Legal

Privacy notice

This notice explains what the clinic records when you use md-k.com, why, who can see it, how long it is kept, and what you can ask us to do with it. It is written for the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

Effective 21 October 2026. Last updated 21 October 2026.

1. Who is responsible

The personal information controller is Dr. Katheryne Castillo, MD, practising as La Peau Parfaite Medical Clinic, Laoag City, Ilocos Norte, Philippines. The clinic decides what is collected on md-k.com and why.

Data protection contact: doctor@md-k.com, marked "Privacy". This is the address to use for any request about your information.

2. What we collect

When you use the free consultation or an appointment request, we record:

What	Detail
Identity and contact	Name, mobile number, and email address if you choose to give one.
Your answers	What you would like to improve, how long it has lasted, what you have tried, where you are, whether you prefer in clinic or online, your timing, and, for aesthetic treatments, whether a price range is workable.
Health information	The free-text box may contain health details you choose to type. Under Philippine law this is sensitive personal information, and it is treated as such. Please do not send photographs, test results, or identity documents in that box; we will ask for them properly if they are needed.
Technical	The browser and device you used, and a salted, truncated hash of your IP address used only to stop spam and repeated submissions. The raw IP address is not written to the database, and the hash expires within an hour.
Consent record	Which consents you ticked, and when. We keep this so we can show that your information was collected lawfully.

We do not use advertising trackers, we do not build a profile of you across other websites, and we do not buy or sell contact lists.

3. Why, and on what legal basis

• To assess your request and decide whether the clinic is a suitable fit for what you need, and to tell you honestly if it is not.
• To contact you about that request, by phone, message or email, including so Dr. Castillo can arrange a time with you.
• To keep a record of the request and of your consent, and, if you become a patient, to open and maintain your medical record.
• To keep the website working: preventing spam, automated submissions and abuse.

Our legal bases are your consent (RA 10173, section 12(a)) for your contact details and answers, and your explicit consent (section 13(a)) for the health information you choose to type, given for the purpose of medical assessment and the arrangement of your care. You may withdraw consent at any time, and we will stop processing and delete what is not required to be kept; see your rights.

4. What is required and what is optional

The name and mobile number are required, because without them the clinic cannot assess or answer the request. The email address is optional. The four consent boxes on the free consultation are required, because without them we may not lawfully collect health information or contact you; if you prefer not to tick them, simply do not send the form.

5. Who sees it

• Dr. Castillo and clinic staff who deal with requests and appointments. Access is limited to what the task requires.
• Service providers ("processors") who host and run the systems, under contract and only on our instructions: Cloudflare (website hosting, database and spam protection), Resend (sending the clinic's emails), and, when a request is a fit, Telegram (a short notification to the doctor's own device). The Telegram notification contains your name, number, the type of visit and a one-line summary, not the free-text health details.
• Nobody else, unless you ask us to share it with another doctor, or the law requires it (for example a court order, a public health reporting duty, or a regulator exercising a lawful power).

We never sell your information, and we never share it with advertisers or data brokers.

6. Where it is stored

The website and its database are hosted by Cloudflare on infrastructure outside the Philippines, and notification emails are delivered by a provider in the United States. Your information is therefore transferred outside the Philippines. We transfer it on the basis of your consent, with providers bound to confidentiality and security obligations, and the clinic remains accountable for it under RA 10173.

7. How long we keep it

• A free consultation that does not lead to care: kept for up to 12 months, so the clinic can answer if you write again, then deleted.
• An appointment request: kept while it is active and for up to 12 months afterwards.
• A medical record, once you are a patient: kept for the period required of a medical practice in the Philippines, which is longer than the periods above. Clinical records are not deleted early, because the law and your own safety require them to be available.
• Spam and rate-limit data: an hour at most.

You may ask us to delete your information sooner, and we will do so unless we are required to keep it, in which case we tell you why.

8. Your rights

Under the Data Privacy Act you have the right to:

• Be informed that your information has been collected and how it is used (this notice).
• Access the information we hold about you, and be given a copy.
• Correct anything inaccurate or incomplete.
• Object to processing, and withdraw consent at any time.
• Erase or block your information, subject to what the clinic must keep by law.
• Data portability, in a structured and commonly used format.
• Complain to the National Privacy Commission, and to be indemnified for damages if your rights are violated.

To exercise any of these, write to doctor@md-k.com with "Privacy" in the subject. We answer within 15 working days, and we may ask you to confirm your identity so we do not hand your information to someone else.

If you are not satisfied with our answer, you may complain to the National Privacy Commission (privacy.gov.ph).

9. How it is protected

• The site and its API are served over HTTPS only, with strict transport security.
• Access to the clinic's systems requires authentication; patient records are gated by role.
• The review of a borderline lead uses a signed, expiring link that is emailed only to the clinic's reviewer. It is not a public page and it is excluded from search engines.
• Submissions are rate limited, screened for automated abuse, and deduplicated so a retry cannot create a second record.
• If a personal data breach occurs that requires notification, we notify the National Privacy Commission and the affected individuals as the law requires.

10. Cookies and storage on your device

md-k.com does not use advertising or analytics cookies to track you across sites. It does use your browser's local storage, on your own device only, for two practical reasons: to remember answers you typed in case the connection drops, and to keep your booking reference for 48 hours so you can check it. You can clear this at any time from your browser settings, and the site keeps working.

11. Minors

The free consultation may only be sent by someone aged 18 or over, or by a parent or legal guardian acting for a minor. Where a minor's information is involved, the guardian's consent is required, and the clinic may ask for evidence of the guardianship before any treatment.

12. Changes

If we change how we use your information, we update this notice and the date at the top of the page. A change never applies retrospectively to information already collected for a purpose you consented to; if a new purpose needs consent, we ask for it.

13. Contact

Privacy questions, access requests, corrections, deletions, or a complaint about how your information was handled:

See also the terms of use, which explain what the free consultation is and is not.