 081-928-3243 (Mon–Fri, 9:00–18:00) Email: nat.sri@mulberrysoft.com

Reporting inappropriate content or conduct: Through the report button in the application, or by email to nat.sri@mulberrysoft.com

If you are dissatisfied with the outcome of our handling of your request, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).

19. Governing Language

If this policy is translated into any other language and there is any conflict or inconsistency between versions, the Thai version shall prevail.