Kalingap

Kalingap policies

Privacy Policy

What we collect, why we collect it, who we share it with, what we delete and when, and how you stay in control of your information.

Version 1.1 · Last updated August 2026

1. Who this policy covers

This Privacy Policy explains how Kalingap collects, uses, shares and protects personal information when you use our mobile app, website and related services.

It applies to everyone who uses Kalingap — families and individuals booking care ("Clients"), and the independent care providers who accept those bookings ("Caregivers").

Kalingap is the personal information controller for the information described here. We handle it under the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and the issuances of the National Privacy Commission.

This is version 1.1 of this policy. When you accept it in the app, the app records which version you accepted and the date — so it is always clear which text you agreed to.

2. Information we collect

Information you give us

  • Account details — name, email address, mobile number, profile photo.
  • Booking details — the care requested, schedule, service address, and any notes you add about the person receiving care.
  • Verification documents — a government-issued ID, an NBI or police clearance, and any certifications you choose to add. These are sensitive personal information and we only collect them after you give the separate consent described in section 3.
  • Messages you send through the app, and reviews you write.
  • Support requests and anything you tell us when you report a problem.

Information collected automatically

  • Device and app information — device model, operating system, app version, and crash diagnostics.
  • Usage information — the screens you open and actions you take in the app.
  • Location — approximate or precise location, when you grant permission, to match you with nearby caregivers or clients and to support visit check-ins. You can withdraw this permission in your device settings at any time.

Information from others

  • The result of a clearance check made against the National Bureau of Investigation's own verification portal, when a Caregiver uploads an NBI clearance. Section 5 explains exactly how that check works.
  • Payment confirmations from PayMongo, our payment processor. Kalingap never receives or stores your full card number.

3. Sensitive personal information, and its separate consent

Some of what Kalingap handles is sensitive personal information under the Data Privacy Act. For us that means three things:

  • your government-issued identification document;
  • your NBI clearance or police clearance, and the result of any check we run against it;
  • health-related details about the person receiving care — mobility needs, medication reminders, or a condition a caregiver needs to know about in order to work safely.

Because it is sensitive, it sits behind its own consent. Accepting the Terms of Use and this Privacy Policy is one thing; consenting to sensitive personal information is a separate, optional checkbox — currently version 1.0 — and it is never ticked for you.

Until you give that consent, the app will not accept a government ID, a clearance upload or a health disclosure. That is enforced on our servers, not just hidden in the interface: the write is refused outright. You can browse Kalingap without it. You cannot be verified as a Caregiver, and you cannot complete a booking that depends on health details, without it.

Withdrawing it. Email us and we will act on it, or delete your account in the app, which removes these documents outright. Withdrawal stops any further collection immediately; anything already held is deleted except where section 8 requires us to keep a record. Withdrawing does not make our earlier handling unlawful, and it may mean we can no longer verify you or support a booking.

If you are arranging care for another adult or for a child, share only what a caregiver genuinely needs to provide safe care, and only where you have the authority to share it on that person's behalf.

4. How we use your information

  • To create and maintain your account.
  • To match Clients with Caregivers and to arrange, track and complete bookings.
  • To carry out the verification checks described in section 5, and to keep the platform safe.
  • To process payments and issue receipts and payouts.
  • To provide customer support and respond to reports.
  • To send service messages about bookings, and — where you have opted in — product updates. You can unsubscribe from marketing at any time.
  • To detect and prevent fraud, abuse and security incidents.
  • To meet our legal, tax and regulatory obligations.

We do not use your personal information to train machine-learning models, and we do not make decisions about you by automated means alone. Section 5 explains the one place software assists a decision, and where the human sits in it.

5. How verification works, and what a badge means

Kalingap deliberately never shows a bare "Verified" label, because it would not tell you anything. Every badge names the check that passed and the date it passed. There are three, and they are separate:

  • Documents submitted — the Caregiver uploaded documents. Nobody at Kalingap has checked them yet. This states an upload, not a result.
  • ID matched — a person at Kalingap compared a liveness selfie against the photo on the submitted ID and confirmed they are the same person. We record when, and who did it.
  • NBI checked — the clearance was verified against the National Bureau of Investigation's own portal. We record the result, the date, and — where a person made the call — who.

The three-way rule. A clearance is only accepted when the name on the account, the name on the identification document and the name on the clearance all agree, the clearance number matches the document, and the clearance has not expired. If any one of those disagrees, no badge is granted and the case goes to a person to look at.

Where software assists. When a Caregiver uploads an NBI clearance, we may open the NBI's public verification page in a hosted browser run by a specialist provider on our behalf, enter the clearance number, and read back what the portal says. This is done to reduce the wait for the Caregiver, and it is deliberately one-sided: it can confirm a clean result that already satisfies the three-way rule above, and in every other case — anything unreadable, unexpected, mismatched or simply unclear — it does nothing except place the clearance in a queue for a person at Kalingap to check by hand. It cannot reject you, and it cannot record a result a human would not have recorded. The provider processes this on our instructions only, and the processing may take place on servers outside the Philippines; section 7 covers that.

What a check is not. A check tells you what a record said on the day we looked. It is not a prediction of anyone's conduct, and it is not a substitute for your own judgement about whether a particular Caregiver is right for your situation.

6. When we share information

We do not sell your personal information. We share it only in these situations:

  • Between users, to make a booking work. A Caregiver sees the booking details and service address they need in order to attend. A Client sees the Caregiver's profile, experience, ratings and the specific checks that have passed. A Client never sees a Caregiver's identification document, clearance file or clearance number — only that a check passed, and when.
  • With service providers who work on our behalf — cloud hosting and databases, payment processing, the hosted-browser provider described in section 5, push notifications, customer support tooling and analytics. Each receives only what it needs, is bound to act on our instructions, and may not use the information for its own purposes.
  • For safety and legal reasons — where we are required by law, responding to a valid legal request, or where it is necessary to investigate a safety incident or protect someone from harm.
  • In a business transfer — if Kalingap is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We will tell you first.

Transfers outside the Philippines. Some of these providers process information on servers outside the country. Where that happens, Kalingap remains accountable for the information under the Data Privacy Act and requires contractual protections at least equivalent to those the Act provides before the transfer takes place.

7. How long we keep it — and what we throw away

We keep the least we can for the shortest time we can, and the app enforces the schedule automatically rather than relying on anyone remembering to prune.

  • Clearance and ID files are deleted 30 days after review. Once a document has been reviewed, the window exists only so a decision can be contested. After it closes we delete the image or PDF itself and keep a minimal record: the document type, the result, the review date, the expiry date and a SHA-256 fingerprint of the file. The fingerprint lets us recognise the same document if it is uploaded again; it cannot be turned back into the document.
  • Health details about a care recipient are kept while they serve the bookings they belong to, and pruned thereafter.
  • Booking chats close a day after the visit, so contact between users stays tied to real work.
  • Booking and payment records are retained for the period required by Philippine tax and accounting rules, and for as long as needed to resolve any dispute.
  • Consent records — which version you accepted, when, and any withdrawal — are kept as the proof of the legal basis on which we held your information at the time.

Outside those specific schedules, we keep personal information while your account is active and afterwards only where we still need it for a purpose named in this policy.

8. How we protect it

Personal information is encrypted in transit. Uploaded documents are stored privately — there is no public address for them. When a file needs to be shown to someone entitled to see it, the app issues a short-lived link for that one view rather than exposing the file.

Access is limited to the people who need it to do their job, and every administrative action on a verification record — who viewed it, who recorded a result — is written to an audit log.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the National Privacy Commission as required by law.

9. Your rights and choices

Under the Data Privacy Act, and equivalent laws where they apply to you, you have the right to be informed; to access the personal information we hold about you; to correct information that is inaccurate or out of date; to object to certain processing, including direct marketing; to request erasure or blocking where the grounds for it are met; to receive a copy of your information in a portable format; to be indemnified for damage caused by inaccurate or unlawfully obtained information; and to lodge a complaint with the National Privacy Commission.

Two of these you can exercise yourself, immediately, in the app:

  • Download my data, under Account in your profile, produces a machine-readable copy of your account, your profiles, your care recipients, your documents and their check results, your bookings, your reviews and your full consent history.
  • Delete my account removes your personal information — and it is a real deletion of the sensitive material, not a flag. The bytes of your identification and clearance files, your intro video and your profile photo are deleted from storage; your payout details, biography, date of birth, health disclosures and push notification tokens are removed; and your name and contact details are cleared from your account.

What survives a deletion, and why: financial and booking records we are required to retain for tax and accounting, and your consent record, closed out with a withdrawal entry. Neither contains your identification documents or health details.

For any other right — correction, objection, or a question about any of the above — email support@kalingap.com and we will respond within the period required by law.

10. Children's privacy

Kalingap accounts are for adults aged 18 and over. We do not knowingly allow children to create accounts.

Where a booking involves a child receiving care, the information about that child is provided by their parent or legal guardian and used only to deliver the care requested.

11. Changes to this policy

We update this policy as the service changes. Every version carries a version number, shown at the top of this page and recorded against your acceptance.

When we publish a new version, the app asks you to review and accept it the next time you open Kalingap — an old acceptance never carries over silently. A change to how we handle sensitive personal information carries its own version number and its own fresh opt-in.

12. Contact us

You can reach our privacy team at support@kalingap.com with any question about this policy or about how your information is handled.

If you are not satisfied with our response, you may contact the National Privacy Commission of the Philippines.

Still have a question? Email support@kalingap.com and we'll help.