NPC Issuance Wiki

NPC BN 18-147: In re: Evolution Wellness Philippines, Inc.

Issued Resolution

Resolution Text

IN RE: EVOLUTION WELLNESS PHILIPPINES, INC.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the compliance dated 05 June 2023 of Evolution Wellness Philippines, Inc. (Evolution) with the Order of the National Privacy Commission (NPC) through its Complaints and Investigation Division (CID) dated 30 May 2023.

Facts

Evolution Wellness Philippines, Inc., formerly known as Fitness First Philippines, is historically known as a popular health resort.1 It accepts the use of credit cards to facilitate payments from its clients as one of its payment platforms.2

On 03 August 2018, Evolution transmitted an Initial Report to the Commission, stating that on 01 August 2018, they received reliable information regarding a “possible data security incident involving credit card fraud.”3

The Report indicated that there were nine members who were affected, and that Evolution believes that the possible breach all took place at its Fitness First – Manila Branch.4 Further, Evolution stated that the breach has caused financial damage to the affected data subjects:

The impact of the breach has caused financial loss and damage to the members of the Company as follows: [redacted name] - P168,512.30, [redacted name] - P90,00.00, [redacted name] - P2,000.00, while others are still undergoing investigation and verification.5

Moreover, Evolution alleged that “[i]nitial investigations show that the data security incident is internal and caused by malicious acts of employees.”6

To respond to the breach, Evolution stated that it had taken the following actions:

  1. The Company placed the concerned employees under investigation.

  2. The Company reminded concerned personnel to follow Company protocol of: (a) asking for IDs to verify identity (sic) of credit card holder; (b) letting the members swipe their own card in paying Fitness First membership dues and other charges, (c) letting the members press the Approve button; and (d) new members personally encoding personal information as needed by the Company to provide proper services.

  3. The Company also notified the affected members of the possible breach, actions the Company is taking and possible remedies to address this matter.7

On 08 October 2020, the CID issued an Order requiring Evolution to submit a Full Report detailing the incident within fifteen (15) days from receipt.8

On 22 October 2020, Evolution submitted its Full Incident Report, indicating that “the affected Data Subjects were newly joined members or members who a[m]ended their personal details regarding credit card details. They were assisted by one of the Company’s Membership Consultants, JY.”9

Notably, as opposed to what was previously stated in the Initial Report, the Full Incident Report provided that there are approximately sixteen (16) members affected.10 The affected Data Subjects were newly joined members or members who amended their personal details regarding credit card details.11 They were all assisted by one of the Company’s Membership Consultants, JY.12

The Report also stated that the personal information involved included information that may be used to identify fraud, such as: (i) names of the data subjects and (ii) credit card information:13

2. Personal Data Possibly Involved

a. List of the sensitive personal information involved

None.

b. List of other information involved that may be used to identify fraud

  1. Names of affected data subjects

  2. Credit card information14

Further, the Report stated that between the period of 05 July until 09 August 2018, Evolution received reports from affected members about unidentified transactions on their credit card statements.15 Attached to the Report is a table detailing the financial damage suffered by the affected data subjects:

Member’s NameComplaint ReceivedUnidentified Transaction
1 [Redacted name]July 5, 2018 by Email/Web Feedback form1. June 30 and July 01, 2018 online purchase from Honestbee
2 [Redacted name]July 26, 2018 by Letter1. June 23, 2018 online purchase from Agoda amounting to PHP97,243.76; 2. July 19, 2018 online purchase Flyscoot amounting to PHP57,401.16; 3. July 20, 2018 online purchase from Honestbee amounting to PHP13,867.38
3 [Redacted name]July 26, 2018 by Letter1. Online purchase from Agoda amounting to PHP90,000
4 [Redacted name]July 27, 2018 by Email/Web Feedback form1. Several days after June 30, 2018, [Redacted name] received a phone call [from a] malicious actor asking verification of personal details; 2. Two weeks after June 30, while [Redacted name] was abroad, he was informed that his credit card information was used to make online purchase of groceries and hotel accommodation in the Philippines
5 [Redacted name]Jul 30, 2018 by Office Visit1. Online transaction on make-up items amounting to PHP2,000
6 [Redacted name]July 31, 2018 by Office Visit1. Online purchase from Agoda
7 [Redacted name]August 2, 2018 by SMS[Redacted name] received a text from bank about suspicious transaction via Paypal
8 [Redacted name]August 7, 2018 by phone call-No Information-
9 [Redacted name]August 7, 2018 by phone call-No Information-
10 [Redacted name]August 7, 2018 by phone call-No Information-
11 [Redacted name]August 3, 2018 by office visit-No Information-
12 [Redacted name]August 3, 2018 by office visit-No Information-
13 [Redacted name]August 7, 2018 by phone call[Redacted name] informed the Company of an unauthorized transaction amounting to PHP75,000
14 [Redacted name]August 7, 2018 by phone call-No Information-
15 [Redacted name]August 7, 2018 by phone call[Redacted name] informed the company of an unauthorized Agoda purchase in the amount of PHP46,00016

The Report stated that upon the conduct of an internal investigation, it was found by Evolution that JY did not follow the Company’s process for adding new members or changing member details.17 It was discovered that JY encoded the affected data subjects’ personal information, including credit card information.18 Furthermore, Evolution determined that upon review of the relevant CCTV footage, JY’s behavior “[is] consistent with the acts of recording, copying, capturing and collecting data of the members without their consent including sensitive and confidential information.”19

Attached to the Full Incident Report is an investigation report dated 11 August 2018, executed by Knight Hawk Security Force Inc., wherein it was concluded that JY was engaged in “recording, copying, capturing and collecting data of the members without their consent.”20 The report stated:

Based on discussions and findings, it can easily conclude that JY is guilty for violating Data Privacy of the members. He was caught recording, copying, capturing and collecting data of the members without their consent including sensitive and confidential information. He was aware of his job description as members consultants that only service consultant are allowed to process and handle credit card transaction. He nevertheless, extended his help to his co-staff with the intention in mind to solicit members’ information. Given the number of members who complained in no time of credit card fraud is not just coincidence but interposes a reasonable ground to believe that a crime of credit card fraud can be link to JY acts. He will not collect data on member’s credit card without intention in mind considering that he is expert in gathering online transactions.21

In order to address the breach and to prevent recurrence of the incident, Evolution alleges to have taken the following measures:

3. Remedial Measures Taken Subsequent to Suspected Breach

a. Description of the measures taken or proposed to be taken to address the breach

The Company has done the following:

  1. Conducted an Internal Investigation,

  2. Secured the services of Knight Hawk Security Force, Inc. to conduct an investigation (Attached is the Investigation report marked as Annex “D”);

  3. Notified the National Privacy Commission of the breach within seventy-two (72) from discovery of the possible breach or on 03 August 2018 (Attached as Annex “E”);

  4. Notified the National Privacy Commission of the updated breach within seventy-two (72) from discovery of the possible breach or on 09 August 2018 (Attached as Annex “F”)

  5. Notified all members who have interacted with JY of the possible data breach; and

  6. Cooperated with the Data Subjects in coordinating with the merchants where the unauthorized transactions

Further, the Company has terminated the employment of JY effective 18 September 2018.

b. Actions being taken to secure or recover the personal data that were compromised

The Company has been cooperating with the affected Data Subjects to coordinate with the merchants. The Merchants cannot disclose the personal information of the affected Data Subjects directly with the Company as the latter is not the owner of the personal information.

c. Actions performed or proposed to mitigate or limit the possible harm or negative consequences, damage or distress to those affected by the incident

The Company has been cooperating with the affected Data Subjects to coordinate with the merchants. The Merchants cannot disclose the personal information of the affected Data Subjects directly with the Company as the latter is not the owner of the personal information.

x----------------------------------------------------x

e. The measures being taken to prevent a recurrence of the incident

Since the incident the Company has updated and implemented the following increased protocols and safety measures described below.

  1. The Company has changed its Official Policy Instructions (Attached as Annexes “H”, “H-1”, and “H-Z”), which implements, among others-

a. The new Policies and Procedures on Add Member Process and Change Payment Details issued last. August 9, 2018 should be implemented effective immediately

b. Member are to encode their personal details and credit card information during Add Member Process and change payment/personal details.

c. Member to swipe their credit card during payment and press enter, Front desk to key in amount

d. At no instance will a member be allowed to leave his/her credit card at the reception or with any of our staff for whatever purpose.

  1. The Company has implemented an updated Payment Card Industry Data Security Standard (Attached as “I”)

This updated policy includes, among other key protocols:

a. Email confirmation to be received by the member for card enrolment.

b. Bank’s notification to cardholder for every successful charge.

c. CCV and 3DS switch on.

d. Writing/scanning/photocopying/capturing/embossing/any other method of recording full.

e. card details are prohibited.

f. Copy of payment card will not be required for sales vetting.

g. First 6, last 4 digits, expiry date, cardholder name of payment card can be recorded on paper contract or payment authorization form. Any further details will be deemed as non-compliance.

Such forms should be scanned on the member’s profile accordingly.

h. Payment card details should be entered onto system by CARDHOLDER only.

i. 3DS authentication steps will be populated when required by card issuing bank, cardholder will receive One Time Pin (OTT)/TAC number via SMS for cardholder to enter the pin in order to complete the authentication process. Otherwise, it will not be prompted

j. Credit Card plan will show integrated online enrolment form for instant validation result and successful tokenized card details will be displayed at payment details page.

k. Card enrolment email will be sent to member for each addition or change event.

l. Installation of privacy filter protector screen on workstations use for new join member and updating of credit card details.

  1. The Company has added a Data Privacy Seminar as part of each employee’s orientation process. (Attached Annex “J”)22

It is also notable that, according to the Report, since the incident, the affected data subjects have not reported any additional incidents of unauthorized use of their personal information.23

Finally, Evolution alleges that all members who interacted with JY were immediately notified of the possible breach by a service call and/or written notice between July to August 2018.24

On 11 April 2023, the CID issued an Order directing Evolution to submit, within ten (10) days from receipt, additional information and/or documentation, on the following:

  1. Proof of receipt of notification sent to all affected data subjects; and

  2. Proof of actions taken to coordinate with affected data subjects and/or third-party merchants where the unauthorized transactions were made.

  3. Report on the results internal investigation conducted on JY

  4. Actions taken against JY.

  5. Proof of actions taken to retrieve any personal data which may have been unlawfully processed by JY.25

On 12 May 2023, in compliance with the Order dated 11 April 2023, Evolution submitted additional documents,26 including (i) the same investigation report attached to the Full Incident Report which now includes screenshots of CCTV footages that appear to evidence JY’s malicious acts; and (ii) a termination letter addressed to JY stating that he is dismissed as of 03 September 2018.27

On 30 May 2023, the CID issued an Order directing Evolution to provide the information it failed to include in its previous submission.28 Specifically, Evolution was asked to submit the following:

  1. Proof of receipt of notification sent to all affected data subjects; and

  2. Proof of actions taken to coordinate with affected data subjects and/or third-party merchants where the unauthorized transactions were made.29

On 02 June 2023, Evolution filed a Motion for Extension of Time to Submit Requested Documents, wherein Evolution prayed for an additional five days, or until 09 June 2023, within which to comply with the Order of the Commission dated 30 May 2023.30

On 05 June 2023, Evolution submitted its Compliance with the Order dated 30 May 2023 containing two notarized affidavits with annexes.31 These notarized affidavits were executed by (i) MBF, who was the Club Manager of Fitness First Manila from 2017-2019 and is currently the Club General Manager of Fitness First Aura;32 and (ii) RKH (RKH), who was the Front of House Manager of Fitness First Manila from 2015-2019, and has been the Club Manager of Fitness First Manila from 2019 to the present.33

In MBF’s notarized affidavit, he indicated, among others, that Evolution sent data breach notifications to the affected data subjects:34

  1. Sometime between July to August 2018, we sent out data breach notices to the affected Fitness First members, informing them of the situation and the steps we took to remedy the same, specifically:

8.1. That the breach incident involved unauthorized access to personal data, potentially including names, contact information, membership details, and payment card information.

8.2. To address the breach, we conducted service calls to inform and guide affected data subjects.

8.3. Measures were taken to reduce harm and enhance data protection protocols.

8.4 Our representative can be contacted for additional information.

8.5. We advised affected individuals to dispute any fraudulent transactions with their banks.

8.6. We remain committed to transparency, accountability, and assisting affected data subjects.

  1. We had the affected members acknowledge receipt of these notices. We have conducted a diligent search for these receipts but have so far been unable to locate the same within the limited amount of time since we received the order of the National Privacy Commission (“NPC”) to produce it. We beg the indulgence of the NPC to give us more time as it has been almost five (5) years since the acknowledgement receipts were executed.35

RKH notarized affidavit affirmed that Evolution indeed sent notifications to the affected data subjects, and elaborated on the contents of the notifications:36

  1. Pursuant to our obligations under the DPA, the Company made diligent efforts to fulfill its responsibilities in safeguarding personal data. In this regard, appropriate measures were taken to notify the affected clients of a potential data breach and the subsequent actions implemented to rectify the situation. These notices contain:

12.1. Nature of the breach - The breach incident involved unauthorized access to personal data within our system. Although specific details of the breach have been addressed and contained, it is essential to note that it encompassed the unauthorized acquisition of personal information by an individual.

12.2. Personal data possibly involved - The breach may have exposed various personal data, which could include but is not limited to names, contact information, membership details, and payment card information of the affected data subjects.

12.3. Measures taken to address the breach - In response to the breach, we implemented immediate measures to address the situation. One of the primary steps taken was to establish a service call to directly communicate with the affected data subjects. Through this service call, we aimed to provide them with timely information about the incident and guidance on how to review their transactions and validate their data for potential discrepancies.

12.4. Measures taken to reduce harm or negative consequences - Our priority is to minimize the potential harm and negative consequences resulting from the breach We have taken appropriate actions to enhance our security protocols and strengthen our data protection measures. This includes reinforcing staff training on data privacy and implementing additional safeguards to prevent future incidents.

12.5. Representative of the personal information controller - Our designated representative, who serves as the contact person for data subjects seeking additional information regarding the breach, can be reached through the club’s official contact channels. These channels provide direct access to the representative who can address any queries or concerns related to the breach incident.

12.6 Assistance provided to affected data subjects - We understand the importance of providing assistance to the affected data subjects. In this regard, we promptly advised them to dispute any potentially fraudulent transactions with their respective banks or financial institutions. By taking this action, we aimed to support the affected individuals in rectifying any unauthorized financial activities resulting from the breach.37

Issue

I. Whether the matter falls under mandatory breach notification; and

II. Whether Evolution has sufficiently complied with the Order dated 30 May 2023, including the implementation of reasonable and appropriate security measures.

Discussion

The Commission finds that Evolution has sufficiently complied with the Order dated 30 May 2023. Further, the Commission notes that although the matter falls under Mandatory Breach Notification, the affected data subjects were already sufficiently notified in accordance with NPC Circular 16-03 (Personal Data Breach Management), and that Evolution has implemented reasonable and appropriate security measures to address the breach and prevent a recurrence of the incident. As such, the Commission resolves to close the matter.

I. The breach falls under Mandatory Breach Notification.

Section 11 of NPC Circular 16-03 provides the conditions when notification is mandatory:

Sec. 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

B. There is reason to believe that the information may have been acquired by an unauthorized person; and

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.38

As to the first element, the Full Incident Report indicated that the information involved included the names and credit card information of the data subjects. On the other hand, the affidavit submitted by RKH indicated that the breach may have exposed various personal data, which could include but is not limited to names, contact information, membership details, and payment card information of the affected data subjects.39 These pieces of information are such that, under the circumstances, may be used to commit identity fraud against the affected data subjects. In fact, said pieces of information were already utilized to commit identity fraud, resulting to the fraudulent transactions made in the names of the data subjects. As such, the first element is present.

As to the second element, there is not only reason to believe, but absolute certainty that the information has been acquired by an unauthorized person. It has been established that JY acquired the information of the data subjects, which led to their financial loss. The investigation report submitted by Complainant concluded, among others that JY “was caught recording, copying, capturing and collecting data of the members without their consent including sensitive and confidential information”.40 Thus, the second element is also present.

As to the third element, as was previously discussed, the data subjects already experienced serious harm through the fraudulent transactions made in their name. Again, there is certainty that the unauthorized acquisition gives rise to a real risk of serious harm. The third element, therefore, is also present.

Since all the elements are present, the matter falls under Mandatory Breach Notification. However, as will be further discussed, the Commission finds that Evolution already sufficiently notified the affected data subjects.

II. Evolution sufficiently notified the data subjects who were affected by the breach.

Section 18 of NPC Circular 16-03 provides for the required contents and form of the notification to the affected data subjects.

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.41

In its Full Incident Report, Evolution indicated that all members who interacted with JY were immediately notified of the possible breach by a service call and/or written notice within July to August 2018.42

It is notable that in the notarized affidavit of RKH, the notifications are consistent with the required contents prescribed by Section 18 (C). To reiterate, RKH indicated that the notification to the affected data subjects included the (i) nature of the breach; (ii) personal data possibly involved; (iii) measures taken to address the breach; (iv) measures taken to reduce harm or negative consequences; (v) representative of the personal information controller; and (vi) assistance provided to the affected data subjects.43

In addition, Evolution has implemented reasonable and appropriate organizational, physical, and technical measures to address the breach and prevent its recurrence.

Relative to a personal information controller’s (PIC) duty to implement measures to protect personal information, Section 20 (a) of the Data Privacy Act of 2012 (DPA) provides:

Sec. 20. Security of Personal Information.

a. The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.44

In its Full Incident Report, Evolution indicated that it undertook measures to address the breach and to prevent recurrence. Among others, these measures included: (i) conducting an internal investigation, (ii) notifying the data subjects who interacted with JY; (iii) terminating the employment of JY; (iv) changing its official policy instructions which includes new policies and procedures on the “Add Member Process” and “Change Payment Details;” (v) implementing an updated “Payment Card Industry Data Security Standard” covering several key protocols; and (vi) the holding of Data Privacy Seminars as part of each employee’s orientation process.45

The “Payment Card Industry Data Security Standard” to be implemented includes key protocols including: (i) email confirmation for card enrolment; (ii) bank’s notification to cardholder for every successful charge; (iii) CCV and 3DS switch on; (iv) prohibition of writing/scanning/photocopying/capturing/embossing or any other method of recording full card details; (v) requiring that payment card details to be entered unto the system by the cardholder only; (vi) requiring an OTP/TAC number from the cardholder to complete the authentication process; (vii) credit card plan will show integrated online enrolment form for instant validation result and successful tokenized card details will be displayed at payment details page; (viii) card enrolment email will be sent to member for each addition or change event; and (ix) installation of privacy filter protector screen on workstations use for the adding of new members and the updating of credit card details.46

Considering the reasonable and appropriate measures Evolution has taken to address and prevent the breach, and the fact that Evolution has sufficiently notified the affected data subjects, the Commission resolves to consider the matter closed.

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-147 “In re: Evolution Wellness Philippines, Inc.” is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines. 17 October 2024.

SGD

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

SGD

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

SGD

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

AV Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Initial Report dated 03 August 2018 of Evolution Wellness Philippines, Inc. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Initial Report dated 03 August 2018 of Evolution Wellness Philippines, Inc. ↩

  6. Id. ↩

  7. Id. ↩

  8. In re: Evolution Philippines Wellness Inc., NPC BN 18-147, Order 08 October 2020. ↩

  9. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Attachments to the Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  22. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  23. Id. ↩

  24. Id. ↩

  25. In re: Evolution Philippines Wellness Inc., NPC BN 18-147, Order 11 April 2023. ↩

  26. Compliance dated 12 May 2023 of Evolution Wellness Philippines, Inc. ↩

  27. Id. ↩

  28. In re: Evolution Philippines Wellness Inc., NPC BN 18-147, Order 30 May 2023. ↩

  29. Id. ↩

  30. Motion for Extension of Time to Submit Requested Documents dated 12 May 2023 of Evolution Wellness Philippines, Inc. ↩

  31. Compliance dated 12 May 2023 of Evolution Wellness Philippines, Inc. ↩

  32. Affidavit of MBF dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  33. Affidavit of RKH dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  34. Affidavit of MBF dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  35. Id. ↩

  36. Affidavit of RKH dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  37. Id. ↩

  38. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 11 [NPC Circ. 16-03] (2016). ↩

  39. Affidavit of RKH dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  40. Attachments to the Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  41. NPC Circular 16-03, rule V, § 18. ↩

  42. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  43. Affidavit of RKH dated 05 June 2023 of Evolution Wellness Philippines, Inc. ↩

  44. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20 (2012). ↩

  45. Full Incident Report dated 22 October 2022 of Evolution Wellness Philippines, Inc. ↩

  46. Id. ↩

Backlinks

  • No backlinks found