Data Privacy Policy and Privacy Notice
Reference copy · PHSL-DPP-2026-01 · 1.0 (Original Adoption)
Read the current effective privacy noticePH STROKE LAB
Precision Technique Program
DATA PRIVACY POLICY
AND PRIVACY NOTICE
Governing all processing of personal data by PH Stroke Lab, including the website, the swimmer portal, and every phase of the Precision Technique Program Adopted pursuant to Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the circulars and advisories of the National Privacy Commission.
| Field | Entry |
|---|---|
| Document reference | PHSL-DPP-2026-01 |
| Document title | Data Privacy Policy and Privacy Notice |
| Version | 1.0 (Original Adoption) |
| Personal Information Controller | PH Stroke Lab |
| Executed by | Jerard Dominic S. Jacinto, Founder and Data Protection Officer |
| Date of adoption | ______________________, 2026 |
| Date of effectivity | ______________________, 2026 |
| Next scheduled review | Twelve (12) months from the date of effectivity |
| Companion instruments | PHSL-DRP-2026-01 (Data Retention Policy); PHSL-DUP-2026-01 (Data Usage Policy); PHSL-VCP-2026-01 (Video, Image and Footage Consent Policy and Notice) |
| Status | Adopted as a sworn instrument and published in full on the PH Stroke Lab website and Portal. |
1. DECLARATION OF POLICY
1.1 Statement. PH Stroke Lab recognizes that the right to privacy of communication and correspondence, and the right to the protection of personal data, are fundamental rights guaranteed by Article III, Sections 2 and 3 of the 1987 Constitution of the Republic of the Philippines and given effect by the Data Privacy Act of 2012, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.
1.2 The Nature of the Data Held. PHSL is a specialist swimming technique and measurement program. The ordinary conduct of that program requires PHSL to collect the health information of children, to record video footage of children in swimwear, to measure and score their bodies in motion, and to retain those records over time. PHSL treats this as processing of the highest sensitivity. Every provision of this instrument is written on the understanding that the persons whose personal data PHSL holds are, in the main, minors, and that the trust placed in PHSL by their parents and legal guardians is not transferable, not renewable, and not recoverable once broken.
1.3 Primacy of the Swimmer. Where any provision of this instrument is capable of two interpretations, the interpretation more protective of the Swimmer prevails. Where compliance with a procedural requirement of this instrument would conflict with the immediate welfare or safety of a Swimmer, the welfare and safety of the Swimmer prevails, and the deviation shall be documented and reported to the Data Protection Officer within twenty-four (24) hours.
1.4 Binding Effect. This instrument binds PHSL, its Founder, and every coach, specialist, contractor, volunteer, and administrative person engaged by PHSL, and every third party engaged to process personal data on its behalf. Adherence is a condition of engagement with PHSL.
2. PERSONAL INFORMATION CONTROLLER AND DATA PROTECTION OFFICER
2.1 Identity of the Controller. The Personal Information Controller ("PIC") for all processing described in this instrument is PH STROKE LAB ("PHSL"), a specialist swim technique and measurement program organized and operating under the laws of the Republic of the Philippines, represented by its Founder, Jerard Dominic S. Jacinto.
2.2 Contact Details. All communications relating to this instrument, including the exercise of any right of a data subject, may be addressed as follows:
| Field | Entry |
|---|---|
| Personal Information Controller | PH Stroke Lab |
| Represented by | Jerard Dominic S. Jacinto, Founder |
| Registered or operating address | _________________________________________________ |
| Electronic mail for privacy matters | jaojacinto2@gmail.com |
| Mobile number | +63 961 750 3272 |
| Data Protection Officer | Jerard Dominic S. Jacinto (concurrent capacity) |
| Website | _________________________________________________ |
| Swimmer Portal | _________________________________________________ |
2.3 Designation of the Data Protection Officer. PHSL designates Jerard Dominic S. Jacinto as its Data Protection Officer in concurrent capacity with his role as Founder, in accordance with NPC Advisory No. 2017-01. PHSL discloses that this concurrence is a consequence of its present size and undertakes to designate an independent Data Protection Officer, or a Compliance Officer for Privacy reporting to a Data Protection Officer, upon the engagement of additional administrative personnel. The Data Protection Officer shall not be penalized for the performance of his statutory functions, and no instruction shall be given to him as to the manner in which he discharges them.
2.4 Disclosure as to Business Registration. PHSL discloses that, as at the date of adoption of this instrument, its business registration with the Department of Trade and Industry and the Bureau of Internal Revenue is in process. This instrument is accordingly executed by Jerard Dominic S. Jacinto in his personal capacity and as the natural person operating under the business name "PH Stroke Lab," and the obligations assumed in it are assumed by him personally. Upon completion of business registration, this instrument shall be re-executed in the name of the registered entity, without diminution of any obligation assumed or of any right of a data subject accrued under this version.
2.5 Registration Status with the National Privacy Commission. PHSL employs fewer than two hundred fifty (250) persons and processes the sensitive personal information of fewer than one thousand (1,000) individuals. PHSL nonetheless acknowledges that its processing involves the health information and video footage of children and involves transfer outside the Philippines, and may therefore be characterized as processing likely to pose a risk to the rights and freedoms of data subjects within the meaning of Section 5 of NPC Circular No. 2022-04. PHSL therefore undertakes to register its Data Processing System and its Data Protection Officer with the National Privacy Commission through the National Privacy Commission Registration System, and, in the event registration is ultimately determined not to be required, to execute and file the sworn declaration prescribed by that Circular. PHSL shall in every case file the Annual Security Incident Report on or before the thirty-first (31st) day of March of each year, reporting nil where no incident occurred during the covered period.
3. SCOPE AND APPLICATION
3.1 Covered Processing. This instrument applies to all processing of personal data by PHSL, whether by automated means or otherwise, and whether carried out within or outside the Republic of the Philippines, including processing conducted through:
(a) the PHSL public website and any subdomain, landing page, or form hosted on it;
(b) the PHSL swimmer Portal, including account registration, video upload, session records, progress views, and messaging;
(c) the enrollment, discovery call, waiver, invoicing, receipting, and scheduling processes;
(d) in-pool sessions of the Program, including diagnostic observation, video recording, measurement, and scoring;
(e) the online phase of the Program, including video review, mental conditioning, mobility prescription, and check-ins;
(f) electronic mail, Short Message Service, Facebook Messenger, calendar booking systems, and other channels used by PHSL to correspond with Swimmers, Guardians, and partner organizations; and
(g) the internal technical knowledge library maintained by PHSL.
3.2 Covered Data Subjects. This instrument protects Swimmers enrolled in, applying to, or previously enrolled in any PHSL program; Guardians and emergency contacts; coaches and personnel of home clubs and partner organizations with whom PHSL corresponds; visitors to the PHSL website and users of the Portal; and applicants for engagement with PHSL.
3.3 Relationship to the Other Instruments in the Set. This instrument forms part of a set of four (4) policies adopted together on the same date and to be read as one framework, namely the Data Privacy Policy and Privacy Notice (PHSL-DPP-2026-01), the Data Retention Policy (PHSL-DRP-2026-01), the Data Usage Policy (PHSL-DUP-2026-01), and the Video, Image and Footage Consent Policy and Notice (PHSL-VCP-2026-01). It is further to be read with the PH Stroke Lab Parent and Guardian Consent and Liability Waiver and with the Program Partnership Agreement between PH Stroke Lab and Swim League Philippines. Where any of those documents affords a data subject greater protection than this instrument, that document prevails to the extent of the greater protection. In every other case of irreconcilable conflict on a matter of data protection, this instrument prevails.
3.4 Structural Neutrality. The obligations in this instrument attach to the processing of personal data and are not conditioned upon the size of a Batch, the venue, the number or duration of sessions, or the calendar on which the Program is run. A change in any of those operational matters does not alter, suspend, or diminish any obligation in this instrument.
4. DEFINITIONS AND STANDARD PERIODS
4.1 Adopted Definitions. Terms defined in Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the "DPA"), and in its Implementing Rules and Regulations (the "IRR"), bear the same meaning in this instrument. In addition, and consistently across all four instruments in the set, the following terms are used as follows:
"Batch" means a cohort of Swimmers enrolled together in a single running of the Program. The maximum size of a Batch is fixed by the applicable partnership or enrollment agreement and does not affect the operation of this instrument.
"Child" means consistent with NPC Advisory No. 2024-03, a person below eighteen (18) years of age, or a person eighteen (18) years of age or over who is unable to fully take care of or protect himself or herself from abuse, neglect, cruelty, exploitation, or discrimination because of a physical or mental disability or condition.
"Coaching Team" means Jerard Dominic S. Jacinto (in-water stroke coaching), Nathan Jao (out-of-pool education, metrics, and mental conditioning), and Lukasz Gorkas (athletic training, mobility, and biomechanics), together with any coach or specialist subsequently engaged by PHSL in writing.
"Footage" means any video recording, still photograph, screen capture, frame extraction, motion-tracking overlay, annotated still, or other derivative visual record of a Swimmer captured or generated by or for PHSL, together with any audio incidentally captured with it.
"Guardian" means the parent or legal guardian of a Swimmer who is a Child, being the person authorized under law to give consent on that Swimmer’s behalf.
"Portal" means the secure online platform operated by or for PHSL through which Swimmers, Guardians, and the Coaching Team access Program materials, submit and review Footage, and view records of progress.
"Program" means the PHSL Precision Technique Program, comprising an in-pool correction phase and a subsequent online check-in and reinforcement phase, the venue, cadence, session count, and duration of which are fixed for each Batch by the applicable enrollment or partnership agreement and by the schedule issued to each Swimmer.
"Program Data" means the technical record generated by PHSL in respect of a Swimmer, including the baseline diagnostic assessment, identified symptom and root cause, prescribed drills, cues and progressions, stroke count, stroke rate, breakout distance, split and benchmark times, fresh and fatigued scoring, mobility assessment, attendance, mid-block and mid-phase checks, self-report, and the end-of-Program summary report.
"SLP" means Swim League Philippines, the organization with which PHSL has entered into a Program Partnership Agreement.
"Swimmer" means an individual enrolled in, applying to, or previously enrolled in the Program.
"Working day" means a day other than a Saturday, a Sunday, or a regular or special non-working holiday declared in the National Capital Region.
4.2 Standard Periods. The following periods apply uniformly across all four instruments in the set. Where any other document issued by PHSL states a different period for the same act, the period below prevails.
| Act | Period |
|---|---|
| Acknowledgment of a data subject request or complaint | Two (2) working days from receipt |
| Substantive response to a data subject request or complaint | Fifteen (15) working days from receipt of a complete request |
| Extension of the response period, once only, with notice and reasons given before the original period expires | A further fifteen (15) working days |
| Effect given to a withdrawal of consent in respect of internal processing | Seven (7) calendar days |
| Effect given to a withdrawal of consent in respect of material already published | Thirty (30) calendar days |
| Internal report of a security incident or suspected breach to the Data Protection Officer | Four (4) hours from becoming aware |
| Notification of a notifiable personal data breach to the National Privacy Commission and to affected data subjects | Seventy-two (72) hours from knowledge of, or reasonable belief in, its occurrence |
| Revocation of all access upon cessation of an engagement | Twenty-four (24) hours |
| Certification by departing personnel of deletion of all personal data held | Seven (7) calendar days from cessation |
| Update of the register of processing activities following any change | Ten (10) calendar days |
| Notice to Guardians of a material amendment to any instrument in the set | Not less than fifteen (15) calendar days before effectivity |
| Review of each instrument in the set | At least once every twelve (12) months |
5. GENERAL DATA PRIVACY PRINCIPLES
5.1 Transparency. A data subject is entitled to be informed of the nature, purpose, extent, and duration of the processing of his or her personal data, the risks and safeguards involved, the identity of the PIC, his or her rights, and how those rights may be exercised. PHSL discharges this duty through this instrument, through the concise notice displayed at each point of collection, and through the age-appropriate notice at Annex B.
5.2 Legitimate Purpose. PHSL processes personal data only for purposes compatible with a declared and specified purpose which is not contrary to law, morals, or public policy. PHSL does not process personal data for any purpose not disclosed in this instrument or in the Data Usage Policy.
5.3 Proportionality. Processing is adequate, relevant, suitable, necessary, and not excessive in relation to the declared purpose. Where the purpose can be achieved by processing less data, or data in a less identifiable form, PHSL adopts the lesser means. This principle is applied with particular rigor to Footage and to health information.
5.4 Accuracy. PHSL maintains personal data in a form that is accurate and, where necessary, up to date. Inaccurate or incomplete data shall be rectified, supplemented, destroyed, or its further processing restricted, upon request or upon PHSL becoming aware of the inaccuracy.
5.5 Accountability. PHSL is responsible for personal data under its control or custody, including personal data transferred to a third party for processing, and remains accountable for compliance by that third party.
6. CATEGORIES OF PERSONAL DATA PROCESSED
6.1 Enumeration. PHSL processes the following categories of personal data. This enumeration is exhaustive as at the date of adoption. No category may be added without amendment of this instrument and, where consent is the lawful basis, without fresh consent.
| Category | Specific data items | Source |
|---|---|---|
| Swimmer identity | Full name; date of birth; age; sex where relevant to event classification; identification photograph within the Portal | Guardian, through the enrollment form and waiver |
| Swimmer athletic profile | Current club or training group; primary and secondary events; personal best times; competition history and results; time standard classification; target events for the Batch | Guardian; SLP; publicly published meet results |
| Guardian and contact data | Full name; relationship to the Swimmer; mobile number; electronic mail address; home address | Guardian |
| Emergency contact data | Full name; relationship; mobile number | Guardian |
| Health information (sensitive personal information) | Existing injuries; chronic conditions; allergies; medications; recent surgeries; medical clearance; declaration of medical fitness; injury, pain, or discomfort reported during a session; mobility assessment findings | Guardian; Swimmer; observation by the Coaching Team |
| Footage | Above-water and underwater video; still photographs; frame extractions; motion overlays and annotated stills; audio incidentally captured | Recording by PHSL; upload by Swimmer or Guardian during the online phase |
| Program Data | Baseline diagnostic assessment; symptom and root cause; prescribed drills, cues, and progressions; stroke count; stroke rate; breakout distance; split and benchmark times; fresh and fatigued scoring; attendance; self-report; end-of-Program summary report | Coaching Team; Swimmer self-report |
| Financial and transactional data | Invoice and receipt references in the PHSL-2026-00X series; amounts; payment channel used; proof of payment furnished by the payor; name of payor | Guardian; SLP; payment channel |
| Correspondence | Electronic mail; Short Message Service; Facebook Messenger exchanges; calendar bookings; notes of discovery calls | Guardian; Swimmer; SLP |
| Portal account data | Username; hashed password credential; account role; access and activity logs; upload records; timestamps | Data subject; system-generated |
| Website technical data | Internet Protocol address; browser type and version; device type; pages viewed; date and time of visit; referring source; cookie identifiers | System-generated |
6.2 Sensitive Personal Information. PHSL expressly acknowledges that health information as described above constitutes sensitive personal information within the meaning of Section 3(l) of the DPA, and that the age of a Swimmer, taken together with Footage of that Swimmer, constitutes data of heightened risk. Such data is subject to the elevated lawful bases in Section 7 and to the enhanced controls in Section 15 and in the Video, Image and Footage Consent Policy.
6.3 Data PHSL Does Not Collect. PHSL does not collect, and instructs its personnel not to collect: government-issued identification numbers of Swimmers; financial account numbers or card credentials of Guardians, payments being settled through channels operated by third parties; biometric templates; genetic data; information as to religious, philosophical, or political affiliation; information as to sexual life; and information concerning an offense committed or alleged to have been committed by a data subject. Where any such data is furnished unsolicited, it shall be securely deleted upon discovery and the deletion logged.
7. LAWFUL BASES FOR PROCESSING
7.1 Requirement. PHSL determines and records the lawful basis for each processing activity before that processing commences, in accordance with Sections 12 and 13 of the DPA and NPC Circular No. 2023-04.
7.2 Bases Relied Upon. The following table records the lawful basis applicable to each purpose:
| Purpose | Data involved | Lawful basis |
|---|---|---|
| Assessing an applicant against the selection criteria and conducting the discovery call | Identity; athletic profile; Guardian contact | Sec. 12(b) — steps taken at the request of the data subject prior to entering into a contract |
| Delivering the Program: coaching, diagnosis, correction, measurement, and reporting | Identity; athletic profile; Program Data | Sec. 12(b) — performance of a contract entered into by the Guardian on the Swimmer’s behalf |
| Processing health information to protect the Swimmer during high-intensity in-water work | Health information | Sec. 13(a) — consent of the Guardian; and Sec. 13(d) — protection of the life and health of the data subject where he or she is not legally or physically able to express consent |
| Recording, reviewing, and retaining Footage for internal coaching diagnosis and progression tracking | Footage | Sec. 12(a) and Sec. 13(a) — express, specific, written consent of the Guardian, recorded as a separate item in the waiver |
| Using anonymized Footage for coaching education, internal training, and case study development | Anonymized Footage | Sec. 12(a) and Sec. 13(a) — separate, optional, and independently revocable consent |
| Using identifiable Footage and photographs in marketing and promotional materials | Footage; identity | Sec. 12(a) and Sec. 13(a) — separate, optional, and independently revocable consent, never a condition of enrollment |
| Furnishing the end-of-Program summary report to the Swimmer’s home club coach | Program Data; identity | Sec. 12(a) — consent of the Guardian, revocable at any time before transmission |
| Issuing invoices and receipts and keeping books of account | Financial and transactional data | Sec. 12(c) — compliance with a legal obligation under the National Internal Revenue Code and the regulations of the Bureau of Internal Revenue |
| Administering the Portal, authenticating users, and maintaining access logs | Portal account data | Sec. 12(b) and Sec. 12(f) — legitimate interests in securing the Portal, assessed under NPC Circular No. 2023-07 |
| Maintaining website security and measuring aggregate website performance | Website technical data | Sec. 12(f) — legitimate interests, subject to the cookie consent requirements in Section 14 |
| Establishing, exercising, or defending a legal claim, including a claim arising from injury | Any relevant category | Sec. 12(f) and Sec. 13(f) — establishment, exercise, or defense of legal claims |
7.3 Quality of Consent. Where PHSL relies on consent, that consent shall be freely given, specific, informed, and constituted by a clear affirmative act, and shall be evidenced by written, electronic, or recorded means. PHSL does not obtain consent through bundled or blanket wording, through pre-ticked boxes, through deceptive design patterns, or by making a benefit conditional upon a consent not necessary to the delivery of that benefit.
7.4 Consent and Enrollment. Enrollment in the Program is conditioned upon consent to the recording and internal coaching use of Footage, because a stroke fault cannot be diagnosed without it. That necessity is disclosed to the Guardian before enrollment. Enrollment is not, and shall never be, conditioned upon consent to anonymized educational use or to marketing and promotional use. A Guardian who declines either optional consent receives the Program in identical form, at identical price, with no disadvantage of any kind.
7.5 Withdrawal of Consent. A data subject or Guardian may withdraw consent at any time, in writing or by electronic mail to the address in Section 2.2, without giving reasons and without cost. Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before it. PHSL gives effect to a withdrawal within the periods stated in Section 4.2 and confirms in writing when it has done so.
8. PROCESSING OF THE PERSONAL DATA OF CHILDREN
8.1 Recognition of Vulnerability. The Program admits Swimmers from thirteen (13) years of age. The majority of Swimmers are therefore Children. PHSL adopts, as binding upon itself, the standards articulated in NPC Advisory No. 2024-03, notwithstanding that the said Advisory is advisory in form.
8.2 Consent of the Guardian. No personal data of a Child shall be processed by PHSL except upon the written consent of that Child’s parent or legal guardian, executed through the Parent and Guardian Consent and Liability Waiver prior to the Child’s first session. PHSL shall verify that the executed waiver is on file before the Child enters the water and before any Footage of the Child is recorded.
Where a partner organization is responsible under a partnership agreement for collecting waivers, that allocation does not relieve PHSL of this verification duty.
8.3 The Child as a Data Subject. The consent of the Guardian does not extinguish the Child’s standing as a data subject. PHSL furnishes every Swimmer with a privacy notice written in language appropriate to his or her age, separate from the notice furnished to adults, explaining what is recorded, why, who sees it, how long it is kept, and how to object. That notice is at Annex B.
8.4 Assent and the Right to Object. Where a Swimmer aged fourteen (14) years or over objects to being recorded on a given day, or to a particular use of Footage, that objection shall be honored immediately by the coach present, recorded in the session log, and referred to the Guardian and the Data Protection Officer within twenty-four (24) hours. A Swimmer’s objection is never overridden in the moment, even where the Guardian has consented. Where an objection to recording is sustained, the consequence for the diagnostic work is discussed with the Guardian; it is never resolved by pressuring the Swimmer.
8.5 No Profiling or Behavioral Advertising. PHSL does not profile Children, does not conduct automated decision-making producing legal or similarly significant effects upon Children, does not serve behavioral advertising to Children, and does not permit any third party to do so through the PHSL website or Portal.
8.6 Breach Notification to Children. Where a personal data breach affects a Child, PHSL notifies both the Guardian and, in language appropriate to his or her age, the Child, in accordance with Section 4 of NPC Advisory No. 2024-03 and Section 18 of NPC Circular No. 16-03.
8.7 Child Protection Overlay. The handling of imagery of Children by PHSL is governed additionally by Republic Act No. 7610 and Republic Act No. 11930. The operational controls adopted in consequence are set out in the Video, Image and Footage Consent Policy.
9. NOTICE AT THE POINT OF COLLECTION
9.1 Layered Notice. PHSL provides a concise notice at each point of collection identifying the data collected, the purpose, the lawful basis, the identity of the PIC, and a link to this instrument in full. A privacy notice and a consent form are distinct instruments; the display of the former is not treated as a substitute for the execution of the latter.
9.2 Points Covered. Layered notice is displayed on the website enrollment form, the Portal registration screen, the Parent and Guardian Consent and Liability Waiver, the discovery call script, the video upload interface, and any electronic form used to collect personal data.
9.3 Language. PHSL furnishes a Filipino translation of the concise notice and of the notice at Annex B upon request, and in every case explains the content of a consent instrument orally to a Guardian who so requests before signature.
10. DISCLOSURE AND SHARING
10.1 Principle. PHSL does not sell, lease, trade, or otherwise commercially exploit personal data. PHSL discloses personal data only as set out in this Section, only to the extent necessary, and only to recipients bound by confidentiality obligations equivalent to those in this instrument.
10.2 Recipients. Personal data may be disclosed to the following:
| Recipient | Data disclosed | Purpose and control |
|---|---|---|
| Members of the Coaching Team | Only the categories necessary to the recipient’s function, applying the access matrix in the Data Usage Policy | Delivery of the Program. Bound by written confidentiality and data protection undertakings. |
| Swim League Philippines | Swimmer name; enrollment status; attendance; invoice and payment status. Health information and Footage are not disclosed absent separate written consent. | Administration of the Program Partnership Agreement. |
| The Swimmer’s home club coach | The end-of-Program summary report, fault map, and next priority correction | Continuity of development. Disclosed only with the consent of the Guardian, revocable before transmission. |
| The training facility | Swimmer name; session schedule; lane allocation; and, in an emergency, such health information as is necessary to protect life | Facility access, lifeguarding, and emergency response. |
| Payment channels and financial institutions | Payor name; amount; reference number | Settlement of fees. These parties act as independent controllers under their own policies. |
| Information technology and hosting providers | Data stored or transmitted through the Portal, website, or cloud storage | Hosting, backup, and security. Engaged as personal information processors under written agreement. |
| Medical and emergency responders | Health information and emergency contact details | Protection of the life and health of the Swimmer. |
| Legal counsel, insurers, auditors, and competent authorities | Such data as is strictly required | Legal claims, regulatory compliance, and lawful orders of a court or of the National Privacy Commission. |
10.3 Compelled Disclosure. Where PHSL receives a subpoena, order, or lawful demand, PHSL verifies the authority of the requesting party, discloses the minimum data responsive to the demand, and, unless legally prohibited, notifies the affected data subject and Guardian before disclosure.
10.4 No Disclosure to Recruiters, Agents, or Scouts. PHSL shall not disclose the identity, contact details, Program Data, or Footage of any Swimmer to any talent scout, agent, recruiter, educational institution, sponsor, or commercial party, whether local or foreign, and whether or not a fee is offered, except upon the specific written consent of the Guardian obtained in respect of the particular disclosure.
11. TRANSFER OF PERSONAL DATA OUTSIDE THE PHILIPPINES
11.1 Disclosure of Transfer. PHSL discloses that members of its Coaching Team and certain of its partners are located outside the Republic of the Philippines, and that certain hosting, storage, and communication services used by PHSL store data on servers outside the Philippines. Personal data processed by PHSL is therefore transferred across borders in the ordinary course of the Program.
11.2 Accountability Retained. In accordance with Section 21 of the DPA, PHSL remains responsible for personal data transferred to a recipient outside the Philippines and for the acts and omissions of that recipient in relation to that data. A transfer does not diminish any right of a data subject under this instrument.
11.3 Safeguards. Before any transfer outside the Philippines, PHSL shall: (a) satisfy itself that the recipient is bound by a written agreement containing data protection obligations no less protective than this instrument, adopting where appropriate the Model Contractual Clauses published under NPC Advisory No. 2024-01 or the ASEAN Model Contractual Clauses; (b) limit the transfer to the minimum data necessary to the recipient’s function; (c) require that Footage of a Child be reviewed within the Portal rather than downloaded, save as permitted by the Video, Image and Footage Consent Policy; and (d) record the transfer in the register of processing activities.
11.4 Transfers Presently Contemplated. The transfers presently contemplated are: review of Footage and delivery of out-of-pool education, metrics, and mental conditioning by Nathan Jao; review of mobility and biomechanical assessments and delivery of mobility protocols by Lukasz Gorkas; consultation with Aquatic Sports Performance in the State of California, United States of America, in respect of anonymized technical case material only; and storage and transmission through cloud hosting, electronic mail, calendar, and messaging services. Identifiable personal data is not transferred to Aquatic Sports Performance absent the specific written consent of the Guardian.
12. RIGHTS OF THE DATA SUBJECT
12.1 Enumeration. Every data subject enjoys the following rights under Sections 16, 18, and 34 of the DPA and the IRR, exercisable by the Swimmer personally where he or she has attained majority and by the Guardian on behalf of a Child:
(a) Right to be informed — to be notified before entry into the processing system, or at the next practicable opportunity, of the fact and extent of processing.
(b) Right to access — to obtain, upon demand, the contents of personal data processed, the sources from which they were obtained, the names and addresses of recipients, the manner of processing, the reasons for disclosure, information on automated processes, the date the data was last accessed and modified, and the identity and address of the PIC.
(c) Right to object — to object to processing, including processing for direct marketing, automated processing, or profiling, and to withhold consent where consent is the basis.
(d) Right to rectification — to dispute an inaccuracy or error and have it corrected immediately, unless the request is vexatious or unreasonable, and to have the correction transmitted to recipients of the erroneous data.
(e) Right to erasure or blocking — to suspend, withdraw, or order the blocking, removal, or destruction of personal data upon the grounds set out in Section 34(e) of the IRR, including where the data is incomplete, outdated, false, unlawfully obtained, used for an unauthorized purpose, or no longer necessary for the purpose for which it was collected, or where consent has been withdrawn or the processing objected to.
(f) Right to data portability — where processing is by electronic means and based on consent or contract, to obtain a copy of the data in an electronic or structured format commonly used and allowing further use.
(g) Right to damages — to be indemnified for damages sustained by reason of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.
(h) Right to lodge a complaint with the National Privacy Commission.
(i) Transmissibility — the rights of the data subject are transmissible to his or her lawful heirs and assigns.
12.2 How to Exercise a Right. A request may be made by electronic mail to the address in Section 2.2, or through the request function in the Portal, in either case using the form at Annex A or in any other intelligible form. PHSL acknowledges and responds within the periods in Section 4.2.
12.3 Verification of Identity. PHSL verifies the identity and, where applicable, the authority of the requester before acting, using the least intrusive means available. Data collected for verification is used for no other purpose and is deleted once the request is closed.
12.4 No Fee. PHSL does not charge for the exercise of a data subject right. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, PHSL may decline to act, stating its reasons in writing and informing the requester of the right to complain to the National Privacy Commission.
12.5 Limits. PHSL may decline a request for erasure to the extent that retention is required by law, in particular the preservation of books of account under the National Internal Revenue Code and the retention of executed waivers for the defense of legal claims. In such a case the data shall be blocked from all operational use and retained solely for that purpose until the applicable period in the Data Retention Policy expires.
13. COMPLAINTS
13.1 Internal Complaint. A data subject who believes that his or her rights have been infringed may complain in writing to the Data Protection Officer. PHSL acknowledges and responds within the periods in Section 4.2, stating the findings, the action taken, and the remedy afforded.
13.2 Escalation. PHSL informs every complainant, in its reply, of the right to escalate to the National Privacy Commission and furnishes the Commission’s contact details. Recourse to this internal process is not a condition of complaint to the Commission and does not waive any right.
14. WEBSITE AND PORTAL PROVISIONS
14.1 Cookies. The PHSL website uses cookies and similar technologies. Strictly necessary cookies, which enable navigation, session management, and security, are set without consent as they are indispensable to the service requested. All other cookies, including analytics and preference cookies, are set only upon the affirmative consent of the visitor, obtained through a banner presenting accept and reject options with equal prominence and no pre-ticked boxes. Consent may be withdrawn at any time through the cookie settings link in the website footer. Refusal of non-essential cookies does not impair access to any part of the website.
14.2 Cookie Disclosure. The website discloses, in a cookie notice accessible from every page, the cookies used, their purpose and duration, whether they are first-party or third-party, and the consequence of refusal.
14.3 Portal Accounts. Access to the Portal is by individual named account. Accounts are not shared. Each account is assigned a role and granted only the access described in the access matrix in the Data Usage Policy. Passwords are stored only in salted and hashed form, are never visible to PHSL personnel, and are never transmitted by electronic mail or messaging application. Multi-factor authentication is required for every account holding coaching-level access or above.
14.4 Portal Uploads. Footage uploaded by a Swimmer or Guardian is encrypted in transit, stored in the encrypted repository described in the Video, Image and Footage Consent Policy, and made visible only to those members of the Coaching Team whose function requires review. Upload of Footage of any person other than the Swimmer is prohibited; any such Footage discovered is deleted immediately and the deletion logged.
14.5 Third-Party Links. The website and Portal may link to external sites, including calendar booking, payment, and social media platforms. Those platforms are independent controllers governed by their own policies. PHSL does not warrant and is not responsible for their privacy practices, and encourages Guardians to review them.
14.6 Communication Channels Outside the Portal. PHSL corresponds with Guardians by Short Message Service, electronic mail, and Facebook Messenger. Those channels are operated by third parties and are not controlled end to end by PHSL. Accordingly, PHSL shall not transmit health information, Footage, or Program Data of an identifiable Swimmer through Short Message Service or Facebook Messenger. Such material is exchanged only through the Portal or by an expiring, access-controlled link sent to a registered electronic mail address.
14.7 No Automated Decision-Making. PHSL does not subject any data subject to a decision based solely on automated processing which produces legal effects concerning him or her or similarly significantly affects him or her. All technical, selection, and progression decisions are made by a human coach who bears responsibility for that decision.
14.8 No Data Scraping. PHSL does not collect personal data by automated extraction from third-party websites, social media, or other online sources, whether for enrichment, training, or any other purpose. Publicly published competition results are consulted manually and only in respect of Swimmers who have applied to the Program.
15. SECURITY MEASURES
15.1 Standard. PHSL implements reasonable and appropriate organizational, physical, and technical measures for the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and against any other unlawful processing, in accordance with Section 20 of the DPA, Rule VI of the IRR, and NPC Circular No. 2023-06.
15.2 Organizational. PHSL designates a Data Protection Officer; maintains a register of processing activities; conducts a Privacy Impact Assessment before any new processing activity or material change and before each Batch; requires every coach, specialist, contractor, and volunteer to execute a written confidentiality and data protection undertaking before access is granted; conducts orientation before engagement and refresher orientation annually; applies the principles of need to know and least privilege; and revokes all access within twenty-four (24) hours of the cessation of an engagement.
15.3 Physical. Paper records, principally executed waivers and medical disclosures, are kept in a locked receptacle at a single designated location accessible only to the Data Protection Officer. Recording devices are kept in the custody of the coach on duty during a session and secured when not in use. No paper record containing health information is left unattended on a pool deck. Devices used to record or review Footage are passcode-protected with device-level encryption enabled.
15.4 Technical. PHSL encrypts personal data at rest and in transit using industry-standard algorithms; requires multi-factor authentication for administrative and coaching-level access; maintains access logs recording the identity of the user, the record accessed, and the time of access; maintains backups sufficient to restore availability and integrity, tested at least annually; applies security updates promptly; segregates Footage from identity data so that compromise of one repository does not by itself identify a Swimmer; and prohibits the storage of personal data on the personal devices, removable media, or personal cloud accounts of any member of personnel.
15.5 Processors. Any third party engaged to process personal data on behalf of PHSL is engaged under a written agreement specifying the subject matter, duration, nature, and purpose of the processing, the categories of data, the obligations of the processor, the security measures required, the prohibition on sub-processing without prior written authorization, the duty to assist PHSL in responding to data subject requests and breaches, and the duty to delete or return all data upon termination.
16. PERSONAL DATA BREACH MANAGEMENT
16.1 Responsibility. The Data Protection Officer heads the breach response function and may co-opt any member of the Coaching Team or any external adviser as required.
16.2 Internal Reporting. Any person who becomes aware of a security incident or suspected personal data breach shall report it to the Data Protection Officer within four (4) hours of becoming aware. Failure to report is itself a disciplinary matter.
16.3 Assessment. The Data Protection Officer shall contain the incident, assess the nature and extent of the compromise, determine whether sensitive personal information or information that may enable identity fraud is involved, and determine whether there is a real risk of serious harm to any affected data subject.
16.4 Notification. Where sensitive personal information or information that may enable identity fraud has been, or may reasonably be believed to have been, acquired by an unauthorized person, and the breach is likely to give rise to a real risk of serious harm, PHSL notifies the National Privacy Commission and the affected data subjects within seventy-two (72) hours from knowledge of, or reasonable belief in, the occurrence of the breach. Notification to the Commission is made through the Data Breach Notification Management System.
16.5 Content. A notification describes the nature of the breach, the personal data possibly involved, the measures taken to address it, the measures taken to reduce the harm or negative consequences, the representative of PHSL from whom further information may be obtained, and the assistance available to the affected data subject.
16.6 Children. Where the affected data subject is a Child, the Guardian is notified and the Child is additionally notified in language appropriate to his or her age and understanding.
16.7 Records and Annual Report. PHSL maintains a record of every security incident and personal data breach, including those not requiring notification, retained in accordance with the Data Retention Policy, and files the Annual Security Incident Report on or before the thirty-first (31st) day of March of each year.
17. SCOPE LIMITATION, ALLOCATION OF RESPONSIBILITY, AND LIABILITY
17.1 Nature of the Engagement. PHSL is engaged solely to provide specialist technical swimming coaching, diagnostic observation, measurement, and the reporting of technical findings. PHSL is not engaged to provide, and does not provide, medical care, medical evaluation, medical diagnosis, physiotherapy, nutritional prescription, psychological or psychiatric treatment, lifeguarding, facility safety oversight, or the supervision of a Swimmer outside a scheduled session. Nothing in this instrument, and nothing contained in any record generated under it, constitutes or is to be relied upon as medical advice or a medical opinion.
17.2 Responsibility of the Facility and the Partner Organization. Responsibility for the safety and suitability of the training facility, for the presence of lifeguarding and of qualified medical personnel where required, for emergency response, and for the general welfare of a Swimmer outside a scheduled coaching session, rests with the facility operator and with the partner organization that secured the facility, in accordance with the Program Partnership Agreement. PHSL does not assume and is not to be treated as having assumed any of those responsibilities by reason of the adoption of this instrument.
17.3 Warranties of the Guardian. By enrolling a Swimmer, the Guardian warrants that: (a) he or she is the parent or legal guardian of the Swimmer and is authorized to give the consents recorded in the Parent and Guardian Consent and Liability Waiver; (b) the information furnished to PHSL, and in particular the medical disclosure, is true, complete, current, and not misleading; (c) he or she will inform PHSL in writing, without delay, of any change in that information, including any injury, illness, medication, or condition arising during the Program; and (d) he or she will not upload to the Portal, or transmit to PHSL, any personal data of a person other than the Swimmer without that person’s authority.
17.4 Reliance. PHSL relies on the information furnished by the Guardian and by the Swimmer in the design and conduct of the technical work. To the fullest extent permitted by law, PHSL is not liable for any loss, injury, or damage arising from, or contributed to by, the failure to disclose a material condition, the furnishing of inaccurate or incomplete information, or the failure to notify PHSL of a change in that information.
17.5 No Guarantee of Outcome. Swimming performance is influenced by many factors beyond technical coaching, including individual physiology, growth, recovery, training load carried outside the Program, mental state, competition conditions, and circumstances outside the control of PHSL. PHSL does not warrant or guarantee any specific time improvement, qualifying result, selection outcome, or competitive result for any Swimmer, and no statement in any record generated under this instrument is to be construed as such a warranty.
17.6 Third-Party Platforms. PHSL uses hosting, storage, electronic mail, calendar, messaging, and payment services operated by third parties. Those parties act as independent controllers or as processors under their own terms. PHSL selects them with reasonable care, engages processors under written agreement, and remains accountable for personal data transferred to a processor. PHSL does not, however, warrant the security of a platform it does not operate, and is not liable for an act or omission of an independent controller, save to the extent that liability arises from PHSL’s own act, omission, or failure to exercise reasonable care in that party’s selection or instruction.
17.7 Security of the Guardian’s Own Environment. Where PHSL furnishes material to a Guardian or Swimmer, whether through the Portal, by expiring link, or otherwise, responsibility for the security of that material once received, including the security of the recipient’s device, account credentials, and network, and any onward sharing by the recipient, rests with the recipient. PHSL is not liable for a disclosure arising from the recipient’s own act or omission.
17.8 Force Majeure. PHSL is not liable for a failure or delay in the performance of an obligation under this instrument to the extent caused by an event beyond its reasonable control, including natural disaster, public health emergency, governmental action, civil disturbance, facility closure, or the failure of a public utility or telecommunications network. PHSL shall give notice of the event and shall resume performance as soon as reasonably practicable. This provision does not extend the seventy-two (72) hour period for the notification of a personal data breach.
17.9 Limitation of Liability. To the fullest extent permitted by law, and save as provided in the following Section, the aggregate liability of PHSL to any Guardian or Swimmer arising out of or in connection with this instrument, whether in contract, quasi-delict, or otherwise, shall not exceed the total fees actually received by PHSL in respect of that Swimmer, and PHSL shall not be liable for indirect, incidental, consequential, special, or punitive damages, including loss of opportunity, loss of selection, or loss of sponsorship.
17.10 Non-Derogation. Nothing in this instrument operates, or is to be construed as operating, to: (a) exclude or limit the liability of PHSL for gross negligence or willful misconduct; (b) exclude or limit any liability which cannot lawfully be excluded or limited, including criminal and administrative liability under the DPA; (c) waive, diminish, or condition any right of a data subject under the DPA, its IRR, or the issuances of the National Privacy Commission, every such right being non-waivable and every purported waiver of it being void; (d) restrict the right of any person to complain to the National Privacy Commission or to any other competent authority; or (e) limit the rights of a Child under Republic Act No. 7610, Republic Act No. 11930, or any other law enacted for the protection of children. Any provision of this instrument which would otherwise have such an effect shall be read down to the minimum extent necessary to give effect to this Section, and shall otherwise remain in full force.
17.11 Relationship to the Waiver. This Section supplements, and does not replace, reduce, or supersede, the assumption of risk, release of liability, and indemnity provisions of the PH Stroke Lab Parent and Guardian Consent and Liability Waiver. Where the two instruments address the same subject matter, they are to be read together and cumulatively.
18. GOVERNANCE, REVIEW, AND AMENDMENT
18.1 Accountability. PHSL is responsible for personal data under its control or custody, including personal data transferred to a third party for processing, whether within or outside the Philippines, and remains accountable for compliance by that third party. The Data Protection Officer monitors compliance with this instrument, maintains the register of processing activities, the consent register, the access log, the disposal log, and the record of security incidents, and reports annually to the Founder on the state of compliance.
18.2 Privacy Impact Assessment. A Privacy Impact Assessment shall be conducted before the commencement of each Batch, before the launch of the website or Portal or any material change to either, before the adoption of any new processing tool, platform, or vendor, before the collection of any new category of personal data, and before any new transfer outside the Philippines. Where the assessment concerns the personal data of Children, it shall expressly address the age range affected, the risks arising from the depiction of Children, the adequacy of the age-appropriate notice, and the measures adopted to prevent identification of or contact with a Child by an unauthorized person.
18.3 Training and Undertakings. Every coach, specialist, contractor, and volunteer shall execute a written confidentiality and data protection undertaking before any access to personal data is granted, and shall receive orientation on this instrument before engagement and refresher orientation at least annually. The undertaking survives the termination of the engagement.
18.4 Sanction. A breach of this instrument by personnel is a ground for suspension or termination of engagement, without prejudice to civil, criminal, and administrative liability under Sections 25 to 34 of the DPA.
18.5 Review. This instrument shall be reviewed at least once every twelve (12) months, and additionally upon any material change in the operations of PHSL, upon the issuance of any circular, advisory, or opinion of the National Privacy Commission bearing on its subject matter, and following any personal data breach.
18.6 Amendment. An amendment takes effect upon publication on the PHSL website and Portal. Where an amendment materially affects the rights of data subjects or the purposes of processing, PHSL shall notify affected Guardians directly, giving not less than fifteen (15) calendar days’ notice, and shall obtain fresh consent where consent is the lawful basis and the purpose, scope, method, or extent of processing has changed. An amendment to one instrument in the set which affects another shall be made to both at the same time, so that the set remains internally consistent.
18.7 Version Control. Every version of this instrument shall be retained together with its dates of effectivity, so that the terms applicable at any past date can be established.
19. MISCELLANEOUS
19.1 Governing Law. This instrument is governed by and construed in accordance with the laws of the Republic of the Philippines.
19.2 Severability. Should any provision of this instrument be held invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.
19.3 No Waiver. The failure of PHSL to enforce any provision shall not constitute a waiver of that provision or of any other.
19.4 Interpretation. Headings are for convenience only and do not affect interpretation. The singular includes the plural and the plural the singular. A reference to a statute, circular, or advisory includes that instrument as amended, superseded, or replaced. The words "including" and "in particular" are illustrative and not limiting.
19.5 Publication and Availability. This instrument shall be published in full on the PHSL website and Portal, furnished to every Guardian at enrollment, and made available to the National Privacy Commission and to any data subject upon request. A Filipino translation of the summary notice shall be furnished upon request.
19.6 Effectivity. This instrument takes effect on the date stated in the Document Control table and remains in force until amended or superseded in accordance with Section 18.
ANNEX A DATA SUBJECT REQUEST FORM
Complete and send to jaojacinto2@gmail.com, or submit through the PH Stroke Lab Portal. PH Stroke Lab acknowledges within two (2) working days and responds within fifteen (15) working days of receipt of a complete request.
| Field | Entry |
|---|---|
| Name of requester | |
| Capacity (data subject, parent, guardian, heir) | |
| Name of the Swimmer concerned | |
| Contact number and electronic mail address | |
| Evidence of identity and, where acting for another, of authority |
Right being exercised (tick all that apply):
☐ To be informed as to the processing of personal data
☐ To access personal data held
☐ To rectify inaccurate or incomplete data
☐ To object to processing, in whole or in part
☐ To withdraw a consent previously given (specify below)
☐ To erase or block personal data
☐ To obtain a copy of data in a portable format
☐ To obtain a copy of Footage of the Swimmer
☐ To lodge a complaint
Details of the request:
Signature: ____________________________________ Date: ______________________
FOR PH STROKE LAB USE ONLY
| Field | Entry |
|---|---|
| Date received and acknowledged | |
| Identity and authority verified by | |
| Action taken | |
| Extension invoked, with reasons | |
| Date closed |
ANNEX B PRIVACY NOTICE FOR SWIMMERS
This notice is written for you, the swimmer. Your parent or guardian signs the longer documents. This one is yours. If anything here does not make sense, ask your coach and he will explain it.
What we collect about you
Your name and birthday. Your club, your events, and your best times. Anything about your health that your parent tells us, so we can keep you safe in the water. Video of you swimming. Numbers from your swimming, like your stroke count, your splits, and how your technique holds up when you are tired.
Why we collect it
To find the one thing in your stroke that is slowing you down, fix it properly, and prove it changed. We cannot see a dropped elbow or a sinking hip from the deck. We need the video to see it, and we need the numbers to know whether the fix worked.
Who sees your video
Your coach Jerard. Coach Nathan, who reviews your video and works on the thinking side. Coach Lukasz, who sees the parts that matter for your mobility. Nobody else, unless your parent has separately said yes to something more, and even then only in the ways they agreed to.
How long we keep it
Video used for coaching is deleted after two years, because by then your body and your stroke have changed and it is no longer useful. Your training records are kept for five years so we can compare where you started with where you got to.
You can say no
If you do not want to be filmed on a particular day, tell your coach. He will stop. You will not be in trouble, and nobody will make you explain. We will talk to your parent about it afterwards, because filming is how the diagnosis works, but no one will pressure you in the moment.
Your rights
You can ask to see what we hold about you. You can ask us to correct anything that is wrong. You can ask for a copy of your own video. You can ask us to delete things, and we will unless the law says we have to keep them. If you think we have handled your information badly, you can tell us, and you can also tell the National Privacy Commission, which is the government body that checks on organizations like ours.
Two things we will never do
We will never film in a changing room, shower, or toilet. Not ever, not by accident, not on anyone’s phone. And we will never post a picture or video of you online unless your parent has specifically said yes to that, separately from everything else.
Who to talk to
Coach Jerard is also the person responsible for looking after your information. You can reach him at jaojacinto2@gmail.com or on +63 961 750 3272. Your parent can too.