Key points
- Thailand's private hospitals and clinics with inpatient beds saw 58.5 million outpatient visits in 2022, 5.1 million of them by foreign patients, per the National Statistical Office.2
- In Bangkok's 2010 Census, 225,420 people spoke only a language other than Thai at home, and English, Burmese and Japanese were the largest.1
- The PDPA treats health data as sensitive, sets a 72 hour breach notice to the regulator where feasible and fines of up to five million baht for unlawful processing of it.3
- Private health facilities are overseen by the Ministry of Public Health's Department of Health Service Support, which also approves their advertising.4
- wai drafts replies and notes, a person at the clinic approves or signs each one, and records stay in Thailand.
Summary
A Bangkok clinic can use AI to draft notes and answer patients at any hour today, as long as health data is processed on a PDPA basis, a doctor signs every note and records stay in Thailand. The rules that shape it are the Personal Data Protection Act B.E. 2562, enforced by the Personal Data Protection Committee, and the Sanatorium Act B.E. 2541, overseen by the Department of Health Service Support.
Bangkok clinics now answer a patient in Osaka or Yangon before the patient wakes, and the doctor signs every note before leaving the building. wai drafts both, a person at the clinic approves or signs, and the records are hosted in Thailand under the PDPA.
Part of the JCI hub, with the framework explained, a readiness checklist and 8 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee an overnight enquiry from a patient abroad drafted for your coordinator to approve, and a deposit in baht taken at booking, in fifteen minutes.
| Body or law | Rule | What to ask | How wai meets it |
|---|---|---|---|
| Department of Health Service Support, Sanatorium Act B.E. 2541 | Oversight of private facilities and approval of sanatorium advertising | Which reply templates count as advertising | Templates stay in the clinic's control and every draft is approved by a person |
| PDPA B.E. 2562, s26 | Health data needs explicit consent unless a listed exception such as treatment applies | What is the basis for each data flow | Consent recorded in the patient's thread and record |
| PDPA B.E. 2562, s28 | Transfers abroad only to adequate countries or under an exception | Where is data hosted and processed | Records hosted in Thailand, set up with your clinic |
| PDPA B.E. 2562, s37 | Security measures and breach notice within 72 hours where feasible | Who sees which records, and is it logged | Role-based access, AES-256 at rest, every action logged |
| Personal Data Protection Committee | Administrative fines up to five million baht under s84 | Who owns PDPA compliance at the clinic | Exportable audit trail for that person |
The private care market in Bangkok
The National Statistical Office surveys private hospitals and clinics with inpatient beds every five years. Its 2022 round counted 60.8 million patients, with 58.5 million outpatient visits, 5.1 million of them by foreign patients, and about 213,000 staff.2 Asked what help they wanted from government, 58.4% of these facilities named support for foreign patients coming for treatment.2
Bangkok is where that demand meets the most clinics. Its 2010 Census counted 8,305,218 people, and 32.9% of residents aged 15 and over could read and write a language other than Thai.1
The rules a clinic in Bangkok works under
Private hospitals and clinics are established under the Sanatorium Act B.E. 2541 (1998).2 Oversight sits with the Ministry of Public Health's Department of Health Service Support, whose units include a Division of Sanatoriums and the Art of Healing and a centre that approves sanatorium advertising.4 Promotional reply templates are worth checking against that approval process before they go live.
Section 26 of the Personal Data Protection Act B.E. 2562 lists health data as sensitive and prohibits collecting it without explicit consent, with exceptions that include medical diagnosis, treatment and the provision of health care under a duty of confidentiality.3 Section 37 requires appropriate security measures and notice of a breach to the Office of the Personal Data Protection Committee without delay, and within 72 hours where feasible.3
Section 28 allows transfer of personal data abroad only to a country with adequate protection standards, unless an exception applies, such as the patient's consent after being told the destination's standards are inadequate.3 Section 84 sets an administrative fine of up to five million baht for unlawful collection or transfer of sensitive data.3
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Bangkok. For a Bangkok clinic that means Thailand. Every draft, approval and signature is logged, which is the record a breach review starts from.
The languages Bangkok patients write in
At the 2010 Census, 7,829,946 Bangkok residents spoke only Thai at home, 249,851 spoke Thai and another language, and 225,420 spoke only another language.1 The largest other home languages were English with 127,663 speakers, Burmese with 88,003, Japanese with 58,002, Khmer with 45,117, Chinese with 40,845 and Hindi with 17,557.1
Foreign patients add many more, with 5.1 million foreign outpatient visits to private facilities nationwide in 2022.2 wai works in any language, and every reply it drafts goes to the coordinator for approval.5
What a demo shows in Bangkok
An email arrives at 2am Bangkok time from a patient overseas asking for a dermatology consultation during a trip next month. wai matches it to the patient's thread, reads each doctor's busy times from Google Calendar, Outlook or Apple Calendar and drafts a reply with open slots, and the coordinator approves it at nine. A WhatsApp message from a Sukhumvit resident asking to move Thursday arrives in the same inbox with a new slot held.
The patient books on the clinic's own website in three taps, sees the price for each service and pays a deposit in baht into the clinic's own Stripe account. Intake questions can be answered by voice in any language, and the doctor reads them in English before the visit. In the room wai drafts the note and the letter, and the doctor signs both.
For health systems, governments and insurers in Bangkok
Hospital groups and insurers handling sensitive data at scale need a basis under section 26 for every flow, hosting in Thailand and an audit trail the Committee's Office can review.3 wai builds one pathway at a time with the organisation's own clinical and procurement teams, on one record across services, with data, configuration and model rights agreed in the contract. See wai for health systems and governments.
Where to start
First, map each health data flow to its section 26 basis, and write the explicit consent wording for any that need it, in Thai and English. Second, confirm hosting in Thailand in writing and file it with the data residency checklist.
Third, write the 72 hour breach routine, naming who tells the Office and who tells patients. Fourth, run any promotional reply template past the advertising approval process. Then count last month's enquiries by language, country and hour, and book a Bangkok demo with that count.
Bring a week of Bangkok enquiries, from every country they came from, and see the drafts your coordinators would approve.
Frequently asked questions
Is patient health data sensitive data under Thailand's PDPA?
Yes. Section 26 lists health data and requires explicit consent unless an exception applies, such as diagnosis or treatment under a duty of confidentiality.3
Which body oversees private clinics in Bangkok?
How fast must a Thai clinic report a data breach?
Without delay and, where feasible, within 72 hours to the Office of the Personal Data Protection Committee, and to patients when the risk is high.3
Can Thai patient records be hosted abroad?
Only to a country with adequate protection or under a section 28 exception.3 wai hosts each clinic's records in Thailand.
Can international patients pay a deposit before they fly?
Yes. The booking page takes a card or Apple Pay deposit in baht, paid into the clinic's own Stripe account, with the clinic as merchant of record.6
Does a person check every reply before a patient sees it?
Yes. wai drafts in the clinic's voice, a coordinator approves before it sends, and clinical questions go to a doctor.
Sources
- 1National Statistical Office of Thailand, 2012The 2010 Population and Housing Census, Bangkok, table 7 (Thai and English)Read 15 October 2026Read source
- 2National Statistical Office of Thailand, 2023Preliminary results, Private Hospital and Health Facility Survey 2022 (press release, Thai)Read 15 October 2026Read source
- 3Government Gazette of Thailand, translation hosted by King Mongkut's University of Technology Thonburi, 2019Personal Data Protection Act B.E. 2562 (2019), ss26, 28, 37 and 84, unofficial English translationRead 15 October 2026Read source
- 4Ministry of Public Health, Thailand, 2026Department of Health Service Support, units and divisions (Thai)Read 15 October 2026Read source
- 5wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
- 6wai, 2026wai CheckoutRead 15 October 2026Read source
Every patient abroad answered by morning, every Bangkok note signed by evening.
Fifteen minutes with a clinician who uses wai daily, on your own enquiries and consults. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits