Legal
Privacy Policy
Version 2.0 · Effective 29 August 2026
The Wisdom (Global) Co.,Ltd. ("L120", "we") operates the L120 longevity platform and acts as the data controller for the personal data described here. This policy explains what we collect, the lawful basis for each purpose, who we share it with, how long we keep it, and the rights you hold under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and comparable laws where you live. It forms part of our Terms of Service and the L120 Partner Agreement.
01
Controller, scope and contact
Data controller: The Wisdom (Global) Co.,Ltd., Tax ID 0205566051993, registered office 67/8 Soi Phemi 29, Bang Chak, Phra Khanong, Bangkok 10260, Thailand. This policy covers the L120 websites, member accounts, partner storefronts, seminars, reservations and payout processes. Partner hospitals and laboratories act as separate controllers for the clinical records they create.
02
Categories of data we collect
Identity and contact data (name, date of birth, nationality, phone, email, LINE ID, address); account and security data (hashed credentials, one-time codes, device, IP address, session logs); KYC and payout data (identity document type and number, tax identification number, bank or Stripe Connect account holder name); transaction data (reservations, invoices, escrow status, refunds); partner data (referral code, downline links, commission ledger, campaign statistics); marketing and traffic data (hashed visitor IP for the one-IP-one-follower counter, referral source, page dwell time); communications you send us; and, only where you choose to provide it, health data such as lab results, medical history and treatment notes.
03
Lawful bases for processing
Performance of a contract: creating your account, delivering reservations, calculating and paying commission. Legal obligation: accounting, tax and withholding records, anti-money-laundering and identity verification, responses to lawful authority requests. Legitimate interest: platform security, fraud and bot detection, service improvement, and defending legal claims — balanced against your rights. Consent: marketing messages, cookies that are not strictly necessary, and any processing of health data. Where processing rests on consent you may withdraw it at any time without affecting past lawful processing.
04
Sensitive data and health records
Health data and identity documents are sensitive personal data under PDPA section 26 and are processed only with your explicit consent or where the law otherwise permits, for example the vital interest of a data subject. Health records are stored with row-level access control, are visible only to you and the medical team handling your case, are never used for marketing, never shared with partners or agents, and never used to calculate commission.
05
Identity verification and anti-fraud processing
To pay commission lawfully we verify that the applicant is a real natural person, that the identity document belongs to them, and that the payout account is held in the same legal name. We may re-verify identity at any time, compare records to detect duplicate or nominee accounts, and record the outcome. Where fraud, forged documents or an application submitted on behalf of another person is detected, we retain the evidence for the period required to enforce our rights and to comply with law.
06
Referral tracking and the follower counter
When you open a partner storefront we store a salted, irreversible hash of your IP address together with the partner code and a coarse timestamp, so that one IP counts as one follower permanently. The hash cannot be reversed into your IP address, is not used to build an advertising profile, and is used only to count unique visitors, to attribute a purchase to the correct partner, and to detect artificial traffic.
07
Cookies and similar technologies
Strictly necessary cookies keep you signed in, remember your language and protect forms. Functional storage keeps the referral code that brought you to the site so attribution survives a return visit. Measurement storage counts page views in aggregate. You can clear this storage in your browser; strictly necessary items cannot be disabled without breaking sign-in.
08
Sharing and sub-processors
We share the minimum data necessary with: partner hospitals and clinics for the treatment you book; payment and payout processors (including Stripe) for charges, refunds and partner transfers; cloud hosting, database and email or SMS delivery providers acting on our instructions; professional advisers, auditors and insurers; and government agencies, courts or law enforcement where a lawful request or legal duty applies. Processors are bound by contract to process data only on our instructions and to apply appropriate security. We do not sell personal data and we do not share health data with partners or advertisers.
09
International transfers
Delivery of programmes may require transfer of your data to the Republic of Korea and other countries where partner hospitals operate, and our infrastructure and payment providers may process data outside Thailand. Such transfers are made only where the destination provides adequate protection, or under appropriate safeguards such as standard contractual clauses, binding intra-group policies or your explicit consent after being informed of the risk, as required by PDPA sections 28 and 29.
10
Retention schedule
Account data: while the account is active, then up to 12 months after closure. Accounting, tax, invoice, commission and payout records: 10 years, as required by Thai revenue and accounting law. KYC and identity documents: 10 years from the end of the relationship, for anti-money-laundering purposes. Health vault documents: until you delete them, or 5 years after the last treatment where the law requires medical record keeping. Seminar registration data: 12 months after the event. Referral hashes and traffic logs: 24 months. Fraud evidence: for the duration of any dispute plus the applicable limitation period.
11
Security measures
Data is encrypted in transit, access is limited by authenticated role with row-level security in the database, administrative actions are written to an immutable audit log, payout changes require re-verification, and access to production data is restricted to named personnel bound by confidentiality. No system is perfectly secure; you must keep your credentials and one-time codes private and never let another person use your account.
12
Personal data breach
If a breach is likely to result in risk to your rights and freedoms we will notify the Office of the Personal Data Protection Committee without undue delay and, where the risk is high, notify affected individuals with a description of the incident, the likely consequences and the measures taken.
13
Your rights
Subject to legal exceptions you may: access your data and obtain a copy; correct inaccurate or incomplete data; request erasure or anonymisation; restrict or object to processing; request portability in machine-readable form; withdraw consent; and lodge a complaint with the Personal Data Protection Committee in Thailand. We answer verified requests within 30 days. Requests that would defeat a legal record-keeping duty, an active investigation, or an unresolved payout dispute may be refused in part, and we will explain why.
14
Children
The platform is intended for persons aged 20 and over. We do not knowingly collect data from minors. If we learn that a minor's data has been submitted without lawful parental consent, we delete it and close any associated account.
15
Automated decisions and profiling
Commission attribution, fraud scoring and follower validation are performed by automated rules. They can result in a purchase being attributed to a different partner, a follower not being counted, or a payout being held for manual review. You may request human review of any automated outcome that materially affects you by contacting the address below.
16
Changes to this policy
We may update this policy. Material changes are announced in the platform and by email at least 7 days before they take effect, and the version and effective date above are updated. Continuing to use the platform after that date means you accept the revised policy.