Privacy and Data Use

Data Privacy Notice

This notice explains how MediScope collects, uses, stores, and protects personal information for clinic operations, student requests, and account-related workflows.

Supports consent-driven flows Health and account data handling RA 10173 aligned

1. Introduction

This Data Privacy Notice explains how the MEDISCOPE: WLC Clinic Records and Resource Management System with Student Request Portal for Western Leyte College collects, uses, processes, stores, and protects personal data.

The system is developed to support clinic operations, manage student records, and monitor medical inventory while ensuring full compliance with the Data Privacy Act of 2012 (RA 10173). By using this system, users acknowledge that their personal data will be processed in accordance with this notice.

2. Personal Data Collected

The system may collect the following information when necessary for its functions:

  • Basic personal information such as full name, gender, birthdate, contact number, and address.
  • Student information including student number, enrollment status, course or strand, year level, section, and school year.
  • System account details such as username, email address, encrypted password, and user role.
  • Health and clinic records including clinic visit details, diagnosis, treatment, prescriptions, vital signs, symptoms, and allergies.
  • Appointment and service data such as schedules, laboratory requests and results, and clinic clearances.

The system collects only the minimum necessary personal data required to fulfill its intended functions.

3. Sensitive Personal Information

The system processes sensitive personal information, particularly health-related data such as medical history, diagnosis, treatment records, and other clinic information.

This information is handled with strict confidentiality and is accessible only to authorized clinic personnel in accordance with data protection policies.

4. Purpose of Data Collection

Personal data is collected and processed solely for legitimate purposes, including:

  • Managing student clinic records.
  • Recording and monitoring clinic visits.
  • Issuing medical certificates, prescriptions, and clearances.
  • Managing laboratory requests and results.
  • Scheduling and managing appointments.
  • Monitoring and managing medical inventory and supplies.
  • Ensuring system security and user authentication.
  • Generating reports for administrative purposes.

5. Data Processing and Use

All collected data is:

  • Stored securely in a structured database.
  • Processed only within the system for its intended functions.
  • Accessed strictly by authorized users based on their roles.
  • Not used for unrelated or unauthorized purposes.

Students are allowed access only to limited information such as their appointments and notifications. Access to sensitive medical records is restricted to authorized personnel only.

6. Personal Information Controller

The Personal Information Controller of this system is the group of student developers responsible for the system, under the supervision of their academic institution, Western Leyte College of Ormoc City.

They are responsible for ensuring that personal data is processed in compliance with applicable data privacy laws.

7. Data Sharing and Disclosure

Personal data will not be shared, sold, or disclosed to any third party except when required by law, authorized by the data subject, or necessary to protect the rights, safety, and legal interests of individuals or the institution:

  • When required by law or legal processes.
  • When necessary to protect the rights and safety of individuals.
  • When authorized by the data subject.

8. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes stated in this notice and to comply with academic and legal requirements.

In the MEDISCOPE system, student records are maintained while the user is actively enrolled or utilizing the system. Records of inactive or graduated users may be retained for a period of up to five (5) years for academic and administrative purposes.

After the retention period, data may be securely deleted. Authorized administrators may also deactivate or remove user accounts in accordance with institutional policies.

9. Security Measures

The system implements appropriate technical and organizational measures to protect personal data, including:

  • Password encryption (hashed passwords).
  • Role-based access control (admin, staff, student).
  • Secure login authentication and session management.
  • Restricted access to sensitive information.
  • Activity logging and monitoring of user actions.
  • Protection against unauthorized access and misuse.

While no system can guarantee absolute security, the developers continuously aim to improve system security. In the event of a data breach, the system administrators will take appropriate measures to contain the incident and notify affected users where required by law.

10. Data Subject Rights

In accordance with the Data Privacy Act of 2012, users have rights that may include the right to be informed, access, correction, erasure or blocking, objection, and data portability where applicable.

Users are responsible for ensuring that the personal data they provide is accurate, complete, and up to date.

12. Contact Information

For any questions, concerns, or requests regarding this Data Privacy Notice or personal data handling, users may contact the system administrators through Western Leyte College of Ormoc City via the official system contact channels or designated institutional communication platforms.