Chinese General Hospital and Medical Center (CGHMC)
Website: https://cghmc.com.ph
Introduction
The Chinese General Hospital and Medical Center (“CGHMC”), owned and operated by the Philippine-Chinese Charitable Association, Inc. (“PCCAI”), is committed to protecting the privacy and personal information of all patients in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (“IRR”), and all applicable National Privacy Commission (“NPC”) issuances.
This Privacy Notice outlines how we collect, use, disclose, and protect your personal information when you visit our website (https://cghmc.com.ph) or engage with our services, including as a job applicant or patient.
PERSONAL INFORMATION CONTROLLER
The Personal Information Controller (PIC) responsible for your data is:
Philippine-Chinese Charitable Association, Inc. (PCCAI)
286 Blumentritt Road, Barangay Sampaloc, Manila City 1003 NPC Registration No.: PIC-012-312-2025
PERSONAL INFORMATION WE COLLECT
In the course of providing healthcare services, CGHMC may collect the following categories of personal information:
When Do We Collect Your Data
We collect your personal and sensitive information during your various transactions at CGHMC such as:
- Accomplishing admission, registration, and medical consent forms.
- Face-to-face consultations and assessments with our healthcare professionals.
- Undergoing diagnostic, radiology, and laboratory tests.
- Interacting with our medical staff, billing department, and customer service.
CCTV monitoring systems deployed within the hospital premises for security purposes.
General Personal Information
Full name, date of birth, age, sex, civil status, nationality, home address, contact numbers, email address, government-issued identification numbers (PhilHealth, SSS/GSIS, TIN), photograph, emergency contact details, next-of-kin information, and CCTV footage or video recordings captured while within hospital premises.
Sensitive Personal Information
- Medical – Medical history, diagnosis, treatment records, laboratory results, imaging results, prescriptions, surgical records, mental health records, genetic information, health insurance details, biometric data (if applicable), and any information related to your physical or mental health condition.
- Billing Information – payment details, including credit card and banking information.
Technical Information: IP address, browser type, operating system, device type, and browsing behavior.
Communication Records: Details of your inquiries, feedback, and complaints.
Social Media Interactions: Posts and comments about your experiences with CGHMC on social media platforms.
Survey Responses: Feedback from customer surveys, promotions, and loyalty programs.
Verification Information: Copies of valid identification for verification purposes.
Data Collection for Minors and Incapacitated Patients: For patients who are minors (below 18 years of age) or legally incapacitated to give consent, personal and sensitive information will be collected from, and consent provided by, their parents, legal guardians, or explicitly authorized representatives.
PURPOSE OF PROCESSING
Your personal data is used for various purposes, including but not limited to:
- Medical diagnosis, treatment, and continuity of care
- Admission, discharge, and transfer processing
- Pharmacy dispensing and medication management
- Laboratory, radiology, and diagnostic services
- Billing, insurance claims processing, and PhilHealth submissions
- Medical records management, storage, retrieval, and archiving
- Hospital quality assurance, clinical audits, and accreditation requirements
- Research and training purposes (subject to your specific consent via the MERX Consent Indicator System)
- Compliance with legal and regulatory obligations including reporting to DOH, PhilHealth, and other government agencies
- Hospital safety, security, and incident management
- Communication regarding your care, appointments, and follow-up
CONSEQUENCES OF NOT PROVIDING YOUR DATA
Providing your personal and sensitive information is a necessary requirement for us to deliver safe, effective, and appropriate medical care. If you choose not to provide the requested information, CGHMC may be unable to properly diagnose or treat your medical condition, process your hospital admission or discharge, or facilitate your PhilHealth and health insurance claims.
LEGAL BASIS FOR PROCESSING
CGHMC processes your personal information under the following legal bases as provided under Sections 12 and 13 of Data Privacy Act of 2012 (RA 10173):
- Consent of the data subject (Section 12(a) / Section 13(a))
- Fulfillment of a contract or to take steps at the request of the data subject prior to entering into a contract (Section 12(b))
- Compliance with a legal obligation (Section 12(c))
- Protection of vitally important interests of the data subject, including life and health (Section 12(d) / Section 13(b))
- Adequate level of protection for the rights and freedoms of data subjects as provided in applicable law or regulations (Section 13(f))
MERX CONSENT INDICATOR SYSTEM
CGHMC operates the MERX Consent Indicator System, a first in the Philippines amongst tertiary hospitals, to manage patient consent for research and training purposes:
- GREEN indicator: Patient has provided specific consent for use of their data for research, training, and teaching purposes in addition to direct treatment.
- RED indicator: Patient data may be used for direct medical treatment only. No research, training, or third-party use is authorized.
- Unencoded patients default to RED (treatment only). You may update your MERX consent status at any time by contacting the Data Privacy Office or Medical Records Section.
SHARING AND DISCLOSURE
CGHMC may share your personal information with the following parties, strictly on a need-to-know basis and subject to applicable Data Sharing Agreements:
- Attending physicians, consultants, and healthcare professionals involved in your care
- CGHMC laboratory, pharmacy, radiology, and ancillary departments
- PhilHealth, SSS/GSIS, and health insurance providers for claims processing
- Government agencies as required by law (DOH, BIR, NBI, PNP, courts of law)
- Accreditation bodies for institutional quality audits
- Researchers and academic institutions (only with GREEN MERX consent or separate lawful basis under the DPA)
- Third-party service providers with valid Data Sharing Agreements
DATA RETENTION
Various hospital patient records are retained in accordance with applicable Philippine laws, DOH Administrative Orders, and CGHMC’s Data Retention and Disposal Policy.
After the retention period, depending on the type of records, records are securely disposed of in accordance with the Centralized Documents Disposal Warehouse procedures.
SECURITY MEASURES
CGHMC implements appropriate organizational, physical, and technical security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include access controls in the MERX Hospital Information System, in-house Document Management System, CCTV monitoring, biometric access controls (ZKTECO), and regular security audits.
We implement various security measures to protect your personal data including:
- Data Anonymization: To ensure your data cannot be linked back to you.
- Restricted Access: To limit access to your data to authorized personnel only.
- Secure Storage: To store your data in secure environments.
Regular Audits: To conduct regular security audits and assessments.
YOUR RIGHTS AS A DATA SUBJECT
Under RA 10173, you have the following rights:
- Right to be informed (of the collection and processing of your personal data)
- Right to access (your personal data held by CGHMC)
- Right to object (to the processing of your personal data)
- Right to erasure or blocking (of personal data)
- Right to rectification (of inaccurate or incomplete personal data)
- Right to data portability
- Right to lodge a complaint with the NPC
- Right to damages for violations of the DPA
How to Contact Us
If you have any questions or concerns about this Privacy Notice or wish to exercise your rights, please get in touch with us at:
Data Privacy Office
Chinese General Hospital and Medical Center (CGHMC)
286 Blumentritt Road, Sta. Cruz, Manila, Philippines
Email: dpo@cghmc.com.ph
Site: https://dpo.cghmc.com.ph
CHANGES TO THIS NOTICE
CGHMC reserves the right to update this Privacy Notice to reflect changes in our data processing practices or applicable laws. Updated versions will be made available at the DPO portal and posted in the hospital premises.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
