Privacy Notice

Who we are

Upright Physiotherapy (11th Floor, Room 1104, Corporate 145 Building, Mother Ignacia Avenue, Barangay South Triangle, Quezon City) is the Personal Information Controller for the information described in this notice. We are a physical therapy and rehabilitation clinic, and we handle health information as part of assessing and treating our patients.

This notice explains what we collect, why, who sees it, how long we keep it, and what you can ask us to do with it. It applies to our website, our booking forms, the records we keep once you become a patient, and job applications sent through our careers page.

What we collect

When you book an assessment or a session, we collect:

• Contact and identity details. Your name, email address, mobile number, and age.
• Occupational information. What you do for work, because working posture and physical demands affect both diagnosis and treatment.
• Health information. What is bothering you, how long you have had it, your pain level, your medical history, past injuries and surgery, treatment you have already tried, and any medication you mention.
• Medical records and results you upload. X-ray, MRI or CT results, medical abstracts, doctor’s referrals, past therapy records, and laboratory results.
• Referral details. The name of any doctor who sent you to us, if you give it.
• Insurance details. Your HMO provider, and later your card or account details if you use HMO coverage.
• Appointment and treatment records. Your assessment findings, treatment plan, session notes, progress, and the schedule you keep with us.
• Website information. Basic technical data such as your device type, browser, and how you moved through the site.

Health information, and information about your HMO or any government-issued record, is sensitive personal information under the Data Privacy Act of 2012. We treat it with the additional care the law requires.

You do not have to upload any results in order to book. If you leave that part blank, we will still assess you.

Why we collect it

We use your information to:

• Let our rehabilitation doctor assess your case before your first session.
• Build and adjust your treatment plan.
• Schedule your appointments and send you confirmations and reminders.
• Keep a clinical record so that if you return, you do not have to start over.
• Process your HMO coverage or your payment.
• Follow up on your progress after your programme ends, and let you know about maintenance options.
• Meet our record-keeping obligations as a health facility.

We do not sell your information. We do not use your health information for advertising, and we will not share it with advertisers or data brokers.

Our legal basis

We rely on your consent, which you give when you tick the box on our booking form, to collect and process your health information for your assessment and treatment. Consent is also our basis for sending you follow-up messages about your care.

We also rely on the performance of our agreement with you as our patient, on our legal obligations as a health facility, and, where the situation calls for it, on the protection of your vital interests, including your life and health.

You can withdraw your consent at any time. If you do, we will stop processing your information for the purposes you withdrew, though we may still need to retain your clinical record for the period the law requires.

Who we share it with

We share only what is necessary, and only with:

• Our clinical team. The rehabilitation doctor and the physical therapists treating you.
• Your HMO provider, if you use HMO coverage, for approval and billing.
• Doctors or facilities you ask us to coordinate with, such as an orthopedic specialist or an imaging centre, with your go-ahead.
• Our service providers. The platforms that run our booking system, store our records, and send our email and SMS reminders. They act on our instructions and are bound to protect your information.
• Authorities, where a valid subpoena, court order, or legal requirement obliges us.
• Meta Platforms, for job applicants only and only if you tick the optional advertising box on the careers form. We send your email, mobile number and name in hashed (scrambled) form, together with your IP address, browser details and the fact that you applied, so we can measure how our job ads perform. We never send your resume, documents, intro or any health information.

Some of our service providers store data on servers outside the Philippines. Where that happens, we remain accountable for your information and require the same standard of protection.

How long we keep it

We keep your clinical record for at least fifteen years from your last visit, in line with Department of Health guidance for patient records. For patients who were minors when treated, we keep records until they turn twenty-five, or fifteen years from the last entry, whichever is longer.

Enquiries that never become appointments are deleted within [ 12 ] months. Website analytics are kept for [ 26 ] months.

When a retention period ends, we securely dispose of the record: physical documents are shredded and digital files are permanently deleted.

How we protect it

We use organisational, physical, and technical measures to keep your information safe. Access to patient records is limited to staff who need it for your care. Our systems are password-protected and access is logged. Uploaded files are transmitted over an encrypted connection. Physical records are kept in a locked area.

If a breach occurs that puts your sensitive personal information at real risk of harm, we will notify you and the National Privacy Commission within seventy-two hours of discovering it, and tell you what happened and what to do next.

Your rights

Under the Data Privacy Act of 2012, you have the right to:

• Be informed. Know that we are processing your information, and why.
• Access. Get a copy of what we hold about you, including your clinical record.
• Rectify. Correct anything inaccurate or incomplete.
• Erase or block. Ask us to remove information, subject to the retention periods we are required to observe.
• Object. Refuse further processing beyond your care, including marketing messages.
• Data portability. Receive your records in a format you can hand to another provider.
• Damages. Be compensated for harm caused by inaccurate, unlawfully obtained, or misused information.
• Complain. Raise a concern with the National Privacy Commission.

To exercise any of these, email our Data Protection Officer using the details below. We will verify your identity and respond within fifteen working days. We may charge a reasonable fee for reproducing physical records, and we will never withhold your records over an unpaid balance.

Cookies and website data

Our website uses cookies to keep the site working and to understand how visitors use it, so we can improve it. These do not contain your health information.

Our careers page also uses the Meta Pixel, which sets cookies that tell Meta when someone visits the page from one of our job ads. It is not used anywhere else on the site, including our booking pages.

You can block or delete cookies in your browser settings. The site will still work, though some parts may be less convenient.

Changes to this notice

We will update this notice when our practices change or when the law requires it. The date at the end of this notice always shows the current version. If a change materially affects how we handle your health information, we will tell you directly.

How to reach our Data Protection Officer

If you are not satisfied with how we handle your concern, you may contact the National Privacy Commission at privacy.gov.ph, or at the 5th Floor Delegation Building, PICC Complex, Pasay City.

Updated 14 October 2026.