Data Retention Policy
Reference copy · PHSL-DRP-2026-01 · 1.0 (Original Adoption)
PH STROKE LAB
Precision Technique Program
DATA RETENTION POLICY
Governing the period for which PH Stroke Lab holds personal data, and the manner of its disposal Adopted pursuant to Section 11(e) of Republic Act No. 10173 (Data Privacy Act of 2012), Section 19(d) of its Implementing Rules and Regulations, and the circulars and advisories of the National Privacy Commission.
| Field | Entry |
|---|---|
| Document reference | PHSL-DRP-2026-01 |
| Document title | Data Retention Policy |
| Version | 1.0 (Original Adoption) |
| Personal Information Controller | PH Stroke Lab |
| Executed by | Jerard Dominic S. Jacinto, Founder and Data Protection Officer |
| Date of adoption | ______________________, 2026 |
| Date of effectivity | ______________________, 2026 |
| Next scheduled review | Twelve (12) months from the date of effectivity |
| Companion instruments | PHSL-DPP-2026-01 (Data Privacy Policy and Privacy Notice); PHSL-DUP-2026-01 (Data Usage Policy); PHSL-VCP-2026-01 (Video, Image and Footage Consent Policy and Notice) |
| Status | Adopted as a sworn instrument and published in full on the PH Stroke Lab website and Portal. |
1. DECLARATION OF POLICY
1.1 Storage Limitation. Personal data shall be retained only for as long as necessary for the fulfillment of the purposes for which it was obtained, for the establishment, exercise, or defense of legal claims, for a legitimate business purpose, or for such period as is provided by law. Retention beyond the applicable period is itself a form of unlawful processing.
1.2 Deletion as a Safeguard. PHSL treats deletion as a security control and not merely as housekeeping. Personal data which no longer exists cannot be breached, misused, or misinterpreted. This principle applies with particular force to Footage of Children, the risk profile of which increases with age while its technical value decreases.
1.3 Binding Effect. This instrument binds PHSL, its Founder, every person engaged by PHSL, and every processor engaged to hold personal data on its behalf.
2. PERSONAL INFORMATION CONTROLLER AND DATA PROTECTION OFFICER
2.1 Identity of the Controller. The Personal Information Controller ("PIC") for all processing described in this instrument is PH STROKE LAB ("PHSL"), a specialist swim technique and measurement program organized and operating under the laws of the Republic of the Philippines, represented by its Founder, Jerard Dominic S. Jacinto.
2.2 Contact Details. All communications relating to this instrument, including the exercise of any right of a data subject, may be addressed as follows:
| Field | Entry |
|---|---|
| Personal Information Controller | PH Stroke Lab |
| Represented by | Jerard Dominic S. Jacinto, Founder |
| Registered or operating address | _________________________________________________ |
| Electronic mail for privacy matters | jaojacinto2@gmail.com |
| Mobile number | +63 961 750 3272 |
| Data Protection Officer | Jerard Dominic S. Jacinto (concurrent capacity) |
| Website | _________________________________________________ |
| Swimmer Portal | _________________________________________________ |
2.3 Designation of the Data Protection Officer. PHSL designates Jerard Dominic S. Jacinto as its Data Protection Officer in concurrent capacity with his role as Founder, in accordance with NPC Advisory No. 2017-01. PHSL discloses that this concurrence is a consequence of its present size and undertakes to designate an independent Data Protection Officer, or a Compliance Officer for Privacy reporting to a Data Protection Officer, upon the engagement of additional administrative personnel. The Data Protection Officer shall not be penalized for the performance of his statutory functions, and no instruction shall be given to him as to the manner in which he discharges them.
2.4 Disclosure as to Business Registration. PHSL discloses that, as at the date of adoption of this instrument, its business registration with the Department of Trade and Industry and the Bureau of Internal Revenue is in process. This instrument is accordingly executed by Jerard Dominic S. Jacinto in his personal capacity and as the natural person operating under the business name "PH Stroke Lab," and the obligations assumed in it are assumed by him personally. Upon completion of business registration, this instrument shall be re-executed in the name of the registered entity, without diminution of any obligation assumed or of any right of a data subject accrued under this version.
2.5 Registration Status with the National Privacy Commission. PHSL employs fewer than two hundred fifty (250) persons and processes the sensitive personal information of fewer than one thousand (1,000) individuals. PHSL nonetheless acknowledges that its processing involves the health information and video footage of children and involves transfer outside the Philippines, and may therefore be characterized as processing likely to pose a risk to the rights and freedoms of data subjects within the meaning of Section 5 of NPC Circular No. 2022-04. PHSL therefore undertakes to register its Data Processing System and its Data Protection Officer with the National Privacy Commission through the National Privacy Commission Registration System, and, in the event registration is ultimately determined not to be required, to execute and file the sworn declaration prescribed by that Circular. PHSL shall in every case file the Annual Security Incident Report on or before the thirty-first (31st) day of March of each year, reporting nil where no incident occurred during the covered period.
3. SCOPE
3.1 Application. This instrument applies to every record containing personal data held by PHSL, in whatever medium and wherever located, including records held in the Portal, in cloud storage, on recording devices, in electronic mail and messaging accounts, in accounting records, and in paper form.
3.2 Relationship to the Other Instruments in the Set. This instrument forms part of a set of four (4) policies adopted together on the same date and to be read as one framework, namely the Data Privacy Policy and Privacy Notice (PHSL-DPP-2026-01), the Data Retention Policy (PHSL-DRP-2026-01), the Data Usage Policy (PHSL-DUP-2026-01), and the Video, Image and Footage Consent Policy and Notice (PHSL-VCP-2026-01). It is further to be read with the PH Stroke Lab Parent and Guardian Consent and Liability Waiver and with the Program Partnership Agreement between PH Stroke Lab and Swim League Philippines. Where any of those documents affords a data subject greater protection than this instrument, that document prevails to the extent of the greater protection. In every other case of irreconcilable conflict on a matter of data protection, this instrument prevails. The categories of personal data referred to in this instrument bear the meanings given to them in the Data Privacy Policy. Where any other PHSL document states a retention period inconsistent with this instrument, this instrument prevails.
4. DEFINITIONS AND STANDARD PERIODS
4.1 Adopted Definitions. Terms defined in Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the "DPA"), and in its Implementing Rules and Regulations (the "IRR"), bear the same meaning in this instrument. In addition, and consistently across all four instruments in the set, the following terms are used as follows:
"Batch" means a cohort of Swimmers enrolled together in a single running of the Program. The maximum size of a Batch is fixed by the applicable partnership or enrollment agreement and does not affect the operation of this instrument.
"Child" means consistent with NPC Advisory No. 2024-03, a person below eighteen (18) years of age, or a person eighteen (18) years of age or over who is unable to fully take care of or protect himself or herself from abuse, neglect, cruelty, exploitation, or discrimination because of a physical or mental disability or condition.
"Coaching Team" means Jerard Dominic S. Jacinto (in-water stroke coaching), Nathan Jao (out-of-pool education, metrics, and mental conditioning), and Lukasz Gorkas (athletic training, mobility, and biomechanics), together with any coach or specialist subsequently engaged by PHSL in writing.
"Footage" means any video recording, still photograph, screen capture, frame extraction, motion-tracking overlay, annotated still, or other derivative visual record of a Swimmer captured or generated by or for PHSL, together with any audio incidentally captured with it.
"Guardian" means the parent or legal guardian of a Swimmer who is a Child, being the person authorized under law to give consent on that Swimmer’s behalf.
"Portal" means the secure online platform operated by or for PHSL through which Swimmers, Guardians, and the Coaching Team access Program materials, submit and review Footage, and view records of progress.
"Program" means the PHSL Precision Technique Program, comprising an in-pool correction phase and a subsequent online check-in and reinforcement phase, the venue, cadence, session count, and duration of which are fixed for each Batch by the applicable enrollment or partnership agreement and by the schedule issued to each Swimmer.
"Program Data" means the technical record generated by PHSL in respect of a Swimmer, including the baseline diagnostic assessment, identified symptom and root cause, prescribed drills, cues and progressions, stroke count, stroke rate, breakout distance, split and benchmark times, fresh and fatigued scoring, mobility assessment, attendance, mid-block and mid-phase checks, self-report, and the end-of-Program summary report.
"SLP" means Swim League Philippines, the organization with which PHSL has entered into a Program Partnership Agreement.
"Swimmer" means an individual enrolled in, applying to, or previously enrolled in the Program.
"Working day" means a day other than a Saturday, a Sunday, or a regular or special non-working holiday declared in the National Capital Region.
4.2 Standard Periods. The following periods apply uniformly across all four instruments in the set. Where any other document issued by PHSL states a different period for the same act, the period below prevails.
| Act | Period |
|---|---|
| Acknowledgment of a data subject request or complaint | Two (2) working days from receipt |
| Substantive response to a data subject request or complaint | Fifteen (15) working days from receipt of a complete request |
| Extension of the response period, once only, with notice and reasons given before the original period expires | A further fifteen (15) working days |
| Effect given to a withdrawal of consent in respect of internal processing | Seven (7) calendar days |
| Effect given to a withdrawal of consent in respect of material already published | Thirty (30) calendar days |
| Internal report of a security incident or suspected breach to the Data Protection Officer | Four (4) hours from becoming aware |
| Notification of a notifiable personal data breach to the National Privacy Commission and to affected data subjects | Seventy-two (72) hours from knowledge of, or reasonable belief in, its occurrence |
| Revocation of all access upon cessation of an engagement | Twenty-four (24) hours |
| Certification by departing personnel of deletion of all personal data held | Seven (7) calendar days from cessation |
| Update of the register of processing activities following any change | Ten (10) calendar days |
| Notice to Guardians of a material amendment to any instrument in the set | Not less than fifteen (15) calendar days before effectivity |
| Review of each instrument in the set | At least once every twelve (12) months |
5. PRINCIPLES GOVERNING THE PERIODS ADOPTED
5.1 Basis. The periods in Section 6 are fixed by reference to: the ten-year prescriptive period for actions upon a written contract under Article 1144 of the Civil Code of the Philippines; the four-year prescriptive period for actions upon injury to the rights of the plaintiff under Article 1146 of the same Code; the preservation of books of account and accounting records for ten (10) years under the regulations of the Bureau of Internal Revenue; the requirement to evidence the lawful basis of past processing; and the principle of data minimization, which requires that where no legal period compels retention, the shortest workable period be adopted.
5.2 Trigger. Unless otherwise stated, a retention period runs from the later of the date on which the Swimmer’s participation in the Program concludes, being the date of the final outcome assessment, and the date on which the record was created.
5.3 No Indefinite Retention. No category of personal data is retained indefinitely. The only material held without a fixed end date is material which has been irreversibly anonymized and has therefore ceased to be personal data, and the adequacy of that anonymization is itself reviewed annually.
5.4 Records Superseded. Where a record is superseded by a corrected or updated version, the superseded version is retained only where necessary to evidence what was held and when, and is otherwise deleted.
6. RETENTION SCHEDULE
6.1 Schedule. The following schedule governs. It is reproduced in operational form at Annex A.
| Record | Retention period | Basis and notes |
|---|---|---|
| Enrollment and application records of an applicant who is not admitted | Six (6) months from the decision | Retained to answer queries as to the decision and to permit reapplication. Deleted thereafter unless the Guardian asks in writing that the application be kept live. |
| Swimmer identity and athletic profile of an enrolled Swimmer | Five (5) years | Supports continuity of coaching across subsequent blocks and answers technical queries from the home club coach. |
| Executed Parent and Guardian Consent and Liability Waiver | Ten (10) years, or until the Swimmer attains the age of twenty-one (21), whichever is later | Civil Code, Art. 1144. The instrument is the primary evidence of consent and of the assumption of risk and must survive the period within which a claim may be brought. |
| Medical disclosure and medical clearance | Five (5) years | Sensitive personal information, retained for the shortest period consistent with the defense of a claim arising from injury. Blocked from operational access once participation concludes. |
| Emergency contact details | Ninety (90) days | No purpose survives the last session. Deleted on a scheduled sweep. |
| Program Data, including baseline, session logs, benchmark results, and the end-of-Program report | Five (5) years | Enables comparison across blocks and substantiates the technical work performed. |
| Footage — internal coaching use | Twenty-four (24) months from capture | The diagnostic value of Footage decays as the Swimmer’s body and stroke change, while its risk profile does not. Deleted automatically at expiry unless a written extension is requested by the Guardian. |
| Footage — anonymized educational use | For so long as the consent stands, reviewed every twenty-four (24) months | Consent is independently revocable. On revocation, deleted within thirty (30) days. |
| Footage — marketing and promotional use | For so long as the consent stands | On revocation, withdrawn from every channel under PHSL control within thirty (30) days and deleted from the source repository. |
| Consent records, including the record of any withdrawal | Five (5) years after the consent lapses or is withdrawn | Retained to evidence the lawful basis of past processing. |
| Invoices, receipts in the PHSL-2026-00X series, and proof of payment | Ten (10) years | Regulations of the Bureau of Internal Revenue on the preservation of books of account and accounting records. |
| Correspondence by electronic mail, Short Message Service, and Facebook Messenger | Three (3) years | Purged on a rolling annual sweep. Correspondence forming part of a dispute is placed on legal hold. |
| Portal account records | Duration of the account plus twelve (12) months | Permits reactivation for a subsequent block without re-enrollment. |
| Portal and system access logs | Twelve (12) months | Security monitoring and incident investigation. |
| Website analytics and cookie data | Twelve (12) months maximum | Aggregated at the earliest opportunity; identifiers truncated. |
| Data subject requests and the responses to them | Five (5) years | Demonstrates compliance with the Data Privacy Policy. |
| Security incident and personal data breach records | Five (5) years | NPC Circular No. 16-03 and the Annual Security Incident Report. |
| Personnel records of coaches, specialists, contractors, and volunteers | Five (5) years from cessation of engagement | Employment and contractual claims. |
| Irreversibly anonymized entries in the PHSL technical knowledge library | No fixed period | Once irreversibly anonymized the material ceases to be personal data. Anonymization is verified before an entry is admitted and re-identification risk is reviewed annually. |
7. STORAGE AND BLOCKING DURING THE RETENTION PERIOD
7.1 Active and Archived States. A record is held in an active state only for so long as it is required for a current operational purpose. Once that purpose is spent, and where a legal or evidentiary period continues to run, the record is moved to an archived state, blocked from ordinary operational access, and made available only to the Data Protection Officer and only for the purpose which justifies its continued retention.
7.2 Security in Archive. Archived records are subject to the same security measures as active records, and to the additional control that access is logged individually and reviewed at each disposal review.
7.3 Segregation. Archived Footage is stored under a Swimmer reference code, with the key linking code to identity held separately and access-controlled.
8. DISPOSAL
8.1 Method. Personal data reaching the end of its retention period is disposed of in a manner that renders further processing impossible. Electronic records are deleted by secure deletion or by destruction of the encryption key where the record is held in encrypted form. Paper records are cross-cut shredded. Recording devices and storage media are securely wiped before disposal, transfer, sale, or repair.
8.2 Disposal Review. The Data Protection Officer conducts a disposal review at least once every six (6) months, and in any event within thirty (30) days of the conclusion of a Batch.
8.3 Disposal Log. The Data Protection Officer maintains a disposal log recording the category of record disposed of, the volume, the date, the method, and the person who effected the disposal. The log is itself retained for five (5) years. A certificate in the form at Annex B is completed for each disposal cycle.
8.4 Notice Before Deletion of Footage. PHSL notifies the Guardian thirty (30) days before the scheduled deletion of Footage held for internal coaching use, and the Guardian may request a copy, an extension, or immediate deletion.
9. LEGAL HOLD
9.1 Imposition. Where PHSL becomes aware of an actual or reasonably anticipated legal claim, regulatory investigation, complaint, or safeguarding report, the records relevant to that matter are placed on legal hold and are not disposed of, notwithstanding the expiry of the applicable retention period, until the matter is concluded and the hold lifted in writing by the Data Protection Officer.
9.2 Effect. A record on legal hold is blocked from all operational use and is accessible only for the purpose of the matter which justifies the hold.
9.3 Record. Every imposition and lifting of a legal hold is recorded, with its date and reason, in the disposal log.
10. BACKUPS AND TECHNICAL RESIDUE
10.1 Backups. PHSL discloses that deletion from a live system does not immediately remove a record from encrypted backup media. Backups are retained on a rolling cycle not exceeding ninety (90) days, after which a deleted record ceases to exist in backup. A record restored from backup is re-assessed against this instrument before being returned to operational use, and is deleted immediately if its retention period has expired.
10.2 Residue on Devices. Personnel shall ensure that deletion of Footage from a device extends to automatic cloud backup, camera roll, recently deleted folders, and messaging application caches. Deletion is confirmed to the Data Protection Officer.
10.3 Honest Disclosure. PHSL does not represent that it can guarantee the erasure of a copy which has passed outside its control, whether through lawful publication with consent or through the act of a recipient. This limitation is disclosed to a Guardian before any consent to publication is taken, and not afterwards.
11. PROCESSORS AND THIRD PARTIES
11.1 Contractual Requirement. Every written agreement with a processor requires that processor to delete or return all personal data upon termination of the engagement, to certify that deletion in writing, and to apply retention periods no longer than those in Section 6.
11.2 Departing Personnel. Upon cessation of an engagement, personnel return or irretrievably delete all personal data in their possession, including copies held on personal devices or accounts, and certify the deletion in writing within seven (7) calendar days.
12. EARLY DELETION AND DATA SUBJECT REQUESTS
12.1 Erasure on Request. Nothing in this instrument prevents earlier deletion at the request of a data subject where the right to erasure or blocking applies and no legal ground for continued retention subsists.
12.2 Partial Retention. Where part only of a record must be retained, PHSL deletes or redacts the remainder rather than retaining the whole.
13. SCOPE LIMITATION, ALLOCATION OF RESPONSIBILITY, AND LIABILITY
13.1 Nature of the Engagement. PHSL is engaged solely to provide specialist technical swimming coaching, diagnostic observation, measurement, and the reporting of technical findings. PHSL is not engaged to provide, and does not provide, medical care, medical evaluation, medical diagnosis, physiotherapy, nutritional prescription, psychological or psychiatric treatment, lifeguarding, facility safety oversight, or the supervision of a Swimmer outside a scheduled session. Nothing in this instrument, and nothing contained in any record generated under it, constitutes or is to be relied upon as medical advice or a medical opinion.
13.2 Responsibility of the Facility and the Partner Organization. Responsibility for the safety and suitability of the training facility, for the presence of lifeguarding and of qualified medical personnel where required, for emergency response, and for the general welfare of a Swimmer outside a scheduled coaching session, rests with the facility operator and with the partner organization that secured the facility, in accordance with the Program Partnership Agreement. PHSL does not assume and is not to be treated as having assumed any of those responsibilities by reason of the adoption of this instrument.
13.3 Warranties of the Guardian. By enrolling a Swimmer, the Guardian warrants that: (a) he or she is the parent or legal guardian of the Swimmer and is authorized to give the consents recorded in the Parent and Guardian Consent and Liability Waiver; (b) the information furnished to PHSL, and in particular the medical disclosure, is true, complete, current, and not misleading; (c) he or she will inform PHSL in writing, without delay, of any change in that information, including any injury, illness, medication, or condition arising during the Program; and (d) he or she will not upload to the Portal, or transmit to PHSL, any personal data of a person other than the Swimmer without that person’s authority.
13.4 Reliance. PHSL relies on the information furnished by the Guardian and by the Swimmer in the design and conduct of the technical work. To the fullest extent permitted by law, PHSL is not liable for any loss, injury, or damage arising from, or contributed to by, the failure to disclose a material condition, the furnishing of inaccurate or incomplete information, or the failure to notify PHSL of a change in that information.
13.5 No Guarantee of Outcome. Swimming performance is influenced by many factors beyond technical coaching, including individual physiology, growth, recovery, training load carried outside the Program, mental state, competition conditions, and circumstances outside the control of PHSL. PHSL does not warrant or guarantee any specific time improvement, qualifying result, selection outcome, or competitive result for any Swimmer, and no statement in any record generated under this instrument is to be construed as such a warranty.
13.6 Third-Party Platforms. PHSL uses hosting, storage, electronic mail, calendar, messaging, and payment services operated by third parties. Those parties act as independent controllers or as processors under their own terms. PHSL selects them with reasonable care, engages processors under written agreement, and remains accountable for personal data transferred to a processor. PHSL does not, however, warrant the security of a platform it does not operate, and is not liable for an act or omission of an independent controller, save to the extent that liability arises from PHSL’s own act, omission, or failure to exercise reasonable care in that party’s selection or instruction.
13.7 Security of the Guardian’s Own Environment. Where PHSL furnishes material to a Guardian or Swimmer, whether through the Portal, by expiring link, or otherwise, responsibility for the security of that material once received, including the security of the recipient’s device, account credentials, and network, and any onward sharing by the recipient, rests with the recipient. PHSL is not liable for a disclosure arising from the recipient’s own act or omission.
13.8 Force Majeure. PHSL is not liable for a failure or delay in the performance of an obligation under this instrument to the extent caused by an event beyond its reasonable control, including natural disaster, public health emergency, governmental action, civil disturbance, facility closure, or the failure of a public utility or telecommunications network. PHSL shall give notice of the event and shall resume performance as soon as reasonably practicable. This provision does not extend the seventy-two (72) hour period for the notification of a personal data breach.
13.9 Limitation of Liability. To the fullest extent permitted by law, and save as provided in the following Section, the aggregate liability of PHSL to any Guardian or Swimmer arising out of or in connection with this instrument, whether in contract, quasi-delict, or otherwise, shall not exceed the total fees actually received by PHSL in respect of that Swimmer, and PHSL shall not be liable for indirect, incidental, consequential, special, or punitive damages, including loss of opportunity, loss of selection, or loss of sponsorship.
13.10 Non-Derogation. Nothing in this instrument operates, or is to be construed as operating, to: (a) exclude or limit the liability of PHSL for gross negligence or willful misconduct; (b) exclude or limit any liability which cannot lawfully be excluded or limited, including criminal and administrative liability under the DPA; (c) waive, diminish, or condition any right of a data subject under the DPA, its IRR, or the issuances of the National Privacy Commission, every such right being non-waivable and every purported waiver of it being void; (d) restrict the right of any person to complain to the National Privacy Commission or to any other competent authority; or (e) limit the rights of a Child under Republic Act No. 7610, Republic Act No. 11930, or any other law enacted for the protection of children. Any provision of this instrument which would otherwise have such an effect shall be read down to the minimum extent necessary to give effect to this Section, and shall otherwise remain in full force.
13.11 Relationship to the Waiver. This Section supplements, and does not replace, reduce, or supersede, the assumption of risk, release of liability, and indemnity provisions of the PH Stroke Lab Parent and Guardian Consent and Liability Waiver. Where the two instruments address the same subject matter, they are to be read together and cumulatively.
14. GOVERNANCE, REVIEW, AND AMENDMENT
14.1 Accountability. PHSL is responsible for personal data under its control or custody, including personal data transferred to a third party for processing, whether within or outside the Philippines, and remains accountable for compliance by that third party. The Data Protection Officer monitors compliance with this instrument, maintains the register of processing activities, the consent register, the access log, the disposal log, and the record of security incidents, and reports annually to the Founder on the state of compliance.
14.2 Privacy Impact Assessment. A Privacy Impact Assessment shall be conducted before the commencement of each Batch, before the launch of the website or Portal or any material change to either, before the adoption of any new processing tool, platform, or vendor, before the collection of any new category of personal data, and before any new transfer outside the Philippines. Where the assessment concerns the personal data of Children, it shall expressly address the age range affected, the risks arising from the depiction of Children, the adequacy of the age-appropriate notice, and the measures adopted to prevent identification of or contact with a Child by an unauthorized person.
14.3 Training and Undertakings. Every coach, specialist, contractor, and volunteer shall execute a written confidentiality and data protection undertaking before any access to personal data is granted, and shall receive orientation on this instrument before engagement and refresher orientation at least annually. The undertaking survives the termination of the engagement.
14.4 Sanction. A breach of this instrument by personnel is a ground for suspension or termination of engagement, without prejudice to civil, criminal, and administrative liability under Sections 25 to 34 of the DPA.
14.5 Review. This instrument shall be reviewed at least once every twelve (12) months, and additionally upon any material change in the operations of PHSL, upon the issuance of any circular, advisory, or opinion of the National Privacy Commission bearing on its subject matter, and following any personal data breach.
14.6 Amendment. An amendment takes effect upon publication on the PHSL website and Portal. Where an amendment materially affects the rights of data subjects or the purposes of processing, PHSL shall notify affected Guardians directly, giving not less than fifteen (15) calendar days’ notice, and shall obtain fresh consent where consent is the lawful basis and the purpose, scope, method, or extent of processing has changed. An amendment to one instrument in the set which affects another shall be made to both at the same time, so that the set remains internally consistent.
14.7 Version Control. Every version of this instrument shall be retained together with its dates of effectivity, so that the terms applicable at any past date can be established.
15. MISCELLANEOUS
15.1 Governing Law. This instrument is governed by and construed in accordance with the laws of the Republic of the Philippines.
15.2 Severability. Should any provision of this instrument be held invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.
15.3 No Waiver. The failure of PHSL to enforce any provision shall not constitute a waiver of that provision or of any other.
15.4 Interpretation. Headings are for convenience only and do not affect interpretation. The singular includes the plural and the plural the singular. A reference to a statute, circular, or advisory includes that instrument as amended, superseded, or replaced. The words "including" and "in particular" are illustrative and not limiting.
15.5 Publication and Availability. This instrument shall be published in full on the PHSL website and Portal, furnished to every Guardian at enrollment, and made available to the National Privacy Commission and to any data subject upon request. A Filipino translation of the summary notice shall be furnished upon request.
15.6 Effectivity. This instrument takes effect on the date stated in the Document Control table and remains in force until amended or superseded in accordance with Section 14.
ANNEX A RETENTION AND DISPOSAL REGISTER
Completed by the Data Protection Officer at each semi-annual disposal review and at the conclusion of each Batch.
| Record category | Period | Trigger date | Scheduled disposal | Disposed on / by |
|---|---|---|---|---|
| Unsuccessful applications | 6 months | |||
| Swimmer identity and profile | 5 years | |||
| Executed waiver | 10 years or age 21 | |||
| Medical disclosure | 5 years | |||
| Emergency contacts | 90 days | |||
| Program Data and reports | 5 years | |||
| Footage — internal coaching | 24 months | |||
| Footage — educational | Consent-bound | |||
| Footage — marketing | Consent-bound | |||
| Consent records | 5 years post-lapse | |||
| Invoices and receipts | 10 years | |||
| Correspondence | 3 years | |||
| Portal accounts | Term + 12 months | |||
| Access logs | 12 months | |||
| Website analytics | 12 months | |||
| Data subject requests | 5 years | |||
| Incident and breach records | 5 years | |||
| Personnel records | 5 years |
Records placed on legal hold this cycle, with reasons:
ANNEX B CERTIFICATE OF DISPOSAL
| Field | Entry |
|---|---|
| Disposal cycle covered | |
| Date of disposal | |
| Categories disposed of | |
| Approximate volume | |
| Method used for electronic records | |
| Method used for paper records | |
| Devices or media wiped | |
| Records withheld from disposal, with reasons |
I certify that the records described above have been disposed of in the manner stated, and that no record subject to a legal hold has been disposed of in this cycle.
JERARD DOMINIC S. JACINTO Data Protection Officer, PH Stroke Lab
Date: ______________________