Privacy, Retention & Security Policy

Doc JPR Virtual Assistant — John Paulo D. Ramos, MD | Last updated: June 2026 | Version 2.3

We want you to understand exactly what we collect, why, and what choices you have — in plain language, not just legal text. The short version is below; the full detail follows, and we cite the specific Philippine laws we rely on so you can check them yourself.

The short versionWe collect only what we need to assess your request and issue your documents — your identity, contact details, a government ID, what's bothering you, and proof of payment.
A licensed physician personally reviews your information. We ask for payment only after the doctor approves your request.
Your data is encrypted, access-controlled, and never sold or used for advertising.
We delete your government ID within 30 days of closing your case. Medical records are kept 10 years because Philippine law requires it.
You can ask to see, correct, download, or delete your data at any time — email us with the subject "Privacy Request" and we'll respond within 15 business days.
You message us through Facebook Messenger (Meta), which has its own privacy policy we don't control. Please don't send anything there you wouldn't want stored on Messenger.
This summary is for convenience; the full sections below govern, and nothing here limits your rights under the Data Privacy Act of 2012 (RA 10173).

1. Data Controller

John Paulo D. Ramos, MD — General Medicine & Telemedicine
PRC License No. 0159928 | PTR No. MKT10093938MN
telemedicine@jpdjr.com | 0967 230 5477

John Paulo D. Ramos, MD is the Personal Information Controller for this service under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (NPC). For any privacy question or to exercise your rights, email the address above with the subject "Privacy Request".

2. What Data We Collect

Category	Specific data	Source
Identity	Full name, date of birth, sex	You (via the intake form)
Contact	Mobile number, home address, Facebook Messenger PSID	You (via Messenger)
Government ID	Photo / scan of a valid Philippine government-issued ID	You (uploaded via Messenger)
Health information	Symptoms, duration, known conditions, current medications, allergies, reason for consultation	You (via the intake form)
Payment proof	Screenshot of GCash or Maya transaction confirmation, reference number	You (uploaded via Messenger)
Communication	Chat transcript (last 40 messages, 14-day rolling window)	Automatically captured from Messenger
Issued documents	Medical certificate content, prescription details, lab request items, document IDs	Generated by the physician upon issuance
Consent record	Timestamp and method of consent capture	Automatically recorded at submission
Booking records	Appointment date, time, type of service, notification delivery status	Automatically captured when an appointment is scheduled

3. Why We Process It (Purposes & Legal Basis)

Purpose	Legal basis (RA 10173)
Evaluate teleconsultation request and issue medical documents	Consent (§12(a)) + Medical purposes by a licensed health professional (§13(e))
Identity verification (to prevent fraud)	Consent; legitimate interest of the physician
Payment verification	Performance of a service contract (§12(b))
Physician's mandatory medical record-keeping	Compliance with legal obligation (§12(c))
Certificate authenticity verification (QR scan)	Legitimate interest; only document validity is confirmed — no medical details disclosed
After-care follow-up (3-day wellness check)	Consent; continuing care obligation
Appointment reminders (about 1 hour and 15 minutes before the call)	Consent; performance of service
Daily operational digest (physician only)	Legitimate interest of the physician; data not shared externally

4. Data Storage & Infrastructure Security

Records are stored in Cloudflare Workers KV, a globally distributed key-value store, and uploaded images (government IDs, payment screenshots) in Cloudflare R2 object storage. Both provide the following security properties:

Encryption at rest — all KV data is encrypted at rest by Cloudflare using AES-256.
Encryption in transit — all data is transmitted over TLS 1.2 or 1.3 only. Plain HTTP connections are rejected.
Access control — the physician dashboard is protected by a session-authenticated password. Five failed login attempts trigger a 15-minute IP-level lockout.
Process isolation — the system runs in Cloudflare's V8 isolate sandbox; no other tenant shares the same runtime.
Tamper-evident documents — every issued document carries a unique control number (DCN) and a QR code. Anyone can confirm authenticity at the verification page (jpdjr.com/v) by scanning the QR or entering the DCN — without accessing any medical details.
One-time session tokens — patient intake form links use cryptographically random, single-use tokens that expire within 60 minutes and are invalidated once submitted.
File access tokens — ID and payment proof images are held in Cloudflare R2 under unguessable 16-character random keys and served only through short-lived signed URLs; retrieval requires dashboard authentication.
Webhook signature verification — all inbound Messenger webhooks are verified against Meta's HMAC-SHA256 signature before processing.

⚠️ Messenger channel notice: Communication occurs via Facebook Messenger, operated by Meta Platforms, Inc. and subject to Meta's own Privacy Policy. Do not send sensitive information you are not comfortable transmitting through Messenger. For end-to-end encrypted transmission, contact Dr. Ramos directly via the email address above.

5. Retention Schedule

Data type	Retention period	Basis
Government ID photos	30 days after the case is closed	Minimum necessary for identity verification. Stored in Cloudflare R2 and automatically deleted by a daily privacy job 30 days after the case is closed — and immediately on a valid erasure request.
Payment proof screenshots	12 months after payment date	Financial record-keeping; stored in R2 and expired by bucket lifecycle rule
Chat transcripts	14 days rolling window (last 40 messages)	Operational support (live takeover); auto-expired by KV TTL
Medical records (case records, SOAP notes, issued documents)	10 years minimum	DOH Administrative Order No. 2016-0002 and standard Philippine medical record-keeping practice; after 10 years, records are securely deleted
Prescriptions (Rx records)	10 years	Same as above
Audit logs	10 years	Compliance; legal defence
Booking & appointment records	2 years	Operational; then purged
In-progress form and conversation session	12 hours	Auto-expired when the temporary session ends
Submitted intake awaiting valid ID	7 days from submission	Available to the physician while awaiting ID; securely deleted if incomplete

6. Data Sharing & Third Parties

We do not sell, trade, or otherwise transfer your personal data to third parties. Data may be disclosed only in the following limited circumstances:

Certificate verification — when an employer, school, or government agency scans the QR code on your document, the system confirms only whether the document ID is authentic and who issued it. Your medical details are never disclosed.
Legal requirement — if compelled by Philippine law, court order, or a regulatory body with lawful authority.
Infrastructure providers (data processors only):
- Cloudflare, Inc. — hosting, KV storage, and edge compute
- Meta Platforms, Inc. — Messenger communication channel
- Google LLC — encrypted backup spreadsheet (physician access only)
Each operates under its own security and privacy frameworks and processes data only as instructed.

7. Your Rights Under RA 10173 (Data Privacy Act of 2012)

Right to be informed — this notice constitutes that disclosure.
Right to access — request a copy of personal data held about you.
Right to rectification — request correction of inaccurate or incomplete data.
Right to object — object to processing for legitimate interest purposes.
Right to erasure — request deletion of data, subject to the physician's mandatory retention obligations described in Section 5.
Right to data portability — request your data in a structured, machine-readable format.
Right to complain — file a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any right, email telemedicine@jpdjr.com with subject "Privacy Request" and describe your request. We will respond within 15 business days.

8. Data Protection Officer

John Paulo D. Ramos, MD acts as the Personal Information Controller and Data Protection Officer for this service. Contact: telemedicine@jpdjr.com.

9. International Data Transfers

This service runs on Cloudflare, Inc. (edge hosting, encrypted storage) and uses Google LLC for an encrypted backup spreadsheet. These providers may process and store data on servers outside the Philippines under their own security and contractual safeguards. Communication occurs via Facebook Messenger (Meta Platforms, Inc.) and is subject to Meta's privacy policy.

10. Data Breach Notification

In the event of a personal-data breach that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected patients within 72 hours of knowledge of the breach, as required by RA 10173 and NPC Circular 16-03.

11. Consent & Truthfulness Declaration

By submitting the intake form, you:

Freely give, and specifically consent to, the collection and processing of your personal and health information as described in this policy.
Certify that all information provided is true, accurate, and complete to the best of your knowledge.
Understand that providing false or misleading information may void any issued document and may expose you to civil or criminal liability under applicable Philippine law.
Acknowledge that the final clinical decision to issue, withhold, or qualify any medical certificate or prescription rests solely with the licensed physician.
Understand that this service is for non-urgent concerns only, and that emergencies must be brought to the nearest emergency room immediately.

12. Policy Updates

This policy may be updated from time to time. The current version and effective date are shown at the top of this page. Continued use of the service after a material update constitutes acceptance of the revised policy. Material changes will be communicated via Messenger to active patients.