01
Making a request
Use the contact form, saying in the message that it is a privacy request. Explain what you want to know or change and give enough context to locate the information, such as the address used for correspondence and an approximate date. You do not need to cite a law.
We may need proportionate information to confirm identity or authority before disclosing, changing or deleting personal information. Please do not initially send a passport, identity-card scan or a full medical record. An authorised representative should identify the person represented and describe the authority relied on. Verification information is used for that purpose and associated lawful record-keeping.
02
Access, correction and other requests
You may ask whether we hold information about you, request a copy, identify an inaccuracy, or ask that information be deleted or no longer used for a stated purpose. Tell us if there is a particular concern about confidential correspondence or a safety report. We will consider the request under the applicable rules and explain the outcome.
Some records may need to be preserved for a legal obligation, a genuine claim or a relevant safety responsibility. A deletion request therefore does not automatically require destruction of every record. If only part of a request can be fulfilled, we will explain the relevant reason and available next steps. Personal information relating to another person may need to be withheld or redacted.
03
EU and UK rights where applicable
Where the EU or UK GDPR applies to the processing, rights may include access, rectification, erasure, restriction, objection and, in specified circumstances, data portability. Consent can be withdrawn for processing based on consent without changing the lawfulness of earlier processing. The right to object to direct marketing is distinct from other objections.
The applicable rules ordinarily require a response without undue delay and within one month. A permitted extension may be available for complexity or the number of requests, with the required notice and reasons. The precise treatment of identity checks, clarification and extensions follows the relevant law. The applicable statutory deadlines govern the response.
You may complain to the competent data-protection authority; for EU matters, this can include the authority in the place of habitual residence, work or the alleged infringement, where the law provides. For UK matters, the supervisory authority is the Information Commissioner’s Office. Contacting us first is encouraged but is not a condition of exercising a legal complaint right.
04
California rights where applicable
If Luang Pharma and the relevant processing fall within the California Consumer Privacy Act as amended, California residents may have rights to know and access personal information, request deletion and correction, and exercise applicable sale, sharing and sensitive-information controls. Covered businesses must not unlawfully discriminate because a person exercises those rights.
Applicable access, correction and deletion requests generally require a response within 45 calendar days, subject to a legally permitted extension and notice. Other requests can have different deadlines. The public website does not sell personal information or share it for cross-context behavioural advertising. It has no advertising profile for a browser opt-out signal to switch off. A change to those practices would require corresponding disclosures and controls.
Rights under California law depend on the law’s scope and exemptions; this page does not assert that every visitor has CCPA rights. Complaints can be directed to the California Privacy Protection Agency or the California Department of Justice where relevant.
05
Lao PDR and other applicable protections
Applicable Lao PDR requirements and any other mandatory privacy protections continue to govern relevant activities. A reference to foreign rights does not reduce local protections. If you consider a different privacy law relevant, identify your concern and country so it can be assessed without requiring you to give an unnecessary travel or residence history.
The privacy policy explains the information categories, purposes and recipients. If you disagree with a response, ask for reconsideration, stating the issue. Where a law grants an appeal or complaint right, that right remains available.