Privacy Policy · CAA Surgical Commons

This Privacy Policy is issued by Center for Advanced Aesthetics (CAA), operator of the Surgical Commons, in compliance with Republic Act No. 10173 — the Data Privacy Act of 2012 — its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

1. Personal information we collect

Practitioner data: full name, PRC number, specialty, phone, email, clinic, credentials submitted during Portal onboarding.
Patient inquiry data: name, contact details, referring surgeon, and stated concern submitted via the intake form.
Booking data: scheduled procedures, OR suite, notes.
Technical data: browser type, IP address, device information, and cookies (see Cookie Policy).

2. Purposes and lawful basis

We process personal data on the following bases under DPA §12–13:

Consent — for marketing outreach and non-essential cookies.
Contract — to facilitate OR bookings and practitioner privileges.
Legal obligation — DOH, PhilHealth, BIR, and NPC reporting where applicable.
Legitimate interest — facility safety, fraud prevention, and service improvement.

3. Sharing and disclosure

We share personal data only with: (a) the assigned surgeon or their clinic staff; (b) DOH-accredited third-party clinical laboratories and pathology providers strictly for the procedure booked; (c) our hosting and email infrastructure vendors under written data-processing agreements; and (d) government agencies when compelled by law or valid court order. We do not sell personal data.

4. Retention

Practitioner and booking records are retained for the duration of the account plus five (5) years to satisfy medical-recordkeeping regulations. Marketing inquiry records are retained for two (2) years unless earlier deletion is requested.

5. Your rights as a data subject

Under DPA §16 you have the right to be informed, to object, to access, to correct, to erasure or blocking, to damages, to data portability, and to file a complaint with the NPC. Submit any request through the Data Privacy Request form. We will respond within fifteen (15) working days.

6. Security measures

We apply organizational, physical, and technical safeguards including role-based access control, database Row-Level Security, encryption in transit (TLS 1.2+) and at rest, quarterly access reviews, and mandatory privacy training for all staff.

7. Data Protection Officer

Our Data Protection Officer (DPO) may be contacted at dpo@advancedaesthetics.ph, or by post at Center for Advanced Aesthetics, Attn: Data Protection Officer, Makati City, Metro Manila, Philippines.

8. Changes to this policy

Material changes will be posted here and, where required, notified via email. The "Updated" date at the top of this page reflects the latest revision.