1. Introduction
CareConnect PH respects your privacy. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
By using the Service you confirm that you have read this policy.
2. Who is responsible for your data
The personal information controller is CareConnect PH, a business based in the Philippines (business registration in progress). Contact: support@careconnectph.net. Our Data Protection Officer can be reached at the same address (see section 13).
3. Personal data we collect
| What | Examples | From |
|---|---|---|
| Account | Username, email, password (stored only as a secure hash by Firebase), sign-in method (email or Google) | You, when you sign up |
| Private details | Real name, birthday, phone number, home address | You, in My details |
| Profile | Photo, bio, skills, rates, experience, portfolio photos, approximate area | You |
| Location | Saved home or task location; your phone's GPS only when you allow it (for example the Live GPS switch on the task map) | You or your phone |
| Activity | Tasks, offers, agreements, ratings (both ways), app reviews, disputes, reports, blocks | Created as you use the app |
| Messages and calls | Chat messages and photos. In-app voice calls are not recorded; we keep only who called and when | Created as you use the app |
| ID and skill checks | Government ID photo and number, a selfie holding the ID, clearances, licenses and skill proof photos | You, when you get verified |
| Payments | Wallet balance, top-ups, withdrawals, held and released payments, fees, GCash reference numbers. We do not see or keep your GCash PIN or card numbers. During the free launch period the wallet is off: clients pay providers directly and we keep only the agreement and whether each side tapped Paid | You, PayMongo, the app |
| Device and technical | Browser and device type, IP address, sign-in times, push notification token for each phone | Your phone, automatically |
4. Why we use it
We use your data only for these purposes:
- Your account: to sign you in and keep your account secure;
- Matching: to show nearby tasks and providers, on a list or a map;
- Talking: chat, in-app calls, notifications and service emails;
- Payments: to hold, release, refund and record payments and fees;
- Trust and safety: to check IDs and skills, spot scams, hide illegal posts, handle reports, blocks and disputes;
- Improving the app: to find bugs and understand which features are used;
- The law: to keep tax and payment records and answer lawful requests.
5. Legal basis
Under Sections 12 and 13 of RA 10173, we rely on one or more of these:
- Consent, which you give when you sign up and when you turn on things like GPS or push notifications;
- Contract, to provide the Service you asked for;
- Legal obligation, such as keeping tax records;
- Legitimate interest, such as preventing fraud and keeping the Service safe, balanced against your rights.
7. How long we keep it
- Active accounts: while your account is open.
- Closed accounts: the account is turned off and kept for 30 days so it can be restored, then erased, except records we must keep. See how to delete your account.
- ID documents: kept while your account is open so your badge stays valid. When you upload a new copy of a document, the old file is deleted. If a document is rejected, its photo, selfie and ID number are deleted 30 days after the rejection; we keep only the fact that it was rejected. When an account is erased, its ID photos and ID numbers are erased with it, except that we keep the ID number of a banned account so it cannot be used to open a new one.
- Chats and agreements: up to 5 years after the last activity, to help settle disputes.
- Payment and tax records: 10 years, as the National Internal Revenue Code requires.
- Inactive accounts: may be deleted or made anonymous after 5 years without use.
8. Data stored outside the Philippines
Our service providers may store and process data outside the Philippines, mainly in Singapore, the United States and the European Union. When data leaves the Philippines we use providers that offer contract terms to protect it (for example Google's data processing terms).
You can read Google's privacy practices at policies.google.com/privacy.
9. How we protect it
- all data travels over HTTPS;
- Google Cloud encrypts stored data;
- security rules let each user read only what they are allowed to see; ID documents are visible only to the owner and our review team; files attached to an agreement are visible only to the client, the provider and our review team;
- our records are backed up automatically every day, and backups stay inside Google Cloud;
- admin accounts use two-step login;
- we watch for errors and unusual activity.
No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and the NPC within 72 hours, as the law requires.
Your part. Keep your password and GCash PIN to yourself, use a strong password, and do not share your account. We are not responsible for loss caused by sharing your own login, or for what other users do with information you choose to give them in a chat or on your profile, to the extent the law allows.
10. Your rights
Under RA 10173 you have the right to:
- be informed about how we use your data;
- access a copy of your data (Settings, then Policies, then Download my data, or ask us);
- correct wrong or outdated data;
- object to processing based on legitimate interest or for marketing;
- erase or block data that is outdated, unlawful or no longer needed;
- data portability: get your data in a common format;
- damages for harm from wrong or unauthorized use of your data;
- complain to the National Privacy Commission.
To use any of these rights, email support@careconnectph.net with the subject "Privacy request". We reply within 2 business days and resolve requests within 30 days.
12. Children
CareConnect PH is only for people 18 and older. We do not knowingly collect data from minors. If you think a minor has an account, tell us and we will delete it.
13. Data Protection Officer and privacy contact
CareConnect PH has a Data Protection Officer (DPO) who makes sure we follow the Data Privacy Act and who answers privacy questions and requests.
To reach the DPO, email support@careconnectph.net with the subject "Privacy request". We aim to reply within 2 business days.
14. National Privacy Commission
If you believe your privacy rights were violated and we did not fix it, you may complain to the National Privacy Commission:
- 5th Floor, Philippine International Convention Center (PICC), Vicente Sotto St., Pasay City, Metro Manila 1307
- Website: www.privacy.gov.ph
- Email: info@privacy.gov.ph
15. Changes to this policy
We will update the date at the top when this policy changes, and tell you in the app or by email about important changes. If you keep using the Service after that, the new policy applies.