Medsync Digital Technologies Inc. (hereinafter also referred to as “the Company” or MDTI for brevity) through Health Bio Online (the “Platform”) is committed to fully protect your personal data privacy in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).
This Privacy Notice details the manner in which MDTI stores, uses, shares, protects and disposes of personal information through Health Bio Online (the “Service”), and how you may exercise your rights as a Data Subject under Republic Act No. 10173, or the Data Privacy Act of 2012 (“DPA”), its Implementing Rules and Regulations (“IRR”), and issuances of the National Privacy Commission (“NPC”). A separate privacy notice in an appropriate format and manner will be provided whenever we collect personal data through other channels.
In all instances, we assure you that processing your personal data will strictly follow the provisions of DPA, especially the general data privacy principles of transparency, legitimate purpose, and proportionality.
Who We Are and How to Contact Our Data Protection Officer
Personal Information Controller (PIC) – Medsync Digital Technologies Inc. (MDTI)
SEC Registration No. 2024090167618-06
Principal Office - Unit 815 Central Bloc Tower 1, V. Padriga St, Cebu IT Park, Apas, Cebu City, Cebu
Data Protection Officer: Marianyl I. Orlain / dpo@healthbio.online / 09176228703
Scope of Privacy Notice
This Privacy Notice is for the Health Bio Online websites, mobile applications, software, and all related features and services that enables the platform to store and process your personal information.
The Privacy Notice applies to Patients, Legal Representatives, Authorized Users, Medical Doctors, and Medical Doctor’s Assistants. With respect to Clinical Records, each Medical Doctor is a separate PIC, and the Company processes those records on the Medical Doctor’s behalf (see Section 7 of Part One). Medical Doctors are responsible for providing their own privacy notices to their Patients where required and may adopt this Privacy Notice for that purpose to the extent applicable.
Personal Information You can Store
| Category | Examples | Source |
|---|---|---|
| Account and identity information | Name, date of birth, sex, e-mail address, mobile number, address, username, password (hashed), profile photo, government-issued ID used for verification¹ | You or your Legal Representative |
| Health Data (sensitive personal information) | Medical history, consultation notes, diagnoses, laboratory and imaging results, prescriptions, vaccination records, allergies, vital signs, medical certificates, health insurance and PhilHealth information | You, your Legal Representative, Medical Doctors you authorize, Healthcare Facilities you authorize |
| Legal Representative information | Name, relationship to the Patient, proof of authority (birth certificate, guardianship order, SPA) | The Legal Representative |
| Medical Doctor professional information | PRC license number and validity, PTR number, S2 license, specialty, clinic and Healthcare Facility affiliation, professional fees, schedule | The Medical Doctor; PRC online verification |
| Tele-consultation data | Appointment details, chat messages, shared files, session metadata | Patient and Medical Doctor |
| Transaction information | Plan subscribed, amounts paid, transaction reference numbers, billing name; the Company does not store full card numbers | You; payment service providers |
| Device and usage information | IP address, device type, operating system, app version, log-in times, access logs, crash reports, cookies and similar identifiers | Automatically collected by the Service |
| Communications | Support tickets, feedback, privacy requests, survey responses | You |
| Advertising preferences | Opt-in or opt-out status; non-sensitive interest categories (only if you opt in) | You; the Service |
¹ Government-issued ID numbers are sensitive personal information and are collected only for identity verification, retained only as long as necessary for that purpose, and never displayed in full to other users.
We do not require you to provide more information than is necessary for the purpose for which it is collected. Fields that are optional will be marked as such.
Purposes and Lawful Bases for Processing
We process personal information only for the declared, specified and legitimate purposes below, and on the lawful bases under Section 12 (for personal information) and Section 13 (for sensitive personal information) of the DPA:
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Create, verify and administer your Account | Account and identity; Legal Representative information | Contract (Sec. 12(b)); for government ID: Consent (Sec. 13(a)) |
| Store, organize and display your Health Data to you | Health Data | Consent (Sec. 13(a)) |
| Share Health Data with Medical Doctors and other Authorized Users you designate | Health Data (only the categories you select) | Consent, specific to each grant (Sec. 13(a)) |
| Enable Medical Doctors to provide consultation, diagnosis and treatment, including Teleconsultations, e-prescriptions and medical certificates | Health Data; Teleconsultation data | Medical treatment by a medical practitioner with adequate protection (Sec. 13(e)); Consent (Sec. 13(a)) |
| Emergency access where the Patient cannot give Consent | Health Data (minimum necessary) | Protection of life and health (Sec. 13(c)) |
| Verify Medical Doctor credentials | Professional information | Contract (Sec. 12(b)); legal obligation and legitimate interest in patient safety (Sec. 12(c), 12(f)) |
| Process payments and issue official receipts | Transaction information | Contract (Sec. 12(b)); legal obligation under tax laws (Sec. 12(c)) |
| Secure the Service, maintain audit logs, detect and prevent fraud and unauthorized access | Device and usage information; access logs | Legal obligation to implement security measures (Sec. 12(c), Sec. 20); legitimate interest (Sec. 12(f)) |
| Respond to inquiries, support requests and privacy requests | Communications; Account information | Contract (Sec. 12(b)); legal obligation (Sec. 12(c)) |
| Improve the Service using aggregated or de-identified statistics | Usage information; de-identified data | Legitimate interest (Sec. 12(f)), assessed under NPC Circular No. 2023-07; Health Data is used only if de-identified so that individuals are no longer identifiable |
| Show contextual advertisements | None personal beyond technical data needed to serve the ad | Legitimate interest (Sec. 12(f)) |
| Show personalized advertisements (never using Health Data) | Non-sensitive profile and in-app activity | Separate opt-in Consent (Sec. 12(a)) |
| Send promotional messages and newsletters | Contact details | Separate opt-in Consent (Sec. 12(a)) |
| Comply with laws, lawful orders and regulatory requirements; establish, exercise or defend legal claims | As required | Legal obligation (Sec. 12(c), Sec. 13(b)); legal claims (Sec. 13(f)) |
We will not process your personal information for a purpose incompatible with those stated above. If we intend to process it for a new purpose, we will inform you beforehand and, where required, obtain your Consent.
How We Obtain and Record Consent
In accordance with NPC Circular No. 2023-04 (Guidelines on Consent) and NPC Advisory No. 2023-01 (Guidelines on Deceptive Design Patterns):
(a) Consent is requested separately from acceptance of the Terms, and separately for each purpose (see Annex A). Consent boxes are never pre-ticked.
(b) Refusing optional Consents (such as personalized advertising or marketing) will not prevent you from using the basic features of the Service.
(c) Each Consent is recorded with the date, time, version of this notice and the Account that gave it.
(d) You may withdraw Consent at any time, as easily as you gave it, through Settings > Privacy or by contacting the DPO. Withdrawal does not affect the lawfulness of processing before withdrawal, or processing based on another lawful basis (for example, a Medical Doctor’s legal obligation to retain Clinical Records). Withdrawing Consent to core Health Data storage means we can no longer provide the Service to you, in which case we will help you download your data.
Minors and Patients Lacking Capacity
Health Bio as a service is not directed at persons below eighteen (18) years of age acting on their own. Personal information of a Minor Patient or a Patient Lacking Capacity is processed only with the Consent of the Legal Representative, who exercises the Data Subject’s rights on the Patient’s behalf. We apply heightened safeguards to such data and consistent with NPC Advisory No. 2024-03 (Guidelines on Child-Oriented Transparency), make available a simplified, age-appropriate explanation of how a child’s information is used. We do not use the personal information of minors for personalized advertising or marketing under any circumstances.
Who We Share Your Information With
We do not sell or rent your personal information. The Platform only stores, organizes and enables authorized access to medical records and other health information, as authorized by the user as follows:
(a) Medical Doctors, Medical Doctor’s Assistants and other Authorized Users — only those you (or your Legal Representative) designate, only for the categories, purpose and period you select, and until you revoke access.
(b) Healthcare Facilities and laboratories — only at your direction (for example, to receive results into your Account).
(c) Service providers acting as our Personal Information Processors — such as cloud hosting, data storage, video-conferencing, SMS and e-mail delivery, customer support and IT security providers, bound by outsourcing agreements that comply with Section 14 of the DPA and Sections 43 to 45 of the IRR, and that require them to process data only on our instructions and to maintain appropriate security.
(d) Payment service providers — to process your payments, as independent PICs under their own privacy policies and BSP regulations.
(e) Government agencies, courts and regulators — only when required by law, regulation or a lawful order (for example, the NPC, DOH, PhilHealth, Bureau of Internal Revenue, or courts), and only to the extent required.
(f) Advertisers — aggregated and de-identified advertisement performance reports only. Advertisers never receive information that identifies you, and never receive Health Data.
(g) Successors — in the event of a merger, acquisition, or sale of a part or all of the Company’s assets, subject to prior notice to you, continued protection under this Privacy Notice, and the requirements of the DPA.
Where we share personal information with another PIC under a data sharing arrangement, we will do so in accordance with NPC Circular No. 2020-03 (Data Sharing Agreements), as clarified by NPC Advisory No. 2025-01.
Cross-Border Transfers
Some of our service providers (such as cloud hosting providers) may store or process personal information outside the Philippines, including Singapore. Under Section 21 of the DPA, the Company remains responsible for personal information transferred to third parties, including those abroad. We protect such transfers through contractual safeguards, including the NPC Model Contractual Clauses under NPC Advisory No. 2024-01 or equivalent measures, and require recipients to provide a comparable level of protection.
How Long We Keep Your Information
We retain personal information only for as long as necessary to fulfill the declared purposes, or as required by law, after which it is securely deleted, destroyed or anonymized:
| Category | Retention Period |
|---|---|
| Account and identity information | While the Account is active. |
| Government ID used for verification | Deleted within (30 days) after verification is completed, except the verification result |
| Patient-uploaded Health Data | While the Account is active; deleted within 30 days after Account closure unless you ask us to transfer it |
| Clinical Records | For the period required of the Medical Doctor or Healthcare Facility under DOH, PRC and other applicable regulations. |
| Teleconsultation recordings (if Consented) | 30 days, unless a longer period is required by law or the Patient requests earlier deletion |
| Transaction and billing records | Ten (10) years, as required under the National Internal Revenue Code and BIR regulations |
| Audit and access logs | While the Account is active. |
| Advertising and marketing preferences | Until you withdraw Consent or close your Account |
How We Protect Your Information
We implement organizational, physical and technical measures consistent with Section 20 of the DPA and NPC Circular No. 2023-06, including: encryption of data in transit and at rest; role-based and least-privilege access controls; multi-factor authentication; comprehensive audit logging; regular vulnerability assessments and penetration testing; secure software development practices consistent with NPC Advisory No. 2025-02 (Privacy Engineering); background checks, confidentiality agreements and regular privacy training for personnel; business continuity and disaster recovery plans; and a documented breach management and incident response procedure. We conduct Privacy Impact Assessments for processing systems involving Health Data.
Automated Processing, Profiling and Artificial Intelligence
The Platform does not make decisions that produce legal or similarly significant effects on you (such as medical diagnoses or eligibility determinations) based solely on automated processing. Where the Platform uses automated tools or artificial intelligence features (for example, to organize or summarize records, or to suggest appointment slots), we will inform you in the Platform, ensure human oversight by the Medical Doctor for any clinical use, and comply with NPC Advisory No. 2024-04 (Application of the DPA to Artificial Intelligence Systems) and the automated decision-making notification requirements of NPC Circular No. 2022-04. We will not use identifiable Health Data to train artificial intelligence models without your separate, specific Consent.
Your Rights as a Data Subject
Under Sections 16 to 18 of the DPA and Rule VIII of the IRR, you have the following rights:
| Right | What it means |
|---|---|
| Right to be informed | To be told whether, how and why your personal information is being processed, including through this Privacy Notice. |
| Right to object | To object to processing, including processing for direct marketing, profiling or personalized advertising, and processing based on legitimate interest. |
| Right to access | To obtain reasonable access to your personal information, the sources, recipients, manner and reasons of processing, and the date it was last accessed or modified. The Service’s access log shows who viewed your Health Data. |
| Right to rectification | To have inaccurate or incomplete personal information corrected. Corrections to Clinical Records are coordinated with the authoring Medical Doctor, who may annotate rather than delete the original entry where required by professional standards. |
| Right to erasure or blocking | To suspend, withdraw, block, remove or destroy personal information that is incomplete, outdated, false, unlawfully obtained, no longer necessary, or processed without authority, subject to legal retention requirements. |
| Right to data portability | To obtain a copy of your personal information in an electronic, structured and commonly used format that allows further use. |
| Right to damages | To be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information. |
| Right to file a complaint | To lodge a complaint with MDTI (dpo@healthbio.online) |
| Transmissibility of rights | Your lawful heirs and assigns may invoke your rights upon your death or incapacity. |
How to exercise your rights. Use the in-app privacy tools or contact our DPO at dpo@healthbio.online. We may ask you to verify your identity (or your authority, if you are a Legal Representative) before acting on a request. We will respond without undue delay and within 15 working days from receipt of a complete request, extendible once by the same period for complex requests, with notice to you. Requests are free of charge, except that a reasonable fee may be charged for manifestly excessive or repetitive requests, as allowed by law.
Personal Data Breach Notification
If a Personal Data Breach occurs that is likely to give rise to a real risk of serious harm to you, we will notify you and the NPC within seventy-two (72) hours upon knowledge of or reasonable belief that the breach occurred, in accordance with NPC Circular No. 16-03, as amended. The notification will describe the nature of the breach, the information involved, the measures we have taken, the steps you can take to protect yourself, and how to reach our DPO.
Changes to this Privacy Notice
We will notify you of material changes to this Privacy Notice through the Service and by e-mail at least thirty (30) days before they take effect, and obtain fresh Consent where required. The version number and effective date at the top of this document identify the current version. Previous versions are available upon request.
Contact Us
For questions, concerns or requests about this Privacy Notice or your personal information, contact our Data Protection Officer: Marianyl I. Orlain / dpo@healthbio.online / 09176228703 or Medsync Digital Technologies Inc. (MDTI) Address: Unit 815 Central Bloc Tower 1, V. Padriga St, Cebu IT Park, Apas, Cebu City, Cebu.
Effective: October 5, 2026