Privacy Policy
Your trust matters, and your health information is private. This policy explains what we collect, why, how we protect it, and the rights you have — in line with the Data Privacy Act of 2012 (Republic Act No. 10173).
Last updated: July 16, 2026 · Effective: July 16, 2026
Who we are
St. John Biocare & Dialysis Center Foundation, Inc. ("St. John Biocare," "we," "us") is the personal information controller responsible for the information collected through this website. Our administrative office is at #10 CK Building, South A Street corner Alejandro Roces Avenue, Barangay Paligsahan, Quezon City 1103.
Our network includes centers operated under St. John Biocare, Core Renal Center, and the St. Josef Renal Care Foundation. Where you inquire about a specific center, your information is handled by that center's team. St. John Biocare, Core Renal Center, and the St. Josef Renal Care Foundation are affiliated organizations that share information within the network only as needed to coordinate your care.
The information we collect
We collect only what you choose to give us through the forms on this site. Depending on the form, this may include:
- your name and contact details (mobile number and/or email);
- the center you're asking about and whether you're a new or transferring patient;
- whether you are a PhilHealth member;
- for job and training applicants: your PRC license number, résumé, and credentials;
- any files you upload (see the next section); and
- the message you write to us.
We also receive limited technical information automatically when you visit — see Cookies and third-party services.
What we do not do: the "personalised invitation letter" tool on our Training page creates your letter entirely on your own device. The name and address you type there are never sent to us or to anyone else.
Sensitive personal information (your health data)
Some of our forms let you attach documents so we can help you faster — for example laboratory results, a doctor's referral, your PhilHealth Member Data Record (MDR), or, for training applicants, a Hepatitis profile and vaccination records.
Under the Data Privacy Act, health information is sensitive personal information and receives stronger protection. We ask for it only when it helps us respond to you, we handle it with extra care, and you are never required to upload it to reach us — you may simply message or call, and bring your documents in person instead.
Why we collect it, and our legal basis
We use your information to:
- reply to your inquiry and answer your questions;
- arrange appointments and coordinate your dialysis care or transfer of care;
- process training and job applications; and
- keep the records we are required to keep as a healthcare provider.
Our legal bases under the Data Privacy Act include your consent (which you give when you tick the consent box and submit a form), the performance of services you request, and our compliance with legal and regulatory obligations as a DOH-regulated provider. We do not sell your information, and we do not use it for advertising.
Consent, and how to withdraw it
When you submit a form, you confirm that you agree to our handling your information for the purpose you contacted us about. You may withdraw your consent at any time by contacting our Data Protection Officer (below). Withdrawing consent won't affect processing already done, and in some cases we may need to keep certain records to meet legal requirements.
Who we share it with
We keep your information within St. John Biocare and share it only as needed to help you:
- Our staff — only those who need it to respond to you or provide care.
- Form delivery (Web3Forms). Our website forms are delivered through Web3Forms, a form-processing service, which passes your submission to the correct center's inbox under appropriate data-processing terms.
- Hospitals and partners, only where necessary to arrange admission, emergency transfer, or specialist care you've asked for.
- Authorities, only when required by law.
We do not sell or rent your information to anyone. We are in the process of migrating our center inboxes to managed, secure business email to further safeguard the information you send us.
Cookies and third-party services
This website does not use advertising cookies and does not run analytics or tracking tools — we don't build a profile of you.
A few features load content from other companies, which means those companies may receive your device's IP address:
- Maps on our center pages are embedded from Google Maps;
- Fonts are loaded from Google Fonts;
- the site is hosted on GitHub Pages, which keeps standard server logs for security.
These providers process that limited technical data under their own privacy policies. We do not set any first-party cookies of our own, so no cookie-consent banner is required to use this site.
How long we keep it
We keep your information only as long as needed for the purpose you shared it, and to meet our legal and record-keeping obligations as a healthcare provider, after which it is securely deleted or anonymised.
In practice, this means we keep:
- Website inquiries that don't become patients — for up to 2 years, then securely deleted;
- Patient records — for as long as you are under our care and for at least 10 years after your last treatment, in line with healthcare record-keeping requirements;
- Job and training applications that aren't successful — for up to 1 year.
How we protect it
We limit access to staff who genuinely need it, keep physical and digital records secure, and train our people on confidentiality. No system is perfectly secure, but we take reasonable and appropriate organisational, physical, and technical measures to protect your information, as required by the Data Privacy Act.
Your rights under the Data Privacy Act
As a data subject, you have the right to:
- be informed about how your information is used;
- access the information we hold about you;
- correct anything inaccurate;
- object to or withdraw consent for certain processing;
- request deletion or blocking where appropriate;
- data portability where applicable; and
- complain to the National Privacy Commission if you believe your rights were violated.
To exercise any of these, contact our Data Protection Officer below and we'll guide you through it.
Children's information
Our services and forms are intended for adults. Where care involves a minor, we rely on a parent's or guardian's involvement and consent. Where a minor receives dialysis care with us, we collect and handle their information only with the consent and participation of their parent or legal guardian.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed, and material changes will be posted on this page.
How to reach our Data Protection Officer
If you have questions, requests, or concerns about your information, please contact:
- Data Protection Officer: William Gregory M. Rivero, MD (interim)
- Email: hello@stjohnbiocare.com
- Phone: +63 (2) 8375 1575
- Address: #10 CK Building, South A Street corner Alejandro Roces Avenue, Barangay Paligsahan, Quezon City 1103
You may also contact the National Privacy Commission (privacy.gov.ph) if your concern is unresolved.