Privacy Policy

1. Our commitment to maintaining your privacy

Davao Stroke Surgery Clinic is committed to protecting the privacy and security of your personal and medical information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, as certified by the National Privacy Commission (NPC). It also explains how we handle information received from Google when you use Google Sign-In.

2. The categories of personal information we collect

We collect the following categories of personal information when you use our Platform and services. The categories below apply to all users, with additional Google-sourced data described in Sections 15 to 21:

• a)Personal identification data: full name, date of birth, sex, nationality, and government-issued ID details you provide during registration or profile setup.
• b)Contact information: email address, mobile phone number (with +63 area code), residential address, and emergency contact name and phone number.
• c)Medical and health information: chief complaint, symptoms and their severity and duration, past medical conditions, previous surgeries and hospitalizations, current medications and dosages, known allergies, immunization history, family medical history, neurological symptoms, and lifestyle data such as smoking, alcohol use, and physical activity.
• d)Appointment and consultation data: appointment type, date, time slot, reason for visit, consultation notes, diagnosis, treatment plan, follow-up dates, and prescribed medications.
• e)Imaging and medical files: CT scans, MRI, X-ray, ultrasound, DSA, and other imaging files you or your professionals upload, including study date, file type, and description.
• f)Insurance and billing information: insurance/HMO provider and number, PhilHealth number, and billing details for claims processing.
• g)Account and authentication data: your email, hashed password for email/password sign-in, and account role (patient, medical professional, secretary, or admin). When you use Google Sign-In, we process your primary Google Account email address, its verification status, and associated OpenID info on Google, including your unique Google account identifier and sign-in verification information. Your name and profile picture may also be provided with the profile permission. Sections 15 to 21 explain how we handle these Google-sourced data.
• h)Technical and usage data: device type, browser, IP address, pages visited, and interaction logs used to maintain and improve the Platform and for security.

3. The categories of personal information we collect about you

The categories of personal information we collect about you depend on how you engage with us:

• a)Registered users (patients, medical professionals, secretaries, and administrators): we collect the full range of categories in Section 2 relevant to your role, including contact, identification, medical and health information, appointment and consultation data, imaging files, and insurance and billing information.
• b)Unregistered users (visitors to our public website): we collect only limited technical and usage data (such as device type, browser, IP address, and pages visited) and any information you voluntarily provide through public forms such as the Contact form.
• c)Young users (patients under eighteen): we collect information through a parent or legal guardian, in accordance with Section 11 on children’s privacy.
• d)Other individuals: we may collect limited personal information about people you refer to us, such as an emergency contact’s name and phone number, which you provide on their behalf.

4. Do we collect sensitive information?

Some of the personal information we collect is "sensitive personal information" under the Data Privacy Act of 2012, including health and medical information, government-issued ID details, and information about your sex or nationality. We collect sensitive information only where it is necessary to provide our medical services, to comply with our legal obligations, or where you have provided your explicit consent. You should not disclose to us any sensitive information that is not necessary or relevant to your care; if you include sensitive information in a field that does not require it, we may remove or restrict it. Sensitive information is stored under the safeguards described in Section 9 and is never sold or used for advertising.

5. How do we collect your personal information?

We collect your personal information in a few different ways:

• a)Directly from you: when you register an account, complete an intake form, book an appointment, upload imaging files, communicate with our staff, or otherwise interact with the Platform.
• b)From related entities: we may receive personal information from other entities within our clinic group or from referring physicians and healthcare providers, in accordance with applicable privacy laws.
• c)Indirectly: when you sign in using Google Sign-In, Google shares the data described in the Google user data sections. We may also receive limited information from your insurance provider or PhilHealth for claims processing.
• d)From your online activities: we collect technical and usage data through cookies and similar technologies when you visit and use the Platform, as described in Section 12.

6. How do we use your personal information?

We collect personal information from you which we have a legal basis to collect and is necessary for the purposes set out below. The table summarises each purpose, the categories of information involved, and the legal basis relied on:

We do not sell your personal or health information, and we do not use your information to serve personalized advertisements.

7. What happens if we are unable to collect your personal information?

It is important for us to collect and process your personal information in order to provide our medical services to you. If you choose not to provide the personal information necessary for your care, we may not be able to register your account, schedule appointments, provide consultations, maintain medical records, process insurance claims, or deliver some or all of our services. You may choose not to share certain information, but doing so may limit the services we can offer you.

8. Who do we share your personal information with?

We do not sell your personal or health information. We may share your information with the following parties:

• a)Your treating medical professionals and authorized clinic staff involved in your care.
• b)Your insurance provider or PhilHealth for claims processing.
• c)Third-party service providers (such as authentication and video conferencing services) under strict confidentiality agreements.
• d)Regulatory or law enforcement authorities when required by law.
• e)Other entities within our clinic group or referring physicians and healthcare providers, where relevant to your care.

9. How do we store and protect your personal information?

We implement administrative, physical, and technical safeguards to protect your information. Your data is stored in a protected database with encryption in transit (TLS) and encryption at rest, and access is restricted through role-based access controls so that only you, your treating professionals, and authorized clinic staff can view the records relevant to your care. Sensitive medical and identity documents, including uploaded imaging files, are stored in private, access-controlled storage with no public access. We conduct regular security assessments, log access to sensitive records, and train our staff on HIPAA and NPC compliance. Despite these measures, no method of transmission or electronic storage is completely secure.

10. How long do we keep your personal information?

We retain your personal and medical information for as long as necessary to provide our services and to comply with legal, regulatory, and medical record-keeping requirements under Philippine law. When information is no longer required, we securely delete or anonymize it. You may request deletion of your account and the personal and medical information we hold about you at any time by contacting us at info@davaostrokesurgeryclinic.com.ph. Upon your request and verification of your identity, we will securely delete or anonymize your data from our active systems, subject to any legal or medical record-keeping obligations that require us to retain certain health records for a minimum period. If you signed in with Google, you can also revoke our access to your Google account at any time from your Google Account security settings, which disconnects our application from your Google data.

11. Children’s privacy

For patients under eighteen (18) years of age, information is collected and managed through a parent or legal guardian. Pediatric neurological services are provided with appropriate consent and in accordance with applicable child protection laws.

12. Cookies and tracking

We may use cookies and similar technologies to enhance your browsing experience, analyze Platform usage, and remember your preferences. You can control cookies through your browser settings, though disabling them may affect some Platform functionality.

13. Your privacy rights

Under the Data Privacy Act of 2012 and HIPAA, you have the following rights in relation to your personal and medical information:

• a)Access your personal and medical records.
• b)Request correction of inaccurate information.
• c)Request restrictions on certain uses and disclosures.
• d)Be informed of data breaches affecting your information.
• e)Data portability.
• f)Withdraw consent where applicable.
• g)Make a complaint about our handling of your information, as described in Section 15.

To exercise these rights, contact us using the details in Section 23.

14. How can you access and correct your personal information?

You can access and update much of your personal information directly through your account on the Platform, including your contact details, profile, and certain medical records. To request access to, or correction of, information you cannot update yourself, contact us using the details in Section 23. We will verify your identity before processing your request and respond within the timeframe required by the Data Privacy Act of 2012.

15. Complaints

If you believe we have mishandled your personal information or wish to make a complaint about our privacy practices, please contact us first using the details in Section 23 so we can investigate and attempt to resolve your concern. If you are not satisfied with our response, you may complain to the National Privacy Commission (NPC) of the Philippines, which regulates the handling of personal information under the Data Privacy Act of 2012.

16. Google user data (Google Sign-In)

Davao Stroke Surgery Clinic uses Google Sign-In, through our authentication service provider Base44, to let you register and log in with your Google account. Google Sign-In uses OpenID Connect to verify your identity. The following sections specifically disclose how we access, use, store, share, retain, and delete your primary Google Account email address and associated OpenID info on Google, as well as basic profile information when provided. These Google sign-in permissions do not grant access to your Gmail messages, Google Drive files, contacts, or calendars.

17. Google user data we access

When you choose Google Sign-In, the following information is received from Google and processed through our authentication service:

• a)Primary Google Account email address (email permission, also identified as https://www.googleapis.com/auth/userinfo.email): your primary email address and the email_verified information indicating whether Google has verified that address.
• b)Associated OpenID info on Google (openid permission): your unique Google account identifier, called the OpenID subject or sub, and the ID-token information needed to verify the sign-in. This includes the token issuer (iss), intended application (aud), issue time (iat), and expiration time (exp).
• c)Basic profile information, when provided with the profile permission: your name and profile picture, if available.

The OpenID subject is a Google account identifier, not your password or a medical record. We do not receive your Google password, read your Gmail messages, or access your contacts, calendars, Drive files, or browsing history through these permissions. Medical information and other details you enter into the clinic Platform are collected separately and are not obtained from Google.

18. How we use Google user data

We use each category of Google-sourced information for the following purposes:

• a)Primary Google Account email address and verification status: to identify the email associated with your clinic account, create or populate your account, and support account-related communications. Google confirming an email address does not replace any separate clinic verification requirements.
• b)Associated OpenID info on Google: our authentication service uses the unique Google account identifier to recognize your Google identity on subsequent sign-ins and maintain its association with your clinic account. Token issuer, audience, and timing information are checked to verify that the sign-in is genuine and intended for this application.
• c)Name and profile picture, when provided: to populate and display your clinic account profile.

We use Google-sourced data only for sign-in, account management, and the account-related services described above. We do not use it for personalized advertising, sell it, or use it to access other Google services.

19. How we store and protect Google user data

Your primary Google Account email address and any name or profile picture saved to your clinic account are held in the Platform’s account records. Associated OpenID identity information is processed by Base44’s authentication infrastructure to manage your Google sign-in and account association; it is not added to your clinical notes. Sign-in tokens and their verification information are handled by the authentication service rather than treated as medical records. We apply the data security safeguards described in Section 9 to Google-sourced account data. Access is limited to the services and authorized personnel who need it for authentication, account administration, or the account-related services described in this policy. We retain Google-sourced account information while needed to operate your account. Any legal obligation to retain clinical records is assessed separately and does not, by itself, require indefinite retention of your Google sign-in information.

20. How we share Google user data

We do not sell your primary Google Account email address, associated OpenID info on Google, or basic profile information, and do not disclose them to advertising or marketing companies. Google-sourced information is handled only as follows:

• a)Google acts as the identity provider for the sign-in you initiate. Base44, our authentication and hosting provider, processes the email, OpenID information, and any supplied profile information needed to authenticate you and maintain your clinic account.
• b)Authorized clinic staff and treating professionals may access the name, email, and profile information shown in your clinic account when needed for account administration or your care. OpenID identifiers and sign-in token information are used by authentication services, not as clinical information.
• c)Information may be disclosed to regulatory or law enforcement authorities when required by applicable law.

We limit disclosures to the information needed for these purposes.

21. Deletion of Google user data

You may request deletion of your clinic account and its Google-sourced data through the Platform or using the contact details in Section 23. This request covers your primary Google Account email address, associated OpenID identity information and Google account association, and any Google-sourced name or profile picture held for your account. After verifying your identity, we will process deletion from active systems, including through our authentication provider as applicable, subject to legal obligations. If any information must be retained, we will explain the reason and restrict it to that purpose; clinical record retention is assessed separately from Google sign-in data. You can also remove the application’s access in your Google Account’s third-party connections settings. Revoking access stops future authorized access but does not automatically delete information already stored in your clinic account; request account/data deletion separately. Deleting your clinic account does not delete your Google Account.

22. Limited use of Google user data

Davao Stroke Surgery Clinic’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This applies to your primary Google Account email address, associated OpenID info on Google, and any basic profile information received. Our use is limited to the practices explicitly disclosed in this Privacy Policy. We will not use Google user data in a new way or for a different purpose without first updating this policy and obtaining your consent. We do not use Google user data for surveillance or advertising.

23. Changes to this privacy policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements, including changes to how we use Google user data. We will notify you of significant changes through the Platform and, where required, prompt you to consent to the updated policy before we use your data in a new way. The "Last updated" date below indicates when the policy was last revised.

24. Contact us

If you have questions about this Privacy Policy or wish to exercise your data privacy rights, contact us at info@davaostrokesurgeryclinic.com.ph or call +63 917 100 1161. Our clinic is located at Room 231, Sibley Medical Arts Building, Brokenshire Medical Center, Davao City.