PH Stroke Lab Privacy Notice

PH STROKE LAB PRIVACY NOTICE

Version: 2026-08-06-draft.2

TEMPORARY DRAFT — NOT EFFECTIVE UNTIL APPROVED AND PUBLISHED

This privacy notice explains PH Stroke Lab’s handling of personal information in its website and portal. It provides information and is not itself consent. When consent is required, PH Stroke Lab asks for it separately and records the exact policy version involved.

A short explanation for students and families

PH Stroke Lab uses the portal to organize swimming lessons and help students learn. We keep only information needed to run the program, protect accounts, support student safety, and show the right information to the right people.

A student sees their own information. An approved parent or guardian sees only a linked child’s permitted information. A coach sees information needed for students currently assigned to that coach. Administrators manage the school and can access information when their work requires it.

Medical notes and emergency contacts are especially private. They are encrypted, access is limited, and every authorized read and change is recorded. Detailed grades, attendance, medical information, safety information, and coaching-review text are not sent by email.

Sharing a YouTube or Google Drive video link for coaching is optional. For a student under 18, an authorized parent or guardian must first approve the current guardian video-consent policy. If something seems wrong or you want to ask about your information, speak with a parent or guardian and contact PH Stroke Lab using the details below.

Scope

This notice covers the public PH Stroke Lab website, the invitation-only portal, supporting APIs, operational email, and administrative processing required to provide the program. It covers students, parents and guardians, coaches, administrators, invited users, and public-site visitors.

The MVP does not provide online billing, payments, chat, advertising profiles, public self-registration, social login, or general file uploads. Public contact links open the visitor’s own email or phone application; the website does not operate a public contact-form database.

Information PH Stroke Lab processes

Category	Examples
Account and identity	Name, email address, required role, account status, invitation state, password hash, authentication-factor and recovery-code records, login and revocation history
Student and family	Date of birth or age information needed to determine minor status, approved parent-child links, relationship details, and permissions such as enrollment, safety, video, and consent authority
Program and scheduling	Courses, sections, sessions, location, lane, enrollment and waitlist requests, makeup requests, conflicts, approvals, cancellations, and reschedules
Attendance	Session roster, present, absent, late, or excused status, makeup eligibility, and reasoned administrative corrections
Learning and progress	Courseware access, lesson-check answers and completion, coach drafts, published progress reports, grade entries, skill assessments, and publication history
Video coaching	YouTube or Google Drive URL, provider, submission status, guardian-consent evidence for a minor, access-issue state, assigned coach, coaching review, withdrawal, URL-removal tombstone, and related audit events
Safety information	Emergency contacts and medical notes, including encrypted revisions and removal history. Medical information is sensitive personal information.
Communications	In-app notifications and limited operational email delivery status for invitations, security events, schedule changes, and enrollment or makeup decisions
Technical and audit	Request ID, date and time, IP address, user agent, actor, affected record, before-and-after state for sensitive mutations, authorization failures, and security logs
Public-site use	Basic server and security logs needed to deliver pages, prevent abuse, and diagnose availability. The MVP does not use advertising trackers.

PH Stroke Lab should not place passwords, TOTP seeds, recovery codes, medical details, grades, attendance details, or coaching-review text in ordinary application logs.

Why the information is used

PH Stroke Lab processes information only for identified and legitimate purposes, including:

• validating invitations and operating secure user accounts;
• confirming roles, family relationships, and permissions;
• publishing course information and managing schedules, capacity, enrollment, waitlists, attendance, and makeups;
• delivering lessons and showing published progress to eligible students and families;
• enabling assigned coaches to teach, assess, and provide requested video feedback;
• maintaining emergency and medical information needed for student safety;
• sending necessary service and security communications;
• detecting abuse, enforcing access boundaries, investigating incidents, and maintaining an append-only accountability record; and
• complying with valid legal duties and responding to data-subject requests.

Depending on the purpose and circumstances, processing may rely on consent, steps requested before or under a program relationship, compliance with law, protection of life and health in an emergency, or a legitimate interest that does not override the person’s rights. Sensitive personal information, including medical information, requires explicit authorization or another condition permitted by Philippine law. PH Stroke Lab must document the applicable basis before real-user processing begins.

Optional video-link processing for a minor depends on an authorized guardian’s separate consent to the current published policy. Refusing or withdrawing video consent does not remove access to the general portal or swimming program.

Who may access information

Access is limited by role and relationship:

• Students may access their own permitted program records, submitted answers, safety records, and video submissions.
• Approved parents and guardians may access only the records of a linked child and only within their granted permissions.
• Assigned coaches may access current rosters, teaching and assessment records, lesson responses, submitted coaching links, and read-only safety information needed for currently enrolled students.
• Administrators may access records required to operate the school, approve workflows, investigate issues, and answer verified requests.
• Service providers process limited information on PH Stroke Lab’s instructions to operate the portal.

Wrong-role access and attempts to use another child’s identifier must be denied. Sensitive safety reads and writes, policy publications, consent changes, and other sensitive mutations are audited.

Service providers and processing locations

PH Stroke Lab uses service providers for defined operational purposes:

• Vercel hosts and delivers the Next.js portal.
• Railway runs the Django API, background workers, scheduler, Redis, and operational logs.
• Neon provides PostgreSQL database hosting.
• Resend delivers limited transactional email.
• YouTube and Google Drive host videos selected and controlled by the person or organization that uploaded them.

These providers may process information outside the Philippines or use infrastructure in multiple countries. Their own privacy and security terms also apply. PH Stroke Lab remains responsible for selecting appropriate providers, limiting the information sent to them, configuring access, and using appropriate contractual and security safeguards.

PH Stroke Lab does not sell personal information and does not use it for third-party behavioral advertising.

External video links

The portal accepts only validated HTTPS links for supported YouTube or Google Drive URLs. PH Stroke Lab stores the external URL, provider, workflow status, consent evidence where required, and coaching review. The backend does not fetch arbitrary submitted URLs server-side.

A student, authorized parent or guardian, or administrator may request removal of a stored video URL. PH Stroke Lab purges the URL from the portal while retaining a non-reversible audit tombstone and any coaching review required for accountability. A tombstone records that an action occurred but does not retain the usable source URL.

Removing the portal URL or withdrawing consent does not change the source video. PH Stroke Lab cannot delete content from YouTube or Google Drive or change the uploader’s sharing settings. The uploader must separately restrict sharing or delete the source content with that provider.

Anyone submitting a link must ensure they are allowed to share it, choose the narrowest practical provider access setting, and avoid including unnecessary personal or sensitive information.

Retention and deletion

PH Stroke Lab keeps personal information only while it is needed for its stated purpose, student safety, security, accountability, dispute handling, or a legal requirement.

The approved operational schedule is:

Category	Retention rule
Invitation and password-reset records	Delete or irreversibly minimize 90 days after the record is consumed or expires. Security audit facts follow the audit-record rule below.
Technical and security logs	Retain no longer than 12 months unless a documented legal hold or active investigation applies.
Emergency contacts and medical notes	Purge encrypted values within 30 days after the student's final active enrollment ends. Keep only the non-sensitive audit tombstone required below.
External video URLs	Purge at the earlier of an authorized removal/withdrawal request or 90 days after review completion. An unreviewed submission remains until review, withdrawal, or removal; the monthly review flags stale unfinished submissions.
Account, academic, attendance, consent, notification, and append-only audit records	Retain for two years after the person's relationship with PH Stroke Lab ends, then delete or irreversibly anonymize where legal and referential constraints permit.
Anonymized aggregates	May be retained indefinitely only when re-identification is not reasonably possible.

A student's relationship-end date is the end or cancellation date of the last enrollment. A parent's date is the later of the final linked student's relationship-end date or the final family-link revocation. A coach's date is the later of the last section-assignment end or account deactivation, and an administrator's date is account deactivation. If source dates conflict, the Data Protection Officer records the conservative later date and the reason in the restricted retention register.

A legal hold or documented investigation pauses disposal only for the affected records. A documented legal hold pauses deletion only for those affected records, and a documented investigation has the same limited effect. The restricted register records the hold or investigation, scope, approver, start date, and release date without copying sensitive values into ordinary logs or tickets. When the hold or investigation ends, any overdue disposal action must be completed and verified without unreasonable delay.

In plain language, invitation and password-reset disposal is 90 days after consumption or expiry; technical and security log retention has a maximum of 12 months; safety-value purge is within 30 days after final enrollment ends; and the video deadline is 90 days after coaching review when no earlier authorized withdrawal or removal applies. The role-based rule begins disposal review 2 years after the relationship ends. Anonymized aggregate information may be retained indefinitely only when re-identification is not reasonably possible.

On the first business day of each month, the Data Protection Officer reviews the category dates, legal-hold and investigation register, stale unfinished video submissions, provider-retention evidence, due and overdue records, and disposal evidence under the committed privacy-retention runbook. If an existing authorized workflow cannot safely complete disposal, the record is restricted and escalated before the deadline; PH Stroke Lab must not use an undocumented direct database deletion or weaken role and relationship checks.

Email and in-app notifications

The portal keeps operational events in-app. Email is limited to invitations, password and security events, session cancellations or reschedules, and enrollment or makeup decisions. Email must not include grades, detailed attendance, medical or emergency information, safety details, or coaching-review text.

Email delivery may expose the recipient address and basic delivery metadata to Resend and receiving-mail providers. Recipients should protect access to their email accounts.

Security and accountability

PH Stroke Lab uses role-based access, approved parent-child links, secure web sessions, short-lived access credentials, rotating refresh credentials, revocation controls, administrator multi-factor authentication, encrypted sensitive safety fields, restricted secrets, HTTPS, request identifiers, and append-only audit events. Sensitive mutations record the actor, request ID, IP address, user agent, before-and-after state, and timestamp. Sensitive values must be excluded from logs and notifications.

No security control eliminates every risk. PH Stroke Lab will investigate suspected incidents, limit harm, preserve evidence, and notify affected people and authorities when Philippine law requires it.

Choices, rights, and requests

Subject to the Philippine Data Privacy Act of 2012 and lawful limitations, a data subject may ask to:

• be informed about processing;
• access personal information;
• object to certain processing or withdraw consent where consent is the basis;
• correct inaccurate or incomplete information;
• erase or block information that should no longer be processed;
• receive portable information where applicable;
• complain to the National Privacy Commission; and
• seek damages where the law provides.

A parent or legal guardian ordinarily exercises these rights for a minor. PH Stroke Lab should also listen to the student, explain the outcome in language the student can understand, and consider the student’s age and maturity.

Kai Guingcangco is the Data Protection Officer and Digital Operations Officer. For privacy rights, consent withdrawal assistance, privacy complaints, or questions about this notice, use the privacy role address privacy@phsl.club.

General public contact: jaojacinto2@gmail.com or +63 961 750 3272, available daily, 00:00–23:59 Asia/Manila. This general public contact is separate from the privacy role address above.

PH Stroke Lab may verify identity, guardianship, and authority before disclosing or changing records. A request may be limited where retention is required by law, needed to protect another person, or necessary for legitimate security and accountability; PH Stroke Lab must explain the applicable reason.

Complaints may also be submitted to the National Privacy Commission.

Automated decisions

The MVP does not make solely automated decisions that produce legal or similarly significant effects. Capacity rules may initially classify an enrollment request as waitlisted when a section is full, but an administrator makes approval, rejection, and promotion decisions.

Publication and changes to this notice

The portal provides a versioned publication workflow and an accessible public privacy-notice route. This draft must not become effective until an authorized approver records the exact approved copy, approver identity and role, and effective date and the same effective revision is verified through the public API and /privacy page before personal information is collected.

Once that process exists, a material change affecting how information is collected, used, shared, or retained must be published clearly to affected users before the changed processing begins. PH Stroke Lab must provide any legally required opportunity to object or withdraw consent and retain evidence of the notice version made available. A new guardian video-consent policy publication requires a guardian to review and consent to that exact revision before a minor submits another video link.

This temporary draft is operational guidance, not legal advice, legal certification, or approved counsel copy. PH Stroke Lab must obtain qualified Philippine privacy review before approving or publishing it for real students and families.