Privacy Policy

1. Who is responsible for your information

Bethlehem Animal Clinic & Grooming, located in Taytay, Rizal, is the personal information controller for customer information used in operating its services. Our address and telephone numbers appear in section 14. This notice is informed by Republic Act No. 10173, the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable National Privacy Commission guidance.

2. Information covered by this notice

Depending on your interaction with us, we handle customer account and contact details; pet profiles and care records linked to their owners; visit registrations, service preferences, and status history; billing and payment records; and information needed for verification, security, and communications. Not every category is required for every service.

We collect information you submit online or provide to staff, information recorded during a pet's visit, and transaction or delivery information returned by the providers used for that interaction. Please provide only information relevant to the account or service, and avoid including unrelated personal details in free-text notes or uploaded records.

3. Account and identity information

Customer signup requires first and last names, an email address, and a password. A username and mobile number are optional. Passwords are stored as hashes. We also process verification status, temporary verification and recovery credentials, account status, and session information to establish and protect access.

For completed customer registrations under the current terms, we record the accepted Terms version and acceptance time. This record demonstrates acceptance of the website agreement; it is not a record of blanket privacy consent. We do not add an IP address or browser fingerprint to this agreement record.

4. Pet profiles and care records

Pet records can include name, species, breed, sex, birthdate, color, weight, size, coat type, neutering information, medical conditions, and profile status. Related records can include vaccination details and supporting documents, consultations, clinical findings, treatments, diagnostic results, procedures, confinement, grooming preferences, progress, and service history.

Although these records concern an animal, they can identify its owner when linked to an account or document. We therefore handle the associated customer information under this notice. Records entered or verified by staff support care continuity and may differ from customer-entered information after professional review.

5. Why we process information and the lawful bases

• Account and requested services: to create and verify accounts, maintain pet records, process visit registrations, deliver clinic or grooming services, and manage billing. Processing needed for these arrangements is based on performing our agreement with you or taking steps you request before that agreement.
• Security and reliable operations: to prevent unauthorized access, limit abusive requests, reconcile transactions, and investigate problems. We rely on legitimate interests where appropriate, balanced against your rights.
• Legal responsibilities: to maintain required records, respond to lawful requests, and establish, exercise, or defend legal claims when applicable.
• Specific consent: where a processing activity requires consent, we must explain its purpose and obtain the appropriate consent separately. You may withdraw it, subject to the consequences explained for that activity and any other lawful reason to retain information.

Acknowledging this Privacy Policy confirms that the notice has been presented to you. It does not authorize every possible use of your information or replace consent needed for a particular purpose. Accepting the Terms and Conditions does not itself provide optional marketing consent or veterinary procedure consent.

6. Verification and service communications

We use your email for registration verification, sign-in confirmation, account recovery, security notices, and protected account changes. Our application sends transactional email through its configured email service; the clinic's documented delivery integration uses Brevo through SMTP. This involves the recipient address and the content necessary for the message.

Where enabled, mobile verification and grooming completion messages use iProgSMS. The provider processes the destination number and message content, with delivery information used to manage the request. Availability can depend on configuration, number eligibility, provider capacity, and network conditions. A mobile number is not verified simply because it was entered at signup.

Verification links, codes, and delivery records are used for account and service security. Required transactional messages are distinct from optional promotional communications. Do not share a password or security code with someone responding to a privacy inquiry.

7. Payments and payment processors

For billing, we record relevant services or products, quantities, amounts, payment method, transaction references, payment status, and receipt information. Cash payments are recorded by clinic staff. Where PayMongo online checkout is made available, the integration sends the order items, amounts, reference, and related transaction identifiers needed to create and reconcile checkout.

Payment credentials requested during hosted checkout are provided to PayMongo or the payment channel concerned. Bethlehem's checkout integration does not ask you to enter a full card number, card security code, or wallet password into the clinic portal. We retain transaction and reconciliation records, rather than those payment credentials. The provider's own notice explains its processing, verification, and retention practices.

8. Collection, use, and disclosure

Authorized clinic, grooming, and administrative staff use information relevant to their assigned work, such as handling registrations, delivering care, updating records, managing customer concerns, and collecting payments. Customer access is tied to authentication and ownership of the relevant records.

Information may be disclosed to the service providers needed for the activity, to a person you authorize, or to an authority when disclosure is required or otherwise permitted by law. Requests are assessed in context, including the purpose and information needed. Contact the clinic if a representative needs access on your behalf.

The platform uses automated checks for validation, account security, visit availability, queue status, and payment reconciliation. These support administration of your requests; they do not replace a veterinary professional's medical assessment. Ask the clinic to review an account or service issue that you believe is incorrect.

9. Hosting and external services

Our website deployment uses Hostinger hosting infrastructure. Hosting and technical support can involve processing stored account and service records to operate and maintain the site. Email, SMS, and payment providers process the information described above when those services are used. Provider infrastructure may be located outside the Philippines; applicable data protection responsibilities continue to apply to information entrusted to providers.

The public website also embeds an OpenStreetMap map. Loading it connects your browser to that service and can disclose technical request information, including your network address. Links to Facebook, map services, payment checkout, and other external sites are subject to those services' own notices. The legal-document pages do not require loading the map or signing in.

10. Cookies and browser storage

The platform uses necessary authentication cookies and temporary session information to maintain account access, bind registration verification to a browser, protect account changes, and support the “remember me” choice where selected. These features can retain a persistent sign-in credential when you choose to be remembered.

Browser session or local storage also supports registration continuation, temporary review details, and verification progress. These records support the interface; server verification still controls access. Blocking or clearing this storage can interrupt continuation or require you to sign in or verify again. Shared-device users should sign out and avoid choosing persistent sign-in.

11. Protecting information

Application safeguards include password hashing, role and ownership checks, protected authentication cookies, expiring verification credentials, request limits, and security-related activity records. Technical request information, including network addresses used for request limiting, helps protect verification and account access.

We take reasonable measures appropriate to the information and processing involved. No storage or transmission system is completely secure. Keep your credentials confidential, check the destination before entering payment information, and contact the clinic promptly about suspected unauthorized access or an unintended disclosure.

12. Retention and account deletion

Information is retained for as long as needed for the purpose for which it was collected, including account administration, care continuity, transaction reconciliation, lawful recordkeeping, and the handling of disputes or claims. The appropriate period depends on the record and any applicable obligation. Temporary registrations and verification credentials are subject to expiry and cleanup rather than indefinite availability.

Contact the clinic to request account closure or deletion of personal information. Depending on the request and applicable requirements, handling may include disabling access, removing information, or anonymizing records. Historical care, transaction, audit, or other records may need to remain for legitimate legal or operational purposes. A deletion request is assessed against those requirements; we do not promise immediate or permanent removal from every record or backup. Ask the clinic about the records and retention reasons relevant to your request.

13. Your data privacy rights

Subject to the conditions and exceptions under Philippine law, you may request information about processing and access to your personal data; seek correction of inaccurate information; object to processing; request blocking, removal, or destruction where applicable; and withdraw consent for processing that relies on it. You may also exercise applicable data portability rights, seek damages where legally warranted, and lodge a complaint with the National Privacy Commission.

These rights apply to your personal information and do not automatically require deletion of every pet-care or billing record. Some requests may affect our ability to maintain an account or provide a requested service. We will explain the applicable handling of your request and any lawful restriction.

14. Questions and requests about your information

Call the clinic or visit the address below and ask staff to route a privacy question or data-rights request to the person responsible for customer information. Describe the account or records concerned, the action requested, and how we can contact you. We may need proportionate identity or representative-authority verification before disclosing or changing protected information. Please do not send passwords, security codes, or unrelated identity documents.

If a concern remains unresolved, you may contact the National Privacy Commission through its official channels. Its guidance on the right to be informed explains the information you can request about processing.

15. Changes to this policy

We may revise this notice when services, processing arrangements, or legal requirements change. The effective and last-updated date above identifies the current notice. We will give appropriate notice of material changes and obtain separate consent when a new activity requires it. Contact the clinic if you need clarification about a change or how it affects your information.