Effective Date: August 28, 2026 | Medflow Aguinaldo Healthcare Management System
1. Who We Are and Scope of This Notice
Medflow Aguinaldo manages the Medflow Aguinaldo patient portal and acts as the personal information controller for the personal information processed through it. This notice explains how we collect, use, store, disclose, and protect personal and sensitive personal information when you use the portal or receive related healthcare services.
2. Information We Collect
Depending on the services you use, we may collect:
- identity and contact details, such as name, date of birth, address, telephone number, email address, and government-issued ID information or image for verification;
- account and portal information, such as login details, account activity, and communications or requests submitted through the portal;
- healthcare and appointment information, such as appointments, medical records, prescriptions, medical certificates, credential requests, and related notes; and
- billing and transaction information needed to process or document clinic charges and payments.
3. Why We Process Your Information
We process information only for declared, specified, and legitimate healthcare-related purposes. These include providing and coordinating healthcare services; booking and managing appointments; maintaining medical records; processing credential requests; communicating service updates; handling billing and payments; protecting portal security; meeting legal, regulatory, and audit requirements; and responding to lawful requests.
4. Legal Bases for Processing
We process personal and sensitive personal information in accordance with Republic Act No. 10173 (Data Privacy Act of 2012), its implementing rules and regulations, and other applicable laws. As applicable to a specific activity, processing may be based on your consent; the performance of or steps related to a healthcare or service relationship; compliance with a legal obligation; protection of vital interests; legitimate interests that do not override your rights; or a lawful basis for the processing of sensitive personal information, including medical treatment where permitted by law.
5. Who May Access Your Information
Access is limited to authorized personnel who need the information for their role, including your treating healthcare professionals, assigned clinic staff, reception and administrative staff, and authorized billing personnel. We may also disclose information to service providers that support the portal or clinic operations, subject to appropriate confidentiality and security safeguards, and to government authorities or other recipients when required or permitted by law. We do not sell personal information.
6. Retention and Secure Disposal
We retain information while your account or healthcare relationship is active and afterwards only for as long as needed for the purposes in this notice and for applicable healthcare, tax, accounting, legal, and professional record-retention requirements. Retention periods can differ by record type. When retention is no longer required, records are securely deleted, destroyed, or anonymized in a manner designed to prevent unauthorized retrieval or use.
7. Security Measures
We implement appropriate administrative, physical, and technical safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, misuse, or destruction. These measures include role-based access controls, account authentication, access management, secure handling practices, and monitoring appropriate to the nature of the information and the risks involved. No method of transmission or storage is completely risk-free; please protect your credentials and notify us promptly if you suspect unauthorized account access.
8. Your Rights Under the Data Privacy Act
Subject to applicable law and its limitations, you may have the right to be informed, access your personal information, request correction or rectification, request erasure or blocking where applicable, object to processing, request data portability, file a complaint with the National Privacy Commission, and claim damages where provided by law.
To make a privacy request, please contact us using the details below and provide enough information for us to verify your identity and locate the relevant record. We may ask for additional information where necessary to protect your privacy and the privacy of others.
9. Privacy Contact
Medflow Aguinaldo Privacy Contact
Email: medflowaguinaldo@gmail.com
Telephone: +63 988 904 711
Address: Arata Commercial Arcade, 959 Quirino Highway, Novaliches, Quezon City
Please state that your message is a privacy request. You may also file a complaint with the National Privacy Commission.
10. Changes to This Notice
We may update this Privacy Notice to reflect changes in our services, processing activities, or legal obligations. The current version will be posted with its effective date.
