Cybersecurity and Data Protection

The Company establishes data security policies and practices as a framework for managing organizational data and information systems, covering personal data protection, confidentiality of information, access control, information technology risk management, and compliance with relevant laws and requirements.

These operations are aligned with the Personal Data Protection Act B.E. 2562, as well as international practices and standards on information security that the Company applies as appropriate to the context of the hospital business. The Company also continuously develops systems and control measures, taking into account quality requirements, patient safety, and medical services that must be delivered continuously and reliably.

The Company places importance on data governance in digital healthcare service systems to prevent unauthorized access, use, disclosure, alteration, destruction, or loss of data, while promoting the use of data within the organization for appropriate purposes and in alignment with the rights of data subjects.

To respond to increasingly complex and rapidly evolving threats, the Company continuously invests in and develops cybersecurity infrastructure, with the aim of ensuring that prevention, detection, and response are effective and aligned with the risk level of systems and data.

The Company implements strict access control and authentication measures for sensitive information, as well as data loss prevention measures, such as data backup in accordance with established practices and data encryption in internal data storage systems, to help reduce the risk of data leakage or cyberattacks.

For monitoring, the Company uses a Security Information and Event Management system, or SIEM, to collect, analyze, and alert abnormalities in network systems and critical systems. This helps the Company detect abnormal signals and respond to incidents more quickly. In addition, the Company conducts Vulnerability Assessment and Penetration Testing, or VAPT, on network systems and critical systems on an annual basis through collaboration between internal experts and external consultants, in order to identify vulnerabilities, remediate them, and systematically follow up on improvements.

The Company recognizes that cybersecurity cannot rely solely on technology, but also requires awareness, understanding, and behaviors of employees at all levels. The Company therefore places importance on continuous communication and training on data security, so that personnel understand risks related to the use of digital systems, patient data management, password usage, phishing prevention, and the secure use of the internet or information systems.

Building a cybersecurity culture also covers raising awareness of threats arising from human factors, such as clicking unsafe links, unintentionally disclosing information, or using more data than necessary in daily work. The Company therefore aims to ensure that personnel can appropriately participate in preventing data-related risks and understand that data security is a shared responsibility of everyone in the organization.

The Company also places importance on developing the capabilities of information technology personnel and relevant departments, so that they can manage security systems, detect anomalies, coordinate during incidents, and support improvements to control measures effectively.

The Company places importance on preparedness for data security incidents and information system disruptions that may affect the provision of medical services. It has therefore developed an Incident Response Plan, or IRP, and a Business Continuity Plan, or BCP, to define approaches for responding, coordinating, recovering, and reducing impacts from potential incidents.

These plans cover management approaches in the event of incidents affecting data or critical systems, such as network system disruptions, cyberattacks, incidents that prevent data from being used normally, or external events that may affect the continuity of medical services. The Company places importance on data backup, system recovery, and maintaining the readiness of critical systems within an appropriate scope.

The Company also provides systems and approaches for data recovery and system restoration in the event of unexpected incidents, to support the protection of critical information and enable appropriate service recovery. In this regard, the Company exercises caution in disclosing technical details of such plans and systems, to ensure that the disclosed information does not create additional risks to system security.