The Hospital is committed to providing quality health and related services to you and this policy outlines our ongoing obligations to you in respect of how we manage your personal information. In order to ensure the safety and confidentiality of your personal data, the Hospital has developed a Privacy Policy that aims to ensure that all appropriate standards for personal information protection in compliance with Republic Act No. 10173 (or the Data Privacy Act of 2012 or “DPA”), its implementing rules and regulations and other applicable and related laws and regulations, including the issuances of the National Privacy Commission (collectively, the “Privacy Laws”) are put in place and implemented efficiently and effectively. This Privacy Notice seeks to notify and inform you of our policies regarding the collection, use and disclosure of personal information we receive from our patients, customers, and/or users of this site.

Under the DPA, your Personal Information includes any information, whether recorded in a material form or not, from which your identity is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly identify you as an individual. These may include, but is not limited to, information which may be used for identification purposes (e.g. names, addresses, e-mail addresses, phone and facsimile numbers), other personal circumstances, contact information, your educational and medical background.

Your Personal Information also includes sensitive Personal Information, which refers to the following:

• Your race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations.
• Your health, education, genetic or sexual life, any proceeding for an offense committed or allegedly have been committed by you, disposal or such proceedings or the sentence of the court in such proceedings.
• Personal identifiers issued by a government agency peculiar to you (as mentioned above); and
• Other information established by law to be kept classified.

As a health institution, the specific Personal Information that we will obtain from you will include (but not necessarily limited to) the following: your home/office address, contact details, e-mail address, race, ethnic origin, age (including birthdate), your health information (including medical information, biometrics [such as height and weight], biological information (such as blood type), medication, genetic [including family medical history] or sexual life), religion, Phil health number, Social Security System number, Government Service Insurance System number, insurance details.

Your Personal Information may be obtained in many ways including through interviews, from application forms, correspondences, by telephone and facsimile, e-mail or via our website [www.westmetro.com.ph], as well as from third parties. However, most of the Personal Information we have are those that you have given us yourself. You provide us your Personal Information when you:

• avail of, or apply for, our services by filling out application forms or other information forms through any of our available channels (e.g. online, upon admission, or through our medical personnel and representatives).
• provides personal information to your doctors who may refer you to our Hospital for your diagnosis and treatment, whether as an in-patient or out-patient.
• gets in touch with us to ask about something, file a complaint, or request for service.
• take part in our research and surveys.
• participates in various activities sponsored by us or any other organization acting on our behalf, such as symposia, conferences, focus group discussions and the like; and
• when you apply for a job with us.

We collect your Personal Information primarily to provide medical services. We also provide information to our clients, partners, and service providers for the same purpose.

We may also use your Personal Information secondarily, in circumstances where you would reasonably expect such use or disclosure of your Personal Information.

You may withdraw your consent (subject to the applicable Privacy Laws) to the processing of your Personal Information at any time by contacting us in writing. We provide below the general categories of the purposes for which we collect and process your Personal Information.

The following categories generally describe the ways by which the Hospital processes your Personal Information. While this is not intended to be a very specific and detailed listing of each process per category, all the ways by which we process your Personal Information fall under one of these categories:

• Your diagnosis and treatment: we use your Personal Information, particularly your medical information to provide medical care and services, including diagnosis and treatment. The Hospital will disclose your Personal Information to physicians and healthcare providers for these purposes. For example, we will share your Personal Information to physicians practicing in the Hospital or to healthcare providers providing outsourced services to the hospital.
• For benefits, payments and claims: We may process your Personal Information for purposes of billing and payment for medical and other related services rendered. The billing may be collected from you, your insurance company, Philippine Health Insurance Corporation, your company or any third party. For this purpose, we may have to disclose the nature and type of your treatment and other related information that will be required for settlement.
• For our business operations: Your Personal Information will be processed as part of our hospital operations. This includes our general business management operations, quality control and assessment, employee and/or staff evaluation, training of medical students and residents and financial performance reporting. Examples of these include the calling of your name either verbally or through a prompter in a queue, our internal evaluation of employee or medical staff performance, giving access to your medical information to medical students and residents as part of our training programs, contacting you personally for appointments or follow-ups, or preparation of statistical data pertaining to the operations of the hospital for quality assurance and financial reporting.
• Performance of a legal obligation: Under the law, the Hospital is required to share your Personal Information to government authorities in certain instances. For example, we may be required to provide documentary and/or testimonial evidence in court proceedings that may require the disclosure of your Personal Information. We may also be required to provide your Personal Information to government authorities in certain circumstances.
• Marketing and other legitimate commercial purposes. We may also use your Personal Information to contact you with newsletters, updates, information campaigns, marketing or promotional materials and other information that may be related to the services we provide, and also to further improve the quality of our services.

Other uses and disclosures of your Personal Information

Outside of the purposes stated above other uses and disclosures of your Personal Information will be made only with your express authorization, unless we are otherwise permitted or required by law as described below.

We may use and disclose your Personal Information in the following circumstances. However, except in case of an emergency or when otherwise permitted or required by law, we will inform you of our intended action prior to making such use or disclosure and will, at that time, offer you the opportunity to object. If you are not present or able to agree or object, we will use our judgment in determining whether the use or disclosure is in your best interest.

• Access to patient directory by your visitors.
• Other people involved in, or interested in your healthcare, such as your family members, loved ones or any other person you identify as being involved in your healthcare. In case you are not capable of agreeing or objecting to such disclosure, we will use our judgment in determining whether the use or disclosure is in your best interest.

On the other hand, we may also use or disclose your Personal Information without your consent or authorization when such use or disclosure is required by law. This includes the disclosure of your Personal Information pursuant to an order of a court or tribunal, or when such disclosure is required under existing laws and regulations.

The following will have access to your Personal Information for the purposes stated above:

• Healthcare professionals, including, without limitation, the members of the Hospital’s medical staff, nurses, caregivers and other healthcare providers, either pursuant to an employment contract or any other arrangement. They will have access to your Personal Information either because they are authorized to enter information to your medical records, review or update the same.
• All departments and units in the Hospital who will need your personal information in the performance of their functions. For example, certain treatments or procedures require that your Personal Information be shared across different departments of the Hospital.
• Any member of a volunteer group, religious or charitable/ non-profit organization who are allowed to provide assistance in the Hospital. This includes priests, pastors or heads of other religious organizations who provide religious rites to patients or the deceased.
• All of our employees, staff or personnel who may need access to your information in the performance of their duties. For example, our employees will access your Personal Information in order to prepare your billing statement, or your medical information will be needed for your dietary needs during your confinement.
• All entities operating within the premises of the Hospital, including, but not limited to affiliated students, on the job trainees, and resident physicians. The Hospital may share your personal information with these entities for the purposes stated above.

You are afforded certain rights under the Privacy Laws, particularly the DPA. We would like to ensure that we have your consent to continue to collect, use and disclose your personal information for the purposes identified in this Notice. You have the right to be informed of these specific rights, to object to the processing of your Personal Information, to access, update and correct the same and to withdraw your consent and/or edit your consent preferences at any time.

If you wish to have access to your Personal Information in our records, or you think that it is incomplete, not up-to-date or otherwise inaccurate, or have any queries or complaints about our Privacy Policy, you may get in touch with our Data Protection Officer through the contact details provided below.

Your rights to your personal information are provided in Section 34 of the DPA which you may access here (https://privacy.gov.ph/data-privacy-act/).

Pursuant to the DPA we undertake to protect your Personal Information. The Hospital creates and maintains a record of your Personal Information in its offices and this notice applies to your Personal Information that we collect. Under the DPA, the Hospital is required to protect your Personal Information, and to process the same only in accordance with the following data privacy principles:

• Transparency: We are obligated to inform you of the nature, purpose and extent of our processing of your Personal Information, including the risks and safeguards involved, the identity of the persons involved in the processing of your personal data, your rights as data subject, and how these rights can be exercised.
• Legitimate purpose: We will only process your Personal Information for a legitimate purpose, compatible with our declared and specified purpose, and not contrary to law, morals and public policy.
• Proportionality: We will process your Personal Information as adequate, relevant, suitable, necessary and not excessive in relation to the declared and specific purpose.

Your Personal Information is stored in a manner that reasonably protects it from misuse and loss and from unauthorized access, modification or disclosure. We strictly enforce our Privacy Policy and put in place technical, organizational and physical security measures that are designed to protect your personal information from unauthorized access, use, alteration and disclosure.

When your Personal Information is no longer needed for the purpose for which it was obtained, we will take reasonable steps to destroy or permanently de-identify or anonymize the same. However, most of the personal information is or will be stored in files which will be kept by us for the minimum period provided under existing laws and regulations.

You may access your Personal Information and to update and/or correct it, subject to certain exceptions. If you wish to access the same, please contact us in writing and we will respond within a reasonable time. Please take note that our ability to respond to your request may also depend on the circumstances regarding our collection of your Personal Information.

We will not charge any fee for your access request but may charge a reasonable administrative fee for providing a copy of your Personal Information.

We may be restricted by law or regulations from giving you access to your personal information.

From time to time, we may change or update our Privacy Statement, Privacy Policy and practices to comply with government and regulatory requirements, to adapt to new technologies and protocols, to align with industry practices or for other legitimate purposes.

You will be provided notice if these changes are significant and, if we are required by law, we will take steps to obtain your updated consent.

If you have any questions about this Notice, you may contact the Hospital’s Data Protection Officer as per below:

Data Protection Officer

West Metro Medical Center

Veterans Avenue Extension, Zamboanga City

62) 991 2506 or 07

dpo@westmetro.com.ph

You may also contact the National Privacy Commission with the following contact details:

National Privacy Commission

3rd Floor, Core G, GSIS Headquarters Bldg., Financial Center

Pasay City, Metro Manila 1308

(02) 920 – 0101 loc. 7021

www.privacy.gov.ph