Privacy notice
What we collect, why, and what we deliberately do not.
Who is responsible for your data
Instly Co., Ltd. is the data controller for this website. Insurance brokering is by Napaporn Palsingh, OIC non-life broker licence no. 6804002937; neither of us is the insurer. When you submit an application, the insurer you chose becomes a controller of that data in its own right and handles it under its own notice.
Registered address: 139 Pan Road, Silom, Bangrak, Bangkok 10500, Thailand. For anything in this notice, including a request about your data, contact [email protected].
You can compare plans without identifying yourself
The questions we ask before showing prices (your age, whether you want out-patient cover, a budget band, a hospital preference, and who is being covered) are used only to ask the insurers for a premium. We do not ask for your name, contact details or any health information at this stage, and the system refuses to, not merely as policy but as a check in the code.
You will see real premiums having given us nothing that identifies you.
What we collect, why, and on what basis
We collect the minimum for each purpose, and we collect it only when you ask for the thing it is needed for.
Three of these rely on your consent, which you can withdraw at any time: emailing you a quote, having an adviser contact you, and website analytics. Withdrawing any of them does not stop you using the comparison. The health information on an application relies on your separate explicit consent, and withdrawing that may mean the insurer cannot assess the application. Nothing else on this list asks for your consent, because each is either necessary to do the thing you asked for or required of us by law.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Age, cover preferences, who is covered | To ask the insurers for a premium and to show you a comparison | Legitimate interest: you asked for a comparison and this is the least data that produces one | 24 months, held against a quote reference and not linked to your identity |
| Email address | To send you the quote comparison you asked for | Consent: you asked us to email it | 24 months from last contact |
| Name and contact details | So an adviser can reply to an enquiry you started | Consent: you asked to be contacted | 24 months from last contact |
| Identity and address on an application | The insurer needs it to issue a policy | Necessary to take steps at your request before entering a contract | Held in memory for up to 24 hours to produce your forms, then deleted |
| Health information on an application | The insurer needs it to underwrite | Explicit consent: given separately, and refusable | Held in memory for up to 24 hours to produce your forms, then deleted |
| Website analytics, only if you choose Accept analytics | To see which sources bring visitors and which pages help (see Cookies and website analytics below) | Consent: you chose Accept analytics in the cookie banner | Deleted by Google after 2 months; only aggregated reports with no identifier are kept longer |
| Server and security logs | To keep the service running and detect abuse | Legitimate interest | 90 days |
Health information
Health information is sensitive personal data under the PDPA. We ask for it only inside an application, only after you have chosen a plan, and only with your explicit consent, which is a separate tick from the declaration of truth and from the Office of Insurance Commission warning.
Your answers are used to produce the insurer's application form and are held in memory for up to 24 hours. They are not written to a database, not written to disk, and not retained by us after that window. You may withdraw consent at any time, though the insurer may then be unable to assess the application.
Who we share it with
The insurers you ask us to quote, so they can price and, if you apply, underwrite. Our own service providers, who process on our instructions: hosting, email delivery, our customer records system and, only if you accept analytics, Google Analytics.
The Office of Insurance Commission, where insurance law requires it. The OIC publishes its own personal data protection policy at oic.or.th.
We do not sell your data. We do not share it with advertisers. We do not pass it to insurers you did not ask about, and we do not put you into a wider marketing ecosystem.
Where your data is processed
Our systems run outside Thailand, so your data is transferred abroad. We use providers that offer suitable protection and process only on our instructions.
One point worth being specific about: the site uses an AI model to run the opening conversation and to phrase the reasoning behind a recommendation. It is sent your cover preferences and the plan data. It is never sent your name, your contact details, or any health information.
If you give us someone else's details
The comparison lets you include a partner or children, and an application asks for beneficiaries. When you give us another person's details you are confirming that you may do so: that you have told them about this notice, and have their agreement where it is needed.
For a child or anyone under 20, or anyone under guardianship, a parent or guardian must give that agreement. We do not knowingly collect a young person's data without it, and we delete it if we find we have.
Your rights
Under the PDPA you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you gave. Withdrawing consent does not affect what we did lawfully before you withdrew it.
Write to [email protected] and we will respond within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Committee.
A Thai version of this notice will be published alongside the English one, and the Thai text will be the operative version.