Privacy Policy

Last updated: November 2026.

Centre for Neurodivergence Medical Corp, doing business as The Center for Neurodivergence ("CFN", "we", "us", "our"), respects your privacy and your child’s. This Privacy Policy explains how we collect, use, share, store and protect personal information when you use thecenterforneurodivergence.com, app.thecenterforneurodivergence.com and our clinic services (together, the "Platform").

We process personal data in accordance with the Data Privacy Act of 2012 (R.A. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This Policy should be read together with our Terms and Conditions.

1. Who we are

CFN is the personal information controller for the data described in this Policy.

Registered name: Centre for Neurodivergence Medical Corp
Address: Suite 408, 4th Floor, Visayas Medical Center, 85 Osmeña Blvd., Cebu City 6000, Cebu, Philippines
Email: [email protected]
Data Protection Officer: Czarina Atupan Calderon, [email protected] (subject: "Attention: Data Protection Officer")

2. Information we collect

About you (parent, guardian or course buyer)

Identity and contact details: name, email address, phone number, address, and your relationship to the child.
Account details: login credentials and account preferences.
Proof of authority: documents showing you can consent for the child (such as a birth certificate, guardianship order or signed authorisation), where we ask for them.
Payment and billing details: amounts paid, payment method type, transaction references and invoices. Card details are handled by our payment processor, PayMongo; we never see or store your full card number.
Discount eligibility: PWD or senior citizen ID details, where you claim a discount.
Communications: messages, emails, call notes, complaints and feedback.

About your child

Identity details: name, date of birth, sex and school.
Health and developmental information: medical, developmental, behavioural, educational and family history; intake and consent forms; assessment results; diagnoses; therapy notes; progress reports; and reports from other professionals or schools that you share with us.

Health information is sensitive personal information under the Data Privacy Act. We handle it with a higher level of care, as described in this Policy.

Collected automatically

Usage and device data: IP address, browser and device type, pages visited, and course progress (for example, which modules you have completed).
Cookies: see Section 9.

Telehealth sessions

Online sessions are not recorded without the written consent of everyone involved. We do not keep video or audio of a session unless that consent has been given.

3. How we use your information and our lawful basis

Providing assessments, therapy and other clinical care to your child, and keeping clinical records: medical treatment by licensed practitioners or a medical treatment institution (Section 13(e)); your consent where required (Section 13(a)).
Creating and managing your account; booking, rescheduling and cancelling appointments; giving you access to courses: performance of our contract with you (Section 12(b)).
Taking payments, issuing invoices and applying PWD or senior citizen discounts: contract (Section 12(b)); legal obligation under tax and discount laws (Sections 12(c) and 13(b)).
Sending appointment reminders, service updates and responses to your enquiries: contract (Section 12(b)).
Acting where a child’s life, health or safety is at risk, including reporting under R.A. 7610: protection of life and health (Sections 12(d) and 13(c)); legal obligation (Sections 12(c) and 13(b)).
Meeting legal, regulatory, licensing and professional-standards obligations: legal obligation (Sections 12(c) and 13(b)).
Handling complaints and establishing, exercising or defending legal claims: protection of lawful rights and legal claims (Sections 12(f) and 13(f)).
Keeping the Platform secure, preventing fraud and fixing technical problems: legitimate interests (Section 12(f)).
Improving our services and courses using aggregated or de-identified data: legitimate interests (Section 12(f)).
Sending newsletters or promotional messages: your consent (Section 12(a)), which you can withdraw at any time.

We do not sell your or your child’s personal information, and we do not use health information for marketing.

4. Children’s information

Our clinical services are for children, but accounts may only be created by adults aged 18 or over. Information about a child is collected from, and consented to by, the child’s parent or legal guardian (or an adult with their written authority). Where appropriate for their age and understanding, clinicians will also explain to the child what is happening and why.

5. Who we share information with

We share personal information only where necessary and with appropriate safeguards:

Our clinicians and staff, on a need-to-know basis, all bound by confidentiality.
Service providers that process data on our behalf, such as our payment processor (PayMongo), website, app and data hosting, scheduling, email and SMS, and video-call providers. They act only on our instructions under written agreements that require them to protect your data.
Other professionals, schools or institutions (such as your child’s school, doctor or another therapist), only with your written authorisation.
HMOs or insurers, only where you ask us to deal with them on your behalf.
Government authorities, regulators and courts, where the law requires it (for example, the Bureau of Internal Revenue, the Department of Health, the Professional Regulation Commission, the NPC, or child-protection authorities under R.A. 7610).
Professional advisers (such as lawyers and auditors) under a duty of confidentiality.

Transfers outside the Philippines

Some of our service providers may store or process data on servers outside the Philippines. Where this happens, we remain responsible for your data under Section 21 of the Data Privacy Act, and we require those providers by contract to protect it to a standard comparable to Philippine law.

6. How long we keep information

Clinical records (assessments, reports, therapy notes, consent forms): at least 10 years after the last session, or longer where required by law or professional standards.
Payment and invoice records: as long as required by tax laws and BIR regulations (generally at least 10 years).
Account and course data: while your account is active, and up to 2 years after it is closed.
Complaints and correspondence: up to 5 years after the matter is resolved, or longer if needed for a legal claim.
Marketing preferences: until you unsubscribe or withdraw consent.

When information is no longer needed, we securely delete or anonymise it.

7. How we protect information

We use organisational, physical and technical measures appropriate to the sensitivity of the data, including:

encryption of data in transit and at rest;
role-based access, so staff see only what they need;
secure, access-controlled storage for paper records at the clinic;
confidentiality obligations for all staff and service providers;
regular review of our security practices.

If a personal data breach occurs that is likely to put you or your child at real risk of serious harm, we will notify the NPC and affected individuals within 72 hours of becoming aware of it, as required by NPC rules, and explain what happened and what we are doing about it.

8. Your rights

Under the Data Privacy Act, you (and, for your child’s data, you as their parent or guardian) have the right to:

Be informed about how personal data is collected and processed.
Access the personal data we hold and obtain a copy, including copies of your child’s records.
Object to processing, including direct marketing, and withdraw consent where processing is based on consent.
Correct inaccurate or incomplete data.
Erase or block data that is no longer necessary, is unlawfully processed, or was obtained without a lawful basis.
Data portability: receive your data in a commonly used electronic format.
Claim damages for harm caused by inaccurate, incomplete, unlawfully obtained or unauthorised use of personal data.
Lodge a complaint with the National Privacy Commission.

Some rights have limits. For example, we cannot delete clinical records that the law or professional standards require us to keep, and withdrawing consent does not affect processing already carried out.

To exercise any of these rights, email [email protected] with the subject "Attention: Data Protection Officer". We may ask you to verify your identity, and your authority over a child’s records, before acting on a request. We will respond within 15 business days; if we need longer, we will tell you why.

9. Cookies

We use cookies and similar technologies to:

keep you signed in and remember your preferences (essential cookies);
understand how the Platform is used so we can improve it (analytics cookies).

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Platform, such as sign-in and checkout, from working. We do not use cookies to show you third-party advertising.

10. Links to other websites

The Platform may link to other websites and services, such as payment pages or video-call tools. Their own privacy policies apply, and we are not responsible for how they handle your information.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted on this page and emailed to account holders before they take effect. The "Last updated" date at the top shows when it was last changed.

12. Contact and complaints

For any question, request or complaint about privacy, contact our Data Protection Officer:

Centre for Neurodivergence Medical Corp (The Center for Neurodivergence), Attention: Data Protection Officer, Suite 408, 4th Floor, Visayas Medical Center, 85 Osmeña Blvd., Cebu City 6000, Cebu, Philippines. Email: [email protected]

If you are not satisfied with our response, you may file a complaint with the National Privacy Commission at privacy.gov.ph or [email protected].