Data Privacy Agreement

IMPORTANT — CONFIDENTIAL PATIENT HEALTH INFORMATION

REMINDER: Patient health information in the Social Hygiene Clinic Information System is CONFIDENTIAL and protected by law.

This includes medical history, consultation findings, laboratory requests and results, diagnoses (including sexually transmitted infection and related health information), treatment notes, and any personal data that can identify a patient.

You must treat every patient record as highly sensitive. Unauthorized viewing, sharing, posting, photographing, printing for personal use, gossiping about, or otherwise disclosing patient health information is a serious violation and may lead to legal charges.

1. Legal basis

This Data Privacy Agreement explains how the City of Parañaque Social Hygiene Clinic (“SHC”, “we”, “us”) collects, uses, stores, and protects personal and sensitive personal information in connection with this System.

Processing is governed by Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, issuances of the National Privacy Commission, applicable local health policies, and other laws protecting the confidentiality of medical and health-related information.

2. Sensitive personal and health information

Under the Data Privacy Act, information about an individual’s health is sensitive personal information and is subject to stricter protection than ordinary personal data.

In SHC operations, this may include: patient identity and contact details linked to clinic visits; sex/gender and demographic data; occupation and establishment data used for clinic programs; consultation and clinical notes; laboratory test requests and results; diagnoses and case classifications; and other records necessary for Social Hygiene Clinic services.

Because SHC services often involve sensitive sexual and reproductive health matters, extra care, discretion, and confidentiality are required at all times.

3. Personal information we collect from system users

For user accounts, we may collect: full name, email address, birth date, contact number, password (stored in hashed form), account status, role and route-access permissions, login activity timestamps, and records of acceptance of these legal agreements.

4. Purpose of processing

Personal and health information is processed only for legitimate purposes, including: delivery of SHC clinical and laboratory services; patient care and continuity of care; official records management; authorized public health reporting and program monitoring; user authentication and access control; audit, security, and accountability; and compliance with legal or regulatory obligations.

Patient health information must never be processed for curiosity, personal interest, social media, unauthorized research, harassment, discrimination, or any purpose not connected to official SHC duties.

5. Confidentiality obligation of users

Every authorized user is a personal information processor/handler for purposes of clinic operations and must keep patient health information confidential during and after employment or assignment.

You must: access records only on a need-to-know basis; log out when leaving a workstation; avoid discussing patient cases in public or non-secure places; secure printed reports; and immediately report suspected breaches to SHC administration.

Confidentiality survives account deactivation. Leaving the clinic or losing System access does not authorize disclosure of information previously learned through the System.

6. Consent and lawful processing

By registering or signing in and accepting this Agreement, you consent to the collection and processing of your account information for the purposes stated above.

Where the System processes patient sensitive personal information, processing is limited to authorized users and to purposes connected with SHC services, public health functions, and applicable law.

7. Data sharing and disclosure

We do not sell personal or health information. Disclosure may occur only to authorized SHC personnel, City offices with a legitimate and documented need, or as required by law, regulation, court order, or lawful request from competent authorities.

Any disclosure outside these channels — including to family, friends, co-workers without authority, media, or online platforms — is unauthorized disclosure of confidential information.

8. Legal charges and penalties for breach

WARNING: Unauthorized access, unauthorized processing, unauthorized disclosure, malicious disclosure, or improper disposal of personal information or sensitive personal information (including patient health data) may constitute criminal offenses under Republic Act No. 10173 (Data Privacy Act of 2012).

Depending on the offense and circumstances, violations may be punishable by imprisonment and/or monetary fines as provided under the Data Privacy Act and its IRR. Offenses involving sensitive personal information, such as health data, generally carry higher penalties. Additional liability may arise under other applicable laws protecting medical confidentiality and, where applicable, HIV/AIDS-related confidentiality.

Aside from criminal charges, violators may face civil claims for damages and administrative disciplinary action, including revocation of System access and sanctions under Civil Service and City of Parañaque rules.

SHC and the City of Parañaque reserve the right to investigate suspected breaches, preserve audit logs as evidence, and refer cases to the National Privacy Commission, City Legal Office, or appropriate law enforcement authorities.

9. Security measures

We implement reasonable organizational, physical, and technical measures to protect personal and health information against unauthorized access, alteration, disclosure, or destruction.

Users must protect their credentials, use the System only on authorized workstations when required by policy, and follow clinic security and records-handling practices.

10. Retention

Account and patient-related operational records are retained for as long as necessary for clinic operations, medical accountability, public health requirements, and compliance with applicable retention rules, after which they may be securely disposed of or anonymized according to policy.

11. Your rights

Subject to applicable law and clinic procedures, data subjects may request access to, correction of, or restriction of processing of their personal information, and may raise privacy concerns with SHC administration or the National Privacy Commission when appropriate.

Requests involving patient medical records will be handled according to clinic policy and applicable confidentiality and health-information rules.

12. Contact

For privacy-related concerns, suspected breaches, or questions about this Agreement, contact the Social Hygiene Clinic administration, City of Parañaque.

13. Acceptance and acknowledgment

By checking the acceptance box on the Login or Registration page, you acknowledge that: (1) you have read this Data Privacy Agreement; (2) you understand that patient health information is confidential and legally protected; (3) you agree to keep such information confidential; and (4) you understand that unauthorized disclosure or misuse may result in administrative sanctions, civil liability, and criminal charges under Philippine law.