Privacy notice
DocJED is an electronic medical record service, a product of DICE (khartalium.com). This notice explains how personal information is handled in DocJED under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
Who is responsible
- Patient records: each clinic or hospital using DocJED is the personal information controller of the records of its patients. It decides why and how patient information is collected and used. DocJED processes those records on the clinic’s behalf only to provide the service.
- DocJED accounts, doctor registration and subscription billing: DICE is the personal information controller.
What we process
- Account holders (doctors and clinic staff): name, username, e-mail, mobile number, role, organization, sign-in and security events; for doctors, PRC license details and the official ID submitted for verification.
- Patients (entered by their clinic): identity and contact details and health information such as consultations, diagnoses, prescriptions, laboratory results, attachments, admissions and billing. Health information is sensitive personal information and receives the highest protection.
Why, and on what basis
- To provide medical care, keep medical records and bill for services — processing necessary for medical treatment by a medical practitioner or institution and for compliance with legal obligations (RA 10173 Sections 12 and 13).
- To create and secure accounts, verify doctors and run the subscription — processing necessary for the contract with the clinic or doctor.
- To keep the service secure: audit trails, fraud and misuse prevention, and incident response — legitimate interest and legal obligation.
DocJED does not sell personal information and does not use patient records for advertising. The public DocJED page shows only platform-wide totals, never names or clinical details.
Sharing
Patient information is shared only as the clinic directs (for example referrals, laboratories, PhilHealth and HMO claims) or as the law requires. Service providers that host or support DocJED act under written processing agreements and the same security obligations.
How it is protected
- Encrypted connections (HTTPS) and encryption of stored files (AES-256-GCM).
- Role-based access checked on the server for every action; each clinic sees only its own records.
- Two-step verification for administrators, account lockout, automatic sign-out after inactivity.
- An audit trail of access to and changes of records, including access by administrators.
- Breach management with notification to the NPC and affected individuals within 72 hours where required.
How long it is kept
Medical records are kept for the retention period set by the clinic in line with Department of Health and professional record-keeping requirements. Account and security records are kept while the account is active and for the period needed to meet legal and audit obligations, then disposed of securely.
Your rights
You have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to damages, and to file a complaint with the National Privacy Commission (privacy.gov.ph).
- Patients: contact the Data Protection Officer of the clinic or hospital that keeps your record. DocJED gives every clinic the tools to act on your request.
- Account holders and doctors: contact the DocJED Data Protection Officer through DICE at khartalium.com.
Changes
This notice is reviewed when processing changes. The current version is always available on this page.