1. Who we are
We operate this clinic management platform. Under the Data Privacy Act of 2012 (RA 10173), each clinic is the personal information controller of its patients' data, and we act as the personal information processor on that clinic's instructions.
2. What we collect
- Clinic accounts: name, email, phone, address, and staff account details.
- Patients (entered by the clinic or submitted through its booking page): name, birthdate, sex, contact details, and appointment information.
- Medical information: visit notes, diagnoses, and prescriptions recorded by the clinic's doctors — this is sensitive personal information under the Act.
- Billing: amounts, payment methods, and official receipt numbers.
- Payment proofs: receipts a clinic uploads for manual subscription payments.
3. How we use it
Only to provide the service: running your clinic's records, appointments, and billing; sending booking confirmations; processing your subscription; and providing support. We do not sell personal information, and we do not use patient data for advertising.
4. Separation between clinics
Every clinic's data is isolated. Staff of one clinic cannot see another clinic's patients or records. Our staff access clinic data only when necessary for support or to comply with the law.
5. Sharing
We share data only with service providers needed to run the platform — our hosting provider and our payment processor (Stripe, for card payments). We do not send patient medical information to our payment processor. We may disclose information where required by a lawful order.
6. Security
Passwords are hashed, traffic is encrypted in transit, payment receipts are stored privately rather than on public URLs, and card details are handled by our payment processor — we never store full card numbers. Databases are backed up regularly.
7. Retention
We retain clinic data for as long as the account is active. On closure, we keep it only as long as necessary for legal and accounting purposes, then delete it. Clinics remain responsible for the retention periods that apply to medical records under Philippine law.
8. Your rights
Under RA 10173, data subjects may be informed about, access, correct, object to the processing of, erase, and obtain a copy of their personal data, and may claim damages for violations. Patients should contact their clinic first, as the clinic controls their record. Clinics may contact us using the details below.
9. Contact
For privacy questions or requests, contact us using the details in the footer of this page. You may also lodge a complaint with the National Privacy Commission (privacy.gov.ph).