LiveBlood Privacy Notice

Effective date: Upon approval by the Oriental Mindoro Blood Council Version: 1.0

This notice explains how LiveBlood collects, uses, shares, and protects your personal information. It follows the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Who we are

LiveBlood is a blood donation platform for the province of Oriental Mindoro.

Personal Information Controller: Oriental Mindoro Blood Council, Oriental Mindoro Provincial Hospital, Brgy. Sta. Isabel, Calapan City, Oriental Mindoro 5200. The Council decides why and how your data is processed.

Personal Information Processor: Jhon Michael V. Gillado, developer of LiveBlood, who builds and maintains the system on behalf of the Council under a written agreement.

Data Protection Officer (DPO): Oriental Mindoro Blood Council Data Protection Office, [email protected], 0906 901 4001.

2. What we collect

Account information

• First name, middle name, last name
• Birth date
• Municipality of residence
• Email address and password (stored only as a secure hash, never readable by anyone)
• Blood type, if you know it
• Mobile number, if you choose to give one

Health information (sensitive personal information)

• Your answers to the donor health questionnaire
• Your eligibility result and any staff review notes
• Your donation history (date, place, blood type, units)

Location information

• Your device location, only when you tap "Use my location" or open the donation map with location turned on. We use it to find your municipality or to sort nearby drives. We do not track your location in the background and we do not store your exact coordinates.

Technical information

• A push notification token for your phone
• App version and basic error logs needed to fix problems

3. Why we use your data

We do not sell your personal data. We do not use it for advertising.

4. How the eligibility check works

The app checks your answers against donor rules set by the Council, such as age, weight, and time since your last donation. This check is a guide only. When your answers need a closer look, trained staff review them. The final decision on whether you donate is always made by the blood service staff or physician at the donation site. You may ask for a human review of any app result by contacting the DPO.

5. Who can see your data

• Council staff and authorized hospital or blood bank staff, only as their job requires. Every staff account has limited access based on its role, and every change to records is logged.
• Service providers that help run the system, each bound to protect your data:
  • Email delivery: Google (Gmail), to send verification codes and notices
  • Push notifications: Expo (United States), to deliver app notifications
  • Hosting and network security: Oracle Cloud and Cloudflare
  • Map tiles: OpenStreetMap, which receives the general map area your phone loads, not your account details
  • SMS: Semaphore, only if SMS alerts are turned on
• Government agencies, only when the law requires it, such as the Department of Health under the National Blood Services Act of 1994 (RA 7719).

Some providers store data outside the Philippines. We share only what each provider needs, and we require protection equal to Philippine law.

6. How long we keep your data

• Account information: while your account is active. If you delete your account, we delete or anonymize it within 15 days, except records the law requires us to keep.
• Health questionnaire answers and eligibility results: kept for the period required by Department of Health rules, as set by the Oriental Mindoro Blood Council.
• Donation records: kept for the period required by Department of Health rules, as set by the Oriental Mindoro Blood Council.
• Totals used for forecasting contain no names and may be kept longer.

7. How we protect your data

• Health questionnaire answers are encrypted in the database.
• Passwords are stored as one-way hashes.
• All connections use HTTPS encryption.
• Staff access depends on role, and every inventory and eligibility change is logged.
• If a breach puts your data at risk, we notify the NPC and affected donors within 72 hours of discovery, as NPC Circular No. 16-03 requires.

8. Donors aged 16 and 17

Donors aged 16 and 17 need the written consent of a parent or guardian before donating, as the National Blood Services Act requires. The app asks for this consent before the health questionnaire. People under 16 cannot create an account.

9. Your rights

Under RA 10173 you have the right to:

• Be informed about how your data is used
• Access your data and get a copy
• Correct wrong or outdated data
• Object to processing, including the app's automated eligibility check
• Withdraw your consent at any time
• Have your data deleted or blocked when it is no longer needed or was processed unlawfully
• Receive your data in a format you can take elsewhere (data portability)
• Claim damages for harm caused by misuse of your data
• File a complaint with the National Privacy Commission (privacy.gov.ph)

To use any of these rights, open Profile, Settings, then Privacy and data in the app, or email the DPO at [email protected]. We reply within 15 working days. Withdrawing consent does not undo processing done before you withdrew it, and records the law requires us to keep stay on file.

10. Changes to this notice

When we change this notice, we update the effective date and tell you in the app before the change applies. Major changes need your consent again.

11. Contact

Data Protection Officer: Oriental Mindoro Blood Council Data Protection Office Email: [email protected] Phone: 0906 901 4001 Address: Oriental Mindoro Provincial Hospital, Brgy. Sta. Isabel, Calapan City, Oriental Mindoro 5200

Questions about your data? Contact the Oriental Mindoro Blood Council: 0906 901 4001.