BIMS Privacy Notice
BIMS is an internal barangay records system. Authorized personnel use it to maintain resident, household, service, and validation records. Access to exact household locations, resident photos, and supporting evidence is restricted by staff permissions and barangay scope.
Citizen account registration
When you create a citizen account, BIMS stores your email address, a one-way password hash, the date and source of your privacy acknowledgment, account-verification status, and security activity needed to protect the account. Your password itself is never stored. Email and security records are used to activate the account, prevent abuse, recover access, notify you about your own requests, and maintain an accountable sign-in history.
Creating an account does not by itself establish residency or eligibility. Resident-profile details, identification evidence, service requests, and complaints are collected only in their corresponding guided forms and are reviewed under their own purpose, access, correction, and retention controls. You may review account activity, correct eligible profile information, or request governed account closure from the citizen account page. Records that must be retained for an active request, audit, legal hold, or lawful government purpose are not silently erased.
The current citizen account registration notice version is BIMS-CITIZEN-ACCOUNT-2026-10-02.
Privacy contacts and requests
The service Citizen’s Charter and Privacy Notice names the approved Personal Information Controller, Data Protection Officer, contact details, retention policy and privacy-rights procedure for a published service. Choose the barangay and service to read that notice.
This general notice does not name an officer or confirm a contact on behalf of every office. If no effective service notice is available, ask the responsible office for its verified privacy contact and approved procedure before sending identity documents or private evidence.
For an existing request, My Requests provides the signed-in owner’s governed privacy-request controls. If you cannot use that account-based route, ask the responsible office for its alternative contact procedure. Reading this notice does not submit a privacy request.
Household location information
When an authorized staff member explicitly presses Search Address, the entered household address is sent to Google Maps Platform to obtain possible location matches. When a live hybrid map is opened, the confirmed coordinates are sent to Google Maps Platform to render that map.
BIMS does not download or permanently store Google Maps imagery. It stores the staff-confirmed coordinates, a separate private BIMS-generated location sketch, and the household's directly uploaded exterior house photo for operational verification. Uploaded house photos are sanitized to remove camera metadata, stored privately, and released only through permission-checked views. Google processes Maps requests under the Google Privacy Policy.
Submission provenance and optional form location
To protect resident-registration workflows, BIMS may record the submission channel (mobile app or website), server-received date and time, a limited device, operating-system, app, or browser summary, and the public IP address observed by the BIMS server. These details support abuse investigation, troubleshooting, and accountable review; they are not proof of identity or residency.
The server-observed public IP may be sent server-to-server to RIPE NCC RIPEstat solely to derive an approximate network ASN and network organization. This best-effort lookup is nonblocking, does not decide whether a form may be submitted, and may be incomplete. A VPN, proxy, shared connection, mobile carrier NAT, or enterprise network can cause the displayed network organization to differ from the subscriber's actual ISP or location.
A form location is collected only after the person completing the form explicitly chooses to share it once. Declining or blocking location sharing does not prevent submission. This optional form location is separate from the household address and map pin. After optional sharing, BIMS may use its existing configured Google Maps service to create a reverse-geocoded submission-address label. That label and the browser coordinates are approximate and unverified; they are not residency proof, an ownership record, or a substitute for barangay validation.
Reviewer screens mask public IP addresses and form coordinates by default. An authorized reviewer must enter a legitimate reason to reveal exact values, and that sensitive access is recorded in the audit trail. Legacy records correctly show Not captured when this information was not collected.
New submission-provenance receipts receive a finite protective review date of 180 days unless the office configures a formally approved schedule. When that date has elapsed and no legal hold or active review blocks disposition, an authorized independent reviewer may cryptographically erase the IP, optional form location, device details, and receipt identifiers while retaining only the accountable event-and-disposition shell.
Optional sensitive self-identification
Gender identity and sexual orientation are separate, optional fields. They may be recorded only when a resident voluntarily self-identifies and must never be inferred from the resident's name, appearance, sex, documents, household, or another field. “Not collected” is different from “Prefer not to say.”
These fields are visible only to the Main Administrator or the resident's assigned Barangay Administrator with independent resident-approval authority. They are excluded from household rosters, resident-list searches, public verification, certificates, service documents, maps, ordinary dashboards, and printed resident profiles. They remain protected within authorized backups and follow the office's resident-record retention and correction procedures.
Population and classification records
WRA, pregnancy, senior, PWD, and resident-classification entries are recorded as time-aware assessments. “Unknown” is preserved when a fact has not been verified. Authorized staff must record the source, effective date, and available supporting reference instead of inferring an answer or treating a blank legacy value as “No.”
Resident lifecycle and household history
Moved-out, transferred, deceased, return, and other lifecycle changes use a maker-checker request and decision process. BIMS keeps structured effective dates, reasons, references, household membership periods, and transfer events so a current profile is not silently rewritten without an accountable history.
Retention, legal hold, and disposition
Supporting history and private evidence may have an approved retention date. BIMS does not purge these records automatically. An authorized independent reviewer must confirm that retention has elapsed, that no legal hold is active, and that disposition is permitted. Approved disposition minimizes personal detail, preserves a strict audit entry, and securely removes private evidence from active storage.
A legal hold suspends disposition until its recorded end date or an authorized release. Setting, releasing, and acting on a hold requires a documented reason and is recorded in the audit trail.
Accuracy, correction, and access
Authorized staff should correct inaccurate information through the controlled edit, lifecycle, duplicate-review, or reconciliation workflow. Merged source profiles cannot be restored through the ordinary archive screen. Access, exports, prints, private-evidence reads, approvals, and dispositions are permission- and barangay-scoped and are subject to audit controls.
Purpose and safeguards
Exact household locations are used for residency validation, legitimate barangay field work, emergency or service coordination, and eligibility checks. They are not intended for public directories, cadastral surveys, ownership determinations, or unrelated tracking.
Users should encode only information needed for an authorized barangay purpose and must follow applicable Philippine data-protection requirements and their office's retention and access policies.