HOSPITAL PRIVACY POLICY
1. Privacy Statement
The Region II Trauma and Medical Center (R2TMC) collects, processes, and stores personal and sensitive personal data about you when you avail of our services, consult us for medical-related concerns, apply for a job, or enter into any contract with us, provided that you have expressly given your consent. This privacy policy aims to better serve persons who avail of our services and inform them of the process by which their personal data and sensitive personal data and collected, used, and secured by the hospital. We encourage you to carefully read and understand our privacy policy in order to get a clear grasp of how R2TMC handles your personal data in accordance with the mandate of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (hereinafter referred to as the “Data Privacy Act”). This privacy policy is also provided at our website.
2. Collection of Personal Data
R2TMC collects information you provide directly to us when you avail of our services, consult us for medical-related concerns, apply for a job, or enter into a contract with us. The following personal information and sensitive personal information may be collected depending on the nature of transaction you shall enter into with us: name, home address, business address, email address, telephone number work/home, age, date of birth, marital status, nationality, ethnic origin, religion, education, photo, biometrics, political association, philosophical beliefs orientation, health, sexual life/preference/orientation, offense committed/alleged to have been committed, unique identifiers issued by government agencies to individuals or other details to better help you with your needs.
3. Use and Processing of Personal Data
R2TMC uses and processes the data collected about you primarily to help you with your treatment and medication/hospitalization in case you are a patient, employment and other human resource action if you are an applicant or an employee, or any formal transaction with the hospital if you are a supplier, contractor or bidder. It also uses data for research and policy-formulation purposes, the process for which comply with the Data Privacy Act:
(i) The research study is conducted by institutional and/or outside researchers who have been properly screened by the hospital and had undergone ethical review process and approval and with whom it has had a Privacy Notice and Data-Sharing Agreement with or government agencies duly authorized under the law to access information for policy-formulation processes and with which the hospital has had a data-sharing agreement with;
(ii) The purpose is for research and/or policy-formulation only;
(iii) The data to be gathered shall pertain to either personal information and sensitive personal information; and
(iv) Such information shall only be held by the researcher/government entity in strict confidentiality, de-identifying, or anonymized me/my patient in such a way that my/his/her identity will not be revealed upon presentation to other people. At all times, be assured that your personal data shall not be used or processed for any purpose that is contrary to law, morals, or public policy.
4. Sharing of Personal Data
R2TMC may share personal and sensitive data between and among the agencies or third parties/entities only in the following instances:
a. Related government agencies, affiliates, and other partners for legitimate public service purposes or as part of your transaction or involvement in any activity with them, such as but not limited to PHIC with respect to patients health records in support of claims, GSIS, PAG-IBIG, SSS if applicable, BIR, OMBUDSMAN, and other government agency pursuant to law and issuances, for employees and contract of service/job order employees as applicable;
b. As a response to lawful requests and in compliance with legal requirements and processes; and
c. Research and policy-formulation purposes in accordance with applicable laws, standard procedure, and best practice
5. Storage and Protection of Personal Data
R2TMC has established a variety of security measures, policies and procedures to protect personal and sensitive data which it has collected, used, and processed. These include securing any document containing personal and sensitive information, requiring the execution of privacy agreements with its employees, interns, third parties, and others who may be given access to your data. Despite the presence of risks of unauthorized access and disclosure of your personal information, R2TMC commits to update and improve its safeguards in order to safeguard your personal data in compliance with the Data Privacy Act.
6. Your Rights under the Data Privacy Act of 2012
As a data subject, you are guaranteed the following rights under the Data Privacy Act:
a. You have the right to be informed of the collection and processing of your personal data, the purpose for which they will be processed, among others; hence, the need to read this privacy policy before giving your consent to the collection and processing of your personal data. Should you have questions or clarifications, please do not hesitate to ask us; you may also contact our Data Protection Officer;
b. You have the right to object to the processing of your personal data. This shall, however, hinder the employees or personnel from accurately diagnosing your disease and giving you the proper medication needed; hence, R2TMC may not agree on treating you should you object to the collection, use, processing, and storing of your personal data.
c. You have the right to have reasonable access to your personal data or obtain a copy of your data in an electronic or structured format if the same is processed by electronic means and in a structured and commonly used format by submitting your request to our Data Protection Officer;
d. You have the right to correct any inaccuracy or error in your personal data, unless the request is vexatious or otherwise unreasonable. You may do this by submitting a request to our Data Protection Officer;
e. You have the right to suspend, withdraw or order the blocking, removal or destruction of your personal data upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, you may notify our Data Protection Officer should you wish to exercise this right;
f. You have the right to be indemnified if you incur damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
7. Changes to Privacy Policy
R2TMC may change this Privacy Policy from time to time to comply with the Data Privacy Act and/or orders of the National Privacy Commission. In case there are significant changes in the collection, use, and protection of personal data, we will provide you notice through updating this privacy policy and uploading a copy of the same in our website.
8. Contacting Us
If there are any questions regarding this privacy policy, you may contact our Medical Center Chief or the Data Protection Officer with the following contact details:
- Title/Designation: Medical Center Chief II
- Postal Address: Medical Center Chief Office, 2/F Old Admin Building, Region II Trauma and Medical Center, Magsaysay, Bayombong, Nueva Vizcaya
- Telephone Number: 078-805-3561 to 64
Email Address: r2tmc@doh.gov.ph - Title/Designation: Data Protection Officer
- Postal Address: 4/F New OPD Building, Region II Trauma and Medical
Center, Magsaysay, Bayombong, Nueva Vizcaya - Telephone Number: 078-805-3561 to 64
Email Address: legal@riitmc.doh.gov.ph
9. Consent
Your consent shall be secured prior to the collection and processing of your personal data, or as soon as practicable and reasonable in order to ensure continuation of our services. Before consenting, you will be provided with an opportunity to read and fully understand this Privacy Policy. If you are a minor or is legally and/or physically incapable of agreeing, your consent shall be secured from your parents or legal guardians. If you consent to the collection and processing of your personal data in accordance with this Privacy Policy, such consent shall be valid for a period of 10 years from the date such consent was given or such longer period as may be required by laws or when necessary as provided by the Data Privacy Act, or unless you have expressly withdrawn such consent. By signing the accompanying Consent for Hospitalization and Consent Form for patients, the contracts, bid forms, canvass, purchase request and/or order, for suppliers and contractors, submission of your applications, personal data sheets, SALN and other documents as required for employment for employees, you are expressly giving your consent to the collection, processing and storage of your personal data as provided herein.