Privacy policy

Ask Dra. Andi is an online medical practice operated by Dra. Andi, MD, a physician licensed by the Professional Regulation Commission of the Philippines. This policy explains what information is collected when you book and attend a consultation, why it is collected, and what rights you have over it.

It is written to comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

Who is responsible for your information

Dra. Andi is the personal information controller for the data described here, and decides how and why it is processed. You can reach the practice at hello@askdraandi.com or +63 945 650 9889.

What we collect

Personal information

• Your name, email address, and mobile number
• Your date of birth, sex, and age
• Booking details — the service you chose, your appointment time, and your reason for the visit
• Payment information — the reference number and proof of payment you submit for a GCash or bank transfer

The practice does not receive or store your card numbers, bank credentials, or GCash PIN.

Sensitive personal information

Under RA 10173, information about your health is sensitive personal information and carries stronger protection. This includes your symptoms and medical history, medications and allergies, laboratory results you share, and the assessment, prescriptions, and certificates issued to you.

Technical information

The website records only what is needed to serve pages securely and keep the service running. It does not use advertising cookies, tracking pixels, or third-party analytics. Cookies are limited to those strictly necessary for the site to function.

Why we process it, and on what basis

Your information is used to:

• schedule, confirm, and conduct your consultation;
• reach a clinical assessment and provide treatment, prescriptions, laboratory requests, and medical certificates;
• keep an accurate medical record for continuity of care;
• process and verify payment; and
• meet legal, regulatory, and professional obligations.

The lawful bases are your consent, the performance of our agreement to provide you care, compliance with legal obligations, and — for health information specifically — the provision of medical treatment by a licensed medical practitioner, as permitted under Section 13 of RA 10173.

When information is shared

Your medical information is confidential and protected by physician – patient privilege. It is never sold, rented, or used for marketing. It is shared only in these situations:

• With your consent — for example, when you ask for a referral to a specialist, or for records to be released to another provider or your employer.
• To fulfil your care — a prescription sent to the pharmacy you nominate, or a laboratory request addressed to the facility you choose.
• With service providers who operate parts of the service on the practice’s behalf, under confidentiality obligations and only to the extent needed. These currently cover appointment scheduling, transactional email, and website hosting.
• Where the law requires it — a lawful court order or subpoena, a mandatory notifiable-disease report, or a situation involving a serious and imminent threat to life or safety.

Some of these providers operate servers outside the Philippines. Where information is transferred abroad, the practice remains accountable for it and uses providers that offer a comparable level of protection, as required by RA 10173.

How long it is kept

Medical records are retained for at least 10 years after your most recent consultation, so that your care history stays available to you and to meet professional record-keeping obligations. Booking and payment records are kept for as long as tax and accounting rules require. Information no longer needed is securely deleted or anonymised.

How it is protected

The practice applies organisational, physical, and technical safeguards proportionate to the sensitivity of health data: encrypted connections (HTTPS) across the site, access restricted to Dra. Andi and any authorised staff bound by confidentiality, hashed passwords, and access limited to what each task requires. No system can be guaranteed perfectly secure, but should a breach occur that puts you at real risk of serious harm, you and the National Privacy Commission will be notified as RA 10173 requires.

Your rights

As a data subject under RA 10173 you have the right to:

• Be informed that your data is being collected and processed;
• Access a copy of the information held about you;
• Correct anything inaccurate or out of date;
• Object to processing, or withdraw consent — noting that this may make it impossible to continue providing care;
• Erasure or blocking of data that is unlawfully obtained, no longer necessary, or used beyond its stated purpose;
• Data portability — receive your records in a commonly used electronic format;
• Damages for harm caused by inaccurate, unlawful, or unauthorised use of your information; and
• Complain to the National Privacy Commission at privacy.gov.ph.

To exercise any of these, email hello@askdraandi.com. You may be asked to verify your identity before records are released, which protects you from someone else obtaining your health information. Requests are answered as promptly as reasonably possible.

Minors

Patients under 18 must book through a parent or legal guardian, who gives consent on their behalf and is responsible for the information provided.

Changes to this policy

This policy may be updated as the practice changes. The date at the top of this page shows when it was last revised, and material changes will be communicated to active patients.