Privacy Notices

In carrying out its mandate under Republic Act (RA) No. 7875, as amended by RAs 9241 and 10606, which relates to the administration of the National Health Insurance Program (NHIP), the Philippine Health Insurance Corporation (PhilHealth or We) collects and processes personal data, including those sourced from its official website.

As a responsible data custodian, PhilHealth commits to keep personal data secure from unlawful or unauthorized processing, in line with RA 10173, also known as the Data Privacy Act of 2012 (DPA), and the fundamental right to privacy of every individual.

This privacy notice defines how we manage information we collect or generate through our official website and linked online services. Since this website also contains links to other websites, visitors are advised to read the privacy notices or privacy policies of those sites, which are separate and distinct from ours.

Information we collect

Collection is primarily carried out through linked web applications found in My PhilHealth Portal under Online Services. These applications may record personal data including, but not limited to:

• PhilHealth Identification Number
• Last name
• First name
• Middle name
• Mobile number
• Sex
• Date of birth
• Civil status
• Email address

We also use cookies to help maintain and improve the website and enhance user experience. When you visit our website, the following information may also be recorded through Google Analytics:

• Browser type and version
• Browser plug-in types and versions
• Date and time of connection
• Length of visits to certain pages
• IP address
• Page interaction information, such as scrolling, clicks, and mouse-overs

Purpose of collection

Personal data collected through linked web applications are used for any or all of the following purposes:

• To facilitate electronic registration
• To verify the identity of a member and/or dependent
• To administer and update PhilHealth account records
• To provide appropriate services
• To guard against potential information security breaches
• To comply with legal and regulatory requirements
• To respond to queries

Data gathered and processed by Google Analytics are used to generate reports on the following:

• Most viewed pages per day and per month
• Number of regular users and new users
• Landing pages
• Social networking site with the most referrals
• Location of most users
• Most common devices and browsers used to access the website

Security measures

PhilHealth has evolving controls and security policies in place to maintain the confidentiality, integrity, and availability of the personal data it collects. Information collected by domains maintained by PhilHealth is stored in data centers accessible only to authorized personnel, including third-party service providers.

Sharing of information

Personal data collected through linked web applications are not disclosed to external parties unless required or permitted by law.

Retention of information

Except when otherwise required or permitted by law, collected data are kept only as long as necessary to achieve the purposes declared in this notice. Afterward, they are deleted or disposed of in a safe and secure manner.

Rights of data subjects

Individuals whose personal data we collect are accorded rights by the DPA as data subjects. They may invoke such rights at any time, in accordance with the provisions of the law. If there are inaccuracies in their records that need to be corrected or updated, members must notify PhilHealth immediately through any Local Health Insurance Office or Branch.

Changes to this notice

This privacy notice was issued on January 16, 2019 and will remain effective unless revised. Revisions become effective immediately after being posted on this site. PhilHealth will make every effort to announce to the public any changes made to this notice.

Contact information

If you have feedback, questions, complaints, or other concerns regarding this privacy notice or PhilHealth's data processing operations, you may contact the Data Protection Officer at (02) 8441-7444 local 7425, Callback Channel 0917-8987442 (PHIC), or email privacy.dpo@philhealth.gov.ph. Text “PHICcallback [space] Mobile No. or Metro Manila landline [space] details of your data privacy concern” and we will call you during office hours, weekdays only. Callback requests will expire after 72 hours.

In carrying out its mandate under RA No. 7875, as amended by RAs 9241 and 10606, PhilHealth collects and processes personal data in a manner consistent with the DPA.

PhilHealth commits to secure and keep confidential all collected data. It also aims to uphold the fundamental right to privacy of all individuals the data pertains to, especially PhilHealth members, dependents, and health care professionals.

Personal data we collect

We collect data necessary to fulfill our functions and activities relative to the implementation of the NHIP when you:

• Fill out any of our forms, either electronically or manually
• Register in and use our online services
• Avail PhilHealth benefits
• Contact us by phone, email, or any other means

These include, but are not limited to, a member's name, age, sex, date of birth, email address, contact details, health information, employment details, government-issued ID numbers, signature, and details about dependents such as spouse, children, and parents. Additional information is collected from health care professionals in relation to residency training and medical affiliations. CCTV footage of PhilHealth personnel and visitors is also recorded within office premises.

You may visit https://www.philhealth.gov.ph/privacy/ to read the privacy notice specific to our website.

How we use personal data

In accordance with our mandate to implement the NHIP, we may use and process collected personal data for any or all of the following purposes:

• To process member registration
• To process accreditation registration
• To process the payment of premiums
• To process reimbursement of benefits and claims
• To establish and maintain PhilHealth databases and records
• To investigate incidents that involve PhilHealth-accredited health care professionals or facilities
• To compile and generate reports for statistical and research purposes
• To relay or communicate queries, clarifications, and official announcements
• To accomplish other compatible purposes allowed by law

We will not subject your personal data to any automated decision-making process without your prior consent or authority granted by law.

Security of personal data

We have established necessary and appropriate physical, technical, and organizational security measures to protect the personal data we collect and process. These safeguards are regularly reviewed and updated to ensure that they remain aligned with international and industry standards. Access to your personal data is limited to authorized PhilHealth personnel and, on occasion, third-party service providers who are required to implement security measures similar to or better than our own.

How we share or disclose personal data

To the extent permitted or required by law, we may share or disclose personal data to other persons or organizations to uphold your interests and pursue ours when administering the NHIP. We may share personal data for reasons including:

• To provide 24/7 call center service when addressing issues and concerns of members, health care professionals, and health care providers
• To facilitate remittance of premiums through Accredited Collecting Agents, such as banks
• To conduct research or surveys for institutional development
• To report or disclose information to the National Privacy Commission (NPC) and other government agencies, when required or allowed by law
• To comply with court orders, subpoenas, and other legal obligations

How we retain and dispose of personal data

As a general rule, we dispose of or delete collected data in accordance with the period prescribed by applicable laws or PhilHealth policy. Sometimes, relevant personal data are retained for historical and statistical purposes.

Rights of data subjects

Individuals whose personal data we collect are accorded rights by the DPA as data subjects. They may invoke such rights at any time, in accordance with the provisions of the law. If there are inaccuracies in their records that need to be corrected or updated, members must notify PhilHealth immediately through any Local Health Insurance Office or Branch.

Changes to this notice

This privacy notice became effective on March 29, 2019 until subsequently amended. Revisions become effective immediately after being posted in areas visible to applicants and members, including PhilHealth's website. PhilHealth shall also avail of other opportunities to communicate such changes.

Contact information

If you have feedback, questions, complaints, or other concerns regarding this privacy notice or PhilHealth's data processing operations, you may contact the Data Protection Officer at (02) 8441-7444 local 7425, Callback Channel 0917-8987442 (PHIC), or email privacy.dpo@philhealth.gov.ph. Text “PHICcallback [space] Mobile No. or Metro Manila landline [space] details of your data privacy concern” and we will call you during office hours, weekdays only. Callback requests will expire after 72 hours.

In carrying out its mandate under RA No. 7875, as amended by RAs 9241 and 10606, PhilHealth collects and processes personal data in a manner consistent with the DPA.

PhilHealth commits to secure and keep confidential all collected data. It also aims to uphold the fundamental right to privacy of all individuals the data pertains to, especially suppliers and consultants, as applicable.

Personal data we collect

We collect, acquire, or generate personal data in many forms. They may consist of written records, photographic and video images, and digital material. Examples include:

• Information you provide prior to engagement, including data submitted through requests for quotation, bid forms, statements of ongoing government and private contracts, statements of single largest completed contract, resumes of consultants or personnel, DTI/SEC/CDA registration, valid and current mayor's permit or business license, tax clearance certificate issued by the BIR, and certificate of PhilGEPS registration.
• Information we collect or generate upon commencement of engagement, including performance records, relationship by consanguinity or affinity between supplier and PhilHealth officers as revealed in articles of incorporation, compliance with professional and labor laws and standards, performance security bond, and non-disclosure agreement.
• Information we collect or generate during engagement with PhilHealth, including pictures or videos of activities you participate in through official documentation, or recordings from CCTV cameras installed within PhilHealth premises.

If you supply us with personal data of other individuals, such as a person to contact in the event of an emergency, we will request you to certify that you have obtained the consent of such individuals before providing us with their personal data.

How we use personal data

To the extent permitted or required by law, we use your personal data to pursue our legitimate interests as a health insurance corporation, employer, and/or contracting party, including administrative, research, historical, and statistical purposes. We may use the information we collect for purposes such as:

• Identifying bidders and processing their bids
• Assessing suitability to provide goods or services
• Verifying provided or submitted information
• Evaluating qualifications
• Administering remuneration and payment for goods or services rendered
• Compiling statistics and conducting surveys and research for internal and statutory reporting purposes
• Performing other processing or disclosure permitted or required by law

We will not subject your personal data to any automated decision-making process without your prior consent or authority granted by law.

Security of personal data

We have established necessary and appropriate physical, technical, and organizational security measures to protect the personal data we collect and process. These safeguards are regularly reviewed and updated to ensure that they remain aligned with international and industry standards. Access to your personal data is limited to authorized PhilHealth personnel and, on occasion, third-party service providers who are required to implement security measures similar to or better than our own.

How we share or disclose personal data

To the extent permitted or required by law, we may share or disclose personal data to other persons or organizations to uphold your interests and pursue ours when administering the NHIP. We may share personal data for reasons including:

• Submission of information to government agencies such as PhilGEPS for transparency of bids and award notices, and the Bureau of Internal Revenue for tax remittance
• Other purposes, when necessary and under circumstances permitted or required by law

How we retain and dispose of personal data

As a general rule, we dispose of or delete collected data in accordance with the period prescribed by applicable laws or PhilHealth policy.

Rights of data subjects

Individuals whose personal data we collect are accorded rights by the DPA as data subjects. They may invoke such rights at any time, in accordance with the provisions of the law.

Changes to this notice

This privacy notice became effective beginning March 29, 2019 until subsequently amended. Revisions become effective immediately after being posted in areas visible to suppliers, including PhilHealth's website.

Full text of this accordion section was not available in the page extract. Refer to the live page at https://www.philhealth.gov.ph/privacy for the complete Applicants and Employees privacy notice.

Full text of this accordion section was not available in the page extract. Refer to the live page at https://www.philhealth.gov.ph/privacy for the complete CCTV privacy notice.