Legal
Data Privacy Policy
Last updated:
Governing Law
RA 10173
Data Privacy Act of 2012 (Philippines)
Clinical Records
10 years
Minimum retention from last appointment
Response Time
15 days
For data subject rights requests
Lumivé Wellness is committed to protecting your personal information and respecting your privacy rights under the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations. This Data Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have as a data subject. By using our website or engaging our services, you acknowledge that you have read and understood this policy.
1. Who We Are
Lumivé Wellness is a registered nurse-led wellness service operating in the Philippines. We act as the Personal Information Controller (PIC) in respect of the personal data we collect from clients, prospective clients, and website visitors. Our Data Protection Officer may be contacted at [email protected] or via WhatsApp at +63 945 277 8000.
2. Personal Information We Collect
We collect the following categories of personal information: Identity and contact information — your full name, date of birth, email address, mobile number, and home or hotel address for concierge appointments. Health and medical information — your current medications, known allergies, existing medical conditions, recent surgeries or procedures, pregnancy status, and other health background details relevant to your clinical assessment. Booking and transaction information — your service preferences, appointment history, consultation notes, and payment records. Communications — messages, enquiries, and correspondence you send to us via our website, WhatsApp, email, or social media. Website usage data — IP address, browser type, pages visited, and session duration, collected via standard web analytics tools. We collect only the information that is necessary for the purposes described in this policy.
3. Sensitive Personal Information
Health and medical information constitutes sensitive personal information under the Data Privacy Act of 2012. We collect and process this information solely for the purpose of conducting clinical suitability assessments and delivering safe, personalised wellness services. We apply heightened security and access controls to all sensitive personal information. Your sensitive personal information will not be shared with third parties except as described in Section 6 of this policy or as required by law.
4. How We Use Your Information
We use your personal information for the following purposes: to process and confirm your booking requests; to conduct pre-treatment clinical suitability assessments; to deliver and personalise our wellness services; to communicate with you about your appointments, membership, and enquiries; to send service-related notifications and reminders; to maintain accurate clinical and administrative records; to comply with our legal and regulatory obligations; to improve our services and website; and to respond to feedback, complaints, or enquiries. We will not use your personal information for any purpose that is incompatible with the purposes for which it was collected without your prior consent.
5. Legal Basis for Processing
We process your personal information on the following legal bases: your consent, which you provide when submitting a booking form or enquiry; the performance of a contract, where processing is necessary to deliver the services you have requested; compliance with a legal obligation, where we are required by law to process or retain certain information; and our legitimate interests, where processing is necessary for the proper administration of our business and does not override your privacy rights.
6. Sharing Your Information
We do not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances: with our registered nurses, clinical staff, and wellness practitioners who need it to deliver your services; with trusted service providers who assist us in operating our website and business (such as booking platforms, payment processors, and cloud storage providers), under strict data processing agreements; with regulatory authorities, law enforcement, or courts where we are legally required to do so; and with your consent, where you have expressly agreed to a specific disclosure. All third parties with whom we share personal information are required to handle it in accordance with applicable data privacy laws.
7. Data Retention
We retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, to maintain accurate clinical records, and to comply with our legal obligations. Clinical and health records are retained for a minimum of ten (10) years from the date of your last appointment, in accordance with applicable healthcare record-keeping requirements. Booking and transaction records are retained for a minimum of five (5) years. Marketing consent records are retained until you withdraw your consent. When personal information is no longer required, we securely delete or anonymise it.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include access controls limiting information to authorised personnel only; encryption of sensitive data in transit and at rest; secure storage of physical and digital records; regular review of our security practices; and staff training on data privacy and confidentiality obligations. While we take all reasonable steps to protect your information, no method of transmission over the internet is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.
9. Your Rights as a Data Subject
Under the Data Privacy Act of 2012, you have the following rights in respect of your personal information: the right to be informed about how your data is collected and used; the right to access a copy of the personal information we hold about you; the right to correct inaccurate or incomplete personal information; the right to erasure or blocking of personal information that is no longer necessary, was collected unlawfully, or where you have withdrawn consent; the right to object to the processing of your personal information on legitimate grounds; the right to data portability, to receive your personal information in a structured, commonly used format; the right to lodge a complaint with the National Privacy Commission (NPC) if you believe your rights have been violated; and the right to damages for any injury suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal information. To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within 15 business days.
10. Cookies and Website Analytics
Our website uses cookies and similar tracking technologies to improve your browsing experience and understand how visitors use our site. Cookies are small text files stored on your device. We use essential cookies necessary for the website to function, and analytics cookies to collect aggregated, anonymised data about website usage. You may disable cookies through your browser settings; however, doing so may affect the functionality of certain parts of our website. We do not use cookies to collect sensitive personal information or to track you across third-party websites for advertising purposes.
11. Third-Party Links
Our website may contain links to third-party websites, including our social media profiles on Instagram and Facebook. This policy does not apply to those third-party websites. We encourage you to review the privacy policies of any third-party sites you visit. Lumivé is not responsible for the privacy practices or content of third-party websites.
12. Children's Privacy
Our services are intended for adults aged 18 years and above. We do not knowingly collect personal information from individuals under the age of 18 without the consent of a parent or legal guardian. If you believe we have inadvertently collected personal information from a minor, please contact us immediately and we will take steps to delete that information.
13. Changes to This Policy
We may update this Data Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. The date of the most recent revision is shown at the top of this page. We will notify existing clients of material changes by email or through a notice on our website. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.
14. Contact and Complaints
If you have any questions, concerns, or complaints about this policy or the way we handle your personal information, please contact our Data Protection Officer at [email protected] or via WhatsApp at +63 945 277 8000. If you are not satisfied with our response, you have the right to lodge a complaint with the National Privacy Commission of the Philippines at www.privacy.gov.ph.
Your rights
Want to access, correct, or delete your data?
Submit a data subject rights request and we will respond within 15 business days.
Complaints may also be lodged with the National Privacy Commission