Part of the guide to peptide testing in the Philippines
Data privacy and anonymity in peptide testing
By Tested.ph editorial. Last reviewed .
Short answer
Tested.ph collects your email address, a few optional sign-up details, the page you signed up from and a keyed hash of your IP address, and nothing else. Records describe vials, never people. Partner laboratories receive only a sample code, so they never learn the buyer's or the vendor's name. Under RA 10173 you can access, correct or erase your data.
Buyers ask two privacy questions before sending a vial in. Who will know I bought this, and what happens to my details? And will the people measuring the vial know whose product it is?
What does the Data Privacy Act protect?
The Data Privacy Act of 2012, RA 10173, covers personal information, which it defines as any information "from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual." An email address tied to an order is personal information.
The Act also defines a narrower class, sensitive personal information, which includes information about an individual's health. That is one reason Tested.ph records describe vials and never ask why you bought a compound or whether you use it.
Section 11 sets three principles for anyone processing personal information: transparency, legitimate purpose and proportionality. Among other things, personal information must be collected for specified and legitimate purposes declared before, or as soon as reasonably practicable after, collection, be "adequate and not excessive" for those purposes, and be retained only for as long as necessary. Section 12 lists the lawful bases for processing; the first is that the person has given consent.
What rights do I have under RA 10173?
Section 16 of the Act lists the rights of the data subject, the person the data is about. In summary, you are entitled to:
| Right | What the Act says, in summary | Section |
|---|---|---|
| To be informed | Be told whether your personal information is being or has been processed, and be given a description of it, the purposes, the recipients, how long it is stored and your rights | 16(a) and (b) |
| To access | Reasonable access, on demand, to the contents of your data, its sources, its recipients, how it was processed and when it was last accessed or modified | 16(c) |
| To correct | Dispute an inaccuracy or error and have it corrected | 16(d) |
| To erasure or blocking | Suspend, withdraw or order the blocking, removal or destruction of data that is incomplete, outdated, false, unlawfully obtained, used for unauthorised purposes or no longer necessary | 16(e) |
| To damages | Be indemnified for damages from inaccurate, false, unlawfully obtained or unauthorised use of your data | 16(f) |
| To data portability | Obtain a copy of data processed electronically in a structured, commonly used format | 18 |
Section 17 lets lawful heirs and assigns exercise these rights after the data subject's death or incapacity. Section 7 creates the National Privacy Commission, an independent body whose functions include receiving complaints and investigating them. The Tested.ph privacy notice also lists a right to object to processing.
What does Tested.ph collect?
Testing has not opened, so today the only personal data Tested.ph holds comes from people signing up to be told when it does. The privacy notice lists all of it:
- Your email address, and if you give them, a shop name, a compound you are interested in and the number of buyers in a group.
- The page you signed up from and any campaign tags in the link you followed.
- A one-way keyed hash of your IP address, used only to limit repeated sign-ups. The IP address itself is not stored.
Tested.ph does not use advertising trackers, analytics cookies or third-party form services. The purpose is to email you once when testing, group tests or vendor testing open, as you asked, and to protect the form from abuse. The lawful basis is your consent, which you can withdraw at any time.
| Question | Answer from the privacy notice |
|---|---|
| Who sees it? | Only Tested.ph. It is never sold or shared. |
| Where is it stored? | With Tested.ph's database host in Singapore. |
| Do partner laboratories see it? | No. They receive coded samples and never receive your details. |
| How long is it kept? | Until testing opens and you have been notified, then for 12 months, unless you ask for it to be deleted sooner. |
| How do I exercise a right? | Through the contact page. You can also complain to the National Privacy Commission. |
Will my name appear on a test record?
No. Records describe vials, not people. When you send in a vial, your name and contact details are never published. A public record names the vendor and the batch. If you would rather the vendor were not named publicly, you can choose a private record, which opens only for people holding its key. In a group test, every buyer receives the same task number and key, and the group decides together whether the record is public or private.
How does sample coding keep the analysis blind?
Anonymity also runs the other way: it protects the measurement from knowing whose product it is. At intake the sealed vial is photographed, its label is covered and it is given a sample code. From that point the partner laboratory sees only the code; the vendor's name stays with Tested.ph.
The vendor name stays with Tested.ph; the lab receives only a sample code; results are matched back to the vendor after the report is signed.
This protects vendors as much as buyers: a laboratory that does not know whose vial it is cannot favour one seller or treat another harshly, consciously or not. See how it works.
What is an anonymous purchase?
For the Tested Index, Tested.ph buys vials anonymously through each vendor's normal checkout, like any customer. The vendor does not choose which vial is analysed, and only these anonymous purchases count toward the Index. Records from vials sent in by buyers or vendors are published too, labelled with who sent them, but they do not affect any grade.
Anonymous buying does not mean secret publishing. Before any record is published, including one from an anonymous purchase, the vendor has 72 hours to reply, and replies are published unedited.
- Does the partner laboratory know who I am?
- No. Partner laboratories receive coded samples and never receive your details. They also do not see the vendor's name, because the label is covered at intake and the vial carries only a sample code. Only Tested.ph links the code back to the vendor and batch.
- Can I ask Tested.ph to delete my email address?
- Yes. RA 10173 gives you the right to have personal data that is no longer necessary removed or destroyed, and the Tested.ph privacy notice lists erasure among your rights. Use the contact page to ask. Otherwise, sign-up details are kept until testing opens and you have been notified, then for 12 months.
- Will the vendor find out I tested their product?
- Not from you, and not from the partner laboratory. If you choose a public record, it names the vendor and batch, and the vendor can reply before publication, but your name is never shown. A private record opens only for people holding its key, so the vendor sees it only if someone with the key shares it.
- Where do I complain about how my data is handled?
- First, use the Tested.ph contact page so the issue can be put right. You can also complain directly to the National Privacy Commission, which RA 10173 created as an independent body with power to receive complaints, investigate them and award indemnity on matters affecting personal information.
Sources
- Republic Act No. 10173, Data Privacy Act of 2012, Lawphil Project