LabNa Privacy Notice

Version: 2026-10-15 · Effective date: 15 October 2026

1. Who we are

LabNa, Philippines (online software service). LabNa is software for clinical laboratories. Labs use it to take bookings and release results to their patients.

For patient data, each lab is the personal information controller. The lab decides why and how your data is used. LabNa is the lab's personal information processor: we process it only on the lab's documented instructions, under a processing contract (RA 10173 Sec. 14; IRR Secs. 43–45). We don't use patient data for our own purposes.
For our own data (lab staff accounts, this website, our security logs), LabNa is the controller.
Data Protection Officer: dpo@labna.ph · General contact: hello@labna.ph
LabNa's registered Philippine business entity and address will be added here after registration.

2. What we process

For labs (patient data):

name, birthdate, mobile number, booking date and time
your privacy-notice acknowledgement and consent choices, with the time, notice version and IP address
if a parent, guardian or representative consents for you: their name and relationship to you (required for patients under 18)
your lab results, as a signed PDF the lab uploads (sensitive personal information)
records of who viewed, downloaded or changed a record, and of failed access attempts.

We don't collect health details at booking.

For ourselves: lab staff work email, name, role and lab; a staff mobile number, if the invite is sent by SMS; password (stored only as a hash); authenticator secret (encrypted); sign-in and security records; staff invite details; and website request data handled by Cloudflare.

3. How patient results are delivered

Only if you chose online results at booking. Otherwise you get your result in person at the lab.
We send an SMS that starts with "LabNa:". It has no result details, only a link.
The link carries an opaque, single-use token and works for 72 hours. To open it, you enter a one-time code (valid 5 minutes) sent by SMS, plus your birthdate.
Once your result opens, you have 15 minutes to view and download the PDF. The connection is encrypted (HTTPS).
You can stop online results for a booking at any time, on the result page or at the lab.

4. Who receives it, and where

Recipient	What	Where
Supabase	Stores the database and result PDFs	Planned to be hosted in Singapore
Cloudflare	Runs the app and website; handles data while requests are processed; DNS and security filtering; a small sample of the app's redacted log lines; forwards email sent to dpo@ and hello@	Cloudflare runs a global network; data and logs may be processed outside the Philippines
SMS provider	Sends the SMS (mobile number and SMS text: the link or the one-time code)	A Philippine SMS provider
Google (Gmail)	Receives the email you send to dpo@ and hello@, forwarded by Cloudflare	May be outside the Philippines
Your lab	Your records	—
Authorities	Only when the law requires	—

Transfers outside the Philippines. Your data may be transferred to Singapore (where the database is planned to be hosted), to wherever Cloudflare's network handles a request, and, for email you send us, to Google. We stay responsible for it. Supabase's data processing terms apply, and Cloudflare processes data under its standard terms. We use security measures to protect your data (DPA Sec. 21; IRR Sec. 50). We don't sell personal data.

5. How long it's kept

Patient records: the lab sets the period for each record type. The platform default for routine results is 10 years (at least 2); some record types are kept longer, and medico-legal records are kept permanently. Labs must not set periods shorter than DOH and PhilHealth rules require.
LabNa doesn't delete patient records on a schedule. Deletion is done on the lab's instruction.
Audit log: kept for a set retention period, and not deleted on a schedule.
Photo uploads in progress: pieces of an unfinished photo upload are deleted once it is completed, or automatically within about a day if it isn't (they expire after 24 hours and are cleared every 15 minutes).
Staff invites: if an invite isn't accepted before it expires, its email address and mobile number are cleared.
Staff accounts: while the account is active, and for a limited period after it is closed.

6. How we protect it

HTTPS; separation of each lab's data in the database; role-based staff access with two-step sign-in; one-time codes stored only as hashes; an append-only audit log; app logs that remove names, birthdates, phone numbers, emails, tokens and codes. LabNa's security is reviewed internally, covering sign-in, access controls and data protection.

7. Your rights

Under RA 10173 you can: be informed; access your data; object; have it corrected; have it blocked or erased; get a copy in a common format; withdraw consent; and claim damages.

Patients: please contact your lab first. The lab is the controller and decides on your request; LabNa helps the lab. If you write to us, we forward your request to your lab and don't answer it ourselves.
Lab staff: email dpo@labna.ph. Requests are free. We reply no later than 30 working days, plus 15 working days for complex requests (NPC Advisory 2021-01).
Complaints: you can complain to the National Privacy Commission: https://privacy.gov.ph/filing-a-complaint/ · complaints@privacy.gov.ph.

8. Breaches

If a breach affects patient data, we tell the lab within 12 hours of becoming aware, and the lab notifies the National Privacy Commission and affected patients within 72 hours when required. For data we control, we notify you and the Commission within 72 hours when required (IRR Sec. 38; NPC Circular 16-03).

9. Changes

We'll post any new version on this page with its effective date.

Abiso sa Privacy ng LabNa

Bersyon: 2026-10-15 · Petsa ng bisa: 15 October 2026

1. Sino kami

LabNa, Pilipinas (online software service). Ang LabNa ay software para sa mga clinical laboratory. Ginagamit ito ng mga lab para sa booking at pag-release ng results sa patients nila.

Sa data ng patient, ang bawat lab ang personal information controller. Ang lab ang nagpapasya kung bakit at paano ginagamit ang data mo. Ang LabNa ang personal information processor ng lab: ipinoproseso lang namin ito ayon sa nakasulat na instruction ng lab, sa ilalim ng processing contract. Hindi namin ginagamit ang data ng patient para sa sarili naming layunin.
Sa sarili naming data (staff accounts, website, security logs), ang LabNa ang controller.
Data Protection Officer: dpo@labna.ph · Pangkalahatang contact: hello@labna.ph
Idadagdag dito ang rehistradong business entity at address ng LabNa sa Pilipinas pagkatapos ng rehistro.

2. Ano ang ipinoproseso namin

Para sa lab (data ng patient): pangalan, birthdate, mobile number, petsa at oras ng booking; ang pagkilala mo sa privacy notice at ang mga consent mo (may oras, bersyon at IP address); pangalan at relasyon ng magulang, guardian o kinatawan kung siya ang pumayag para sa iyo (kailangan kung under 18); ang lab results mo bilang signed PDF (sensitive personal information); at record ng kung sino ang tumingin, nag-download o nagbago ng record. Walang health details sa booking.

Para sa amin: work email, pangalan, role at lab ng staff; mobile number ng staff, kung sa SMS ipapadala ang invite; password (hash lang ang naka-store); authenticator (naka-encrypt); sign-in at security records; detalye ng staff invite; at request data ng website na hawak ng Cloudflare.

3. Paano ipinapadala ang results

Kung pinili mo lang ang online results sa booking. Kung hindi, kunin nang personal sa lab.
May SMS na nagsisimula sa "LabNa:". Walang result details, link lang.
May opaque at single-use na token ang link, valid nang 72 hours. Para mabuksan, ilagay ang one-time code (valid nang 5 minutes) na dumating sa SMS, at ang birthdate mo.
Pagbukas, may 15 minutes ka para tingnan at i-download ang PDF. Naka-encrypt (HTTPS) ang koneksyon.
Puwede mong itigil ang online results para sa isang booking kahit kailan, sa result page o sa lab.

4. Sino ang tumatanggap at saan

Supabase: database at result PDFs; planong i-host sa Singapore.
Cloudflare: nagpapatakbo ng app at website at nagfo-forward ng email sa dpo@ at hello@. Global network ito, kaya puwedeng maproseso ang data at logs sa labas ng Pilipinas.
SMS provider: isang Philippine SMS provider ang nagpapadala ng SMS (number at text ng SMS).
Google (Gmail): tumatanggap ng email na ipinapadala mo sa dpo@ at hello@; puwedeng nasa labas ng Pilipinas.
Ang lab mo, at ang awtoridad kung hinihingi ng batas.

Puwedeng mapunta ang data mo sa labas ng Pilipinas: sa Singapore (planong lokasyon ng database), kung saan man pinapatakbo ng network ng Cloudflare ang request, at sa Google para sa email mo sa amin. Kami pa rin ang mananagot dito. May bisa ang data processing terms ng Supabase, at pinoproseso ng Cloudflare ang data ayon sa standard terms nito. May security measures kami para protektahan ang data mo (DPA Sec. 21; IRR Sec. 50). Hindi kami nagbebenta ng personal data.

5. Gaano katagal itinatago

Records ng patient: ang lab ang nagtatakda kada uri ng record. Default ng platform para sa routine results: 10 taon (hindi bababa sa 2); mas matagal sa ibang uri, at permanente ang medico-legal. Hindi puwedeng mas maikli sa hinihingi ng DOH at PhilHealth.
Hindi nagbubura ang LabNa ng records ng patient nang naka-schedule; sa instruction lang ng lab.
Mga piraso ng photo upload na hindi pa tapos: binubura kapag natapos ang upload, o kusa sa loob ng mga isang araw kung hindi (nag-e-expire pagkalipas ng 24 oras at nililinis kada 15 minuto).
Staff invites: kapag hindi natanggap ang invite bago ito mag-expire, binubura ang email address at mobile number nito.
Audit log: itinatago nang takdang panahon, at hindi binubura nang naka-schedule. Staff accounts: habang active, at nang limitadong panahon pagkatapos isara.

6. Paano namin ito pinoprotektahan

HTTPS; hiwalay ang data ng bawat lab sa database; role-based na access ng staff na may two-step sign-in; hash lang ang naka-store na one-time code; append-only na audit log; app logs na nag-aalis ng pangalan, birthdate, number, email, token at code. Sinusuri namin sa loob ng LabNa ang security nito, kasama ang sign-in, access controls at data protection.

7. Mga karapatan mo

Puwede kang: malaman; ma-access ang data mo; tumutol; ipatama ito; ipa-block o ipabura; makakuha ng kopya; bawiin ang consent; at humingi ng danyos.

Patients: kontakin muna po ang lab ninyo. Ang lab ang controller at nagpapasya sa request; tinutulungan ito ng LabNa. Kung sa amin kayo sumulat, ipapasa namin ito sa lab ninyo.
Lab staff: mag-email sa dpo@labna.ph. Libre ang request. Sasagot kami sa loob ng 30 working days, dagdag ang 15 working days kung komplikado.
Reklamo: puwede kayong magreklamo sa National Privacy Commission: https://privacy.gov.ph/filing-a-complaint/ · complaints@privacy.gov.ph.

8. Breach

Kung may breach sa data ng patient, sasabihan namin ang lab sa loob ng 12 oras, at ang lab ang mag-aabiso sa NPC at sa patients sa loob ng 72 oras kung kailangan. Sa data na hawak namin, aabisuhan namin kayo at ang NPC sa loob ng 72 oras kung kailangan.

9. Mga pagbabago

Ipo-post namin dito ang bagong bersyon kasama ang petsa ng bisa.