Data Privacy  Policy

This Data Privacy Policy (the “Policy”) describes how Care Panda (“we”, “us”, “our”) collects, uses, stores, shares and protects your personal data when you use the Care Panda website, applications and services (collectively, the “Platform”).

We process personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines.

By creating an account or using the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read together with our Terms of Service and General Service Agreement.

• Care Panda operates an online marketplace in the Philippines that connects Clients with independent Care Partners (caregivers and private duty nurses).
• For the purposes of the Data Privacy Act, Care Panda acts as the Personal Information Controller (PIC) for personal data processed through the Platform.
• Where Care Partners independently process Client data in the course of delivering care services, they do so under their own obligations under the Data Privacy Act.

We collect the following categories of personal data:

• Account and identity data — full name, email address (your primary identifier), mobile number, date of birth, government-issued identification and, for Care Partners, licences, credentials and qualifications.
• Profile and care data — profile photos, addresses and service locations, care needs and preferences, availability schedules, biographies and verification documents.
• Sensitive personal information — health and medical information you or a Client chooses to share to arrange appropriate care (e.g., conditions, mobility needs, medication notes). This is processed only with your explicit consent or as otherwise allowed by law.
• Booking and transaction data — booking details, shift records, check-in/check-out times, payment history, Credit Coin balances, Panda Pats, withdrawal requests and payout details.
• Payment data — payment method details are processed and stored by our payment processor (Stripe). We do not store full card numbers on our servers; we retain only references, last digits and transaction identifiers needed for reconciliation.
• Communications — support tickets, dispute submissions, messages, reviews, ratings and correspondence with us. 
• Technical and usage data — device and browser information, IP address, log data, and interactions with the Platform used for security, debugging and improvement.

We use personal data for the following purposes:

• To create and manage your account and authenticate your identity.
• To operate the marketplace — matching Clients with Care Partners, scheduling bookings, managing availability and processing check-in/check-out.
• To process payments, escrow holds, refunds, Credit Coins, Panda Pats, payouts and withdrawals, and to maintain accurate financial and reconciliation records.
• To verify Care Partner credentials and maintain platform safety and trust.
• To communicate with you — booking updates, notifications, support-ticket responses, legal document updates requiring acknowledgment, and service announcements.
• To resolve disputes, investigate support tickets, enforce our Terms and Service Agreement, and prevent fraud and misuse.
• To comply with legal, regulatory, tax and accounting obligations, and to maintain audit trails.
• To analyse and improve the Platform, including aggregated and de-identified reporting.

• Between users — Care Partners receive the Client information reasonably needed to deliver a booked service; Clients receive the Care Partner’s profile, credentials summary and ratings.
• Service providers — payment processing (Stripe), cloud hosting and database infrastructure, transactional email delivery, and analytics, each under confidentiality and data-processing obligations.
• Legal and regulatory — where required by law, court order, or competent authority, or to protect the rights, safety and property of users and the public.
• Business transfers — in connection with a merger, acquisition or reorganisation, subject to this Policy.

We do not sell your personal data to third parties.

• Some of our service providers process data on servers located outside the Philippines. Where personal data is transferred across borders, we ensure appropriate safeguards consistent with the Data Privacy Act are in place.

• Account data is retained while your account is active.
• Booking, payment, escrow and payout records are retained for the periods required by Philippine tax and accounting laws (generally up to ten (10) years).
• Audit logs and support-ticket records are retained as needed for security, reconciliation and legal compliance.

When data is no longer required, it is securely deleted or anonymised

• We apply organisational, physical and technical safeguards including encryption in transit and at rest, role-based access control, row-level data isolation, strong password requirements, and access logging.
• Payment card data is handled by our PCI-DSS-compliant payment processor and never stored in full on our servers.
• No method of transmission or storage is completely secure; we maintain incident-response procedures and will notify affected users and the National Privacy Commission of personal-data breaches as required by law.

Under the Data Privacy Act, you have the right to:

• Be informed about the collection and use of your personal data.
• Access the personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erase or block personal data that is incomplete, outdated, unlawfully obtained, or no longer necessary, subject to legal retention requirements.
• Object to processing based on legitimate interests or for direct marketing.
• Data portability — obtain a copy of your data in a structured, commonly used format where applicable.
• Lodge a complaint with the National Privacy Commission if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before acting on a request.

• We use cookies and similar technologies for authentication, session management, security and Platform functionality. You may control cookies through your browser settings, though disabling them may affect Platform features.

• The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from minors for account creation. Care-related information about a care recipient who is a minor may be provided only by their parent or legal guardian.

• For privacy questions, requests, or complaints, contact Care Panda support through the Platform’s Contact Support feature or by email at privacy@thecarepanda.com.

• We may update this Policy from time to time. Material changes will be notified through the Platform or by email before they take effect, and your continued use after the effective date constitutes acknowledgment of the updated Policy.
• The version number and effective date at the top of this document identify the current Policy.