"Serving with Compassion, Healing with Excellence"
As a Catholic Vincentian healthcare institution, San Juan de Dios Educational Foundation Inc. - Hospital (SJDEFI-Hospital) believe that every person is a child of God. We view your health information as a "sacred story" entrusted to our care. Our commitment to the Data Privacy Act of 2012 (RA 10173) is an extension of our core values:
In our mission to provide holistic healing, we collect and process the following categories of data:
Your data is processed for Treatment, Payment, and Healthcare Operations, including AI-assisted clinical support (acting as a "second opinion" only) and security surveillance.
Mandatory Note (NPC Circular No. 2023-04): This notice provides a general overview. For detailed descriptions of specific processing activities at your point of care, please request an "Information Disclosure Sheet" from the Admitting or Medical Records sections.
The following table details the expanded categories of how and why data is collected across the institution:
| Ecosystem / Department | Data Categories Collected | How Data is Collected | Why Data is Collected | |
|---|---|---|---|---|
| Admitting & Patient Services | Full name, address, email, contact numbers, and health information (medical history, vital signs). | Collected directly from the patient or their representative during registration, admission, or consultation. | To establish medical continuity, fulfill treatment plans, and maintain a "sacred story" of patient care. | |
| Medical Service Division | Clinical data, telemedicine records, and public health data (e.g., Infection Control, TB-DOTS). | Entered into the Hospital Information Management System (HIMS) and physical charts by doctors and consultants. | For AI-assisted diagnostic support (acting as a "second opinion") and mandatory submission to the Department of Health (DOH). | |
| Finance Service Division | Financial/credit card details and regulatory identifiers (PhilHealth, SSS, TIN). | Captured during billing and settlement processes. | For payment and settlement, secure submission of billing to PhilHealth/HMOs, and tax remittances. | |
| Human Resource Division (HRD) | Biometrics, performance data, educational background, and government IDs. | Provided by applicants during recruitment and via employee access logs and biometrics. | For human resources management, payroll, and secure submission to portals like DOLE, SSS, and PRC. | |
| Security & Surveillance | CCTV video footage and images. | Collected via closed-circuit surveillance cameras installed throughout the hospital (excluding prohibited areas). | To maintain peace and order, prevent theft, and investigate security incidents within the healing environment. | |
| Engineering & Maintenance | Operational data regarding waste management. | Recorded systematically through departmental logs. | For mandatory regulatory reporting to the Department of Environment and Natural Resources (DENR). | |
| Academic & Research | De-identified patient health data. | Extracted from clinical records and de-identified to meet "Safe Harbor" standards. | To advance the healing ministry through medical training and clinical research overseen by the Institutional Review Board. |
We engage third parties to facilitate the provision and delivery of our healthcare services to you. Consequently, the sharing of your data with these third parties is necessary. Your data is shared only when strictly necessary and subject to appropriate safeguards. Should your data require transfer to a third party in another country, we will conduct a risk assessment to ensure an adequate level of protection is maintained. We typically incorporate these obligations into our contractual agreements with said third parties. Furthermore, all data transfers, whether within or outside of the Philippines, are encrypted. The third parties assisting us in processing your data are listed below:
| Third Party | Data Collected or Shared | Purpose | Place of Processing |
|---|---|---|---|
| Medical Consultants | Personal identifiers and medical/clinical information. | To provide and coordinate medical care with healthcare professionals. | Philippines |
| PhilHealth | Full Name, Period of Confinement, Disposition, Diagnosis, and Treatment Information. | Reimbursement of claims pursuant to the National Health Insurance Act. | Philippines |
| HMOs | Full Name, Employer, Age, Account Number, and Diagnosis. | To process claims against your insurance provider. | Philippines |
| Payment Partners (Maya, Gcash, Bank POS) | Transaction details, Reference Numbers, and Credit/Debit card information. | To process and verify the payment of bills. | Philippines |
| Financial Assistance Agencies (DSWD, PCSO, OP, OVP) | Medical abstract, Patient ID, and Social Case Study Report. | To process financial assistance applications. | Philippines |
| Funeral Homes / Mortuary Services | Name of the deceased, date/time of death, and representative's identification/contact details. | To facilitate the release and transfer for the safekeeping of the cadaver as authorized by the next of kin (Form AMS-ADM-005). | Philippines |
| Department of Health (DOH) | Name, Birthday, Address, and type of disease/injury or diagnosis. | Mandatory regulatory requirement for disease surveillance. | Philippines |
| Affiliating Educational Institutions | Student/trainee identifiers and limited patient demographics for training access. | To support medical training and internship programs under official affiliation agreements. | Philippines |
| Researchers (Health Research) | De-identified health data or clinical trial specifics. | To advance the healing ministry through clinical research overseen by the IRB and PHREB accreditation. | Philippines |
| BizBox | Hospital Information Management System (HIMS) data | Identified as a Personal Information Processor (PIP). | Philippines |
We protect your data against unauthorized access, loss, or destruction through:
To protect your electronic health records, SJDEFI-H utilizes secure authentication processes and restricted network ports. Automated access is limited to the system offering only the required functionality to each authorized user to ensure no one can use functions that are not necessary for their role.
To maintain a secure healing environment:
Consistent with your inherent dignity, you have the following rights under the DPA:
The sections below apply to the official Website (https://www.sanjuandedios.org/healthministry_rev0.htm). Please be advised that the practices described in this Privacy Policy apply only to information gathered online through our official digital platforms.
By visiting our Website, you are accepting these terms. If you do not agree to the terms of this Privacy Policy, please do not use the Website.
By visiting our official website, we monitor activities through "Cookies"—packets of information transferred to a user's computer for record-keeping purposes.
The SJDEFI-Hospital official website and backend portals utilize Privacy-by-Design security measures to protect confidential data from unauthorized personnel.
SJDEFI provides online forms, particularly for Human Resources recruitment, which may request information.
The San Juan de Dios Hospital website contains external links related to medical partners, HMOs, or health education resources.
For any inquiries, requests for rectification, or to exercise your rights, please contact our Data Protection Officer (DPO):
In accordance with our Integrated Management System (IMS) and NPC mandates, this notice is a living document. It is reviewed at least annually to reflect changes in medical technology, hospital operations, and privacy regulations.
| Revision No. | Release Date | Summary of Changes | Approved By |
|---|---|---|---|
| 01 | July 23, 2018 | Initial DPA Implementation | Administration |
| 02 | Sept 15, 2025 | Updating of NPC Certificate of Registration | MIS |
| 03 | Mar 31, 2026 | Full Compliance with NPC Circular 2023-04 & 2024-02 | VP for Health Services |