Privacy Policy

1. Introduction & Scope

We process personal information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Where we serve users outside the Philippines, we also honour the applicable local data protection requirements.

“Personal information” means any information that identifies you or can reasonably be linked to you. “Sensitive personal information” and “health information” include details about your physical or mental health, medical history, and the care you receive through the Services.

2. Information We Collect

Information you provide to us

• Account details: name, email address, mobile number, and password.
• Profile details: date of birth, sex, address, preferred language, and emergency contact.
• Waitlist details: the information you submit when joining the early-access list, including the audience segment you select and, for partners, an organisation name.
• Payment details: billing name and transaction records. Card and e-wallet credentials are handled by our payment processor and are not stored on our servers.
• Communications: messages you send to support, feedback, and survey responses.

Health information

• Symptoms, reason for visit, and intake questionnaire answers.
• Consultation notes, assessments, prescriptions, laboratory requests, and referrals created by the attending clinician.
• Care summaries and follow-up records generated after a consultation.

Information collected automatically

• Device and connection data: IP address, browser type, operating system, and device identifiers.
• Usage data: pages viewed, features used, referring pages, and timestamps.
• Cookies and similar technologies, as described in “Cookies & Tracking Technologies” below.

We do not knowingly collect more information than we need for the purposes set out in this policy.

3. How We Use Your Information

We use the information we collect to:

• Create and administer your account and verify your identity.
• Facilitate consultations between you and licensed clinicians, including video, voice, and chat sessions.
• Generate, store, and deliver care summaries, prescriptions, and referrals.
• Process payments and issue receipts.
• Send service messages such as appointment confirmations, reminders, and follow-ups.
• Provide customer support and respond to your requests.
• Monitor, secure, debug, and improve the Services, including research and analytics conducted on de-identified or aggregated data.
• Comply with legal, regulatory, professional, and accreditation obligations.

We use health information only for providing care, for the administration directly related to that care, and where required or permitted by law. We do not sell your personal or health information, and we do not use it for third-party advertising.

4. Legal Bases for Processing

Depending on the activity, we rely on one or more of the following legal bases under the Data Privacy Act:

• Consent
  • for joining the waitlist, optional communications, and any processing of sensitive personal information not otherwise permitted by law.
• Contract
  • to deliver the Services you have requested and to administer your account.
• Legal obligation
  • to meet record-keeping, tax, public-health, and regulatory requirements.
• Legitimate interests
  • to secure the platform, prevent fraud and abuse, and improve the Services, balanced against your rights and interests.
• Vital interests
  • to act in a medical emergency where you are unable to give consent.

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawing consent does not affect processing already carried out, and some Services cannot be provided without the information concerned.

5. How We Share Information

We share personal and health information only as described here:

• Treating clinicians
  • the licensed doctor or health professional handling your consultation, and any clinician to whom you are referred, receive the information needed to provide care.
• Service providers
  • vendors that host our infrastructure, process payments, deliver messages, or provide analytics and support tooling, each bound by contract to protect the information and use it only on our instructions.
• Partner organisations
  • where your care is sponsored by an employer, LGU, school, or similar partner, we share only the minimum data needed for eligibility and billing — never your clinical records — and only with your knowledge.
• Legal and safety
  • government agencies, regulators, courts, or law enforcement where disclosure is required by law, court order, or lawful request, or to protect the rights, safety, or property of any person.
• Business transfers
  • if BayanHealth is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We may share de-identified or aggregated information that cannot reasonably be used to identify you for research, reporting, and service improvement.

6. Data Retention

We keep personal information only for as long as necessary for the purposes set out in this policy, unless a longer period is required or permitted by law.

• Medical and consultation records are retained for at least 15 years in line with professional and regulatory requirements.
• Account and billing records are retained for the life of your account and for 10 years afterward for tax and audit purposes.
• Waitlist information is retained until the early-access programme closes or you ask us to remove it, whichever comes first.
• Server logs and analytics data are retained only for as long as needed for security, operations, legal compliance, and service improvement, then securely deleted or de-identified.

When information is no longer needed, we securely delete, anonymise, or de-identify it.

7. Data Security

We maintain organisational, physical, and technical safeguards designed to protect personal and health information against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit and at rest.
• Role-based access controls, so staff and clinicians see only the information they need.
• Audit logging of access to clinical records.
• Regular security testing, monitoring, and staff training.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to put your rights and freedoms at risk, we will notify you and the National Privacy Commission as required by law.

8. Your Rights

Subject to the limits set by law, you have the right to:

• Be informed about how your personal information is processed.
• Access the personal information we hold about you and obtain a copy.
• Correct information that is inaccurate, outdated, or incomplete.
• Object to, or request that we restrict, certain processing.
• Request erasure or blocking of information where there is no lawful basis to keep it.
• Data portability — receive a copy of certain information in a structured, commonly used, electronic format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the National Privacy Commission, and to be indemnified for damage caused by unlawful processing.

To exercise any of these rights, contact us using the details in “Contact Us”. We may need to verify your identity before acting, and we will respond within the period required by law.

9. Cookies & Tracking Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and understand how the Services are used.

• Strictly necessary
  • required for the Services to function, such as authentication and security. These cannot be switched off.
• Functional
  • remember choices such as language and theme.
• Analytics
  • help us measure and improve performance, on a de-identified basis where possible.

You can control cookies through your browser settings. Blocking some cookies may affect how the Services work.

10. Children's Privacy

The Services are intended for use by adults. A parent or legal guardian may use the Services to seek care for a minor in their care, and is responsible for the information they provide about that minor.

We do not knowingly allow anyone under 18 to create an account. If you believe a minor has provided us information without the involvement of a parent or guardian, contact us and we will take appropriate steps.

11. International Data Transfers

Some of our service providers process information outside the Philippines. Where we transfer personal information across borders, we use contractual and technical measures designed to ensure a comparable level of protection to that required under Philippine law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this page and, where the changes are significant, provide a more prominent notice or seek your consent as required.

We encourage you to review this page periodically. Continued use of the Services after an update takes effect means you accept the revised policy.

13. Contact Us

If you have questions about this policy or wish to exercise your rights, contact our support team:

• Support Team, BayanHealth
• Email: support@bayanhealth.co
• Postal address: Purok 2, Libertad, 8715, Quezon, Bukidnon, Philippines

You may also contact the National Privacy Commission at www.privacy.gov.ph if you believe your rights under the Data Privacy Act have been violated.