GoSlim Data Privacy Policy

Personal Information

As defined by the Data Privacy Act of 2012, refers to "any information, from which, the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify the individual."

Sensitive Personal Information

As defined by the Data Privacy Act of 2012, it refers to any personal information that is "(1) about an individual's race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) about an individual's health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; or (4) specifically established by an executive order or an act of Congress to be kept classified."

Data subject

As defined by the Data Privacy Act of 2012, refers to an individual whose personal information is processed. GoRocky's data subjects include but are not limited to the following:

• Customers and Patients – persons who accomplish the GoRocky Assessment Form and avail of GoRocky's services. This term shall likewise include persons who commence with accomplishing the Assessment Form but do not complete the same.
• Employees – persons who are employed in GoRocky.
• Doctors – persons who are employed by GoRocky or are engaged on a contractual basis.

Personal Information

GoRocky assures that all information you provide will be confidential and will be used within the bounds of applicable Philippine laws, rules, and regulations. When a) accomplishing our Assessment Form as a prerequisite to avail of our products and services, and/or b) engaging GoRocky for purposes of employment and/or lawful business transactions, your personal information will be collected to facilitate the necessary assessments by our healthcare providers and actions by our Operations Team to process and fulfill your transaction and pursuant to Section 12 (a), (b), (c), and (f). The personal information which we will collect from you and process may include:

Data Subjects' personal details including but not limited to:

• Name
• Address
• Occupation
• Email and
• Telephone/mobile number

Sensitive Personal Information

The following shall be classified as sensitive personal information which may be collected by our institution pursuant to Section 13 (a), (b), and (e):

• Age
• Current health conditions
• Past medications
• Medical History
• TIN
• SSS
• Philhealth
• HMO

Privileged Information

The following shall be classified as privileged information which may be collected by our institution pursuant to Section 13 (a) and (e):

• Health Declarations
• Family Health History
• Client Orders

Information with Third Parties

When necessary, we may seek to verify information obtained from you with third-party entities, such as government regulators, judicial, supervisory bodies, or other authorities.

Usage and Technical Data

In the course of using our GoRocky and GoSlim platforms, we may collect non-personal information such as your IP address, operating system, and other machine identifiers.

Other Data

Our platforms may utilize cookies to understand how data subjects use the same and improve their experience. Those that are necessary for communication applications such as Viber, Messenger, and the like, may likewise be collected and shall remain confidential and will be subject to the policy laid down in this Policy.

Identity Verification and Communication

• Verify identities and address individuals appropriately.
• Contact data subjects to confirm their purchase of goods or services.
• Contact data subjects who do not complete the assessment form.
• Notify designated persons about incidents or emergencies affecting data subjects.
• Provide communications regarding GoRocky's products, services and health-related information.

Operations, Services and Medical Consultations

• Approve, facilitate, administer, and process transactions.
• Provide telehealth services, including consultations, prescriptions, and related healthcare products.
• Process payments for services and products.
• Enhance the user experience.
• Analyze usage trends and improve our services.
• Respond to inquiries and provide customer support.
• Provide tailored support addressing customer/patient needs.
• Provide updates on order tracking via delivery or pick-up.

Health and Safety Management

• Maintain comprehensive medical records and provide individualized care.
• Determine health risks of customers/patients and manage medical history for appropriate action.
• Monitor patient safety and conditions following the use of GoRocky's products or services.

Employment and Personnel Management

• Identify individuals for employment records and personnel actions including hiring, timekeeping, and performance evaluations.
• Identify the personnel involved in workplace concerns and issues, allowing for a thorough investigation, resolution, and implementation of appropriate measures to address and prevent future grievances.
• Track work hours and ensure compliance with labor laws.
• Process salaries and manage mandatory benefits in accordance with labor laws.

Financial Administration

• Process transaction records for bookkeeping under tax laws.
• Collection of unpaid balances.

Legal Compliance and Safety

• Comply with applicable local and international laws.
• Establish accountability and ensure compliance with safety regulations.
• Establish proper information security.
• Monitor incident reports and safeguard the Data Subjects' rights.

Marketing and Promotional Use (should Data Subjects consent to the same)

• Promote new products, newsletters and services as well ongoing or future promotions.

You can opt-out of marketing communications at any time by contacting us or through the unsubscribe link in our communications.

Miscellaneous

• Perform acts in furtherance of GoRocky's obligations with the data subjects.
• Perform any other legally permitted activities or those with the explicit consent of data subjects.

Organizational

• DPO appointment and NPC registrations/notifications as required.
• Privacy by design/default in new systems; Privacy Impact Assessments (PIAs) for new or high-risk processing (e.g., EMR, CCTV, AI tools).
• Access governance: role-based access control (RBAC), least privilege, segregation of duties; no access to patient health data by non-clinical staff (Sales, General Ops, Tech).
• Implementation of internal policies for data protection.
• Training & awareness: onboarding and annual refreshers, confidentiality undertakings for all personnel.
• Processor oversight: due diligence, DSAs, security audits where appropriate.

Physical

Controlled facilities; visitor logs; locked storage for paper records with limited key custody; clean desk policy; secured shredding and media destruction; CCTV in common areas only.

Technical

• EMR: All patient records are stored in a secure EMR with audit trails, unique user accounts, session timeouts, encryption in transit and at rest, and export controls.
• Google Workspace hardening interim and ongoing: domain-restricted sharing, link-sharing disabled by default, DLP rules for health/ID data, 2-factor authentication (2FA/MFA), context-aware access, drive labels, and periodic permission reviews.
• Identity & access: strong passwords, MFA, periodic rotation; prompt de-provisioning on role change/exit; admin accounts segregated.
• Endpoint security: device encryption, screen-lock, anti-malware/EDR, auto-patching; MDM for corporate and BYOD.
• Network security: firewalling, secure configs, TLS, restricted ports, no public data buckets; logging and monitoring of privileged actions.
• Backups & recovery: encrypted, versioned backups; periodic restore tests; separate from production to prevent ransomware impact.
• Vulnerability & change management: regular patching; change approvals; periodic penetration tests or vulnerability scans; remediation tracking.