KrizzieMD OB Clinic – Online Appointment Booking System
Effective Date: [January 1, 2026]
Last Updated: [January 1, 2026]
KrizzieMD OB Clinic ("KrizzieMD," "we," "us," or "our") respects your privacy and is committed to protecting your personal information when you use our online appointment booking system located at:
This Privacy Policy explains how we collect, use, store, protect, and disclose personal information submitted through our online appointment booking system.
This Privacy Policy is intended to comply with applicable Philippine privacy laws, including Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA) and its implementing rules and regulations.
The DPA requires personal information processing to follow the principles of transparency, legitimate purpose, and proportionality.
1. Information We Collect
When you register for an account, request an appointment, manage an appointment, or communicate with KrizzieMD through the online booking system, we may collect the following information:
A. Personal Information
This may include:
- Full name
- Date of birth or age
- Sex
- Email address
- Mobile or telephone number
- Address or location
- Username
- Account information
- Appointment history
- Preferred clinic location
- Other information necessary to identify and communicate with you
B. Appointment Information
We may collect information relating to your appointment, including:
- Selected clinic/location
- Doctor or healthcare professional
- Appointment date
- Appointment time
- Selected service
- Appointment status
- Cancellation or rescheduling information
- Notes or information necessary to facilitate your appointment
C. Health-Related Information
Depending on the information you provide during the appointment process or subsequent clinical interaction, we may process health-related or medical information necessary for providing healthcare services.
Health information is classified as sensitive personal information under the Philippine Data Privacy Act.
We will only collect and process health information when necessary and in accordance with applicable law.
D. Technical Information
When you use the website, certain technical information may also be automatically collected, such as:
- IP address
- Browser type
- Device information
- Operating system
- Date and time of access
- Login activity
- Security and audit logs
- Website/session information
This information may be used for security, system administration, troubleshooting, and improving the reliability of the online booking system.
2. Purpose of Collecting Your Information
KrizzieMD collects and processes your information for legitimate and specified purposes, including:
Appointment Management
To:
- Create your patient account
- Process your appointment request
- Confirm your appointment
- Display available appointment dates and times
- Assign appointments to the appropriate clinic/location
- Manage doctor schedules
- Manage available appointment slots
- Allow you to cancel appointments
- Allow you to change or reschedule appointments
- Prevent duplicate or conflicting appointments
Patient Communication
We may use your contact information to send:
- Appointment confirmation
- Appointment reminders
- Appointment changes
- Cancellation notifications
- Rescheduling notifications
- Patient account information
- Login/account instructions
- Other communications directly related to your appointment or healthcare service
Healthcare Services
Information may be processed as necessary to facilitate medical consultation, treatment, and other healthcare-related services provided by KrizzieMD.
The DPA recognizes processing necessary for medical treatment by a medical practitioner or medical treatment institution as one of the circumstances in which sensitive personal information may be lawfully processed, provided adequate protection is ensured.
System Security
Information may also be processed to:
- Protect patient accounts
- Detect unauthorized access
- Prevent fraud or misuse
- Maintain system security
- Investigate security incidents
- Maintain system audit records
3. Legal Basis for Processing
KrizzieMD will process personal information only when there is a lawful basis under applicable Philippine law.
Depending on the specific processing activity, this may include:
- Your consent;
- Processing necessary for the performance of a service you requested;
- Processing necessary for medical treatment;
- Compliance with legal or regulatory obligations;
- Protection of vital interests; or
- Other lawful grounds recognized under the Data Privacy Act.
For sensitive personal information, including health information, KrizzieMD will comply with the stricter requirements applicable under the DPA.
4. Patient Account
To use certain functions of the online booking system, you may be required to create a patient account.
Your account may contain:
- Name
- Email address
- Contact information
- Username
- Appointment information
- Account status
- Other information necessary to manage your appointments
You are responsible for keeping your username, password, and other login credentials confidential.
You should immediately notify KrizzieMD if you believe that your account has been accessed without authorization.
KrizzieMD will never ask you to disclose your password through an unsolicited email, text message, or telephone call.
5. Email and Electronic Communications
When you provide an email address, you authorize KrizzieMD to use it for communications directly related to your appointment and patient account.
These communications may include:
- Appointment confirmation
- Appointment schedule
- Appointment cancellation
- Appointment rescheduling
- Account registration information
- Login information
- Password-related communications
- Important service announcements
These communications are considered transactional/service communications and are necessary for operating the online appointment system.
KrizzieMD may use an authorized email service provider or technology provider to deliver these messages.
6. Sharing and Disclosure of Information
KrizzieMD does not sell or rent your personal information.
Your personal information may be accessed or disclosed only when necessary and appropriate for legitimate purposes, including to:
- Authorized KrizzieMD doctors
- Authorized clinic staff
- Authorized administrative personnel
- Authorized healthcare personnel
- Technology or hosting providers
- Email service providers
- Calendar or appointment-management service providers
- Other authorized service providers assisting KrizzieMD in operating the booking system
- Government agencies or authorities when disclosure is required or authorized by law
Third-party service providers that process information on behalf of KrizzieMD should be required to maintain appropriate confidentiality and security safeguards.
The DPA recognizes the role of personal information processors that process information on behalf of a personal information controller.
7. Google Calendar Integration
If Google Calendar integration is enabled for appointment management, appointment information may be synchronized with an authorized KrizzieMD Google Calendar account.
This may include:
- Patient name
- Appointment date
- Appointment time
- Clinic/location
- Doctor
- Appointment-related information necessary for calendar management
Calendar information will only be accessed by authorized users and used for legitimate appointment-management purposes.
8. Clinic Location Information
The online booking system may collect and process the clinic/location you select when booking or changing an appointment.
This information is used to:
- Display the correct doctor schedule;
- Display the appropriate available appointment slots;
- Assign the appointment to the correct clinic;
- Manage clinic schedules; and
- Provide you with accurate appointment information.
9. Appointment Cancellation and Rescheduling
Patients may be permitted to cancel or change their appointment through the patient portal subject to KrizzieMD's appointment policies.
Where applicable, the system may enforce a minimum period before the scheduled appointment, such as a 48-hour rescheduling requirement.
Information relating to cancellations and rescheduling may be retained as part of the appointment history and administrative records.
10. Data Retention
KrizzieMD will retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, including:
- Appointment management
- Healthcare services
- Patient records
- Legal and regulatory requirements
- Accounting and administrative requirements
- Security and audit requirements
- Resolution of disputes or complaints
When personal information is no longer required, KrizzieMD will take reasonable steps to securely delete, destroy, anonymize, or otherwise dispose of it in accordance with applicable law and its internal retention policies.
Specific retention periods may vary depending on the type of information and applicable legal or regulatory requirements.
11. Data Security
KrizzieMD implements reasonable and appropriate organizational, physical, and technical measures to protect personal information against:
- Unauthorized access
- Unauthorized disclosure
- Accidental loss
- Alteration
- Destruction
- Misuse
- Other unlawful processing
Security measures may include:
- User authentication
- Password protection
- Role-based access
- Access controls
- Secure communications
- System monitoring
- Audit logs
- Security updates
- Backup procedures
- Administrative controls
The NPC emphasizes that organizations processing personal information should implement reasonable and appropriate safeguards against natural and human risks.
However, no internet-based system can guarantee absolute security.
12. Data Breaches and Security Incidents
In the event of a personal data breach or security incident, KrizzieMD will investigate the incident and take appropriate measures in accordance with applicable law and National Privacy Commission requirements.
Where legally required, affected individuals and/or the National Privacy Commission will be notified within the applicable period.
13. Your Rights as a Data Subject
Under the Data Privacy Act, you may have the right to:
Right to Be Informed
You have the right to know whether your personal information is being collected, processed, or stored and how it is being used.
Right to Access
You may request access to personal information held about you, subject to applicable legal limitations.
Right to Correct
You may request correction of inaccurate or incomplete personal information.
Right to Object
You may object to certain processing of your personal information where permitted by law.
Right to Erasure or Blocking
You may request deletion, blocking, or removal of personal information where legally applicable.
Right to Data Portability
Where applicable, you may request your personal information in a structured and commonly used format and request its transfer where legally permitted.
Right to File a Complaint
If you believe that your privacy rights have been violated, you may raise a concern with KrizzieMD and, where appropriate, file a complaint with the National Privacy Commission.
These rights are recognized under the Data Privacy Act and NPC guidance.
14. How to Exercise Your Privacy Rights
To exercise your privacy rights or ask questions about how your personal information is processed, please contact:
KrizzieMD OB Clinic
Website:
Email:
[INSERT PRIVACY/DPO EMAIL ADDRESS]
Telephone:
[INSERT CLINIC CONTACT NUMBER]
Clinic Address:
[INSERT COMPLETE CLINIC ADDRESS]
Data Protection Officer / Privacy Officer:
[INSERT DPO/PRIVACY OFFICER NAME]
Please provide sufficient information to allow us to verify your identity and properly respond to your request.
15. Children's Privacy
The online appointment system is intended to be used by individuals who are legally capable of providing the information required for appointment registration.
Where information concerning a minor is provided, the parent, legal guardian, or other authorized representative should provide the information where required by law.
KrizzieMD will take appropriate measures to protect information relating to minors.
16. Cookies and Similar Technologies
The booking system may use cookies or similar technologies that are necessary for:
- User authentication
- Maintaining login sessions
- Security
- Website functionality
- Appointment booking functionality
- Remembering certain user preferences
- System performance and troubleshooting
Cookies that are not necessary for the operation of the service, if used, should be disclosed appropriately and managed in accordance with applicable requirements.
17. Third-Party Websites and Services
The booking system may contain links or integrations to third-party services.
Examples may include:
- Google Calendar
- Email service providers
- Other services necessary to operate the appointment system
KrizzieMD is not responsible for the privacy practices of third-party websites that are outside its control.
Patients should review the privacy policies of third-party services when using those services.
18. Changes to This Privacy Policy
KrizzieMD may update this Privacy Policy from time to time to reflect:
- Changes to our services;
- Changes to the online booking system;
- Changes in applicable laws or regulations;
- Changes in our data-processing practices; or
- Security and operational improvements.
When material changes are made, KrizzieMD will provide an updated Privacy Policy through the booking system or other appropriate means.
The NPC itself notes that privacy notices should be updated when substantial changes occur.
19. Consent and Acknowledgment
By creating an account, submitting an appointment, or otherwise using the online appointment booking system, you acknowledge that you have read and understood this Privacy Policy.
Where consent is required by applicable law, you will be asked to provide consent before the relevant processing takes place.
You may withdraw consent where the processing is based on consent, subject to applicable legal limitations and the consequences of withdrawal.
Withdrawal of consent does not affect processing that was lawfully performed before the withdrawal.
20. Contact and Privacy Complaints
If you have questions, concerns, complaints, or requests regarding your personal information, please contact KrizzieMD first using the contact information provided above.
If you are not satisfied with the response or believe your privacy rights have been violated, you may also contact the:
National Privacy Commission (NPC)
Republic of the Philippines
Official website: National Privacy Commission
The NPC provides information concerning data-subject rights, privacy complaints, and the Data Privacy Act.