Privacy Policy

Scope and information we collect

eDonate is offered only in the Philippines and supports donor registration, screening, identity verification, appointments, blood requests and donation records. This notice covers the web application. The organization identified below determines the purposes of processing. Health facilities may have separate responsibilities and notices.

Depending on the service you request, we collect names, email addresses, phone numbers, birthdate, gender, address, blood type, screening answers, identity documents, appointment details, donation history and blood-request responses. Health information, age and government-issued identifiers can be sensitive personal information under Philippine law. Staff accounts contain identity, role and authentication information.

Security records include session identifiers, IP addresses, sign-in and administrative events. Passwords are hashed. Two-factor secrets and recovery credentials are security data. Google sign-in supplies a verified account identity and email. Optional AI messages and replies are stored and sent to Google when that service is enabled and you choose it.

Purposes and legal grounds

We use submitted details to provide requested donor services, arrange appointments, review identity and eligibility, coordinate blood requests, maintain donation records and protect accounts. We keep evidence of notice acknowledgment and specific consent choices. Accepting terms, acknowledging a notice and consenting to a processing purpose are separate concepts.

When relying on consent, we request an affirmative, specific choice before processing. The operator must document the applicable legal ground under Republic Act No. 10173, including a valid Section 13 condition for sensitive information. It must identify any applicable healthcare or public-sector mandate rather than treating a checkbox as a substitute. A mandatory field alone does not make processing lawful.

Optional maps, analytics and AI are not a condition of account access. Staff do not consent on behalf of donors by saving administrative forms. Do not submit another person's information without the necessary basis and authority.

Recipients and international processing

Access is intended for authorized donation staff, reviewers and administrators according to their roles. Hosting and email providers process information needed to operate the site. If approved and enabled, Firebase synchronization copies donor, location, appointment, notification and eligibility records to Google. Disabling synchronization does not erase earlier copies.

Google sign-in involves Google/Firebase when requested. Optional map tiles disclose your IP address and requested map area to OpenStreetMap. Approved geocoding uses barangay/city/province rather than a donor's street address. Optional Gemini chat sends the conversation to Google; it is for general navigation help and must not contain personal, confidential or medical information.

The operator must verify providers, countries, contracts, transfer safeguards and subprocessors before enabling these integrations. Consent alone is not an international transfer safeguard. No analytics or advertising provider is currently enabled. New recipients or tracking purposes require updating this notice and obtaining any required consent. Legally required disclosure is subject to appropriate checks and minimization.

Retention and protection

The application provides cleanup tools for expired codes, old read notifications and, when approved, rejected verification files. Chat messages have a configurable 30-day cleanup threshold. Deletion occurs only when the operator runs cleanup. Backups and provider copies have separate retention. Donation, medical, consent and audit records require a documented schedule covering legal duties, deletion, anonymization and legal holds.

Technical controls include role restrictions, password hashing, private document storage, validation and security logging. The operator must maintain encryption, patching, backups, access reviews, incident response and processor oversight. No system is risk-free. Incidents will be assessed and notified where applicable law requires.

Your rights and choices

Use the contact below to request information, access, correction, objection, blocking or erasure, portability where applicable, or withdrawal of consent. Identity checks should be proportionate. Rights may be limited by legal duties and other people's rights; the operator must explain a limitation. Withdrawal does not retroactively invalidate lawful processing. It may prevent continuation of the particular service that requires that processing.

Change optional browser choices through “Privacy choices” in the footer. Withdrawal stops future optional activity but cannot recall data already sent. Ask about removal of existing records and provider copies. You may complain to the Philippine National Privacy Commission.

Screening, minors and other jurisdictions

Automated screening assists staff and is not a diagnosis or a guarantee of donation eligibility. Request human review if you disagree with the result. Account creation and blood donation are limited to people who are at least 18 years old. eDonate does not offer minor or guardian-managed accounts. If the operator learns that a minor created an account, the account and associated information must be reviewed and handled under the approved deletion and legal-retention procedure. Gemini has separate age restrictions, and this integration is not offered in the donor portal.

The service is offered only in the Philippines. The operator must reassess applicable law before actively offering or monitoring the service elsewhere. If the GDPR later applies through establishment, offering services or monitoring within its territorial scope, the operator must document Article 6 and, for health data, Article 9 grounds, transfer safeguards, applicable response deadlines, supervisory authority contacts and any required representative or DPO. Worldwide access alone does not determine GDPR applicability.

Changes and accessible assistance

Material changes receive a new version and require fresh consent when processing purposes change in a way that requires it. Contact the operator for an accessible format, help exercising rights or an alternative to an inaccessible online step.

Operator and privacy contact

Responsible organization: City Health Office of Lipa City.

Postal address: City Hall Compound, Lipa City, Batangas, Philippines.

Privacy representative: John Merrick F. Fortis (Privacy representative).

Service territory: Philippines only.

Minimum age for account creation and blood donation: 18 years old. Accounts for minors are not offered.

Privacy, rights requests, complaints and accessibility assistance: fortismerrick@gmail.com.