Privacy Policy

Buela Physical Therapy uses this portal to coordinate care and HMO administration. This draft describes the portal's current processing; the clinic must confirm its actual practices before publication.

What we collect and why

We collect account and contact details to identify you and communicate; appointments to arrange visits; medical records, referrals and uploaded files for care; and HMO details for eligibility and claim processing. Activity logs support security and accountability. We collect only information needed for these purposes. Do not put unrelated sensitive information in messages or optional notes.

Who can access your information

Patients access their own records. Staff and Admin access their assigned branch's permitted work. Consultants access assigned consultations; PT doctors review their branch's referrals and assigned sessions. Accounting accesses staff-forwarded HMO transactions across branches. Super Admin manages the system across branches. Access is role- and record-restricted, not permission to browse without a work purpose.

Service providers and sharing

When live delivery is configured, Brevo processes email delivery and iProgSMS processes mobile verification messages. The clinic must confirm provider contracts, hosting locations and safeguards, including any overseas processing. Development log delivery is for private testing only. Relevant HMO information may be shared with the selected provider through clinic processes; this portal has no live HMO API. We do not sell your information.

Retention and account deletion

Information is kept only as long as needed for care, claims, legal duties and legitimate disputes. The clinic must approve specific retention periods and secure disposal procedures; this draft does not invent a fixed period. You can request account deletion in Profile. Following review, completion disables login and removes account contact identifiers. Medical/HMO records, referrals, files, relevant audit records and backups may still contain identifying information where retention is necessary. This is not immediate or complete erasure; contact the privacy contact about the retained records and applicable reasons.

Security and essential cookies

The portal uses access controls, password hashing, request validation and private authorized file routes. Production requires HTTPS, protected backups and restricted logs. No system can promise absolute security. The pages use essential session and CSRF cookies only, with no advertising or analytics cookies. Blocking essential cookies prevents sign-in and form submission.

Your choices and rights

Subject to applicable conditions, you may request access, correction, erasure or blocking, data portability, or object to processing and withdraw consent. Profile provides a limited account/status download; contact us for other records or rights requests. We may verify identity and explain lawful retention or other limits. You may complain to the National Privacy Commission. Exercising rights does not remove records that must lawfully be retained.

Contact and review

Data privacy contact: Not yet designated. Ask your branch for the clinic administrator.
Buela Physical Therapy
Address available through your branch.
Use the branch contact numbers below.
Email not yet published.

Sources for clinic review: Republic Act No. 10173, implementing rules and NPC privacy manual guidance. These links open only when selected.