Privacy Notice

1. About This Notice

Dr. Aldin Rosas Clinic (the Clinic, we, us, or our) uses Dentosh to provide appointment, patient-record, consultation, prescription, billing, payment-recording, and related dental-clinic services. For patient information entered for this clinic, the Clinic is the personal information controller. This notice explains how we process personal data under Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.

This notice applies to Dentosh public pages, patient and clinic portals, online appointment forms, consultations, clinic transactions, and records maintained through the platform.

2. Personal Data We Process

Depending on the service used, we may process:

• Identity and profile data, including name, birth date, age, sex, photograph, signature, and patient or account identifiers;
• Contact and relationship data, including address, email, mobile number, and emergency-contact details;
• Health and dental data, including medical and dental history, allergies, medications, chief complaints, clinical notes, odontograms, images, diagnoses, treatment plans, prescriptions, and treatment outcomes;
• Appointment data, including requested service, branch, dentist, date, time, status, reminders, cancellations, and attendance;
• Billing and transaction data, including charges, receipts, balances, discounts, payment status, and transaction references. We do not intentionally request a GCash or Maya PIN or one-time password;
• Account and third-party sign-in data. Optional Google Sign-In may provide a Google account identifier, name, email address, profile image, and authentication token;
• Device and security data, including IP address, browser or device details, login and verification activity, timestamps, audit trails, and security-event logs; and
• Communications and documents sent to the Clinic, including attachments and privacy-rights requests.

Health, dental, government-issued, and certain financial information may be sensitive personal information and receives additional protection.

3. How We Collect Data

We collect data directly from you or an authorized representative, from Clinic dentists and staff during care, from records you provide, and from services you choose to connect, such as Google Sign-In or a payment provider. We also generate appointment, audit, prescription-verification, and transaction records as Dentosh is used.

4. Purposes and Lawful Bases

We process personal data when reasonably necessary to:

• Receive, review, confirm, reschedule, and manage appointment requests;
• Identify patients and provide safe, coordinated dental assessment and treatment;
• Maintain dental and medical records, prescriptions, treatment plans, and professional documentation;
• Send confirmations, reminders, care instructions, and service communications;
• Prepare bills and receipts, record payments, reconcile transactions, and meet accounting obligations;
• Verify appointment and prescription authenticity using reference numbers or QR codes;
• Operate, troubleshoot, secure, back up, audit, and improve the platform;
• Respond to lawful requests, prevent fraud, protect vital interests, and comply with legal or regulatory duties; and
• Create statistical reports using aggregated or de-identified information where reasonably possible.

The lawful basis may be consent, steps necessary to provide a requested service or perform an agreement, compliance with law and professional obligations, protection of life and health, or a legitimate interest that does not override data-subject rights. When consent is legally required for sensitive information or an optional use, it will be requested separately. This notice is not itself a consent form.

5. AI-Assisted Features

Dentosh may organize information or provide an AI-assisted pre-consultation guide. It is not a diagnosis and does not replace a dentist. Clinical decisions are made by licensed dental professionals. The Clinic does not intend to make treatment decisions that significantly affect a patient solely through automated processing.

6. Sharing and Disclosure

Access is limited according to role and need. Relevant information may be shared with:

• Treating dentists and authorized Clinic personnel;
• Laboratories, specialists, pharmacies, hospitals, insurers, or other care providers when authorized, requested, necessary for care, or required by law;
• Providers supporting hosting, maintenance, backups, email or SMS delivery, identity sign-in, analytics, and payment processing under appropriate privacy and security obligations;
• Google, GCash, Maya, or another provider when its service is selected, subject also to that provider's own terms and privacy notice;
• Government, regulatory, judicial, or law-enforcement authorities when disclosure is required or permitted by law; and
• The National Bureau of Investigation for dental records when required by Presidential Decree No. 1575.

Protect QR codes and reference numbers. A person who obtains a valid appointment or prescription verification link may see the verification details shown on that page. Share these only with the Clinic or an intended verifier, such as a pharmacy.

7. Storage and Security

We use reasonable organizational, physical, and technical safeguards appropriate to health information. These may include role-based access, authentication, audit logs, backups, access reviews, staff confidentiality duties, and incident-response procedures. No internet-based system can guarantee absolute security. Notify the Clinic promptly if an account, QR code, or record may have been accessed improperly.

Some technology providers may process or store data outside the Philippines. Cross-border processing requires an appropriate legal basis and reasonable contractual and security safeguards.

8. Retention and Disposal

• Dental records are retained for professional and legal requirements. Under Presidential Decree No. 1575, dental practitioners must keep accurate and complete dentition and treatment records and, after ten years from the last entry, turn them over to the National Bureau of Investigation, while copies may be retained.
• Appointment inquiries that do not become patient records are generally retained for up to two years after the last action unless a dispute, security concern, or legal duty requires longer retention.
• Billing, tax, prescription, consent, and transaction records are retained for periods required by applicable law and legitimate professional needs.
• Account, audit, and security records are retained only as long as reasonably necessary for access control, investigation, continuity, and legal claims.

When retention is no longer justified, records are securely deleted, destroyed, anonymized, or transferred to the proper authority as required. Protected backups are removed according to their rotation schedule.

9. Data-Subject Rights

Subject to legal conditions and exceptions, you may exercise the rights to be informed, object, access, correct, erase or block data, obtain data portability, withdraw consent for consent-based processing, be indemnified for damages, and file a complaint with the National Privacy Commission. Withdrawing consent does not invalidate prior lawful processing and may not require deletion of records the Clinic must retain by law. Reasonable proof of identity and authority may be required before a request is acted upon.

10. Children and Representatives

A parent, legal guardian, or properly authorized representative should provide and manage information for a minor or person unable to act independently, subject to applicable law and the patient's rights. Do not submit another person's health information without authority.

11. Cookies and Similar Technology

Dentosh may use essential session cookies and similar technology for login, security, preferences, and reliable operation. Optional third-party features may set their own cookies. Disabling essential cookies may prevent account or appointment functions from working correctly.

12. Contact and Complaints

Address privacy requests to Dr. Maria Santos, Dr. Aldin Rosas Clinic at 123 Rizal Street, Iloilo City, Iloilo, 5000. Email: admin@brightsmile.com. Telephone: 09171234567. State your name, request, and a safe way to contact you. You may also lodge a complaint directly with the National Privacy Commission.

13. Changes to This Notice

The Clinic may revise this notice when services, providers, or legal obligations change. The updated notice will show a new effective date. Additional notice will be provided when a material change affects a consent-based use.