Data Protection Officer (DPO) Executive Statement
As the designated Data Privacy Officer (DPO) for CodeNinjas Web Development Services (operating under the trade name Clinic Natin), we declare our institutional commitment to safeguarding the constitutional right to privacy of every patient, attending doctor, and healthcare practitioner.
Operating an outpatient queue tracking and electronic medical records (EMR) system places Clinic Natin in custody of Sensitive Personal Information (SPI) under Section 3(l) of RA 10173. Consequently, privacy-by-design and security-by-default are core architectural imperatives implemented into our PostgreSQL schema, Row-Level Security (RLS) policies, and front-desk clinic triage workflows.
Public-Facing Privacy Policy
Applicable to all patients, attending physicians, secretaries, and clinic staff.
1Scope & Operating Boundary
CodeNinjas Web Development Services provides digital outpatient queue coordination, clinical vitals triage, e-prescriptions, and practice workflows connecting patients with licensed medical practitioners across the Philippines (specifically beachhead operations at Maria Reyna Xavier University Hospital, CUMC, Polymedic Plaza, and Northern Mindanao Medical Center in Cagayan de Oro City).
2Categories of Data Processed (PI vs. SPI)
In accordance with Section 3 of RA 10173, data is classified into two distinct legal tiers:
Personal Information (PI)
- Identity Demographics: Full legal name, preferred display name, birth date, age, biological sex.
- Contact Details: Philippine mobile number (+63 9XX), email address, emergency contact name and phone.
- System Telemetry: IP address, device user agent, session timestamps, and clinic proximity distance.
Sensitive Personal Information (SPI)
- Clinical Vitals: Blood pressure, heart rate, body temperature, weight, height, BMI.
- Health Demographics: Documented drug allergies, blood type, chronic comorbidities, maintenance meds.
- Medical Encounters: Chief complaint, SOAP consultation notes, ICD-10 diagnostic codes, electronic prescriptions (℞).
- Statutory Identity: Senior Citizen OSCA ID, PWD ID, PhilHealth Identification Number (PIN), HMO cards.
- Physician Credentials: PRC License No., PTR No., and PDEA S2 Dangerous Drugs License No.
3Lawful Bases for Processing
- Explicit Consent (Sec. 12(a) & Sec. 13(a)): Freely given and informed consent captured during signup and consultation check-in.
- Medical Treatment by Health Professionals (Sec. 13(b)): Processing is strictly necessary for clinical triage, medical consultation, and electronic prescription generation by a licensed physician bound by medical confidentiality.
- Compliance with Legal Obligations (Sec. 12(c) & Sec. 13(c)): Computation of statutory 20% Senior Citizen (RA 9994) / PWD (RA 7277) discounts, FDA Circular 2020-007 e-Rx mandates, and DOH clinical record archives.
4Data Sharing & Third-Party Sub-Processors (PIP Framework)
Clinic Natin does NOT sell, monetize, or trade patient personal health data with pharmaceutical manufacturers or third-party advertisers. Data transmission is strictly restricted to authenticated infrastructure:
Semaphore SMS
Transmits turn progress alerts and buffer notices directly to Philippine mobile carriers.
PayMongo QRPH
PCI-DSS certified gateway for ₱50 reservation fees via GCash, Maya, and QRPH bank apps.
Supabase Enterprise
PostgreSQL cloud cluster in Singapore (ap-southeast-1) with AES-256 and Row Level Security.
Data Subject Rights & DOH 10-Year Retention Lock
Data Subject Rights Matrix under RA 10173 Section 16
/privacy.DOH 10-Year Clinical Records Retention Harmonization Rule
Pursuant to Department of Health (DOH) Administrative Order No. 2016-0001 and hospital licensing standards, medical encounter data must be preserved for a minimum of ten (10) years from the date of the last consultation (or until the age of majority plus 7 years for pediatric records).
When a patient submits an Erasure Request under RA 10173 Section 16, Clinic Natin immediately deletes all marketing tokens, communication channels, passwords, and demographic contact numbers. In compliance with DOH medico-legal mandates, clinical SOAP encounter notes are pseudonymized and placed into an immutable archive.
Data Breach Management Protocol (72-Hour NPC Notification Rule)
Pursuant to NPC Circular No. 2016-03, Clinic Natin enforces an immutable incident protocol:
Containment & Triage
Affected database credentials revoked; affected server nodes isolated by Security Incident Response Team.
Forensics & Mitigation
Root-cause analysis conducted; integrity of database audit logs validated with cryptographic SHA-256 hashes.
Statutory NPC Report
Formal breach notification transmitted to the National Privacy Commission and all affected data subjects.
Statutory Tax Registration & BIR Compliance (RMC 60-2020 / RMC 79-2024)
In compliance with the Bureau of Internal Revenue (BIR) mandates for taxpayers engaged in online business and digital platforms in the Philippines, Clinic Natin prominently displays its official, scannable Registration Seal Badge:
CodeNinjas Web Development Services
Trade Name: Clinic Natin • RDO 26
RSN: 098RC20260000004735
Tap to view / scan QR code →
Designated Data Protection Officer (DPO) Contact
For questions regarding personal health data processing, data subject access requests (DSAR), or compliance inquiries, please contact our Data Protection Office:
CodeNinjas Web Development Services
Trade & Brand Name: Clinic Natin
Cagayan de Oro City, Northern Mindanao, Philippines
dpo@clinicnatin.ph
Alternate: clinicnatin@gmail.com
NPC DPS Verification: In progress under Circular 2022-04