Data Usage Policy

PH STROKE LAB

Precision Technique Program

DATA USAGE POLICY

Governing the purposes for which PH Stroke Lab may use personal data, the uses which are prohibited, and who within PH Stroke Lab may see what Adopted pursuant to Sections 11 and 12 of Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the circulars and advisories of the National Privacy Commission.

Field	Entry
Document reference	PHSL-DUP-2026-01
Document title	Data Usage Policy
Version	1.0 (Original Adoption)
Personal Information Controller	PH Stroke Lab
Executed by	Jerard Dominic S. Jacinto, Founder and Data Protection Officer
Date of adoption	______________________, 2026
Date of effectivity	______________________, 2026
Next scheduled review	Twelve (12) months from the date of effectivity
Companion instruments	PHSL-DPP-2026-01 (Data Privacy Policy and Privacy Notice); PHSL-DRP-2026-01 (Data Retention Policy); PHSL-VCP-2026-01 (Video, Image and Footage Consent Policy and Notice)
Status	Adopted as a sworn instrument and published in full on the PH Stroke Lab website and Portal.

1. DECLARATION OF POLICY

1.1 Purpose Limitation. Personal data collected for one purpose may not be used for another. PHSL declares in this instrument every use to which personal data in its custody may be put, and undertakes that no other use will be made of it.

1.2 Least Exposure. Within PHSL, personal data is seen by the fewest people, in the least identifiable form, for the shortest time, consistent with the technical work being done well. A coach does not see what his function does not require, however senior he is and however curious he may be.

1.3 Binding Effect. This instrument binds PHSL, its Founder, every coach, specialist, contractor, volunteer, and administrative person engaged by PHSL, and every processor engaged on its behalf. Adherence is a condition of engagement.

2. PERSONAL INFORMATION CONTROLLER AND DATA PROTECTION OFFICER

2.1 Identity of the Controller. The Personal Information Controller ("PIC") for all processing described in this instrument is PH STROKE LAB ("PHSL"), a specialist swim technique and measurement program organized and operating under the laws of the Republic of the Philippines, represented by its Founder, Jerard Dominic S. Jacinto.

2.2 Contact Details. All communications relating to this instrument, including the exercise of any right of a data subject, may be addressed as follows:

Field	Entry
Personal Information Controller	PH Stroke Lab
Represented by	Jerard Dominic S. Jacinto, Founder
Registered or operating address	_________________________________________________
Electronic mail for privacy matters	jaojacinto2@gmail.com
Mobile number	+63 961 750 3272
Data Protection Officer	Jerard Dominic S. Jacinto (concurrent capacity)
Website	_________________________________________________
Swimmer Portal	_________________________________________________

2.3 Designation of the Data Protection Officer. PHSL designates Jerard Dominic S. Jacinto as its Data Protection Officer in concurrent capacity with his role as Founder, in accordance with NPC Advisory No. 2017-01. PHSL discloses that this concurrence is a consequence of its present size and undertakes to designate an independent Data Protection Officer, or a Compliance Officer for Privacy reporting to a Data Protection Officer, upon the engagement of additional administrative personnel. The Data Protection Officer shall not be penalized for the performance of his statutory functions, and no instruction shall be given to him as to the manner in which he discharges them.

2.4 Disclosure as to Business Registration. PHSL discloses that, as at the date of adoption of this instrument, its business registration with the Department of Trade and Industry and the Bureau of Internal Revenue is in process. This instrument is accordingly executed by Jerard Dominic S. Jacinto in his personal capacity and as the natural person operating under the business name "PH Stroke Lab," and the obligations assumed in it are assumed by him personally. Upon completion of business registration, this instrument shall be re-executed in the name of the registered entity, without diminution of any obligation assumed or of any right of a data subject accrued under this version.

2.5 Registration Status with the National Privacy Commission. PHSL employs fewer than two hundred fifty (250) persons and processes the sensitive personal information of fewer than one thousand (1,000) individuals. PHSL nonetheless acknowledges that its processing involves the health information and video footage of children and involves transfer outside the Philippines, and may therefore be characterized as processing likely to pose a risk to the rights and freedoms of data subjects within the meaning of Section 5 of NPC Circular No. 2022-04. PHSL therefore undertakes to register its Data Processing System and its Data Protection Officer with the National Privacy Commission through the National Privacy Commission Registration System, and, in the event registration is ultimately determined not to be required, to execute and file the sworn declaration prescribed by that Circular. PHSL shall in every case file the Annual Security Incident Report on or before the thirty-first (31st) day of March of each year, reporting nil where no incident occurred during the covered period.

3. SCOPE

3.1 Application. This instrument applies to every use of personal data by PHSL and by any person acting for it, in whatever medium and wherever located.

3.2 Relationship to the Other Instruments in the Set. This instrument forms part of a set of four (4) policies adopted together on the same date and to be read as one framework, namely the Data Privacy Policy and Privacy Notice (PHSL-DPP-2026-01), the Data Retention Policy (PHSL-DRP-2026-01), the Data Usage Policy (PHSL-DUP-2026-01), and the Video, Image and Footage Consent Policy and Notice (PHSL-VCP-2026-01). It is further to be read with the PH Stroke Lab Parent and Guardian Consent and Liability Waiver and with the Program Partnership Agreement between PH Stroke Lab and Swim League Philippines. Where any of those documents affords a data subject greater protection than this instrument, that document prevails to the extent of the greater protection. In every other case of irreconcilable conflict on a matter of data protection, this instrument prevails. The categories of personal data and the lawful bases referred to in this instrument bear the meanings given to them in the Data Privacy Policy. The periods for which the data may be held are governed by the Data Retention Policy. The use of Footage is governed additionally by the Video, Image and Footage Consent Policy, which prevails in the event of conflict as to Footage.

4. DEFINITIONS AND STANDARD PERIODS

4.1 Adopted Definitions. Terms defined in Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (the "DPA"), and in its Implementing Rules and Regulations (the "IRR"), bear the same meaning in this instrument. In addition, and consistently across all four instruments in the set, the following terms are used as follows:

"Batch" means a cohort of Swimmers enrolled together in a single running of the Program. The maximum size of a Batch is fixed by the applicable partnership or enrollment agreement and does not affect the operation of this instrument.

"Child" means consistent with NPC Advisory No. 2024-03, a person below eighteen (18) years of age, or a person eighteen (18) years of age or over who is unable to fully take care of or protect himself or herself from abuse, neglect, cruelty, exploitation, or discrimination because of a physical or mental disability or condition.

"Coaching Team" means Jerard Dominic S. Jacinto (in-water stroke coaching), Nathan Jao (out-of-pool education, metrics, and mental conditioning), and Lukasz Gorkas (athletic training, mobility, and biomechanics), together with any coach or specialist subsequently engaged by PHSL in writing.

"Footage" means any video recording, still photograph, screen capture, frame extraction, motion-tracking overlay, annotated still, or other derivative visual record of a Swimmer captured or generated by or for PHSL, together with any audio incidentally captured with it.

"Guardian" means the parent or legal guardian of a Swimmer who is a Child, being the person authorized under law to give consent on that Swimmer’s behalf.

"Portal" means the secure online platform operated by or for PHSL through which Swimmers, Guardians, and the Coaching Team access Program materials, submit and review Footage, and view records of progress.

"Program" means the PHSL Precision Technique Program, comprising an in-pool correction phase and a subsequent online check-in and reinforcement phase, the venue, cadence, session count, and duration of which are fixed for each Batch by the applicable enrollment or partnership agreement and by the schedule issued to each Swimmer.

"Program Data" means the technical record generated by PHSL in respect of a Swimmer, including the baseline diagnostic assessment, identified symptom and root cause, prescribed drills, cues and progressions, stroke count, stroke rate, breakout distance, split and benchmark times, fresh and fatigued scoring, mobility assessment, attendance, mid-block and mid-phase checks, self-report, and the end-of-Program summary report.

"SLP" means Swim League Philippines, the organization with which PHSL has entered into a Program Partnership Agreement.

"Swimmer" means an individual enrolled in, applying to, or previously enrolled in the Program.

"Working day" means a day other than a Saturday, a Sunday, or a regular or special non-working holiday declared in the National Capital Region.

4.2 Standard Periods. The following periods apply uniformly across all four instruments in the set. Where any other document issued by PHSL states a different period for the same act, the period below prevails.

Act	Period
Acknowledgment of a data subject request or complaint	Two (2) working days from receipt
Substantive response to a data subject request or complaint	Fifteen (15) working days from receipt of a complete request
Extension of the response period, once only, with notice and reasons given before the original period expires	A further fifteen (15) working days
Effect given to a withdrawal of consent in respect of internal processing	Seven (7) calendar days
Effect given to a withdrawal of consent in respect of material already published	Thirty (30) calendar days
Internal report of a security incident or suspected breach to the Data Protection Officer	Four (4) hours from becoming aware
Notification of a notifiable personal data breach to the National Privacy Commission and to affected data subjects	Seventy-two (72) hours from knowledge of, or reasonable belief in, its occurrence
Revocation of all access upon cessation of an engagement	Twenty-four (24) hours
Certification by departing personnel of deletion of all personal data held	Seven (7) calendar days from cessation
Update of the register of processing activities following any change	Ten (10) calendar days
Notice to Guardians of a material amendment to any instrument in the set	Not less than fifteen (15) calendar days before effectivity
Review of each instrument in the set	At least once every twelve (12) months

5. DECLARED USES

5.1 Permitted Purposes. Personal data collected by PHSL may be used only for the following purposes:

(a) assessing an applicant against the published selection criteria and conducting the discovery call;

(b) establishing a baseline diagnostic assessment and identifying the root cause of a technical fault, as distinct from its symptom;

(c) prescribing and sequencing drills, cues, corrections, and progressions across the in-pool block;

(d) measuring progression against baseline, including stroke count, stroke rate, breakout distance, split times, fresh and fatigued scoring, and benchmark results;

(e) prescribing mobility and biomechanical protocols calibrated to the correction being applied, and identifying any physical prerequisite the Swimmer does not yet possess;

(f) delivering out-of-pool education, video review, mental conditioning, and reinforcement during the online phase;

(g) protecting the health, welfare, and safety of the Swimmer, including load management and the avoidance of injury;

(h) preparing and, with the consent of the Guardian, transmitting the end-of-Program summary report to the home club coach;

(i) scheduling, attendance management, and communication with Guardians and partner organizations;

(j) invoicing, receipting, accounting, and tax compliance;

(k) administering and securing the website and the Portal;

(l) complying with legal obligations and establishing, exercising, or defending legal claims; and

(m) with separate optional consent, coaching education and case study development on anonymized material, and marketing and promotional use.

5.2 New or Changed Purposes. Where a new purpose arises, PHSL assesses its compatibility with the purpose for which the data was collected, records that assessment, and, where consent was the basis of collection or the new purpose is materially different, obtains fresh consent before proceeding. A new purpose is not adopted by practice; it is adopted by amendment of this instrument.

6. PROHIBITED USES

6.1 Absolute Prohibitions. PHSL shall not, under any circumstance:

(a) sell, lease, license, trade, or otherwise make personal data available in exchange for any consideration;

(b) disclose the health information of a Swimmer to a partner organization, a home club, another Swimmer, another Guardian, or any person who does not require it for the protection of that Swimmer, absent specific written consent or a genuine emergency;

(c) publish, post, or transmit Footage of a Swimmer outside the consent given in respect of that Footage;

(d) use the Program Data or Footage of one Swimmer to solicit, market to, or recruit another;

(e) compare Swimmers publicly by name, or publish any ranking, leaderboard, or league table identifying Swimmers by name, without the written consent of every Guardian concerned;

(f) use personal data to make or communicate a diagnosis of a medical condition, PHSL not being engaged to provide medical care or evaluation;

(g) submit identifiable personal data of a Swimmer to any generative artificial intelligence service, large language model, analytics platform, or other third-party tool which is not engaged as a processor under a written agreement complying with the Data Privacy Policy;

(h) permit personal data to be used to train any artificial intelligence or machine learning model, whether operated by PHSL or by a third party, absent irreversible anonymization and, where the material comprises Footage, the separate written consent of the Guardian;

(i) retain, copy, or use personal data after the termination of an engagement with PHSL;

(j) use personal data to make a decision affecting a Swimmer by automated means alone; or

(k) process personal data in any manner which would expose a Child to the risk of identification, contact, or exploitation by an unauthorized person.

6.2 Consequence. A breach of this Section by personnel is a ground for immediate termination of engagement and, where the facts warrant, for referral to the National Privacy Commission and to the appropriate law enforcement authority.

7. INTERNAL ACCESS CONTROL

7.1 Need to Know and Least Privilege. Access within PHSL is granted by role and limited to what the role requires. No member of personnel holds access to a category of personal data which his or her function does not require.

7.2 Access Matrix. Access is allocated as set out below and reproduced at Annex A:

Data category	Founder and in-water coach	Online education and metrics	Mobility and biomechanics
Swimmer identity and contact	Full	Name and Portal handle only	Name and Portal handle only
Guardian and emergency contact	Full	None	None
Health information	Full	Restricted — only such summary as bears on cognitive load and readiness	Full — required in order to prescribe safely
Footage	Full	Full	Restricted — only segments relevant to mobility assessment
Program Data	Full	Full	Restricted — measurement and mobility fields
Financial and transactional data	Full	None	None
Portal administration and access logs	Full	None	None

7.3 Review of Access. Access rights are reviewed at the commencement and at the conclusion of every Batch, and are revoked within twenty-four (24) hours of the cessation of an engagement. Every grant, change, and revocation of access is recorded.

7.4 Logging. Access to Footage and to health information is individually logged. Logs are reviewed by the Data Protection Officer at each Batch review, and any access without an apparent operational reason is investigated.

8. ARTIFICIAL INTELLIGENCE AND ANALYTICAL TOOLS

8.1 Disclosure. PHSL uses video analysis software, measurement tools, and general-purpose research and drafting assistants in the course of its work. PHSL adopts the standards in NPC Advisory No. 2024-04 in respect of any such tool which processes personal data.

8.2 Controls. Where such a tool is used: (a) personal data is pseudonymized or anonymized before submission wherever the analytical purpose can be achieved without identity; (b) Footage is processed only in tools operated under a written processor agreement prohibiting the use of that material for model training or for any purpose other than the instruction given; (c) the output of any tool is reviewed by a human coach before it is acted upon or communicated; (d) no tool is the sole basis of a decision affecting a Swimmer; and (e) the tools in use are listed in the register of processing activities and disclosed to any Guardian on request.

8.3 Accountability for Output. Responsibility for a technical prescription rests with the coach who gives it, and is not transferred, shared, or diminished by the use of any tool in reaching it.

9. THE ANONYMIZED KNOWLEDGE LIBRARY

9.1 Purpose. PHSL maintains an internal technical library recording symptoms, root causes, drills, cues, mobility prerequisites, metrics, and outcomes, so that the treatment of one Swimmer improves the treatment of the next.

9.2 Anonymization Standard. An entry in that library shall record no name, no initials, no date of birth, no club, no meet, no photograph, and no other detail by which a Swimmer could reasonably be identified, whether alone or in combination with other information reasonably available. Where a combination of event, time, age band, and date would in practice identify a Swimmer within the Philippine competitive population, the entry shall be generalized until it does not.

9.3 Verification. The Data Protection Officer verifies anonymization before an entry is admitted to the library, and conducts a re-identification risk review annually. Where a risk of re-identification emerges, the entry is generalized further or removed.

9.4 Use of the Library. The library may be used for the improvement of PHSL methodology, for coaching education, and for case study development. It may not be used to identify, contact, compare, or market to any individual.

10. MARKETING, TESTIMONIALS, AND PUBLIC STATEMENTS

10.1 Consent Required. PHSL sends marketing communications only to a Guardian who has given prior consent to receive them, given separately from any other consent, and includes in every such communication a simple means of opting out at no cost. An opt-out takes effect within seven (7) calendar days.

10.2 Testimonials and Results. PHSL shall not publish the name, image, times, or results of a Swimmer as a testimonial or as evidence of Program outcomes without the written consent of the Guardian, given specifically in respect of the publication in question, and, where the Swimmer is fourteen (14) years of age or over, without the Swimmer’s own acknowledgment.

10.3 No Implied Guarantee. PHSL shall not present the data of a Swimmer in a manner which represents or implies a guaranteed outcome for any other Swimmer.

10.4 Accuracy of Claims. A public statement by PHSL as to the achievement of a Swimmer shall be accurate, verifiable, and made with the consent of the Guardian. A statement as to a commitment, engagement, or attendance which has not been confirmed in writing by the person concerned shall not be presented as confirmed.

11. PROCESSORS AND VENDORS

11.1 Written Agreement. A third party engaged to process personal data on behalf of PHSL is engaged under a written agreement specifying the subject matter, duration, nature, and purpose of the processing, the categories of data, the security measures required, the prohibition on sub-processing without prior written authorization, the duty to assist PHSL in responding to data subject requests and breaches, and the duty to delete or return all data upon termination.

11.2 Instruction Only. A processor may act only on the documented instruction of PHSL, and may not use personal data for its own purposes, including product improvement or model training.

11.3 Due Diligence. Before engagement, PHSL assesses the security posture, location of processing, sub-processor chain, and retention practice of the proposed processor, and records that assessment.

12. DATA QUALITY

12.1 Accuracy. PHSL verifies identity, health, and contact data at enrollment and invites Guardians to confirm or correct that data at the commencement of each Batch.

12.2 Context of Measurement. Program Data shall record the conditions under which a measurement was taken, including whether the Swimmer was fresh or fatigued and the effort level prescribed, so that the record is not misleading when read at a later date or by another coach.

12.3 Correction Propagation. Where data is corrected, PHSL informs every recipient to whom the erroneous data was disclosed and corrects the record held in the Portal, in the session log, and in any report already issued.

12.4 Separation of Observation from Inference. A record shall distinguish what was observed or measured from what was inferred from it. An inference shall be recorded as an inference and shall be capable of being disputed by the Guardian under the right to rectification.

13. OBLIGATIONS OF PERSONNEL

13.1 Undertaking. Every coach, specialist, contractor, and volunteer executes the undertaking at Annex B before any access to personal data is granted. The undertaking survives the termination of the engagement.

13.2 Prohibition on Retention. Upon cessation of an engagement, personnel return or irretrievably delete all personal data in their possession, including any copy held on a personal device or account, and certify the deletion in writing within seven (7) calendar days.

13.3 Duty to Report. Personnel shall report to the Data Protection Officer, within four (4) hours, any use of personal data which they believe to be outside this instrument, whether by themselves or by another. A report made in good faith shall not expose the reporting person to any detriment.

14. SCOPE LIMITATION, ALLOCATION OF RESPONSIBILITY, AND LIABILITY

14.1 Nature of the Engagement. PHSL is engaged solely to provide specialist technical swimming coaching, diagnostic observation, measurement, and the reporting of technical findings. PHSL is not engaged to provide, and does not provide, medical care, medical evaluation, medical diagnosis, physiotherapy, nutritional prescription, psychological or psychiatric treatment, lifeguarding, facility safety oversight, or the supervision of a Swimmer outside a scheduled session. Nothing in this instrument, and nothing contained in any record generated under it, constitutes or is to be relied upon as medical advice or a medical opinion.

14.2 Responsibility of the Facility and the Partner Organization. Responsibility for the safety and suitability of the training facility, for the presence of lifeguarding and of qualified medical personnel where required, for emergency response, and for the general welfare of a Swimmer outside a scheduled coaching session, rests with the facility operator and with the partner organization that secured the facility, in accordance with the Program Partnership Agreement. PHSL does not assume and is not to be treated as having assumed any of those responsibilities by reason of the adoption of this instrument.

14.3 Warranties of the Guardian. By enrolling a Swimmer, the Guardian warrants that: (a) he or she is the parent or legal guardian of the Swimmer and is authorized to give the consents recorded in the Parent and Guardian Consent and Liability Waiver; (b) the information furnished to PHSL, and in particular the medical disclosure, is true, complete, current, and not misleading; (c) he or she will inform PHSL in writing, without delay, of any change in that information, including any injury, illness, medication, or condition arising during the Program; and (d) he or she will not upload to the Portal, or transmit to PHSL, any personal data of a person other than the Swimmer without that person’s authority.

14.4 Reliance. PHSL relies on the information furnished by the Guardian and by the Swimmer in the design and conduct of the technical work. To the fullest extent permitted by law, PHSL is not liable for any loss, injury, or damage arising from, or contributed to by, the failure to disclose a material condition, the furnishing of inaccurate or incomplete information, or the failure to notify PHSL of a change in that information.

14.5 No Guarantee of Outcome. Swimming performance is influenced by many factors beyond technical coaching, including individual physiology, growth, recovery, training load carried outside the Program, mental state, competition conditions, and circumstances outside the control of PHSL. PHSL does not warrant or guarantee any specific time improvement, qualifying result, selection outcome, or competitive result for any Swimmer, and no statement in any record generated under this instrument is to be construed as such a warranty.

14.6 Third-Party Platforms. PHSL uses hosting, storage, electronic mail, calendar, messaging, and payment services operated by third parties. Those parties act as independent controllers or as processors under their own terms. PHSL selects them with reasonable care, engages processors under written agreement, and remains accountable for personal data transferred to a processor. PHSL does not, however, warrant the security of a platform it does not operate, and is not liable for an act or omission of an independent controller, save to the extent that liability arises from PHSL’s own act, omission, or failure to exercise reasonable care in that party’s selection or instruction.

14.7 Security of the Guardian’s Own Environment. Where PHSL furnishes material to a Guardian or Swimmer, whether through the Portal, by expiring link, or otherwise, responsibility for the security of that material once received, including the security of the recipient’s device, account credentials, and network, and any onward sharing by the recipient, rests with the recipient. PHSL is not liable for a disclosure arising from the recipient’s own act or omission.

14.8 Force Majeure. PHSL is not liable for a failure or delay in the performance of an obligation under this instrument to the extent caused by an event beyond its reasonable control, including natural disaster, public health emergency, governmental action, civil disturbance, facility closure, or the failure of a public utility or telecommunications network. PHSL shall give notice of the event and shall resume performance as soon as reasonably practicable. This provision does not extend the seventy-two (72) hour period for the notification of a personal data breach.

14.9 Limitation of Liability. To the fullest extent permitted by law, and save as provided in the following Section, the aggregate liability of PHSL to any Guardian or Swimmer arising out of or in connection with this instrument, whether in contract, quasi-delict, or otherwise, shall not exceed the total fees actually received by PHSL in respect of that Swimmer, and PHSL shall not be liable for indirect, incidental, consequential, special, or punitive damages, including loss of opportunity, loss of selection, or loss of sponsorship.

14.10 Non-Derogation. Nothing in this instrument operates, or is to be construed as operating, to: (a) exclude or limit the liability of PHSL for gross negligence or willful misconduct; (b) exclude or limit any liability which cannot lawfully be excluded or limited, including criminal and administrative liability under the DPA; (c) waive, diminish, or condition any right of a data subject under the DPA, its IRR, or the issuances of the National Privacy Commission, every such right being non-waivable and every purported waiver of it being void; (d) restrict the right of any person to complain to the National Privacy Commission or to any other competent authority; or (e) limit the rights of a Child under Republic Act No. 7610, Republic Act No. 11930, or any other law enacted for the protection of children. Any provision of this instrument which would otherwise have such an effect shall be read down to the minimum extent necessary to give effect to this Section, and shall otherwise remain in full force.

14.11 Relationship to the Waiver. This Section supplements, and does not replace, reduce, or supersede, the assumption of risk, release of liability, and indemnity provisions of the PH Stroke Lab Parent and Guardian Consent and Liability Waiver. Where the two instruments address the same subject matter, they are to be read together and cumulatively.

15. GOVERNANCE, REVIEW, AND AMENDMENT

15.1 Accountability. PHSL is responsible for personal data under its control or custody, including personal data transferred to a third party for processing, whether within or outside the Philippines, and remains accountable for compliance by that third party. The Data Protection Officer monitors compliance with this instrument, maintains the register of processing activities, the consent register, the access log, the disposal log, and the record of security incidents, and reports annually to the Founder on the state of compliance.

15.2 Privacy Impact Assessment. A Privacy Impact Assessment shall be conducted before the commencement of each Batch, before the launch of the website or Portal or any material change to either, before the adoption of any new processing tool, platform, or vendor, before the collection of any new category of personal data, and before any new transfer outside the Philippines. Where the assessment concerns the personal data of Children, it shall expressly address the age range affected, the risks arising from the depiction of Children, the adequacy of the age-appropriate notice, and the measures adopted to prevent identification of or contact with a Child by an unauthorized person.

15.3 Training and Undertakings. Every coach, specialist, contractor, and volunteer shall execute a written confidentiality and data protection undertaking before any access to personal data is granted, and shall receive orientation on this instrument before engagement and refresher orientation at least annually. The undertaking survives the termination of the engagement.

15.4 Sanction. A breach of this instrument by personnel is a ground for suspension or termination of engagement, without prejudice to civil, criminal, and administrative liability under Sections 25 to 34 of the DPA.

15.5 Review. This instrument shall be reviewed at least once every twelve (12) months, and additionally upon any material change in the operations of PHSL, upon the issuance of any circular, advisory, or opinion of the National Privacy Commission bearing on its subject matter, and following any personal data breach.

15.6 Amendment. An amendment takes effect upon publication on the PHSL website and Portal. Where an amendment materially affects the rights of data subjects or the purposes of processing, PHSL shall notify affected Guardians directly, giving not less than fifteen (15) calendar days’ notice, and shall obtain fresh consent where consent is the lawful basis and the purpose, scope, method, or extent of processing has changed. An amendment to one instrument in the set which affects another shall be made to both at the same time, so that the set remains internally consistent.

15.7 Version Control. Every version of this instrument shall be retained together with its dates of effectivity, so that the terms applicable at any past date can be established.

16. MISCELLANEOUS

16.1 Governing Law. This instrument is governed by and construed in accordance with the laws of the Republic of the Philippines.

16.2 Severability. Should any provision of this instrument be held invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

16.3 No Waiver. The failure of PHSL to enforce any provision shall not constitute a waiver of that provision or of any other.

16.4 Interpretation. Headings are for convenience only and do not affect interpretation. The singular includes the plural and the plural the singular. A reference to a statute, circular, or advisory includes that instrument as amended, superseded, or replaced. The words "including" and "in particular" are illustrative and not limiting.

16.5 Publication and Availability. This instrument shall be published in full on the PHSL website and Portal, furnished to every Guardian at enrollment, and made available to the National Privacy Commission and to any data subject upon request. A Filipino translation of the summary notice shall be furnished upon request.

16.6 Effectivity. This instrument takes effect on the date stated in the Document Control table and remains in force until amended or superseded in accordance with Section 15.

ANNEX A ACCESS MATRIX

Completed and signed at the commencement of each Batch and reviewed at its conclusion.

Data category	Founder and in-water coach	Online education and metrics	Mobility and biomechanics
Swimmer identity and contact	Full	Name and Portal handle only	Name and Portal handle only
Guardian and emergency contact	Full	None	None
Health information	Full	Restricted summary	Full
Footage	Full	Full	Restricted segments
Program Data	Full	Full	Restricted fields
Financial and transactional data	Full	None	None
Portal administration and access logs	Full	None	None

Field	Entry
Batch reference
Date access granted
Accounts created
Multi-factor authentication verified
Date access reviewed
Date access revoked
Anomalous access investigated

ANNEX B CONFIDENTIALITY AND DATA PROTECTION UNDERTAKING

To be executed by every coach, specialist, contractor, and volunteer before any access to personal data is granted.

I, the undersigned, in consideration of my engagement with PH Stroke Lab, undertake as follows:

1. I have read and understood the PH Stroke Lab Data Privacy Policy, Data Retention Policy, Data Usage Policy, and Video, Image and Footage Consent Policy, and I agree to be bound by each of them.

2. I will access personal data only where my function requires it, and only to the extent permitted by the access matrix applicable to my role.

3. I will not disclose personal data to any person outside PH Stroke Lab except as expressly permitted by those instruments.

4. I will not store personal data on a personal device, removable medium, or personal cloud or messaging account, and where a personal device is used out of operational necessity I will transfer the data to the PH Stroke Lab repository and delete it from the device, including from automatic backups, camera rolls, recently deleted folders, and application caches, before the end of the same day.

5. I will not submit identifiable personal data of a Swimmer to any third-party tool which is not engaged as a processor by PH Stroke Lab under written agreement.

6. I will report any security incident, suspected personal data breach, or use of personal data outside those instruments to the Data Protection Officer within four (4) hours of becoming aware of it.

7. I will report immediately any Footage being used, sought, requested, or circulated in a manner suggestive of sexual interest in a Child, and I understand that no internal or reputational consideration justifies delaying such a report.

8. Upon the cessation of my engagement I will return or irretrievably delete all personal data in my possession and will certify that deletion in writing within seven (7) calendar days.

9. I understand that this undertaking survives the termination of my engagement, and that a breach of it may give rise to civil, criminal, and administrative liability under Sections 25 to 34 of the Data Privacy Act of 2012.

Signature	Date
Printed name	Role
Location of engagement	Access level granted

Countersigned for PH Stroke Lab: __________________________ Date: ______________________