Privacy Notice

VitalStats Philippines (“VitalStats”, “we”) runs this website and decides how the personal information you give us is used. Under the Data Privacy Act of 2012 (RA 10173) we are the personal information controller for that information.

Registered business name and address: [To be confirmed: registered business name and address]

Data Protection Officer: [To be confirmed: DPO name, email and phone]. Until then you can reach us through the contact page, by phone or Viber at 09278608705, or on Facebook at facebook.com/vitalstatswellness.

• Identity and contact details: your name, date of birth, sex, phone number, email address, or Facebook name.
• Delivery details: your delivery address and any delivery notes, when you order.
• Health information: height, weight, BMI, waist size, smoking and drinking habits, medical conditions, pregnancy status, surgeries, medications and allergies, when you book a consult. Prescriptions, when you order a product that needs one. The law treats health information as sensitive personal information.
• Order details: the products you order, amounts, payment method and order status. We do not store your card details; the payment provider handles them.
• Messages: what you write to us through the contact form or our other channels.
• Technical details: your IP address, used to limit spam and repeated submissions.

• To assess your consult and design a suitable program. Basis: your consent, given on the consult form, because this is health information.
• To process and deliver your order, take payment, and handle cancellations and refunds. Basis: our contract with you.
• To review a prescription for a product that needs one. Basis: your consent, given before you upload it.
• To answer your questions and send updates about your consult or order. Basis: your request and our contract with you.
• To keep records that tax and health regulations require. Basis: legal obligation.
• To keep the site safe from spam and abuse. Basis: our legitimate interest.

We do not sell your information, and we do not use it for advertising.

Only with the people and services we need to run the service, each for the purpose above:

• Our clinical team and pharmacist, to review consults and prescriptions.
• Our order management system, which our staff use to check stock, pack and ship your order.
• Couriers (such as Lalamove or J&T Express), who receive your name, phone number and delivery address.
• Our payment provider, which processes online payments.
• Google (Apps Script and Sheets), where our team keeps a working copy of consult requests.
• Resend, which sends our emails.
• Supabase and Vercel, which host our database and website.
• Vercel Analytics, which counts page visits without cookies. It sees request details such as your IP address, but we do not use it to identify you.
• Government authorities, only when the law requires it.

We keep your information only as long as the purpose needs it or the law requires. Consult records: [To be confirmed: retention period]. Order and payment records: [To be confirmed: retention period required by tax rules]. Contact messages: [To be confirmed: retention period]. After that we delete it or make it anonymous.

Your information is sent over encrypted connections and stored in access controlled systems. Only staff who need it for their work can see it, and health information is limited to our clinical team and pharmacist.

Under RA 10173 you have the right to:

• be informed about how your information is used (this notice);
• access the information we hold about you;
• correct information that is wrong or out of date;
• object to processing, and withdraw consent you gave (this does not undo processing already done);
• have your information erased or blocked when it is no longer needed or was processed unlawfully;
• get a copy of your information in a common electronic format;
• be compensated for damage caused by misuse of your information;
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, contact our Data Protection Officer (above). We will reply within [To be confirmed: response time].

When we change this notice we publish the new version here with a new date. Each form records the version you agreed to.