1
What Information We Collect
We collect only the information necessary to provide you with safe, effective healthcare and a smooth hospital experience. Here's what we gather:
- Personal identification — Full name, date of birth, gender, nationality, and government-issued ID numbers
- Contact details — Phone number, email address, home address, and emergency contact information
- Health records — Medical history, diagnoses, lab results, prescriptions, imaging reports, and physician notes
- Appointment history — Past visits, upcoming bookings, preferred doctors, and treatment plans
- Insurance and billing — HMO details, PhilHealth number, and payment information
- Device information — When using our website or CHi app, we may collect browser type, IP address, and device identifiers for security and service improvement
2
How We Use Your Information
Your information helps us deliver quality care and keep you informed. We use it for:
- Providing healthcare — Diagnosing conditions, creating treatment plans, and coordinating care between departments and specialists
- Appointment management — Booking confirmations, reminders, rescheduling, and follow-up notifications
- Medical records — Maintaining accurate, up-to-date health records accessible to your authorized care team
- Billing and insurance — Processing payments, submitting HMO claims, and generating receipts
- Service improvement — Analyzing usage patterns (anonymized) to improve wait times, staffing, and patient experience
- Health communications — Sending lab results, post-visit instructions, and health education materials you've opted into
We will never use your personal health information for marketing purposes without your explicit consent. You can opt out of non-essential communications at any time.
3
Who We Share With
We share your information only when necessary and only with people and organizations directly involved in your care:
- Your healthcare team — Doctors, nurses, and specialists directly involved in your treatment at Chong Hua Hospital
- HMO and insurance providers — Only with your consent, for claims processing and coverage verification
- Regulatory bodies — When required by law, such as reportable diseases mandated by the Department of Health
- Accredited laboratories — For tests that are processed by partner facilities, under strict data sharing agreements
We never sell your personal information to third parties. Ever. We do not share your data with advertisers, marketers, or data brokers.
4
Your Rights Under the Data Privacy Act
Under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights regarding your personal information:
- Right to access — Request a copy of the personal data we hold about you, including your medical records
- Right to correction — Ask us to correct inaccurate or incomplete information in your records
- Right to erasure — Request deletion of your personal data when it is no longer needed for the purpose it was collected (subject to legal retention requirements)
- Right to data portability — Receive your personal data in a structured, commonly used format for transfer to another healthcare provider
- Right to object — Object to the processing of your personal data for specific purposes, such as direct marketing
- Right to file a complaint — If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph
To exercise any of these rights, contact our Data Protection Officer using the details at the bottom of this page.
5
Data Security
We take your data security seriously. Our protection measures include:
- Encryption — All data transmitted between your device and our systems is encrypted using industry-standard TLS/SSL protocols
- Access controls — Only authorized personnel can access your medical records, based on their role and your care needs
- Audit logs — Every access to patient records is logged, monitored, and reviewed for unauthorized activity
- Physical security — Paper records and servers are stored in secure, access-controlled facilities with 24/7 surveillance
- DPO oversight — Our Data Protection Officer regularly audits our data handling practices and trains staff on privacy protocols
- Incident response — We have a documented breach notification process in compliance with NPC requirements
6
Cookies & Analytics
When you visit our website or use the CHi app, we use cookies and similar technologies to improve your experience:
- Essential cookies — Required for the website to function properly (login sessions, security tokens). These cannot be disabled.
- Analytics cookies — Help us understand how visitors use our website (pages visited, time spent, referral sources). This data is anonymized and never linked to your medical records.
- Preference cookies — Remember your settings like language preference and dark/light theme choice.
We do not use advertising or tracking cookies. We do not participate in cross-site tracking or retargeting.
How to opt out: You can manage cookies through your browser settings. Disabling analytics cookies will not affect your ability to use our website or patient portal.
7
Contact Our Data Protection Officer
If you have questions about this privacy policy, want to exercise your data rights, or need to report a privacy concern, contact our Data Protection Officer:
8
Updates to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you through:
- A prominent notice on our website
- An update in the CHi patient portal
- Email notification to registered patients (for material changes)
We encourage you to review this page periodically. The "Last Updated" date at the bottom of this page indicates when the policy was most recently revised.
Last Updated: January 2026 · Effective Date: January 1, 2026
