Bonecore Privacy Policy

Who we are

Bonecore Medical Equipment and Supplies Trading ("Bonecore", "we") is a sole proprietorship registered with the Bureau of Internal Revenue under Richard Cas Dela Cruz. We distribute orthopedic implants and surgical supplies to hospitals in the Philippines.

• Address: Unit 422 Mayon Galleria Suites, 33 N. Roxas Street, Lourdes, 1114 Quezon City
• E-mail: bonecoremedical@gmail.com
• Phone: 0906 401 4706 / 0924 584 1486
• Data Protection Officer: Richard Cas Dela Cruz, at the same address and e-mail

This policy covers our website, our quotations and letters, our internal operations app, and our internal Telegram assistant.

What we collect and why

We collect only what a quotation, delivery or billing needs.

• Hospital and clinic staff, surgeons: name, position, work phone and e-mail, hospital. Used to send quotations, schedule deliveries and bill.
• Patients (given to us by the hospital, surgeon or patient's family): full name, procedure, hospital, surgeon, surgery date, quotation and guarantee-letter details. Used to quote implants for the case, prepare acceptance letters for DSWD, PCSO, DOH or PhilHealth assistance, deliver to the hospital and bill the paying agency.
• Our own staff: name, contact details, Telegram account. Used to run our operations app and internal assistant.
• Website visitors: whatever you choose to send through e-mail. Used to answer you.

We do not ask patients for diagnoses beyond the planned procedure, and we do not sell personal information or use it for advertising. Our lawful basis is the performance of a supply contract and the processing a hospital or assistance program requires to pay for a patient's implants.

Google account data

The Google app "Bonecore Hermes" is an internal tool. It signs in only to Bonecore's own Google account and is not offered to the public.

• What it accesses: files in Bonecore's Google Drive, under the Drive permission approved at sign-in.
• What it does: saves documents we issue (quotations, letters, receipts, loaner forms) and files our staff post in our team chat into Bonecore's Drive folders, and keeps private backups of our operations data.
• What it does not do: it does not read Gmail, contacts or calendars, does not access any other person's Google account, and does not share Google data with anyone outside Bonecore.
• Limited Use: Bonecore Hermes's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is not used for advertising, is not sold, and is not used to train AI models.
• Removing access: the account owner can revoke access at any time at https://myaccount.google.com/permissions.

Sharing, storage and your rights

We share a patient's details only with the hospital doing the surgery and the agency paying for the implants (for example DSWD, PCSO, DOH or PhilHealth), and only what that agency asks for. We also give information to government offices when a law or a lawful order requires it.

Our records are kept on our own servers and in Bonecore's Google Drive, both limited to Bonecore staff. The service providers that host them process the data for us and for no other purpose. Access needs a staff login, and backups are kept in a private folder only the business owner can open.

We keep quotations, letters, receipts and billing records for five years after the annual tax return for that year is filed, as the Bureau of Internal Revenue requires, and longer only while a tax case involving them is open. We keep the record of which implant lot was used for which patient for ten years, so we can reach patients if a manufacturer recalls a lot. Inquiries that do not lead to an order are deleted after one year.

Under the Data Privacy Act you may ask to see the information we hold about you, have it corrected, object to its use, or have it deleted where the law allows. Write to bonecoremedical@gmail.com and we will reply within 15 working days. You may also complain to the National Privacy Commission (https://privacy.gov.ph).

We will post any change to this policy on this page with a new date.