Health Information Privacy Notice and Consent

Effective Date: 08 September 2026
Last Updated: 08 September 2026
Version: 1.0

Read this notice before you submit symptoms, medical history, prescriptions, photographs, laboratory records, results, government IDs, or other health information. It explains the immediate use and sharing needed to provide the service you selected.

1. Why You Are Seeing This Notice

NowExpress uses health information to assess and coordinate the specific healthcare, pharmacy, diagnostic, delivery, or follow-up service you request. Because this information is sensitive, you see this notice before collection, not only in a website footer.

The form or booking also identifies the exact service, responsible provider, required fields, and relevant recipient names or categories. The full Privacy Policy provides broader details about website use, orders, cookies, security, retention, and all of your privacy rights.

2. Who Handles the Information

NowExpress is responsible for the health information it controls for assessment routing, service coordination, payment, support, safety, and its own records. Because NowExpress operates a licensed pharmacy and, within its current FDA licence scopes, is licensed to distribute or wholesale drugs and medical devices, this includes the patient medication profile, prescription recording, dispensing, counseling, product traceability, storage and temperature, complaint, adverse-event, device-incident, and recall records that NowExpress creates for regulated work it performs.

A consulting doctor or diagnostic laboratory separately controls the professional or regulated record it creates. If a particular order identifies another licensed pharmacy as the dispenser, that pharmacy may separately control its dispensing record. A provider that only processes information for NowExpress must follow documented instructions and appropriate confidentiality and security duties. You may ask which entity controls a particular assessment, consultation note, prescription, dispensing record, laboratory result, or support record.

3. Health and Related Information We May Request

Information Examples
Patient identity Name, birth date, sex or gender where clinically relevant, contact details, current location for telehealth safety, and patient or representative verification.
Health history Symptoms, goals, diagnoses, operations, family history, allergies, pregnancy or breastfeeding, current and past medicines, supplements, substance use, lifestyle, and prior treatment.
Measurements and observations Height, weight, BMI, waist measurement, blood pressure, glucose, temperature, photographs, device readings, and clinician observations.
Clinical and pharmacy records Assessment answers, messages, consultation notes, care plans, prescriptions, dispensing checks, counseling, adverse events, side effects, adherence, and follow-up.
Diagnostic information Doctor's request, test selected, preparation, appointment, branch, specimen details, laboratory result, imaging report, recollection, and result-routing instruction.
Documents Prescription, referral, government ID, Senior Citizen or PWD proof, laboratory record, letter of authorization, and representative authority.
Service and audit information Booking or order reference, provider, payment and refund status, delivery, notice and consent version, date and time, and proportionate technical logs.

The form requests only the information reasonably needed for that service. Do not upload an entire record when a relevant page or result is enough, and do not submit another person's information unless you are authorized.

4. Why the Information Is Used

  • Confirm the patient and, where needed, the authority of a parent, guardian, caregiver, or representative.
  • Check whether an online service appears suitable and identify symptoms that require in-person or emergency care.
  • Support a licensed clinician's assessment, consultation, diagnosis, treatment, prescription, referral, and follow-up.
  • Allow the NowExpress pharmacy and pharmacist, or a separately identified dispensing pharmacy, to validate a prescription, perform safety checks, dispense and label correctly, counsel the patient, keep required records, and investigate a medicine concern.
  • Allow NowExpress to verify lawful sourcing, storage and distribution conditions, product and batch traceability, medical-device complaints, adverse events, safety notices, and recalls for regulated health products it sells or distributes.
  • Allow a laboratory or facility to confirm requirements, prepare for the appointment, identify the patient and specimen, perform the service, release a result, and correct a quality issue.
  • Coordinate payment, statutory benefits, booking, delivery, home service, support, cancellation, refund, complaint, recall, or safety report.
  • Maintain records required for patient safety, continuity of care, professional accountability, consumer redress, security, and law.

5. Who May Receive It

We share only information relevant to the task. Depending on the service, recipients may include:

  • The licensed doctor or medical provider identified for your review or consultation.
  • The NowExpress pharmacy and licensed pharmacist responsible for prescription validation, dispensing, counseling, fulfillment, or product-safety work, and any separately identified fulfillment pharmacy involved in your order.
  • Manufacturers, importers, authorization holders, suppliers, quality teams, or product-retrieval providers when needed to investigate a drug or medical-device quality concern, adverse event, incident, falsification concern, or recall.
  • The selected licensed laboratory, branch, collector, imaging facility, or home-service team.
  • NowExpress clinical, pharmacy, diagnostics, support, safety, finance, privacy, and technology personnel who need access for their role.
  • Payment, identity, secure-upload, cloud, communications, cybersecurity, and support providers that process only what is needed under appropriate safeguards.
  • A courier that receives recipient, address, contact, proof-of-delivery, and special handling information, but not an unnecessary diagnosis or full medical history.
  • A regulator, court, law-enforcement authority, emergency resource, insurer, professional adviser, or other person when disclosure is authorized, legally required, or necessary and proportionate under law.

The point-of-collection notice names the actual provider where reasonably possible. A new recipient or materially different purpose not covered by what you were shown requires an updated notice and, when consent is required, a new choice.

6. Required and Optional Information

Required information is marked or explained in the service flow. If you do not provide identity, relevant health history, prescription, diagnostic request, payment, delivery, or safety information that is necessary, the doctor may be unable to assess or prescribe, the pharmacy may be unable to dispense, the laboratory may be unable to perform or release the service, or NowExpress may be unable to complete the booking or order.

Optional marketing, testimonial, product-review, research, and audio or video recording choices are separate. Refusing an optional use does not prevent the underlying healthcare, pharmacy, or diagnostic service.

7. Legal Grounds for Health-Information Processing

Health information is sensitive personal information. Depending on the purpose, processing may be based on your specific consent; a law or regulation; protection of life and health when consent cannot be expressed; medical treatment carried out by a medical practitioner or medical treatment institution with adequate protection; establishment, exercise, or defense of legal claims; or another ground permitted by the Data Privacy Act.

Contract performance or legitimate interests may support related ordinary personal information where the legal conditions are met, but they do not by themselves remove the additional requirements for sensitive health information.

We do not describe consent as the basis when the actual basis is a legal, professional, safety, or treatment duty. When consent is the basis, it must be specific, informed, freely given, recorded, and capable of withdrawal for future processing.

8. How Long Information Is Kept

For prescriptions dispensed by the NowExpress pharmacy, the pharmacy's patient medication profile and appropriate prescription recording system are kept for at least two years after the last entry, as required by Section 37 of the Philippine Pharmacy Act. Dangerous-drug records follow Republic Act No. 9165 and applicable regulatory issuances.

Other assessment, consent, dispensing, order, support, distribution and wholesale traceability, storage and temperature, complaint, adverse-event, medical-device incident, recall, security, accounting, tax, dispute, and audit records are kept for the period required by their purpose, applicable FDA or other rules, and NowExpress's approved retention schedule. A complaint, recall, investigation, security incident, legal hold, or claim may extend retention of relevant records.

A hospital-specific DOH or National Archives schedule is not the default period for NowExpress pharmacy, platform, order, or support records. It applies only where a covered hospital or facility controls the record. A consulting doctor, diagnostic laboratory, or separately identified fulfillment pharmacy may keep its own professional record for the period required by law and professional standards. Withdrawing consent, cancelling an order, or ending a service does not automatically erase a record that must be kept.

9. How Information Is Protected

We use safeguards appropriate to sensitive health information, including access based on role, least privilege, secure transmission, encryption where appropriate, authentication, logging, backups, vendor controls, workforce confidentiality, incident response, and secure disposal. We use approved channels for uploads and may move an ordinary email or social-media conversation to a more secure channel.

No online method is completely risk-free. Protect your device, booking links, verification codes, and transaction references; use a private connection and location where possible; and report suspected unauthorized use of your information to privacy@nowexpress.ph.

10. Your Rights

Subject to the Data Privacy Act and lawful limits, you may be informed; request access; object; correct inaccurate information; request erasure or blocking where the conditions apply; receive eligible data in portable form; withdraw consent for future consent-based processing; seek damages; and complain to the National Privacy Commission.

Tell the clinician or support team promptly if a health answer, medicine, prescription, patient identity, booking, or result is wrong. A correction to a NowExpress record may also need to be sent to the doctor, pharmacy, or laboratory that received or controls the information.

11. Emergency and Other Processing Without Ordinary Consent

In a genuine emergency, incapacity, public-health situation, legal proceeding, or another circumstance recognized by law, information may be used or disclosed without the ordinary consent process when necessary and proportionate. Examples may include protecting life or health, complying with a lawful order, reporting a regulated safety event, responding to a recall, or establishing or defending a legal claim.

An exception is not permission for unrelated use. We document the basis and limit the information, recipients, and purpose as required.

12. Representatives and Information About Another Person

If you act for a minor, an incapacitated patient, or another person, you confirm that you are authorized and that the information is accurate to the best of your knowledge. We may ask for proof of identity and authority. The patient should receive an age- and capacity-appropriate explanation and be involved in the decision where appropriate.

If you submit a referral, prescription, laboratory request, or record as a professional or authorized organization, you must have a lawful basis to provide it and must use the approved secure process. An employer or sponsor does not automatically receive a patient's results merely because it paid for a service.

13. Withdrawing Consent or Objecting

Email privacy@nowexpress.ph to withdraw a consent or object to processing. State the service and purpose involved. We will explain what future activity can stop and any consequence, such as being unable to continue a requested consultation, dispense a medicine, send data to the selected laboratory, or provide follow-up.

Withdrawal is not retroactive. It does not invalidate processing already lawfully completed and does not require us or a provider to delete information retained under another lawful ground. We will stop future consent-based processing within the applicable legal and operational period.

14. What Your Health-Information Consent Means

Where consent is the appropriate legal condition, selecting the health-information consent control means that:

  • You are the patient or a verified person legally authorized to act for the patient.
  • You received this notice and the service-specific explanation of the information, purpose, required fields, relevant providers and recipients, likely consequence of refusal, retention, and your rights.
  • The information you provide is complete and accurate to the best of your knowledge.
  • You voluntarily consent to the collection and use needed for the specific assessment, consultation, prescription, pharmacy, diagnostic, delivery, follow-up, support, or safety purpose shown.
  • You authorize the necessary disclosure of relevant information to the identified doctor, pharmacy, laboratory, or other service recipient shown in the flow.
  • You understand how to withdraw consent for future consent-based processing and that some records may still be processed or retained under another lawful ground.

This consent does not include unrelated marketing, research, testimonials, sale of health information, or audio or video recording. Those require a separate lawful basis and separate choice where applicable.

15. Required Consent or Acknowledgment Record

The control is unchecked by default and appears before submission. The record captures the patient and representative where applicable, authority, service, purpose, required provider and recipient categories, notice and consent version, date and time, booking, order, transaction, request, or service reference, and method of acceptance.

Where processing does not rely on consent, the interface asks you to acknowledge that you received the privacy notice rather than falsely asking for consent. A copy of the applicable notice and your recorded choice is available on request.

16. Where This Notice Must Appear

This notice or an approved short version linking to it appears before a medical assessment is submitted; before a prescription, ID, photograph, or health record is uploaded; before a telehealth booking or interaction; before diagnostic information is sent to a laboratory; before results are made available through a new channel; and before follow-up or reorder health information is submitted.

A footer link alone is not enough for a new collection of sensitive information. The immediate form must tell you why the information is needed and who will receive it.

17. Questions and Complaints

For a health-information privacy question, correction, access request, consent withdrawal, or complaint, email privacy@nowexpress.ph. NowExpress is based in Manila, Philippines.

You may also use the National Privacy Commission complaint process. A clinical, pharmacy, laboratory, consumer, or safety concern may also be raised through the relevant channel on the Contact NowExpress page.

18. Your Rights Under Philippine Law

This policy is intended to work with the following Philippine laws, rules, and official guidance, as amended or replaced from time to time:

Nothing in this policy takes away a right or remedy that Philippine law gives you. If any part conflicts with a mandatory legal requirement, the legal requirement controls.