Hair Transplant Medical Records in Thailand: Where They're Kept and Who Can See Them

One r/HairTransplants poster had a hair transplant in Bangkok in February 2024, then flew home to the US. A local hospital nurse took out the stitches, and the poster could still feel some left in, "like plastic".

Part of our hair transplant guide, this page covers where your hair transplant medical records are kept and who may see them. In short, the Thai clinic keeps them for at least five years, Thai privacy law treats them as sensitive health data, and you have a right to a copy.

Under Thailand's Personal Data Protection Act (PDPA), the clinic must answer a copy request within 30 days, which a 2026 rule lets it extend by up to 30 more if it tells you. In most cases, the easier route is to ask for your operative report and discharge summary before you leave Thailand, while you can still talk to the surgeon in person.

The stitches story is on r/HairTransplants. The poster wrote that the hospital "assigned a nurse to have my stitches removed and guess what? She was not very good!"

On a later trip to Thailand, the surgeon who did the transplant "checked and removed 5 stitches that were not removed!" The poster doesn't say what paperwork they carried home.

A doctor at home can only see what was done in Bangkok if you bring the record with you.

Follow your own surgeon's instructions on stitches, dressings and medicines, and ask your own doctor at home before changing anything.

Who keeps your records and what you can ask for

Rules in your home country are different, and this page covers Thailand only. It summarizes what the published texts say and isn't legal advice.

What counts as your medical record after a hair transplant

A Thai medical record is broader than the surgeon's notes. Thai Wikipedia's article on medical records describes it as medical documents of every type used to record a patient's history (translated from Thai).

That includes personal and family history, drug allergies, consent documents, illness, treatment and lab results. It covers recorded values "whether in numbers, letters, images or other marks".

The same article summarizes the Medical Council of Thailand's guidelines on what a discharge record should hold. That list is "the final diagnosis or differential diagnosis; a summary of findings and important events during the hospital stay, together with the treatment the patient received; a summary of the operation and important procedures; the outcome of treatment; the patient's status at discharge; and the advice given to the patient or relatives" (translated from Thai).

When a procedure is done, the guideline adds a record of "the reason and necessity of the procedure" and the patient's consent form. It also says the record "should be complete within at most 15 days after the patient is discharged" (translated from Thai).

For hair transplants specifically, Medvoyal, a patient guide site, suggests asking for "pre-procedure photos, design photos, donor-area photos, graft-count documentation, operative summary or treatment notes, aftercare instructions, medication list if one was provided, the clinic's follow-up contact details".

Its reason is practical: "This documentation is not just administrative. It helps the clinic understand your case later, and it gives any local reviewing clinician a clearer picture of what was actually done."

Our checklist before you fly home

This is our own list, built from the Medvoyal items and the Medical Council guideline.

The graft count also matters later. Our guide to how many grafts you might need explains what the number does and doesn't tell you.

If you ever need a second hair transplant, a new hair restoration surgeon will be planning around the first one. That guide covers what to bring to the consultation.

Where your records actually live

A record can sit in more than one form at the same clinic. Written notes, photos and scans may each be kept separately.

Samitivej Hospital, a hospital in Bangkok, says "Imaging records are delivered on CD-ROM, and can be picked up in person or posted by mail. Imaging records cannot be sent via email."

Electronic systems are part of the picture too. A draft Thai healthcare data guideline, summarized by Hogan Lovells Cadwalader, mentions healthcare businesses using "overseas cloud infrastructure, regional electronic medical record systems or global patient management platforms". It doesn't say which clinics use them.

Name every part you want in your request: the written clinical notes, the photos and any scans.

Where a Thai clinic keeps yours

The clinic holds the record. J&A International Law quotes section 35(3) of the Sanatorium Act B.E. 2541 (1998), which makes it a joint duty of "the licensee and the operator" to keep documents relating to medical treatment.

They must "preserve them in a condition capable of verification for not less than five years from the date of creation."

We found no Thai hair transplant clinic page that says where it stores patient files. Some may tell you if you ask. So ask your clinic, and ask whether photos are kept with the written notes.

The privacy laws that govern your records

Two Thai laws do most of the work. The first is the Personal Data Protection Act B.E. 2562, known as the PDPA.

Recording Law describes the PDPA as "enacted in 2019 and fully effective since June 1, 2022", and "modeled on the EU's GDPR."

Thai Wikipedia's PDPA article says the Act "covers both the public (state) sector and the private sector" (translated from Thai). So a private clinic falls under it.

The same article says the Act sets up the Personal Data Protection Committee (PDPC) as the main body that puts the law into practice.

The second law is the National Health Act B.E. 2550 (2007), which sets out how personal health information is treated.

Health data is "sensitive" personal data under the PDPA

Section 26 of the PDPA, in the English translation published at pdpathailand.com (read 18 October 2026), lists health data among the types it covers.

It says collecting data on "health data, disability, ... genetic data, biometric data" and similar categories "is prohibited, without the explicit consent from the data subject".

The section goes on to list exceptions. Read the full section, or ask a Thai lawyer, before relying on it in a dispute.

The National Health Act confidentiality rule

Section 7, in an unofficial English translation dated May 2025 (read 18 October 2026), says: "Personal health information shall be kept confidential. No person shall disclose it in such a manner as to cause damage to him or her, unless it is done according to his or her will, or is required by a specific law to do so."

It goes on to say no one has the power under the official information law or other laws to request "a document related to personal health information of any person other than himself or herself."

Section 8 says "public health personnel shall provide health information in connection with the service to the service receiver as adequately as to decide the proper choice of service."

The translation doesn't say whether "public health personnel" includes staff at a private clinic. Thai Wikipedia describes Section 8 as applying to hospitals, doctors and others who give care, who must give patients enough information about the service to decide whether to accept treatment (translated from Thai).

On your own file, J&A International Law is direct: "Can a patient obtain a copy of their own record? They can, and the provision that fixes the status of the information is section 7 of the National Health Act B.E. 2550 (2007)."

How long a clinic must keep your records

The minimum is five years from the date the record was created, per J&A's quote of the Sanatorium Act.

That's a floor. We found no Thai hair transplant clinic that publishes how long it keeps files beyond it.

A second procedure or a repair can come many years after the first. So keep your own complete copy rather than counting on the clinic's archive.

Who can access your records

Section 7 of the National Health Act bars disclosure that causes you damage, unless it follows your will or a specific law requires it. Nobody can use the official information law to pull another person's health records.

J&A International Law says disclosure in accordance with the direct wish of the subject is "an express exception, so a patient, being the subject, may request their own documents."

If someone else needs to collect records for you, a written authorization helps. Some clinics may want more. Thai Wikipedia lists example document names a hospital may use: a letter of authority to request a patient's history, a request for a copy, a request for a summary, and a consent to disclose treatment history (translated from Thai).

These are examples from one article, not a national form. So ask your clinic which form it uses.

What Thai patients report about who actually gets access

The clearest patient account isn't about a hair transplant. In a 2020 r/Thailand thread, a patient said a hospital had sent their records to their insurance company.

The poster wrote: "The hospital staff person said, 'oh you only went here twice in 2018 so I thought it was ok to give it to them'. She also implied that she thought because it was my insurance company they had a blanket permission to access them."

They found out from the insurer first: "I called the hospital today which is when I confirmed what they did, after the insurance company told me they had records from the hospital."

One commenter, u/TPK001, suggested this: "See if the hospital is a member/accredited by JCI. If yes, file a complaint (see patient rights). They'll record it as an incident and ask the hospital to explain."

That's one hospital case from 2020. It's still a reason to ask your clinic, in writing, who it shares records with, including insurers.

How to get a copy of your records

The right sits in PDPA Section 30. The data subject "is entitled to request access to and obtain copy of the Personal Data related to him or her, which is under the responsibility of the Data Controller".

The clinic, as data controller, "shall fulfill the request without delay, but shall not exceed thirty days from the date of receiving such request."

J&A International Law gives the practical form: "A request should be made in writing, specifying the period and the categories of document required, with evidence kept of the date of the request and the date of receipt".

Our order of steps to request medical records, built on those sources:

1. Before you book, ask whether the clinic gives you an operative report and discharge summary, and in which language. Our consultation questions guide covers how to raise it. 2. On the first day of your stay, hand in a written request so the file is ready at discharge. 3. Name the dates of your treatment and each document you want, using the checklist above. 4. Bring your passport. Requests need identification. 5. Keep a copy of the request with the date on it, and note the date you receive the records. 6. Check the copy before you fly. Make sure the graft count, the technique and the surgeon's name are on it.

The 2026 Thai Access Request Notification

Since 14 September 2026, a PDPC notification sets out how access requests work. Baker McKenzie (10 August 2026) says it was "published in the Government Gazette on 16 July 2026".

On channels, it says: "Data controllers must provide at least physical and postal channels for submitting requests. Electronic channels are welcome. The request must meet the minimum required details and formality and include identification documents."

On timing, it says: "Data controllers must comply with the request within 30 days of receiving the complete and valid request. The data controller may extend the response period by up to an additional 30 days by notifying the Requester, for example, where the request involves a large volume of information."

On fees, it says: "Access requests shall generally be free of charge. Fees may only be charged in certain circumstances, such as where special formats, delivery costs, or repetitive and excessive requests create an additional burden."

Baker McKenzie says the notification also covers identity checks, access methods and record retention. It applies to data controllers in general, not only to clinics.

What one Thai hospital publishes about the process

We found no Thai hair transplant clinic page that sets out its records process, so the clearest example comes from a hospital.

Samitivej Hospital (read 18 October 2026) says it "will gladly provide all patients with a complete copy of their medical records."

For historical records, it asks patients to "request your medical history seven to 10 working days in advance" and to supply "written consent for the release of your medical information as well as a passport or other form of valid photo ID."

For inpatients, records can be ready at discharge, but "you should submit a request for these records at the beginning of your stay to give us time to assemble all of the information."

Samitivej is a hospital, not a hair transplant clinic. So use its page as a guide to what to ask your own clinic.

Getting your records in English

We found no Thai clinic or hospital page that commits to translating an operative report or discharge summary into English. We found no published translation fee either.

Ask before you pay a deposit whether your operative report and discharge summary will be in English.

If the answer is no, ask whether the surgeon can add a short English summary with the graft count, technique and medicines.

Sending your records to a doctor back home

Thailand has rules for sending personal data abroad. Tilleke and Gibbins (4 January 2024) reports that on 25 December 2023 the PDPC issued two notifications under PDPA sections 28 and 29, scheduled to take effect on 24 March 2024.

Under the section 28 notification, unless otherwise provided by the PDPA, "the destination country or international organization that receives the transferred personal data must have 'adequate data protection standards'". These rules are written for a data controller, such as a clinic, sending data out of Thailand.

The PDPA also names a right to data portability in Section 31, according to Thai Wikipedia (translated from Thai).

The practical route is usually simpler. Get your own copy under Section 30, keep it as a PDF and paper set, and hand it yourself to your own doctor, or to a specialist who treats your hair loss at home.

One HairTran patient wrote in April 2023 about follow-up: "You don't even really have to do an in person follow up, just send pics. Ofc in person is better if you can."

Photos to the clinic don't replace a record your own doctor can read. If something goes wrong, our failed hair transplant guide covers the signs and what a repair involves, and your records are the starting point for that conversation.

If your records are shared without your consent

The PDPA has a chapter on complaints, Sections 71 to 76, according to Thai Wikipedia's PDPA article (translated from Thai). Start with a written complaint to the clinic, and keep copies of everything.

Commenters in the r/Thailand thread suggested filing a complaint, and one suggested first checking whether the hospital is accredited by JCI.

One commenter, u/LordFelcher, was blunt about the outcome: "It is likely against the law. You can file a complaint."

The same commenter went on: "You won't get any compensation, and the process will probably take ages. But you should do that."

A complaint about a doctor's own conduct is a separate route. Under section 32 of the Medical Profession Act, in the Medical Council's English text (read 27 September 2026), anyone may file an ethics complaint with the Medical Council of Thailand within one year of learning of the act and who did it, and no later than three years after it.

The 2026 regulatory picture in Thailand

The access rules above are in force. A second set was a draft as of July 2026.

Hogan Lovells Cadwalader (9 July 2026) reports that the PDPC "has released a draft guideline on personal data protection for the healthcare sector for public consultation". It "applies across 8 categories of healthcare businesses, including: hospitals and clinics; aesthetic clinics".

The same summary says the draft "highlights cross-border transfers as a key compliance area". As of that article it was a consultation draft, not binding law.

Terms used on this page

• PDPA is Thailand's Personal Data Protection Act B.E. 2562 (2019), fully effective since 1 June 2022.
• PDPC is the Personal Data Protection Committee, the body that puts the PDPA into practice.
• Data controller means the organization responsible for your personal data. For your records, that's the clinic.
• Data subject means you, the person the data is about.
• Sensitive personal data means the PDPA Section 26 categories, health data among them, that need explicit consent to collect, except in the cases that section lists.
• National Health Act (B.E. 2550) is the 2007 law whose Section 7 keeps personal health information confidential.
• Sanatorium Act (B.E. 2541) is the 1998 law J&A International Law quotes for the five-year duty to keep treatment documents.
• Operative report means the written summary of the operation and important procedures.
• Discharge summary means the record of your status and the advice given when you left the clinic.
• Graft count means the number of grafts moved, as documented by the clinic.

Frequently asked questions

Where are my medical records stored, and under what privacy laws?

With the Thai clinic that treated you, and J&A International Law quotes the Sanatorium Act as requiring treatment documents to be kept for not less than five years from creation. The PDPA classes health data as sensitive personal data, and the National Health Act says personal health information "shall be kept confidential". This summarizes published texts and isn't legal advice.

Can a hospital give my records to my insurer without asking me?

One r/Thailand poster said a hospital did that in 2020, with staff assuming the insurer had "blanket permission". Section 7 of the National Health Act, in an unofficial English translation, bars disclosure that causes the patient damage unless it follows the patient's will or a specific law. Commenters suggested filing a complaint, and one suggested first checking whether the hospital is accredited by JCI.

Will the clinic charge me for a copy?

Under the PDPC notification in force since 14 September 2026, Baker McKenzie says access requests "shall generally be free of charge". Fees are allowed in some cases, such as special formats, delivery costs, or repetitive and excessive requests. Ask the clinic in writing before you request, so a fee doesn't surprise you.

Can I get my hair transplant records in English?

We found no Thai clinic or hospital page that promises an English translation of the operative report or discharge summary. Ask before you pay a deposit. If the full file is in Thai, ask the surgeon for a short English summary with the date, technique (FUE, FUT or DHI), graft count and medicines.

How many follow-up visits will I need after I fly home?

Your clinic sets that, so ask before you book. One HairTran patient wrote that you "don't even really have to do an in person follow up, just send pics", adding that in person is better if you can, and did one visit when back nine months later. Whatever the plan, take your records home so your own doctor can follow it.