Privacy Notice

Sanare Integrated Health Services (“Sanare”, “we”, “us”) is an integrated outpatient clinic at National Highway, Barangay Kalawag II, Isulan, Sultan Kudarat, Philippines. We operate a General Medical Clinic, an Animal Bite Treatment Center and a Pharmacy.

For the purposes of Republic Act No. 10173, the Data Privacy Act of 2012, and its Implementing Rules and Regulations, Sanare is the Personal Information Controller for the information described in this notice.

We collect only what is necessary for your care, our billing and our legal obligations. Depending on the services you use, this includes:

We do not collect your information from social media, and we do not buy personal information from third parties. Almost everything we hold about you was given to us by you, by your guardian, or by a clinician treating you here.

We process your information for these purposes only:

• To provide your medical care. To identify you correctly, avoid dangerous drug interactions and allergic reactions, decide on and deliver treatment, and complete your anti-rabies or other follow-up schedule. Section 13(f) of the Data Privacy Act permits the processing of sensitive personal information for medical treatment by a medical practitioner or healthcare institution where adequate safeguards are in place.
• To manage appointments and queues. To book, confirm, reschedule and cancel appointments, issue queue numbers, and send you reminders about appointments and upcoming doses. This is necessary to perform the service you asked us for.
• To bill you and process claims. To issue bills and receipts, apply senior citizen and PWD discounts, and submit PhilHealth and other claims on your behalf.
• To meet legal and regulatory obligations. To keep the medical records required of a healthcare facility, to report notifiable conditions such as animal bite and rabies exposure to the Department of Health and local health authorities as required by law, to comply with PhilHealth and Professional Regulation Commission requirements, and to satisfy tax and accounting rules.
• To keep our clinic and records safe. To trace vaccine batches in the event of a recall, to log access to patient records so misuse can be detected, and to secure our systems.
• To improve how we operate, using aggregated and de-identified figures such as patient volumes and average waiting times. These reports do not identify you.

Where we rely on your consent — for example to send you SMS reminders, or to let a guardian manage your record as a dependent — you may withdraw that consent at any time without affecting your care.

We do not sell, rent or trade your personal information. We do not use it for advertising or profiling. We share it only as follows:

• Our own clinical and administrative staff, strictly on a need-to-know basis. A pharmacist sees what is needed to dispense safely; a billing officer sees what is needed to bill. Confidential clinical notes are not visible to staff outside your care.
• PhilHealth, where you are claiming a benefit, limited to the information the claim requires.
• The Department of Health, the local health office and other government authorities, where a law, regulation, subpoena or lawful court order requires disclosure — including the mandatory reporting of animal bite and rabies exposure cases.
• Clinicians and facilities we refer you to, limited to the clinical information needed for that referral, with your knowledge.
• Service providers who operate parts of our systems under written contract — our hosting and database provider, and our SMS or email delivery provider. They act only on our instructions, may not use your information for their own purposes, and are bound to security measures at least as strict as our own.
• A parent, guardian or authorized representative, where you are a minor or where you have authorized someone to act for you.

Our systems are hosted on infrastructure that may be located outside the Philippines. Where your information is transferred abroad, it remains subject to this notice and to contractual safeguards requiring protection equivalent to that required by the Data Privacy Act.

We apply organizational, physical and technical security measures proportionate to the sensitivity of health information:

• Access to your record requires an individual staff account with a specific role. Each role grants only the permissions that role needs.
• Every access to a patient record is written to an append-only access log, recording who looked, when, and at what. These logs cannot be edited or deleted by our staff.
• Passwords are stored only as irreversible cryptographic hashes. Accounts lock after repeated failed login attempts.
• Information is encrypted in transit between your device and our systems, and encrypted at rest in our database and backups.
• Paper records and printed documents are kept in locked storage accessible only to authorized staff.
• Our staff sign confidentiality undertakings and receive training on handling patient information.
• The printed QR poster at our entrance contains only the address of our registration page — no name, no patient number and no identifier of any kind — so scanning it reveals nothing about anyone.

No system can be guaranteed absolutely secure. Should a personal data breach occur that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within the period required by law.

• Medical records are retained for at least fifteen (15) years from your last visit, in line with Philippine requirements for healthcare facilities. Where the patient is a minor, the period runs from the date they reach the age of majority.
• Billing, payment and claim records are retained for ten (10) years, as required by tax and accounting rules.
• Consent records and access logs are retained for as long as the related record is retained, so that lawful processing remains demonstrable.
• Incomplete registration drafts and one-time verification codes are deleted automatically within days.
• Patient portal accounts are kept while active. If you close your account, your login credentials are deleted, but your medical record itself is retained for the period above.

Once a retention period ends, records are securely disposed of, or irreversibly anonymised so they can no longer identify you.

Under Chapter IV of the Data Privacy Act of 2012, you hold the following rights over your personal information. Exercising them is free, and never affects the care we give you.

Where the data subject is a minor or is otherwise unable to exercise these rights, they may be exercised by a parent, legal guardian or authorized representative, on presentation of proof of authority.

We treat patients of all ages. Where a patient is a minor, their information is provided and managed by a parent or legal guardian, who exercises the rights in section 7 on the child’s behalf. A guardian may be linked to a dependent’s record in the patient portal only where we have recorded their authority to manage it.

This website uses cookies only where they are strictly necessary: to keep you signed in to the patient portal, to protect forms against cross-site request forgery, and to remember an in-progress registration so you can resume it. We do not use advertising cookies, third-party analytics or tracking pixels, and we do not build a profile of your browsing.

For any question about this notice, to exercise any of your rights, or to raise a concern about how your information has been handled, contact our Data Protection Officer:

If you are not satisfied with our response, you may lodge a complaint with the National Privacy Commission (NPC), 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City 1307, Metro Manila — telephone (02) 8234-2228, email [email protected], website privacy.gov.ph.

This is version 1.0 of our privacy notice, effective 1 January 2026. If we change how we handle your information, we will publish a new version here with a new version number and effective date, and we will display a notice at our reception counter. Where a change materially affects how your sensitive personal information is processed, we will ask for your consent again. The version of the notice you consented to is recorded against your patient record.