Digital Informed Consent for Aesthetic and Dental Clinics in Thailand

If you run an aesthetic or dental clinic in Thailand today and search for an informed consent form template that actually fits your business, most of what you'll find is a PDF built for a public hospital or a medical school — designed for the public-hospital context, not for a private clinic that has to manage its own document risk and PDPA communication on its own. No SaaS provider in Thailand currently addresses this gap directly.

This isn't a minor issue. Thailand has more than 7,000 aesthetic clinics nationwide (roughly 2,000 in Bangkok and around 5,000 in the provinces) (WifiTalents, an estimate from a private data-aggregation source), and most still manage consent on paper, scattered across multiple folders — extremely difficult to produce in full if a dispute with a patient ever arises.

This guide answers the three questions clinic owners actually want answered: what content a valid informed consent form must contain, how to digitize it without losing legal weight, and — most importantly — why it has to be clearly separated from PDPA consent.

TL;DR: A valid informed consent form must adequately explain the nature of the procedure, the risks involved, the available alternatives, and the patient's right to refuse — in line with the ethical guidelines of the Medical Council or Dental Council of Thailand — and it is a separate document from PDPA consent (one authorizes the procedure, the other authorizes the use of personal data). It can be digitized under the Electronic Transactions Act B.E. 2544 (2001) ("the ETA"), provided there is reliable identity verification such as OTP and a document-change audit trail. These strengthen the evidentiary weight of the document — they don't guarantee the outcome of a case. Paper documents kept in separate folders carry a high risk of loss and are hard to trace afterward, a gap that most of Thailand's 7,000+ clinics are still managing on paper.

What you'll get from this article

• The 4 elements every informed consent form must include under professional ethics guidelines
• The clear difference between informed consent and PDPA consent, and why they must never be combined into one document
• Why digital signing via OTP is legal under the Electronic Transactions Act B.E. 2544 (2001) — not under PDPA
• Why an audit trail matters more than paper, based on the real value of PDPA fines already issued in the healthcare sector
• The 4 most common mistakes seen in Thai clinics, and how to avoid them

Last updated: August 2026. This article is reviewed against changes in law and professional ethics guidelines at least once a year.

Beyond the size of the domestic market, Thailand's dental tourism sector is also growing steadily, generating US$1,110.3 million in revenue in 2025 and projected to grow at a compound annual rate of 21.1% between 2026 and 2033 (Grand View Research), with Thailand welcoming close to 972,000 dental tourists per year (Travel And Tour World). These numbers reflect how many Thai clinics are now treating both domestic and international patients at once — which makes a reliable, traceable document system a necessity, not an option.

Before You Start: What You Need to Know

Getting a digital informed consent form right doesn't require expert-level legal knowledge, but you need to understand these 3 fundamentals before you start.

• Know the 2 relevant legal frameworks without confusing them: the Electronic Transactions Act B.E. 2544 (2001) ("ETA," which validates digital signatures) and the Personal Data Protection Act B.E. 2562 (2019) ("PDPA," which governs the use of personal data). This is the single most common source of confusion in Thai clinics.
• Identify higher-risk procedures that require a more detailed explanation than usual — surgery, injectables, or procedures that can't be reversed.
• Have a clear document retention policy — covering how long records are kept, who can access them, and what data security measures are in place.

Step 1: Understand the Legal Framework That Applies

Informed consent falls under the professional ethics rules of the Medical Council or Dental Council of Thailand, while the validity of its digital form falls under the Electronic Transactions Act B.E. 2544 (2001). This is the most important starting point, because many clinic owners don't realize there are two separate layers of rules working together.

The first layer is the practitioner's ethical duty to give the patient adequate information before any procedure, especially higher-cost or higher-risk ones. The Dental Council of Thailand explicitly states that higher-cost dental procedures require a more detailed explanation (Dental Council of Thailand). This guidance is a standard that also applies by extension to aesthetic clinics, even though it isn't written specifically for the aesthetic field.

The second layer is the validity of the signature format itself. Under Section 9 of the Electronic Transactions Act B.E. 2544 (2001), an electronic method that can reliably identify the person signing satisfies the legal requirement for a signature. This is the legal basis that makes a digital informed consent form as binding as one signed on paper.

The detailed content required by law and professional regulations — including the Medical Council's ethics regulations and the Health Establishment Act B.E. 2541 (1998) as it relates to patient records — should be checked against the latest consolidated legal text before being relied on in practice. This article is based on a synthesis of consistent secondary legal sources, not a direct, section-by-section reading of the primary legislation.

The table below summarizes what each legal basis covers and why it matters for your clinic.

Read the full guide to the legal basics of electronic signatures in Thailand

Step 2: Include the 4 Mandatory Elements of an Informed Consent Form

A valid informed consent form must adequately explain 4 things: the nature of the procedure, in plain language; the risks and possible side effects involved; the alternatives available (including the option of doing nothing); and the patient's clear right to refuse or change their mind.

The level of detail for each element should scale with the risk of the procedure. Invasive aesthetic procedures or injectables need much more detail than routine skincare treatments, and for higher-cost dental procedures, the Dental Council of Thailand explicitly requires a more detailed explanation — covering the nature of the procedure, the risks, and the cost (Dental Council of Thailand).

[REVIEW:JURISTE] The exact level of detail legally required for each procedure type should be further verified with legal counsel or the latest professional regulations before being adopted as a standard practice in your clinic.

A simple rule clinics should remember: the higher the risk or cost of a procedure, the higher the level of detail the consent form should include. Using the same generic consent form for every procedure, without distinguishing by risk level, is the most common weakness seen in clinics still using old paper forms.

Step 3: Clearly Separate Informed Consent From PDPA Consent

Informed consent and PDPA consent are two separate documents, governed by two separate laws. Combining them into one is the most common mistake observed in Thai clinics.

Informed consent authorizes a doctor or licensed practitioner to perform a given medical or aesthetic procedure, and falls under the professional ethics rules of the Medical Council or Dental Council. PDPA consent authorizes the clinic to collect and process a patient's personal or health data, and falls under Section 19 of the Personal Data Protection Act B.E. 2562 (2019). Both require two separate signatures, even if they can be delivered through the same link in a single signing session.

A particular point of caution: Never present the Electronic Transactions Act B.E. 2544 (2001) as the legal basis for processing personal data. This is a common and incorrect misconception. The ETA 2544 only validates the signature and the document format. The legal basis for collecting and using personal data is PDPA 2562 alone. The two laws answer different questions and must never be conflated.

The comparison table below makes the difference clearer.

The importance of keeping these two documents properly separated becomes even clearer when you look at real PDPA enforcement data in Thailand. In 2025, 8 administrative penalties were announced across 5 cases on August 1, 2025, totaling around ฿14.5 million (roughly US$400,000) (DLA Piper). This confirms that health data — a sensitive category under PDPA — is an area regulators are paying particular attention to. Clinics that don't clearly separate PDPA consent from informed consent carry a higher risk than the average business.

See all clinic document templates (10 forms)

Step 4: Strengthen Signer Verification With OTP

OTP is not a mandatory condition for the basic validity of a consent form, but it strengthens the evidence of the signer's identity if a dispute arises.

What OTP actually provides is a clear record of the verification channel used and the time it was confirmed — which lines up with the criteria courts use to assess the reliability of electronic evidence: how the document was created, the integrity of how it was stored, and how the sender's identity was verified. This is based on Section 11 of the Electronic Transactions Act B.E. 2544 (2001), which we cover in detail in our article on court evidence.

Important reminder: Never write or communicate that OTP "guarantees" the legal validity of a consent form. The correct language is that OTP "strengthens" the reliability of the evidence. No technology guarantees the outcome of a dispute in court 100%.

For clinics that treat a significant number of international patients, verification by email may be more practical than verification by Thai phone number, since many foreign patients don't have a Thai phone number registered at the time they book their appointment.

Can an online signed document be used as evidence in court? Read the full guide on how OTP and audit trails strengthen your evidence

Step 5: Keep an Audit Trail Instead of a Paper File

A signed paper file can be lost, torn, or disputed with no trace of who saw it or when. A timestamped audit trail captures that evidence automatically.

A complete audit trail should log the IP address, the device used to sign, and the time the document was sent, opened, and signed at each step. This information matters directly if a dispute with a patient arises — even though no system can guarantee the outcome of a case.

The need for traceable record-keeping becomes even clearer when you look at the real fine amounts already issued. One private company was hit with an administrative fine of up to ฿7,000,000 (roughly US$195,000) in 2024, over a lack of adequate security measures that led to a data leak affecting more than 100,000 customers — the first administrative fine order issued under PDPA (isranews.org; amarintv.com). And in 2026, Thailand's Personal Data Protection Committee (PDPC) announced total fines of roughly ฿21.5 million across 5 publicly disclosed cases (Enersys). These are real-world examples showing that loose handling of health documents leads to tangible outcomes, not just theoretical risk.

If your clinic is still sending consent forms as scanned PDFs over LINE and storing them in scattered folders, start free and see a live audit trail example from Jabmue is a good place to start.

Step 6: Link Consent to Other Required Documents

A patient agreeing to an aesthetic or dental procedure typically needs to sign 2 to 4 separate documents on the same day: informed consent, PDPA consent, image-use consent (if reviews or promotional use are involved), and sometimes a payment plan.

Bundling these documents into a single link before the appointment reduces the risk of a patient forgetting to sign one of them, and cuts down the time staff spend on paperwork in the waiting room. The key is bundling the delivery channel, not merging the documents into one — each document remains legally separate, as explained in Step 3.

For clinics that want to get started quickly: See all clinic document templates (10 forms), covering informed consent, PDPA consent, and other related documents, ready to send in a single link before the appointment.

Common Mistakes and How to Avoid Them

The most common mistake is combining PDPA consent and informed consent into a single document. Beyond that, there are 3 more mistakes Thai clinics should watch out for.

1. Confusing ETA 2544 with PDPA 2562 These are two separate laws that answer two different questions. ETA 2544 validates the signature; PDPA 2562 governs the use of personal data. Using the wrong legal basis in a document or in an explanation to a patient can create a misunderstanding that's hard to trace back and correct.

2. Presenting a signed consent form as a total liability waiver A court can still find medical negligence, even where a signed consent form exists. [REVIEW:JURISTE] This principle is a synthesis drawn from several consistent Thai legal sources, but should be confirmed with legal counsel before being communicated to patients or used in official marketing copy. Consent proves that information was given before a decision was made — it is not a waiver of liability.

3. Using before/after photos as proof of outcomes in consent-related communication Never use before/after photos or promises of medical outcomes in documents or communications related to informed consent — this carries both a professional-ethics risk and an advertising-law risk.

4. Not adjusting the level of detail to the risk of the procedure Procedures that can't be reversed or are higher cost require a more detailed explanation than standard skincare treatments, per Dental Council of Thailand guidance.

What Good Looks Like Once Your Consent System Is Solid

A clinic with a solid consent system can produce the signed document, proof of signer identity, and a full timestamped record within minutes when audited or when a dispute arises.

That's a very different position from digging through multiple paper folders to find the right consent form, or being unable to confirm at all what information the patient actually saw before making their decision. A good system doesn't guarantee the outcome of a dispute, but it clearly reduces the time and risk involved in managing documents.

If your clinic wants the full picture of PDPA compliance for clinics, the PDPA Checklist for Clinics is a follow-up article that covers this topic in detail.

Frequently Asked Questions

What does an informed consent form need to include?

A valid informed consent form must explain 4 things: the nature of the procedure in plain language, the risks and possible side effects involved, the available alternatives (including the option of doing nothing), and the patient's right to refuse or change their mind. The level of detail should increase with the risk of the procedure.

Is a digitally signed informed consent form legal in Thailand?

Yes, under conditions. Under Section 9 of the Electronic Transactions Act B.E. 2544 (2001), it's legal provided there's reliable verification of the signer's identity, such as through OTP. [REVIEW:JURISTE] The exact reliability conditions should be confirmed with legal counsel for each clinic's specific use case.

Can a clinic perform a procedure if the patient hasn't signed a consent form?

They shouldn't. The absence of a properly informed consent form — one confirming the patient received adequate information before deciding — is a direct ethical and legal risk for the practitioner, no matter how low-risk the procedure may be.

Does informed consent actually protect a clinic from being sued?

No. Consent proves that adequate information was provided before the patient made their decision, but it's not a waiver of the right to sue if provable medical negligence occurred. Courts can still assess liability based on the facts of each case.

Does an aesthetic clinic need consent to take before/after photos?

It should have one. Consent for image use or reviews should be kept separate from informed consent, especially if the images will be used for marketing or public reviews. This is a third, distinct document, separate from both informed consent and PDPA consent.

Conclusion

A solid informed consent process for an aesthetic or dental clinic in 2026 is made up of 4 clearly separate but interconnected components: a complete informed consent form, a separate PDPA consent form, reliable signer identity verification, and a traceable audit trail.

Moving from scattered paper to a traceable system clearly reduces document-related risk — without promising you'll win every legal dispute.

If your clinic is ready to move from multiple paper folders to a system that delivers informed consent, PDPA consent, image-use consent, a 0% payment plan, patient intake forms, and post-procedure instructions — all in a single link before the appointment — start free and see all clinic document templates or see Jabmue's plans and pricing.

This article provides general information for educational purposes only, and is not legal or medical advice for any specific case. For a consent form design suitable for actual use in your clinic, consult a lawyer and the relevant professional bodies directly.