PRIVACY POLICY FOR CVMC PATIENT APPOINTMENT SYSTEM (MOBILE APPLICATION)
LAST UPDATED: September 22, 2026
I. POLICY STATEMENT
Cagayan Valley Medical Center (CVMC) as a government tertiary DOH-retained hospital, recognizes the fundamental right to privacy and is committed to protecting the confidentiality, integrity, availability, and security of personal information entrusted to it by its patients, users, and other data subjects.
This Privacy Policy governs the collection, recording, organization, storage, retrieval, use, disclosure, retention, erasure, and other forms of processing of personal information obtained through the CVMC Patient Appointment System mobile application ("App").
II. SCOPE AND APPLICATION
This Privacy Policy applies to all individuals who access, register with, or use the App, including patients and authorized representatives who provide personal information through the App (collectively, the "Users", “Patients” or "Data Subjects").
In strict compliance with the Philippines' Data Privacy Act of 2012 (RA 10173) and the Google Play Developer Distribution Agreement and User Data policies, this Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application.
III. PERSONAL INFORMATION COLLECTED
CVMC collects and processes only such personal information as may be necessary, relevant, and proportionate to the purposes for which the App is intended, to wit:
A. Personal and Identification Information
This may include:
Full name;
Date of birth;
Sex or gender;
Civil status;
Mobile or telephone number;
Email address; and
Other identifying information necessary for patient identification and appointment processing.
Such information may be processed for purposes including account registration, patient identification, appointment scheduling, appointment verification, communication, and related hospital services.
B. Medical and Appointment Information
The App may collect and process information relating to:
Preferred clinical specialty;
Preferred physician or healthcare provider;
Reason for consultation;
Referral information;
Appointment details and history; and
Other health-related information necessary for appointment coordination and healthcare services.
C. PhilHealth and Insurance Information
Where necessary for appointment or service coordination, the App may collect:
PhilHealth Identification Number (PIN); and/or
Relevant private health maintenance organization (HMO) or insurance information.
The collection of such information shall be limited to what is reasonably necessary for legitimate hospital, administrative, billing, eligibility, or service-coordination purposes.
D. Device and Technical Information
The App may collect limited technical information, which may include:
Device type;
Operating system and version;
Application version;
Unique technical identifiers, where applicable;
Diagnostic information; and
Crash or error logs.
Such information shall be processed primarily for application maintenance, troubleshooting, cybersecurity, system reliability, and performance improvement.
Where technically feasible, CVMC shall minimize the collection of directly identifiable information in connection with technical and diagnostic data.
IV. MOBILE DEVICE PERMISSIONS
To enable certain functionalities of the App, CVMC may request permission to access specific device features, as follows:
A. Notifications: Notification access may be used to provide:
Appointment confirmations;
Appointment reminders;
Rescheduling notices;
Cancellation notices;
Service-related announcements; and
Other notifications necessary for the proper functioning of the App.
B. Camera and Storage
Where supported by the App, access to the device camera or storage may be requested to enable Users to upload documents or images that may be necessary for appointment verification or healthcare coordination, such as:
Government-issued identification;
Referral letters;
Laboratory requests; or
Other supporting documents.
Such access shall be limited to the purposes for which the permission is granted.
Users may generally manage or revoke applicable device permissions through their device settings. Revocation of a permission may, however, affect the availability of certain App functionalities.
V. DISCLOSURE AND SHARING OF PERSONAL INFORMATION
CVMC shall not sell, rent, or trade personal information collected through the App.
Personal information may be disclosed or made accessible only to authorized persons, offices, units, or third-party service providers where such disclosure is necessary, lawful, and proportionate to the declared purpose of processing. These may include:
A. Authorized CVMC Personnel
Personal information may be accessed by authorized physicians, nurses, medical reception personnel, administrative personnel, IT personnel, and other authorized CVMC employees or personnel whose official functions require access to such information.
Access shall be limited according to the personnel's authorized roles and responsibilities.
B. Authorized Personal Information Processors
CVMC may engage qualified third-party service providers to perform specific functions on its behalf, such as:
Application hosting;
Information technology infrastructure;
Technical maintenance;
SMS or notification services;
System security; and
Other services necessary for the operation of the App.
Such third parties shall be required to implement appropriate organizational, physical, and technical safeguards and to process personal information only for authorized purposes and in accordance with applicable data protection requirements.
Where applicable, CVMC shall maintain appropriate contractual or other legally enforceable arrangements governing such processing.
C. Government Agencies and Public Authorities
Personal information may be disclosed where required or authorized by law, regulation, lawful government mandate, subpoena, court order, or DPA policy or other valid legal process.
VI. DATA SECURITY AND CONFIDENTIALITY
CVMC shall implement reasonable and appropriate organizational, physical, and technical measures designed to protect personal information against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, access, or other unlawful processing.
The specific security controls implemented by CVMC may be modified from time to time in response to technological developments, risk assessments, operational requirements, and applicable regulatory standards.
VII. DATA RETENTION AND DISPOSAL
CVMC shall retain personal information only for as long as necessary to fulfill the declared purposes for which it was collected, to comply with applicable laws and regulations, to satisfy legitimate hospital and governmental requirements, or to establish, exercise, or defend legal claims.
Appointment and medical-related records may be retained for periods prescribed by applicable healthcare, government, records-management, archival, or other relevant laws, rules, and regulations.
Users who have created an account through the App may request the deletion of their App account and associated personal information through the account-deletion mechanism made available in the App or through the designated data privacy channel of CVMC.
Where applicable, Users may access: Account Settings → Delete Account
A User may also submit a written request to the CVMC Data Protection Officer through:
Email: dpo@cvmchealthcare.com
Upon receipt and validation of a valid account deletion request, CVMC shall deactivate the User’s account and delete within thirty (30) days, or within such period as may be required under applicable laws, rules, regulations, and CVMC’s established data retention and disposal policies unless statutory legal or medical record retention laws require to preserve it.
VIII. Rights of Data Subject
Subject to the limitations and conditions provided under applicable law, every Data Subject has rights under the DPA, including the right:
To be informed of the processing of personal information;
To access personal information concerning him or her;
To object to certain forms of processing;
To dispute and request correction or rectification of inaccurate or incomplete personal information;
To request erasure or blocking of personal information when legally warranted;
To data portability, where applicable;
To file a complaint before the National Privacy Commission; and
To claim damages in accordance with law when the requirements for such claim are present
Requests relating to the exercise of data subject rights may be submitted through the CVMC Data Protection Officer using the contact details provided in this Privacy Policy.
IX. CHANGES TO THIS PRIVACY POLICY
CVMC reserves the right to amend, revise, or update this Privacy Policy from time to time to reflect changes in applicable laws, regulations, NPC issuances, DOH policies, hospital operations, technological developments, or data processing practices.
Material changes shall be communicated through appropriate channels, including, where applicable, publication through the App or other official CVMC communication platforms.
The "Last Updated" date indicated at the beginning of this Privacy Policy shall be revised whenever the Policy is materially updated.
X. Contact Us
For concerns regarding the processing of personal information, the exercise of data subject rights, privacy complaints, or other data protection matters, Users may contact:
DATA PROTECTION OFFICER
Cagayan Valley Medical Center
Regional Government Center
Barangay Carig Sur
Tuguegarao City, Cagayan, Philippines
Email: dpo@cvmchealthcare.com
Hospital Trunkline: (078) 304-8894