Privacy Policy

Who we are

Somosot Dental Clinic is the Personal Information Controller responsible for the personal data described in this Policy.

This Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you as a data subject. It applies to our website (somosotdental.com), our official Facebook Pages and Messenger channels, our Viber contacts, and our in-clinic operations at both branches.

• Bohol branch — 88 Santos Baura St., Pooc Oriental, Tubigon, Bohol 6329.
• Cebu branch — 12th Floor, Unit 1219–1221, City Soho Mall, B. Rodriguez St., Cebu City 6000.

The personal data we collect

Depending on how you interact with us, we may collect:

• Contact and identifying details — your name, phone number, Facebook profile name and the contents of your message, when you message us on Facebook Messenger or Viber, call us, or reach out through the website.
• Callback requests — if you use the “Ask us to call you” form on our website, the name and phone number you enter, the branch you choose, and the time of day you prefer. See “Callback requests from our website” below for exactly what happens to them.
• Booking requests — if you use the “Book at the Tubigon branch” form on our website, the name and mobile number you enter, the day and time of day you ask for, the broad reason for the visit you choose from a fixed list, and — only if you choose to answer it — whether this would be your first visit to us. See “Booking requests from our website” below, because these are kept, and callback requests are not.
• Appointment and enquiry details — the service you are interested in, your preferred branch, and any scheduling information you share with us.
• Health information — your dental and medical history, clinical findings, treatment records and diagnostic images, provided in the course of dental care. Health information is classified as sensitive personal information under the DPA and is given a higher level of protection.
• Website usage data — collected automatically through analytics tools when you visit our website. See “Cookies and analytics” below.

How we use your personal data

We collect only the data we reasonably need. We process your personal data to:

• respond to your enquiries and messages;
• schedule, confirm and manage your appointments;
• provide dental care and maintain your clinical records;
• contact you about your treatment, follow-ups and recalls;
• keep records required for our lawful, regulatory and professional obligations; and
• improve our website and services.

Legal basis for processing

We process your personal data on one or more of the following bases under the DPA: your consent; the performance of a service or contract you have requested, such as dental treatment; compliance with a legal obligation; and our legitimate interests in operating and improving the clinic, provided these do not override your rights.

For sensitive personal information, including health data, we rely on your consent and on the grounds permitted under Section 13 of the DPA, including processing necessary for medical treatment carried out by a medical practitioner or under their supervision.

Our automated messaging assistant

Our Facebook Messenger channels may use an automated assistant to help answer common questions and route your enquiry to the right branch. The assistant is designed to process only the message you send during that conversation and is not used to build a profile of you.

A member of our team handles anything that requires clinical judgment or booking.

Callback requests from our website

Our website has a form that asks for your name, a number to ring, the branch you want, and the time of day that suits you. It exists so that you can reach us without using a chat app.

When you send it, those details are passed straight to an SMS gateway, which delivers them as a single text message to that branch's own phone. Our website does not keep a copy: there is no database, no file and no log of callback requests on it, and nothing about your request can be retrieved from it afterwards. The only record is the text message on the branch's handset, which is handled the same way as any other enquiry we receive.

The form deliberately has no message box, and we ask you not to include medical details in it. Anything about your teeth or your health is better discussed on the call itself, with a dentist.

We rely on your consent for this, given by choosing to send the form. Because we do not store the request, we cannot delete it on request — but you can ask the branch to disregard it, and to delete the message on their phone, by messaging or calling them.

Booking requests from our website

Our Tubigon branch page has a form that asks for your name, a mobile number, the day and time of day you would like to come, and the broad reason for your visit chosen from a fixed list. It also asks, optionally, whether this would be your first visit — answering helps the front desk know whether they need to register you before booking, and leaving it blank costs you nothing. It is a request, not a confirmation: nothing is booked until someone at the branch texts you back.

This one is kept, and that is the difference between it and a callback. Your request is passed from our website to the clinic's own appointment system, where our staff can see it, confirm it or turn it down. Our website itself keeps no copy — it has no database and no log of these requests — but the appointment system does, which is what makes the rest of this section necessary.

We keep a booking request in that system until someone at the branch confirms it or turns it down, and for a period afterwards, so that we can answer questions about an appointment that was recently arranged. It does not lapse on its own: a request stays on the front desk's list until a person answers it. We delete it once it is no longer needed for that purpose.

The form deliberately has no message box, and the list of reasons is intentionally broad, so that we are not holding a description of your symptoms. Anything about your teeth or your health is better discussed at the visit, with a dentist.

We rely on your consent for this, given by choosing to send the form. Because we do keep it, you can ask us to delete a booking request at any time — contact our Data Protection Officer, or simply ask the branch.

How we share your personal data

We do not sell your personal data. We may share it only in the following limited circumstances:

• with our dentists and staff at the branch handling your care, on a need-to-know basis;
• with service providers who help us operate — for example website hosting, analytics and messaging platforms — who are bound to protect your data and use it only for the services they provide to us;
• where a case requires care beyond what we provide and you are referred to another provider, with your knowledge; and
• where required by law, regulation, or a lawful order of a competent authority.

Transfers outside the Philippines

Some of our service providers may process data outside the Philippines. Where this occurs, we take steps intended to ensure your data continues to receive a comparable level of protection.

CCTV at our clinics

Both branches operate 24-hour CCTV for the safety of patients and staff and for the security of the premises. Being recorded while you are on the premises is processing of your personal data under the DPA, so it is set out here rather than left to a notice on the door.

Footage is kept for one month and then overwritten. The exception is footage needed for an active incident, complaint, insurance matter or lawful request from an authority, which is kept until that matter is resolved and then disposed of.

• Access is limited to the clinic staff who need it for the purposes above.
• Footage is not published, sold, or used for advertising.
• You may ask what footage of you exists and request a copy, subject to the rights set out below and to the privacy of anyone else who appears in it.

How long we keep your personal data

We retain personal data only for as long as necessary for the purposes described in this Policy, or for as long as required by law and professional record-keeping obligations. Clinical records are retained in accordance with applicable retention requirements. When data is no longer needed, we dispose of it securely.

Callback requests sent through our website are not retained by the website at all — they are forwarded as a text message and kept nowhere on it. See “Callback requests from our website” above.

Booking requests are different, and this is the one place the two must not be read as the same thing: a booking request is kept in the clinic's appointment system until someone confirms it or turns it down, and for a period after that. It does not lapse on its own. You can ask us to delete one at any time. See “Booking requests from our website” above.

How we protect your personal data

We implement reasonable and appropriate organizational, physical and technical measures to protect your personal data against unauthorized access, disclosure, alteration or loss. These include access controls, secure storage and staff handling procedures.

No system can be guaranteed completely secure, but we work to protect your data and to address any incident promptly and in accordance with the DPA.

Cookies and analytics

Our website uses analytics tools, including Google Analytics, to understand how visitors use the site so we can improve it. These tools may set cookies and collect information such as pages visited and general device and usage data.

You can control or disable cookies through your browser settings; doing so may affect how the website functions.

Your rights as a data subject

Under the DPA, you have the right to:

• be informed about how your personal data is collected and processed;
• access the personal data we hold about you;
• object to or withdraw consent to certain processing;
• rectify inaccurate or incomplete data;
• erase or block data under the conditions allowed by law;
• data portability, where applicable;
• be indemnified for damages arising from unlawful processing; and
• lodge a complaint with the National Privacy Commission.

Changes to this Policy

We may update this Policy from time to time. The current version will always be posted on this page with its effective date. Material changes will be indicated by updating the “Last updated” date above.