CAGAYAN VALLEY
MEDICAL CENTER

PRIVACY POLICY FOR CVMC MOBILE APPLICATION (CVMCAnnounce)
Cagayan Valley Medical Center
Last Updated: September 22, 2026

I. POLICY STATEMENT
Cagayan Valley Medical Center (CVMC) as a government tertiary DOH-retained hospital, recognizes the fundamental right to privacy and is committed to protecting the confidentiality, integrity, availability, and security of personal information entrusted to it by its patients, staff, users, and other data subjects.
This Privacy Policy governs the collection, recording, organization, storage, retrieval, use, disclosure, retention, erasure, and other forms of processing of personal information obtained through the CVMCAnnounce (Official Hospital Announcements & Activity Guide) and CVMC Patient Appointment System mobile application (“App”).

II. SCOPE AND APPLICATION
This Privacy Policy applies to all individuals who access, register with, or use the App, including the general public, hospital staff, patients, and authorized representatives who provide personal information through the App (collectively, the “Users”, “Patients” or “Data Subjects”).
In strict compliance with the Philippines’ Data Privacy Act of 2012 (RA 10173) and the Google Play Developer Distribution Agreement and User Data policies, this Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application.

III. PERSONAL INFORMATION COLLECTED
CVMC collects and processes only such personal information as may be necessary, relevant, and proportionate to the purposes for which the App is intended, to wit:
A. Personal and Identification Information
• Full name;
• Department or unit (for registered CVMC staff and administrators);
• Date of birth, sex or gender, civil status (where applicable);
• Mobile or telephone number;
• Email address; and
• Other identifying information necessary for staff account registration, patient identification, and appointment or announcement processing.
Such information may be processed for purposes including account registration, authorization for publishing hospital announcements, patient identification, appointment scheduling, appointment verification, communication, and related hospital services. Public users may view official hospital announcements without logging in.

B. Medical, Announcement, and Appointment Information
• Official hospital announcements, advisories, memos, and scheduled activities;
• Preferred clinical specialty, preferred physician or healthcare provider, reason for consultation, referral information, and appointment details and history (where applicable); and
• Other health-related information necessary for public health advisories, appointment coordination, and healthcare services.

C. PhilHealth and Insurance Information
• PhilHealth Identification Number (PIN); and/or
• Relevant private health maintenance organization (HMO) or insurance information (where applicable).

D. Device and Technical Information
• Device type;
• Operating system and version;
• Application version;
• Push notification tokens and unique technical identifiers, where applicable;
• Diagnostic information; and
• Crash or error logs.
Such information shall be processed primarily for delivering hospital notifications, application maintenance, troubleshooting, cybersecurity, system reliability, and performance improvement.

IV. MOBILE DEVICE PERMISSIONS
A. Notifications
Notification access may be used to provide:
• Service-related and urgent hospital announcements;
• Scheduled hospital activity reminders;
• Appointment confirmations, reminders, rescheduling notices, and cancellation notices; and
• Other notifications necessary for the proper functioning of the App.

B. Camera and Media Selection
Where supported by the App, access to the device camera or system photo/video picker may be requested to enable authorized Users to upload images, short videos, or documents for official hospital announcements or healthcare coordination. Users may manage or revoke device permissions through their device settings.

V. DISCLOSURE AND SHARING OF PERSONAL INFORMATION
CVMC shall not sell, rent, or trade personal information collected through the App.
Personal information may be disclosed or made accessible only to authorized CVMC personnel, qualified Personal Information Processors (application hosting, IT infrastructure, notification services, and system security), or Government Agencies and Public Authorities where required or authorized by law.

VI. DATA SECURITY AND CONFIDENTIALITY
CVMC shall implement reasonable and appropriate organizational, physical, and technical measures designed to protect personal information against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, access, or other unlawful processing.

VII. DATA RETENTION AND DISPOSAL & ACCOUNT DELETION
CVMC shall retain personal information only for as long as necessary to fulfill the declared purposes for which it was collected, to comply with applicable laws and regulations, to satisfy legitimate hospital and governmental requirements, or to establish, exercise, or defend legal claims.
How to Request Account & Data Deletion:
• In-App: Open CVMCAnnounce → My Account (Account Settings) → Delete Account and confirm deletion.
• By Email: Send an account deletion request to the CVMC Data Protection Officer at dpo@cvmchealthcare.com.
Upon receipt and validation of a valid account deletion request, CVMC shall deactivate the User’s account and delete associated personal information within thirty (30) days, unless statutory legal or medical record retention laws require preserving it.

VIII. RIGHTS OF DATA SUBJECT
Every Data Subject has rights under the Philippines’ Data Privacy Act of 2012 (RA 10173), including the right:
• To be informed of the processing of personal information;
• To access personal information concerning him or her;
• To object to certain forms of processing;
• To dispute and request correction or rectification of inaccurate or incomplete personal information;
• To request erasure or blocking of personal information when legally warranted;
• To data portability, where applicable;
• To file a complaint before the National Privacy Commission; and
• To claim damages in accordance with law when the requirements for such claim are present.

IX. CHANGES TO THIS PRIVACY POLICY
CVMC reserves the right to amend, revise, or update this Privacy Policy from time to time to reflect changes in applicable laws, regulations, NPC issuances, DOH policies, hospital operations, technological developments, or data processing practices.

X. CONTACT US
DATA PROTECTION OFFICER
Cagayan Valley Medical Center
Regional Government Center, Barangay Carig Sur
Tuguegarao City, Cagayan, Philippines
Email: dpo@cvmchealthcare.com
Hospital Trunkline: (078) 304-8894
© 2026 Cagayan Valley Medical Center (CVMC). All rights reserved.