This Privacy Policy explains how Salun-at ("we", "us", "our") collects, uses, discloses, and protects personal information when you use our hospital management platform (the "Service"). We are committed to processing your data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

The Service is operated by Lines For Growth (LFG), the Personal Information Controller responsible for personal data processed through Salun-at. [Placeholder: registered business address and NPC registration number.]

1. Information We Collect

We collect the following categories of information:

• Account data: name, email address, hashed password, role, and authentication identifiers (including Google account identifiers when you sign in with Google).
• Sensitive personal information (health data): vitals (height, weight, blood type, blood pressure, heart rate, temperature, blood sugar), allergies, appointments, medical records, lab results, and referrals. Under the Data Privacy Act, health information is sensitive personal information subject to heightened protection.
• Establishment data: facility registration details, departments, employees, and service catalogs supplied by participating establishments.
• Technical data: IP address, device and browser information, push-notification subscriptions, and server logs generated when you use the Service.

2. How We Use Your Information

• To create and manage your account and authenticate access.
• To schedule, confirm, reschedule, and manage appointments and admissions.
• To maintain your health records and share them with establishments you engage.
• To process cross-establishment referrals you or your provider initiate.
• To send transactional emails and push notifications about your care.
• To secure the Service, prevent fraud, and comply with legal obligations.

3. Legal Basis for Processing

We process personal information on the basis of your consent, the performance of a contract with you, compliance with a legal obligation, and our legitimate interests in operating a secure healthcare platform. Sensitive personal information is processed only where a lawful ground under Section 13 of the Data Privacy Act applies — typically your consent or the provision of medical care by a healthcare professional.

4. How We Share Information

We do not sell your personal information. We share it only:

• with healthcare establishments and employees involved in your care;
• with target establishments when you or your provider create a referral;
• with service providers acting as our processors (email delivery, hosting, push notifications) under written data-processing terms;
• when required by law, legal process, or a lawful order of a competent authority.

5. Data Retention

We retain personal and health information for as long as your account is active and for the period required by applicable medical-records retention rules and law, after which it is securely deleted or anonymized. [Placeholder: specify retention periods per data category.]

6. Security

We apply organizational, physical, and technical safeguards, including encrypted transport (HTTPS/HSTS), a strict Content Security Policy, scrypt password hashing, role-based access control, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Under the Data Privacy Act, you have the right to:

• be informed about the processing of your personal data;
• access your personal data and obtain a copy;
• object to processing and withdraw consent;
• rectify inaccurate or incomplete data;
• erasure or blocking of data under certain conditions;
• data portability for information processed by automated means;
• lodge a complaint with the National Privacy Commission; and
• be indemnified for damages arising from unlawful processing.

8. Data Breach Notification

Where a personal data breach likely to give rise to a real risk of serious harm occurs, we will notify the National Privacy Commission and affected data subjects within seventy-two (72) hours of knowledge of the breach, in accordance with NPC Circular 16-03.

9. Children

Accounts for minors must be created and managed by a parent or legal guardian, or by a healthcare establishment acting under lawful authority.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email, and the "Last updated" date above will be revised.

11. Contact — Data Protection Officer

To exercise your rights or ask questions about this Policy, contact our Data Protection Officer:
Aaron John N. Tamayo
Email: aaronjohn.tamayo29@gmail.com
Phone: +63 966 789 0899