Privacy Policy

Last updated 9 October 2026

Who we are

Buenavista Holistic Mobility Solutions, Inc. (BHMS), 64 Kanlaon St., Highway Hills, Mandaluyong City, Philippines. Telephone (02) 8470 2369. We provide prosthetic, orthotic, rehabilitation and whole-person mobility care.

What this covers

Everything we hold about you, whether you are a patient, somebody who booked an assessment, bought from us online, filled in a form on this website, subscribed to our newsletter, or messaged us on Facebook or Instagram.

We keep these records in our own system, the BHMS team portal. Only our staff can sign in to it.

In short: we collect what we need to treat you, to fit and maintain your device, to take payment and to answer you. We do not sell your information to anyone, and we do not use your health information for advertising.

What we hold about patients

If you are a patient, we keep a clinical record. Under the Data Privacy Act of 2012 health information is sensitive personal information, and we treat it that way.

• Who you are: name, date of birth, sex, patient number, medical record number.
• How to reach you: phone, email, address.
• In an emergency: the name, phone number and relationship of the person you named.
• Your care: clinic notes, visit records, the measurements we take, and the services provided.
• Your device: prostheses and orthoses fitted to you, including type, body part and side, make, model, serial number, when it was fitted, its condition, any problems, and why one was replaced.
• Files: photographs, scans and documents attached to your record.
• Appointments: when you came, or are due to come.

We collect this because we cannot fit or maintain a device, or treat you safely, without it. We ask for it from you directly, or it is produced during your care.

What we hold about everybody else

You do not have to be a patient for us to hold something about you.

• If you fill in a form here, we keep what you wrote, your name, email and phone number if you gave them, and which page you wrote from.
• If you book an assessment, we keep your name, contact details and the time you chose.
• If you buy something online, we keep what you ordered, the price, your delivery address and your contact details. Payments are handled by PayMongo; we never see or store your card number.
• If you subscribe to our newsletter, we keep your email address until you unsubscribe. Every newsletter carries an unsubscribe link.
• If you message us on Facebook or Instagram, we keep the conversation, and your name and profile picture as the platform gives them to us, so we can answer you.
• If you give us your phone number, we may use it to text you about your booking, your order, or an offer. Every marketing text tells you how to stop.

We do not run advertising trackers on this website, and we do not build profiles of you for advertisers.

Why we use it, and who can see it

We use what we hold to treat you and fit your device, to arrange and remind you of appointments, to take payment and send receipts, to answer your messages, and to send you news if you asked for it.

Inside BHMS, only staff with an account on the team portal can see your records, and each account is limited to the parts of the business that person works in. Clinical records are visible to clinical staff.

Outside BHMS, these services hold or handle some of it on our behalf, because our systems run on them:

• Cloudflare — hosting, the database and uploaded files.
• Resend — sending and receiving our email.
• PayMongo — card and e-wallet payments. They hold the card details; we do not.
• Twilio — text messages.
• Meta (Facebook, Instagram) — messages you send us there, and posts we publish.
• Google — where we connect a Gmail mailbox, to read and send that mailbox's email.
• Anthropic and Higgsfield — writing and picture tools used for our own marketing material.

The writing and picture tools are used for marketing content only. We do not send patient records to them.

We also share information where the law requires it, or with another health professional involved in your care, with your knowledge. We do not sell your information, and we do not pass it to advertisers.

How long we keep it

Clinical records are kept for as long as the law requires, and for as long as they may matter to your care. Order records are kept for our tax and accounting obligations. If you unsubscribe from our newsletter we keep only enough to make sure we do not email you again.

Your rights

Under the Data Privacy Act of 2012 you may:

• ask what we hold about you, and get a copy;
• have something corrected if it is wrong;
• object to us using it for marketing, and withdraw consent at any time;
• ask us to delete it, where we are not required to keep it;
• complain to the National Privacy Commission.

To use any of these, write to us using the details below. We will ask you to confirm who you are before we release a record, because the alternative is handing someone's health information to a stranger.

Messages you send us on Facebook

If you message our Facebook Page, we read and answer it from our team portal rather than from Facebook itself. To do that we receive, from Meta: what you wrote, anything you attached, the name and profile picture on your Facebook account, and an identifier Facebook gives us that means nothing to anyone but us and that Page.

We use it for one thing: answering you, and keeping the thread so whoever picks it up next can see what was already said. If you give us an email address or a phone number in the conversation, we save it so we can reach you about your request, which also adds you to our contact list for this website.

We do not post as you, read anything outside your conversation with our Page, or use what you wrote to advertise to you. We do not sell it, and we do not give it to anyone except the services listed above that carry it for us.

A conversation is kept while it may still matter to your care or your enquiry. You can ask us to delete it at any time, as below.

Deleting your data

You can ask us to delete what we hold about you, and we will, except where the law requires us to keep a clinical or accounting record. Write to us using the details below, saying which of these you mean. For a Facebook conversation, tell us the name on the Facebook account you messaged us from.

We will ask you to confirm who you are first. We will not hand someone's health information, or their messages, to a stranger who asks for them.

We answer within fifteen working days, and we will tell you what was deleted and what we had to keep, and why. To remove our Page's access from your side as well, you can also remove our app under Settings and privacy, then Apps and websites on Facebook; doing that stops new messages reaching us but does not by itself delete what we already hold, so write to us for that.

Security

Access to the team portal needs an account and a password, and each account only reaches the parts of the business that person works in. Credentials we hold for other services are stored encrypted.

No system is perfectly secure, and we will not pretend otherwise. If a breach puts your information at real risk, we will tell you and the National Privacy Commission, as the law requires.

Contact us

Buenavista Holistic Mobility Solutions, Inc.
64 Kanlaon St., Highway Hills, Mandaluyong City, Philippines
(02) 8470 2369