Privacy Policy

1 Overview & Legal Basis

PetCare Clinic ("we," "us," or "our") is committed to protecting the privacy and personal data of our users in accordance with applicable Philippine law. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use the PetCare Clinic platform (the "Platform").

By registering an account and using the Platform, you consent to the collection, use, and disclosure of your personal data as described in this Privacy Policy. You may withdraw your consent at any time, subject to legal or contractual restrictions, by contacting our Data Protection Officer (DPO) using the contact details provided in Section 13.

This Policy applies to all users of the Platform, including pet owners, veterinarians, groomers, and administrators.

2 Information We Collect

We collect personal information that you voluntarily provide to us when you create an account, book appointments, or interact with the Platform, as well as certain data collected automatically during your use of the Platform.

We only collect information that is adequate, relevant, and not excessive in relation to the purposes for which it is being processed, in accordance with Section 11(c) of RA 10173.

We do not knowingly collect sensitive personal information (as defined under RA 10173, such as health data, religious beliefs, or financial information) beyond what is strictly necessary for providing veterinary services. Veterinary medical records constituting health data are handled with heightened protection measures.

3 Pet Information Collected

As part of the Platform's core service, we collect and store information about your registered pets. This may include:

• Basic pet details: Name, species (e.g., dog, cat), breed, date of birth or estimated age, sex, color, and distinguishing markings
• Health information: Known medical conditions, allergies, current medications, vaccination history, and any special dietary requirements
• Veterinary records: Diagnoses, treatment notes, prescriptions, and follow-up instructions entered by licensed veterinarians on the Platform
• Photos: Images of your pet uploaded for profile identification purposes
• Microchip or registration numbers: If voluntarily provided

Pet health information is treated with the same level of care as personal health data. It is accessible only to the registered pet owner, the attending veterinarian, and authorized Platform administrators for support purposes.

You are responsible for the accuracy of all pet information you submit. Inaccurate health information may negatively affect the care your pet receives from veterinary professionals.

4 Appointment & Veterinary-Related Information

When you book or manage appointments through the Platform, we collect and process the following appointment-related data:

• Selected clinic, veterinarian, or groomer
• Preferred appointment date and time
• Type of service requested (e.g., consultation, vaccination, grooming)
• Appointment status (pending, confirmed, completed, cancelled)
• Pre-appointment notes or instructions you provide
• Post-appointment veterinary notes, diagnoses, and treatment plans entered by the attending professional
• Ratings and reviews you submit after appointments

Appointment records are retained to maintain a complete history of your pet's care, facilitate future visits, and support administrative and analytical functions. This data is shared with the relevant clinic and its staff as necessary to perform the booked service.

Important: Medical records and clinical notes are created and maintained by licensed veterinary professionals. PetCare Clinic facilitates storage and access to these records on the Platform but does not independently verify their clinical accuracy. For any concerns about the accuracy of a medical record, contact the issuing veterinarian directly.

5 How We Use Your Information

We process your personal data only for the specific purposes for which it was collected. These purposes include:

• Account management: Creating, maintaining, securing, and verifying your account
• Service delivery: Facilitating appointment bookings, managing pet profiles, and enabling communication between pet owners and clinic professionals
• Identity verification: Reviewing submitted government IDs to ensure the integrity and security of the Platform
• Notifications and communications: Sending appointment confirmations, reminders, status updates, and other service-related messages via email and in-Platform notifications
• Customer support: Responding to inquiries, complaints, or reports submitted through the Platform
• Platform improvement: Analyzing usage patterns and feedback to improve features, usability, and performance
• Safety and fraud prevention: Detecting, investigating, and preventing fraudulent activity, unauthorized access, or violations of these Terms
• Legal compliance: Fulfilling our obligations under applicable Philippine laws and regulations, including RA 10173
• Aggregated analytics: Generating anonymized, non-identifiable statistical reports about Platform usage

We will not use your personal data for any purpose incompatible with the purposes listed above without your prior written consent, except where required or permitted by law.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6 Storage & Security of Your Information

PetCare Clinic takes reasonable and appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include:

• Password hashing: User passwords are never stored in plain text; they are hashed using industry-standard one-way hashing algorithms
• HTTPS encryption: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Access controls: Personal data and government ID photos are accessible only to authorized administrators and the relevant clinic staff; role-based access controls restrict data visibility
• Session security: Sessions are protected using HTTP-only, SameSite cookies and strict session management policies
• Secure file storage: Uploaded files (ID photos, pet photos, clinic images) are stored in access-controlled server directories not directly accessible via URL without authorization
• CSRF protection: All forms are protected against Cross-Site Request Forgery using token-based validation
• Regular monitoring: We monitor for unauthorized access attempts and apply security patches promptly

Your personal data is stored on servers located in [Server Location — please update]. We endeavor to ensure that any data processor we engage provides equivalent data protection standards.

Despite our best efforts, no method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately using the information in Section 13.

In the event of a personal data breach that is likely to prejudice your rights and freedoms, PetCare Clinic will notify the National Privacy Commission (NPC) and affected data subjects within 72 hours of discovery, in compliance with NPC Circular No. 16-03.

7 When We Share Your Information

We do not share your personal information with third parties except in the following circumstances:

• Participating clinics and professionals: When you book an appointment, relevant booking details and pet information are shared with the selected clinic and its authorized staff for the sole purpose of providing the requested service.
• Service providers: We may engage trusted third-party service providers (e.g., email delivery services, cloud hosting providers) who process data on our behalf. These providers are bound by data processing agreements and are not permitted to use your data for any purpose other than performing services for PetCare Clinic.
• Legal requirements: We may disclose your information when required to do so by applicable law, court order, or government regulation, including to comply with lawful requests from law enforcement agencies.
• Protection of rights: We may disclose data if we reasonably believe disclosure is necessary to protect the rights, property, or safety of PetCare Clinic, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, provided that it continues to be subject to equivalent data protection obligations.
• With your consent: We may share your data with third parties for other purposes if we obtain your explicit, informed prior consent.

Any third party with whom we share personal data is required to treat it with the same level of protection as described in this Privacy Policy and in accordance with RA 10173.

We do not share personal data with advertisers, data brokers, or marketing companies.

8 Your Privacy Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights as a data subject. You may exercise these rights by contacting our Data Protection Officer (DPO) at the details provided in Section 13.

To exercise any of these rights, please submit a written request to our DPO using the contact information in Section 13. We will respond within a reasonable period as required by the DPA and its IRR, generally within 15 working days of receiving a valid request.

If you believe your data privacy rights have been violated, you also have the right to file a complaint directly with the National Privacy Commission (NPC):

9 Cookies & Web Technologies

The Platform uses cookies and similar web technologies to enhance your browsing experience and maintain session state. A cookie is a small text file stored on your device by your web browser.

We use the following types of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management (keeping you logged in) and CSRF security tokens. These cannot be disabled without affecting Platform functionality.
• Functional cookies: Used to remember your preferences, such as dark mode settings, so you do not need to reconfigure them on each visit.
• Analytics cookies: If enabled, used to collect anonymous, aggregated data about how users interact with the Platform to help us improve it. We do not use third-party advertising or tracking cookies.

You can manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Refer to your browser's help documentation for instructions on managing cookies.

We do not use cookies to serve targeted advertisements or to track your activity on third-party websites.

The Platform may use browser localStorage and sessionStorage for preferences such as theme settings. This data is stored locally on your device and is not transmitted to our servers.

10 Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, and as required by applicable law and regulatory obligations.

• Active accounts: Personal data and pet records are retained for the duration of your account's existence on the Platform.
• Appointment records: Appointment history and veterinary records are retained for a minimum of 5 years after the date of service to comply with professional veterinary record-keeping standards.
• Government ID documents: Uploaded ID photos are retained only as long as necessary for account verification purposes. Once verification is complete, we limit access to ID photos to authorized administrators only.
• Deleted accounts: Upon account deletion, personal identification data will be anonymized or deleted within 30 days, except where retention is required by law or for dispute resolution purposes.
• Inactive accounts: Accounts inactive for more than 3 years may be subject to data review and deletion following notification to the account email address.
• Server logs: Technical access logs are retained for up to 90 days for security monitoring, then permanently deleted.
• Marketing consents: Records of consent are retained for the duration of your account to demonstrate compliance with RA 10173.

When personal data is no longer required, we will securely delete, anonymize, or dispose of it in a manner that protects your privacy, in accordance with Section 11(e) of RA 10173.

11 Children's Privacy

The PetCare Clinic Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. Registration on the Platform requires users to be at least 18 years old or to access the Platform under parental or guardian supervision and consent.

In accordance with Republic Act No. 9775 (Anti-Child Pornography Act of 2009) and the Child Safety Online provisions of RA 10175 (Cybercrime Prevention Act of 2012), we take the protection of minors online seriously.

If you are a parent or legal guardian and believe that your child has provided personal data to PetCare Clinic without your knowledge or consent, please contact our DPO immediately using the details provided in Section 13. We will take prompt action to delete any such information from our records.

If we discover that we have inadvertently collected personal data from a minor, we will delete it from our systems as quickly as reasonably possible.

12 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. When we make changes, we will:

• Update the "Effective Date" at the bottom of this page
• Notify registered users via email and/or in-Platform notification for material changes
• Where required by RA 10173, obtain your renewed consent for any new or substantially different processing purposes

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after changes are posted constitutes your acknowledgment of the updated Policy.

If we intend to use your personal data for a purpose not originally disclosed at the time of collection, we will notify you and, where required, seek your separate consent before doing so.

13 Contact Information & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or the exercise of your data subject rights under RA 10173, please contact our designated Data Protection Officer (DPO):

You may also submit a complaint to the National Privacy Commission (NPC) if you believe your data privacy rights under RA 10173 have not been upheld: