Privacy Policy

Who handles your information

This notice covers personal information connected with www.obra.health under Philippine data-protection law. Obra Health Inc. operates the technology platform and coordinates privacy requests. Independent medical consultants provide clinical care, and ObraRx Inc. provides pharmacy services. Each has responsibilities for its actual processing activities; common ownership does not authorize unrestricted sharing.

Information used and why

Depending on the service, information may include your identity and contact details, account information, health questionnaires, consultation notes, test results, prescriptions, dispensing and delivery records, payment references, support messages, consent choices and security logs. Information comes from you, the professionals involved in your care and the services used to fulfill your requests.

Relevant information is used to coordinate appointments, assess and provide care, validate and fulfill prescriptions, verify payments, process refunds, respond to requests, maintain security and meet recordkeeping duties. We explain which information is required and how withholding it affects the requested service.

Ordinary personal information may be processed where necessary for a contract, a legal duty, valid consent or a properly assessed legitimate interest. Health and other sensitive information require a separate lawful condition. We obtain specific consent where required; clinical processing may use the medical-treatment condition where its requirements are met. Agreement to website terms is not unlimited permission to use health information.

Sharing and service providers

Relevant recipients may include your identified clinician, ObraRx, authorized support staff and contracted technology, communications, payment and delivery providers. Sharing is limited to the stated purpose and appropriate information; a courier does not need your full clinical history. Information may also be disclosed where lawfully required by an authority.

Provider arrangements must address authorized use, confidentiality, security and incident handling. Processing outside the Philippines does not remove the responsible organization’s accountability. You may ask our privacy contact about the recipients and processing arrangements relevant to your records.

Choices, cookies and recording

Optional marketing requires a separate choice. You may withdraw it through care@obra.health without ending your care. General service consent does not authorize use of identifiable health information for advertising, unrelated research or AI-model training. Advertising measurement runs only with your optional-cookies choice and is described under optional analytics and advertising measurement.

Any non-essential cookies or tracking tools require appropriate notice and choices based on their actual use. Their purposes, providers and retention details are explained where the choices are presented.

Clinical notes are part of documenting care. Recording a consultation is a separate decision. If recording is offered, we first explain what is captured, its purpose, access, storage, retention and withdrawal arrangements and obtain each participant’s prior consent. Declining recording does not remove the need for clinical notes. Optional recording consent does not authorize public sharing or marketing.

Optional analytics and advertising measurement

If you are 18 or older and accept optional cookies, Google Analytics measures visits using a browser identifier, device information and page views. We send page addresses without query strings or fragments and only the origin of referring websites. Google advertising personalization and automatic form measurement are disabled. Analytics cookies expire after 60 days without renewal; Google’s event and user data retention is set to two months. Aggregated reports may remain available longer. See how Google uses information from websites.

The same choice lets us measure our advertising with Meta (Facebook and Instagram), TikTok and Google Ads. Their tools run on our public pages, the assessment and calculators, and the sign-in, account home, booking and checkout pages. They do not run on the medical history, order pages or the clinician and operations portals. They receive browser identifiers, device information, your IP address, the page address and that a step happened: a page view, starting or submitting the assessment, booking a consultation, a doctor’s approval, opening checkout, and a verified payment with its amount. Our servers also send these steps with your email address and mobile number in hashed form so the platform can match them to an account you may hold with it. We do not send questionnaire answers, measurements, calculator inputs, medicines, doses, clinical decisions or documents. The platforms may use what they receive under their own terms, and processing may occur outside the Philippines. See Meta’s privacy policy, TikTok’s privacy policy and how Google uses advertising data.

The same choice enables Microsoft Clarity on eligible public information pages to show clicks, scrolling and masked session recordings. All text is masked. Clarity is excluded from the homepage with its weight calculator, doctor inquiry pages, health intake, calculators and patient, clinician and operations portals. It is also excluded when a page address or referring address contains query parameters or fragments. We do not identify visitors to Clarity using account or contact details. Microsoft receives browser identifiers, device information and public-page activity; processing may occur outside the Philippines. Recordings are normally kept for 30 days; heatmaps, click data and retained sessions can remain for up to nine months. See Microsoft’s privacy statement and Clarity retention details.

None of these tools loads, and we send nothing to these platforms, before you accept. Declining has no effect on your care or access to this website. Your choice is stored in this browser for up to six months. Use “Cookies” in the footer and reject optional cookies to withdraw consent; the page reloads to stop the tools, removes their accessible cookies and stops our servers sending further events about you. Withdrawal stops future collection and does not automatically erase activity already received by the providers. Contact care@obra.health for privacy requests. Existing essential service and security records remain separate from these optional tools.

Security and retention

The responsible organizations must use appropriate safeguards for the information they handle. No system is completely risk-free. Security incidents are assessed and legally required notifications are provided.

Records are kept for their justified service, legal and evidentiary purposes, then securely deleted or irreversibly anonymized, subject to lawful preservation requirements. Account closure does not automatically delete clinical, pharmacy or tax records. We explain relevant retention requirements and exceptions when responding to a request. Recordings require a separate retention rule and are not automatically kept as long as clinical notes.

Your rights and contact

Subject to applicable conditions, you may request information, access, correction, erasure or blocking; object to processing; withdraw consent; exercise portability rights; and seek remedies, including a complaint to the National Privacy Commission. We may reasonably verify your identity before releasing information.

Withdrawal does not invalidate earlier lawful processing. We explain whether another legal ground requires continued retention or whether withdrawal affects a requested service.

Email care@obra.health with the subject “Privacy request.” Joachim del Castillo is Obra Health Inc.’s interim privacy officer. Obra Health coordinates requests with the organization responsible for the records, including the treating consultant or clinical-record custodian and ObraRx for pharmacy records.

You may write to Obra Health Inc., Unit 10-01, One Global Place, 5th Avenue corner 25th Street, Fort Bonifacio, Taguig City, NCR 1630. ObraRx Inc. is at Unit 2709, Medical Plaza Ortigas, San Miguel Avenue, Brgy. San Antonio, Pasig City. For regulatory information and complaints, visit the National Privacy Commission.

We publish material changes to this notice and seek fresh consent where required.