01
Who is responsible
This website is operated by Luang Pharma Co., Ltd, which is responsible for the website and for the correspondence it invites. Luang Pharma is its brand.
Registered address: C29-6, Haichuan Industrial Park, Boten Economic Special Zone, Luang Namtha Province, Laos. Enterprise code: 364321674000. The full particulars are in the company information notice.
For an initial privacy enquiry, send it through the contact form, marking it “Privacy”. This page does not replace an employment, supplier, clinical-research or commercial privacy notice for a separate activity.
02
Information involved
- Website delivery: hosting and network services receive information such as your IP address, requested address, date and time, browser or device characteristics, response status and security-related request information. Depending on configuration, this information may appear in technical logs. Cloudflare Web Analytics also receives a page view and page-load timings from your browser, as the cookie notice describes. A static website can still involve personal information.
- Correspondence: your email address, name, role, organisation, country, message, attachments and information you choose to provide. An organisation’s name is not always personal information, but the contact details of its staff can be.
- Privacy, accuracy or security requests: the details needed to understand the issue, verify an appropriate requester and record the response.
- Safety or quality reports: product, batch, event and reporter information. Health information needs particular care; the reporting pages explain how to minimise it in an initial message.
We do not operate public user accounts, a shopping cart, a payment service or advertising profiles on this website. We do not use website information for automated decisions that have legal or similarly significant effects on visitors.
03
The enquiry form
The contact page carries a form. When you send it, the name, email address, organisation (if you give one) and message you typed are transmitted to this website over an encrypted connection and delivered to the company mailbox. They are used to answer you and for the correspondence that follows, and are kept no longer than that correspondence needs.
Before a message is accepted, Cloudflare Turnstile checks that the sender is a person and not a script. That check processes the technical characteristics of the request, including your IP address, on Cloudflare’s infrastructure; it is not used to profile you and it does not read the text of your message. The form also carries one field that is hidden from a person; a submission that fills it is treated as automated and discarded. The page saves nothing in your browser. The company publishes no email address; the form is the website’s contact route.
04
Site search, filters and reference-prefill links
The portfolio filters and site-map search run in your browser against information already delivered with the page. They do not send search terms to Luang Pharma, do not create search-result URLs and do not store a search history in browser storage. Your browser or device may separately retain ordinary history, form autofill or accessibility settings.
A product profile can link to the contact page with a portfolio reference in the address, for example ?reference=LP-024. The page writes that value into the visible message box so that you can see it and change it. Nothing is sent until you submit the form yourself.
05
Why information is used
Connection information supports delivery, fault diagnosis and protection against misuse. Correspondence supports answering the enquiry, assessing a proposed business relationship, confirming relevant product and country details, and maintaining a proportionate business record. A complaint or safety report may also need assessment, follow-up and referral to the responsible party or competent authority.
A general enquiry is not consent to unrelated marketing. We do not sell correspondence or use it for cross-context behavioural advertising. A materially different use is subject to the notice, choice and permission requirements of applicable law.
06
Legal grounds where applicable
The legal ground depends on the processing and the law that applies. Where the EU or UK GDPR applies, routine professional correspondence and website protection may be based on legitimate interests, subject to necessity and the individual’s interests and rights. Steps requested by an individual before a contract, or performance of that individual’s contract, may provide a separate ground. A legal obligation may require preservation or disclosure of specified information. Consent is used where required and can be withdrawn for the processing based on it.
Health information needs an additional lawful condition where special-category rules apply; sending an email does not by itself remove that requirement. We do not assume that every foreign privacy law applies merely because the website is accessible in that country. Applicable mandatory protections continue to apply regardless of the company’s project stage.
08
Retention and security
Retention depends on the purpose, whether an enquiry remains active, the need to evidence a business decision, applicable legal or regulatory duties and any genuine dispute or legal hold. Storage availability alone is not a reason for retention. Technical logs and copies held by service providers depend on their service and settings. The security and retention notice explains these distinctions.
Public website delivery and business email are different systems. Do not send passwords, bank-card data, identity-document scans or unnecessary patient records in a general enquiry. Ask for an appropriate transfer arrangement before providing sensitive files. No website or ordinary email exchange can be guaranteed risk-free.
09
Choices and requests
You can read the website without sending an enquiry. You can ask about information held about you, request a correction, or raise a deletion, restriction or other privacy request through the contact form. The privacy rights page explains verification, applicable legal rights, response periods and complaints.
The website is directed to professional and institutional audiences and does not invite children to submit personal information. If you believe a child has provided information unnecessarily, contact us so that the appropriate action can be considered. Parents or representatives should explain their authority without initially sending identity documents.
10
Changes to this policy
The date shown on this page identifies its latest published revision. This policy will be updated to reflect material changes in the information collected, recipients or purposes. A change to this page does not retrospectively authorise an incompatible use of information already received.