Privacy & Cookie Policy

1. About this policy

New Paradigm Mental Health Retreat is a private residential and outpatient mental health practice based in Chiang Mai, Thailand. Confidentiality is foundational to our work. This policy explains what personal data we collect when you use this website or contact us, how we use it, and the rights you have under Thailand's Personal Data Protection Act (PDPA) and, where applicable, the UK/EU General Data Protection Regulation (GDPR).

2. What we collect

2.1 Information you give us

• Enquiry forms. When you complete a contact form, a free emotional evaluation (EEVA), or send an email, we receive your name, email address, telephone number (if provided), and any details you choose to share about your situation.
• Health information in the evaluation. The emotional evaluation also asks about your health, including date of birth, medication, diagnoses, hospital admissions and experiences of abuse. It is only sent with your explicit consent, given by ticking a box on the form.
• Clinical information. If you become a client, we hold the clinical information necessary to deliver your treatment. This is stored separately from website data, with restricted access, and is governed by professional confidentiality.

2.2 Information collected automatically

• Server logs. Standard web server logs: IP address, browser type, pages visited, timestamps. Retained for security and troubleshooting.
• Analytics. We use Google Analytics (gtag.js, measurement ID G-V2Z5B0N87M) to understand which pages are useful and how visitors find us. Google Analytics sets cookies and may receive a truncated IP address.
• Advertising measurement. If you accept marketing cookies, Google Ads measures whether visits from our adverts lead to an enquiry, and may show our adverts to people who have visited this site (remarketing).

3. How we use your data

• To respond to your enquiry and provide the information you have requested.
• To deliver clinical services if you become a client, with your explicit consent.
• To improve the website and understand which content is genuinely helpful (aggregated analytics only).
• To meet legal, regulatory, and licensing obligations.

We do not sell, rent, or trade your personal data. We use Google Ads remarketing only if you accept marketing cookies, and you can refuse it in the cookie banner. We do not share enquiry or client information with third parties for marketing purposes.

To run the website we rely on a small number of service providers: Cloudflare (content delivery and security), Brevo (delivery of form emails), Supabase (storage of evaluation responses) and Google (analytics and advertising, with your consent).

4. Legal basis

Where GDPR applies, we rely on: consent (when you submit a form or accept cookies); contract (when you become a client); legitimate interests (running a secure website and responding to enquiries); and legal obligation (clinical record-keeping and tax/regulatory compliance).

5. Cookies

A cookie is a small file stored by your browser. We use the following categories:

• Essential. Required for the site to function (e.g. remembering your cookie choice, and a session cookie that protects our forms). Always on.
• Analytics. Google Analytics cookies (_ga, _ga_*). Used only after you accept the cookie banner.
• Marketing. Google Ads cookies (_gcl_au). Used only after you accept marketing cookies in the banner.

You can withdraw cookie consent at any time by clearing your browser's storage for newparadigm.org, or by emailing Email.

6. How long we keep data

• Enquiry emails: kept for as long as the conversation is active, then archived for up to 24 months.
• Client clinical records: retained for the period required by professional and Thai regulatory standards (currently a minimum of 10 years).
• Server logs: typically 30 to 90 days.
• Analytics: Google Analytics default retention of 14 months for user-level data.

7. Your rights

Under the PDPA and the GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; ask us to delete data (subject to clinical record-keeping obligations); object to processing; withdraw consent; and lodge a complaint with the supervisory authority in your country.

To exercise any of these rights, email Email. We respond within 30 days.

8. International transfers

We operate from Thailand. If you contact us from the UK, EU, or elsewhere, your data is transferred to and processed in Thailand. We apply equivalent safeguards to any data we receive.

9. Security

The website runs over HTTPS. Clinical records are held on access-controlled systems, separate from the public website. We do not store payment card details on our servers; all payments are handled by accredited processors.

10. Changes to this policy

We may update this policy from time to time. The date at the top of the page reflects the most recent revision. Material changes will be highlighted on the home page.

11. Contact

Questions about privacy, data, or this policy:
Email: Email
Phone: +66 81 894 4513
Post: New Paradigm, 356 Moo 7, Hang Dong, Chiang Mai 50230, Thailand