Privacy Policy

Effective Date: 09 September 2026
Last Updated: 04 September 2026
Version: 1.0

Your health information is personal. This policy explains what NowExpress collects, why we need it, who may receive it, how long it is kept, and the choices and rights available to you.

1. What This Policy Covers

This policy applies when you visit nowexpress.ph or use a NowExpress health assessment, doctor review or consultation, prescription workflow, diagnostic service, order, payment, delivery, follow-up, or support channel.

Health information and government-issued identification are sensitive personal information under Philippine law. We use them only for a stated, legitimate purpose and apply additional safeguards. Read this policy together with the short notice shown where you submit health information and, for telehealth, the Telehealth Informed Consent and Patient Authorization.

2. Privacy at a Glance

  • We collect only information reasonably needed to provide, pay for, deliver, support, secure, and document the service you request, or to meet a legal obligation.
  • NowExpress is responsible for the pharmacy, dispensing, distribution, product-safety, and traceability records it creates. A doctor, laboratory, or separately identified fulfillment pharmacy may be responsible for the professional or regulated record it creates and may give you its own privacy notice.
  • Couriers receive delivery information, not your full medical history. Payment providers receive only the information needed to process and protect a transaction.
  • Optional marketing, testimonials, research, and audio or video recording require a separate choice where consent is needed. Refusing an optional use will not block the underlying healthcare service.
  • You may exercise your privacy rights by emailing our privacy team. We may verify your identity before releasing or changing sensitive information.
  • No online system is risk-free. We use administrative, physical, and technical safeguards appropriate to the sensitivity of the information.

3. Who Is Responsible for Your Information

NowExpress operates an FDA-licensed pharmaceutical outlet or pharmacy and, within the scope of its current FDA licences, acts as a distributor or wholesaler of drugs and medical devices. NowExpress is responsible for personal information under its control as an online merchant and regulated health-product business. This includes information used to run the website, coordinate services, process orders and payments, dispense and deliver medicines, distribute health products, provide support, maintain traceability, investigate quality concerns, manage recalls, prevent fraud, and meet its own legal duties.

For an order dispensed by the NowExpress pharmacy, NowExpress controls the pharmacy's patient medication profile, prescription recording, dispensing, counseling, product-quality, and related regulated records. A consulting doctor or diagnostic laboratory separately controls the clinical or laboratory record it creates. If a particular order identifies another licensed pharmacy as the dispenser, that pharmacy may separately control its dispensing record. In other arrangements, a partner may process information only for NowExpress under written instructions. The role depends on the service and the parties' legal responsibilities.

You may contact us first even when your request also needs action by a doctor, pharmacy, laboratory, courier, or payment provider.

4. Information We May Collect

Category Examples
Identity and contact details Name, birth date, mobile number, email, delivery address, sex or gender information when clinically relevant, and details of an authorized representative.
Verification details One-time-code and security records, identity-verification results, government ID details, Senior Citizen or PWD ID, and supporting documents.
Health and care information Symptoms, health goals, medical and family history, diagnoses, allergies, current medicines, pregnancy or breastfeeding information, vital signs, measurements, lifestyle information, photographs, messages, consultation notes, prescriptions, referrals, laboratory requests, specimens, results, side effects, adherence, and follow-up responses.
Order and service information Products and services selected, appointment details, pharmacy and laboratory coordination, order status, invoices, discounts, cancellations, refunds, delivery records, proof of receipt, and product-quality or adverse-event reports.
Payment information Amount, payment method, billing contact, transaction reference, payment status, fraud checks, refunds, and chargeback records. Card or wallet credentials are entered with the payment provider; NowExpress receives only the details needed to confirm and reconcile payment.
Communications Emails, calls, chat messages, complaints, support history, and call or consultation recordings only when everyone whose consent is legally required has agreed.
Device and website information IP address, browser and device type, operating system, access time, viewed pages, referring page, cookie identifiers, security events, approximate location, and precise delivery location only if you provide or enable it.
Consent and audit records The notice or policy version shown, your selection, date and time, booking or order reference, representative authority, and proportionate technical logs showing how the choice was made.

We do not need every type of information for every service. The form or checkout shows what is required and what is optional. Please do not send unrelated medical records or identification unless we ask for them through an approved channel.

5. Where Information Comes From

We may receive information:

  • Directly from you when you browse, complete an assessment, book, buy, upload a document, communicate with a provider, accept a consent, or contact support.
  • From a parent, guardian, caregiver, authorized representative, referring professional, or ordering doctor who is permitted to act for you or provide the information.
  • From a consulting doctor, pharmacy, laboratory, courier, payment provider, identity-verification provider, or support provider involved in your requested service.
  • Automatically from your browser or device through security logs, cookies, and similar technologies.
  • From public or official sources where lawful and reasonably needed to verify a licence, address, identity, safety alert, recall, or fraud concern.

If you provide another person's information, you must be authorized to do so and should make this policy available to that person when appropriate.

6. Why We Use Information

Purpose What this may include
Provide the service you request Assess eligibility; verify identity; arrange a doctor review; support diagnosis or treatment; prepare a prescription; coordinate dispensing; book a laboratory service; release results; take payment; issue an invoice; deliver an order; and provide follow-up.
Patient and product safety Check allergies and contraindications; identify urgent symptoms; arrange referral; document care; investigate adverse events, suspected defects, temperature concerns, or tampering; communicate recalls; and support continuity of care.
Support and consumer redress Answer questions; locate an order or result; process a cancellation, return, replacement, or refund; investigate a complaint; prevent duplicate charges; and maintain an audit trail.
Security and integrity Authenticate users; detect fraud, abuse, malware, and unauthorized access; monitor reliability; create backups; investigate incidents; and enforce reasonable platform rules.
Legal and regulatory duties Maintain professional, pharmacy, laboratory, consumer, accounting, tax, safety, and consent records; respond to lawful orders; defend legal claims; and report matters to regulators when required.
Improve NowExpress Measure reliability and accessibility, diagnose errors, understand feature use, and improve workflows using the minimum information reasonably needed.
Marketing Send promotions only when legally permitted and according to your choices. Necessary messages about care, orders, results, safety, recalls, security, or policy changes are service messages, not marketing.

7. Our Legal Grounds for Processing

The legal ground depends on the information and purpose. We may process information because it is necessary to perform a contract or take steps you asked us to take; to comply with law; to protect life and health; for medical treatment by or under the direction of a health professional; to establish, exercise, or defend legal claims; for a legitimate interest that does not override your rights; or because you gave valid consent where consent is required.

Consent is not a blanket explanation for every activity. If we ask for consent, we will identify the specific purpose and meaningful recipient categories. You may withdraw consent for future consent-based processing, but withdrawal does not undo processing already lawfully completed or stop retention or use required by another legal ground.

8. Required Information and Your Choices

Identity, health, prescription, payment, booking, or delivery information marked as required is needed to provide the relevant service safely and lawfully. Without it, we may be unable to assess you, arrange care, dispense a medicine, perform a test, take payment, deliver an order, apply a statutory benefit, or investigate a request.

Information for optional promotions, testimonials, research, product reviews, or recordings is not required for care or fulfillment. Those choices are separate and are not preselected. You can change a marketing choice through the message unsubscribe control or by contacting us.

9. Who May Receive Information

We share only what is reasonably needed with:

  • Licensed doctors and care teams who assess, consult, prescribe, refer, document, or follow up on your care.
  • NowExpress pharmacy personnel and licensed pharmacists who validate a prescription, check safety, dispense, label, counsel, deliver, keep required records, handle a recall, or investigate a medicine concern, and any separately identified fulfillment pharmacy involved in a particular order.
  • Licensed diagnostic laboratories, branches, phlebotomists, imaging centers, or home-service teams that confirm requirements, collect a specimen, perform a service, issue a result, or correct a laboratory issue.
  • Couriers and logistics providers that need the recipient name, address, contact number, proof-of-delivery details, and special handling instructions. They do not receive your full medical history merely to deliver a parcel.
  • Banks, card networks, payment gateways, e-wallets, fraud services, and accounting providers that process, verify, reconcile, refund, or dispute a transaction.
  • Hosting, cloud, cybersecurity, identity, file-storage, communications, analytics, customer-support, and professional service providers bound by appropriate confidentiality, security, and data-processing duties.
  • Insurers, auditors, lawyers, regulators, courts, law-enforcement authorities, or other bodies when disclosure is lawful, necessary, and proportionate.
  • A successor or proposed successor in a merger, financing, reorganization, or transfer, subject to confidentiality, due diligence, notice, and continued legal protection.

A doctor, pharmacy, laboratory, or payment provider may collect information directly and may have its own privacy notice. You may ask us which provider received information for a particular NowExpress service.

10. Processing Outside the Philippines

Some technology, cloud, communications, payment, analytics, or support providers may process information in another country. For transfers under our control, we assess the provider, limit access and purpose, require appropriate contractual and security safeguards, and remain accountable as required by Philippine law. You may ask our privacy team for more information about material overseas processing relevant to your data.

11. Cookies, Analytics, and Advertising

Essential cookies support account sessions, security, checkout, load balancing, fraud prevention, and saved preferences. Analytics tools help us understand performance and fix problems. Advertising or marketing technologies operate only as legally permitted and according to the cookie choices made available to you. Blocking an essential cookie may prevent part of the site from working.

We do not permit a vendor to use access to health information for its own unrelated advertising. We will not use health information to create a targeted advertising audience or infer a sensitive health condition unless a specific lawful basis, clear notice, and required consent and safeguards are in place.

12. Automated Tools and Clinical Decisions

Online questionnaires and rules may organize information, identify potential safety flags, calculate measurements, or route you to a next step. They are not by themselves a diagnosis, prescription, or guarantee of eligibility. When professional medical judgment is required, a licensed professional remains responsible. You may ask for an explanation and human review where the law or nature of the service requires it.

13. How We Protect Information

We use safeguards appropriate to the amount and sensitivity of the information. These may include role-based access, least privilege, secure transmission, encryption where appropriate, multi-factor authentication for privileged access, logging, monitoring, backups, vulnerability management, secure development, vendor review, workforce confidentiality, incident response, and tested recovery procedures. Access to health information is limited to people and systems with a legitimate need.

No website, app, email, or delivery process can be guaranteed completely secure. Keep one-time codes private, do not share order or booking references, and email our Data Protection Officer promptly if you suspect your information has been accessed without authorization. These precautions do not transfer NowExpress's responsibility for security under its control to you.

14. How Long We Keep Information

For prescriptions dispensed by the NowExpress pharmacy, the pharmacy records each prescription in its patient medication profile or appropriate prescription recording system. Section 37 of the Philippine Pharmacy Act requires that system to be kept for at least two years after the last entry. This is a minimum period, not a promise that every related document will be deleted exactly two years after it was created.

Records used for dispensing, product traceability, storage and temperature control, complaints, adverse events, medical-device incidents, recalls, accounting, tax, fraud prevention, or a legal claim may have a different or longer period under FDA rules, another law, a regulator-approved requirement, or a documented operational need. Relevant records are also preserved while a complaint, recall, investigation, security incident, legal hold, or claim is active.

A hospital-specific DOH or National Archives retention schedule applies only where a covered hospital or facility controls that record; it is not the default period for NowExpress pharmacy, platform, order, or support records. A consulting doctor, diagnostic laboratory, or separately identified fulfillment pharmacy may apply the lawful professional period for the record it controls. Cancelling an order or withdrawing consent does not automatically erase a record that must be kept. When information is no longer needed, it is securely deleted, destroyed, or irreversibly anonymized. You may ask our privacy team for the period or criteria that applies to a category of your information.

15. Your Privacy Rights

Subject to the Data Privacy Act and lawful limits, you may:

  • Be informed about the collection and use of your personal information.
  • Ask whether we process your information and request access to it.
  • Object to processing in circumstances recognized by law.
  • Correct inaccurate or incomplete information.
  • Ask for erasure or blocking when the legal conditions apply.
  • Receive eligible information in a commonly used, machine-readable form where data portability applies.
  • Withdraw consent for future processing that relies on consent.
  • Seek damages for a violation and file a complaint with the National Privacy Commission.

A request may be limited when continued processing or retention is required for patient safety, a professional record, another person's rights, a legal duty, public interest, an investigation, or a legal claim. If we cannot fully grant a request, we will explain the reason and available review route.

16. How to Make a Privacy Request

Email privacy@nowexpress.ph with the subject "Privacy Request." Tell us which right you want to exercise and which order, booking, or service is involved. Do not email more health information or identification than needed. NowExpress is based in Manila, Philippines.

We will acknowledge the request, verify identity or representative authority when reasonably necessary, and respond within the period required by law. We will use a secure method to provide sensitive copies. When appropriate, we will also communicate a correction, erasure, or restriction to recipients that need to act on it. You may ask for supervisory review if you disagree with the response.

17. Minors and Authorized Representatives

A person placing an order or entering a purchase contract with NowExpress must be at least 18. A minor may receive only a service that NowExpress and the responsible healthcare provider make available to minors, with a parent, guardian, or other legally authorized representative involved as required by law and clinical practice. We may verify the representative's identity and authority.

Where appropriate, we explain the service and privacy choices directly to the patient in language suited to the patient's age and understanding. A representative does not automatically have unlimited access to every confidential record; access depends on authority, patient safety, professional duties, and applicable law.

18. Personal Data Breaches

We investigate suspected security incidents, contain and correct them, preserve necessary evidence, and notify the National Privacy Commission and affected people when law requires. A notice to you will explain, as far as reasonably and lawfully possible, what happened, the information involved, likely risks, steps we have taken, steps you can take, and how to contact us.

19. Changes to This Policy

We may update this policy when services, providers, technology, or legal requirements change. We will post the new effective date and give additional notice for a material change. We will not treat continued site use alone as consent to a new use or disclosure when Philippine law requires separate consent.

20. Contact and Complaints

Data Protection Officer
NowExpress Philippines
Email: privacy@nowexpress.ph
Address: Manila, Philippines

Our Data Protection Officer is reachable through this channel. For an order or clinical issue that also involves privacy, you may contact the relevant support channel as well.

You may also file a complaint with the National Privacy Commission. Contacting us first may help us resolve the matter quickly, but is not a condition of approaching the Commission or using another lawful remedy.

21. Your Rights Under Philippine Law

This policy is intended to work with the following Philippine laws, rules, and official guidance, as amended or replaced from time to time:

Nothing in this policy takes away a right or remedy that Philippine law gives you. If any part conflicts with a mandatory legal requirement, the legal requirement controls.