Privacy Policy

General Privacy Policy

Our Commitment to Privacy

Our Lady of Mt. Carmel Medical Center- San Fernando and Clark (“OLMCMC”, “Hospital”, “we”, “us”, or “our”) respects the privacy and confidentiality of our patients, their authorized representatives, and other individuals whose personal information we process.

As a private healthcare institution in the Philippines, we are committed to protecting personal information in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and other applicable laws, regulations, and issuances of the National Privacy Commission (NPC).

Information We Collect

Depending on the services you receive and your relationship with OLMCMC, we may collect and process your personal information including but not limited to:

• Full name and contact information;
• Date and place of birth, age, sex, and civil status;
• Address and other identification information;
• Government-issued identification and identification numbers, when necessary;
• Emergency contact and authorized representative information;
• Medical history, diagnoses, laboratory and diagnostic results, prescriptions, treatment records, and other health information;
• Insurance, PhilHealth, billing, payment, and financial information;
• Information relating to admissions, consultations, procedures, and discharge;
• Images, photographs, CCTV footage, and other security-related information where applicable;
• Information provided through our patient portals, electronic systems, forms, surveys, and other communication channels; and
• Other information reasonably necessary for the provision, administration, and improvement of healthcare services.

Purposes of Processing

We process patient information only for declared, specified, and legitimate purposes including as necessary to:

1. Provide medical care, diagnosis, treatment, rehabilitation, and other healthcare services;
2. Maintain accurate and complete medical and patient records;
3. Process admissions, appointments, referrals, laboratory services, pharmacy services, and other hospital operations;
4. Coordinate patient care among authorized healthcare professionals and service providers;
5. Process billing, payments, insurance, PhilHealth, and other healthcare-related claims;
6. Communicate with patients and their authorized representatives regarding healthcare services;
7. Protect the health, safety, and security of patients, employees, visitors, and other persons;
8. Comply with legal, regulatory, reporting, and record-keeping obligations;
9. Respond to lawful requests or orders from government agencies and other authorized authorities;
10. Manage quality assurance, patient safety, clinical governance, and hospital operations;

We will not collect or process personal information in a manner that is incompatible with the purposes for which it was collected.

Lawful Basis for Processing

OLMCMC processes personal information only when permitted under the DPA and other applicable laws.

Depending on the circumstances, processing may be based on the patient's consent or another lawful basis recognized by the DPA. In particular, the DPA recognizes circumstances in which processing is necessary for medical treatment when carried out by a medical practitioner or medical treatment institution and an adequate level of protection is ensured.

Processing may also be necessary to protect the life or health of a patient or another person, comply with a legal obligation, perform a contract or service, or establish, exercise, or defend legal claims, where permitted by law.

Where consent is the applicable legal basis, the Hospital will obtain consent in an appropriate manner and will provide information regarding the purpose and extent of processing.

Disclosure and Sharing of Patient Information

Patient information shall be accessed or disclosed only when necessary and authorized by law. We may share appropriate information with:

• Authorized physicians, nurses, healthcare professionals, and other personnel involved in patient care;
• Laboratories, pharmacies, diagnostic centers, specialists, and other healthcare providers involved in treatment;
• Insurance companies, HMOs, PhilHealth, and other authorized payors;
• Authorized representatives, guardians, or persons designated by the patient, subject to applicable requirements;
• Service providers that process information on behalf of the Hospital, subject to appropriate contractual and privacy safeguards;
• Government agencies or regulatory authorities when disclosure is required or permitted by law;
• Courts, law enforcement agencies, or other authorized authorities pursuant to lawful processes or applicable legal requirements; and
• Other persons or organizations where disclosure is authorized by the patient or otherwise permitted under applicable law.

We will not sell patient medical records or use patient information for unrelated purposes without an appropriate lawful basis.

Data Security

We implement appropriate organizational, physical, and technical safeguards to protect patient information against unauthorized access, use, disclosure, alteration, loss, or destruction.

These safeguards include access controls, secure data storage and transmission, confidentiality measures, system monitoring, backup and recovery procedures, employee privacy training, and incident response protocols.

We regularly review and enhance these measures to ensure the continued security and confidentiality of personal information.

Data Retention and Disposal

OLMCMC retains patient information only for as long as necessary to fulfill the purposes for which it was collected, comply with applicable laws and regulatory requirements such as (but not limited to) the Department of Health, establish or defend legal claims, and satisfy legitimate healthcare and business requirements.

When personal information is no longer required and may lawfully be disposed of, it will be securely destroyed, deleted, anonymized, or otherwise disposed of in a manner designed to prevent unauthorized access, use, or disclosure.

Your Rights as Data Subject

Subject to the limitations and conditions provided by applicable law, patients and other data subjects have rights under the DPA, including:

• Right to be informed about the collection and processing of their personal information;
• Right to access personal information subject to applicable requirements and limitations;
• Right to correct inaccurate or incomplete information;
• Right to object to certain processing;
• Right to suspend, withdraw, or order the blocking, removal, or destruction of personal information in circumstances allowed by law;
• Right to data portability, where applicable; and
• Right to file a complaint concerning violations of applicable data privacy rights.

The exercise of these rights may be subject to limitations imposed by law, including circumstances where retention or processing is required for medical, legal, regulatory, public-interest, or other lawful purposes.

Patients or authorized representatives who wish to exercise their privacy rights or raise a privacy concern may contact the OLMCMC’s Data Protection Officer (DPO) through:

Data Protection Officer
Our Lady of Mt. Carmel Medical Center
dpo.sf@olmcmc.com

We will evaluate and respond to privacy requests in accordance with applicable laws, regulations, and Hospital procedures.

Changes to This Privacy Policy

OLMCMC may update this Privacy Policy from time to time to reflect changes in applicable laws, regulations, NPC issuances, hospital practices, technology, or healthcare services. Any updates will be posted on this website and will take effect upon posting unless otherwise stated.

Contact Us

For questions, requests, complaints, or concerns regarding the privacy and protection of your personal information, please contact:

Data Protection Officer
Our Lady of Mt. Carmel Medical Center
dpo.sf@olmcmc.com
dpo.clrk@olmcmc.com