PRELIMINARY PROVISIONS
Section 1. Agreement
These Terms and Conditions of Use (“Terms”) constitute a binding agreement between you and Medsync Digital Technologies Inc., a corporation duly organized and existing under the laws of the Republic of the Philippines (the “Company,” “we,” “us,” or “our”), governing your access to and use of the Health Bio Online (“HBO”) websites, mobile applications, software, and all related features and services (collectively, the “Platform” or “Service”).
The Platform stores, organizes and enables authorized access to medical records and other health information, and facilitates related services such as medical teleconsultations, doctor scheduling, and the electronic issuance by Medical Doctors of prescriptions, medical certificates and similar documents.
Section 2. Acceptance
You accept these Terms by clicking or tapping “I Agree” (or a similar button) at registration, or when these Terms are presented to you after an amendment. Acceptance of these Terms is separate and distinct from the consents you may give for the processing of your personal information, which are obtained through the separate consent screens described in the Privacy Notice (Part Two) and reproduced in Annex A. Your acceptance is an electronic document and electronic signature recognized under Republic Act No. 8792, or the Electronic Commerce Act of 2000.
If you do not agree to these Terms, do not create an Account or use the Platform.
Section 3. Order of Precedence
These Terms, the Privacy Notice, the Consent Forms (Annexes A and B), and, for Medical Doctors, the Medical Doctor’s Undertaking (Annex C), form one integrated agreement. In case of conflict on any matter involving personal information, the Privacy Notice and applicable data privacy law shall prevail. Where separate terms are expressly stated to apply to a particular feature, those separate terms shall govern that feature.
RULE I — GENERAL PROVISIONS
Section 4. Definition of Terms
For purposes of these Terms and the Privacy Notice, the following terms shall mean:
(a) “Account” — a user account created to access the Service, whether a Patient Account or a Medical Doctor Account.
(b) “Patient Account” — an Account created by or for a Patient to store and manage the Patient’s own Health Data. A Medical Doctor may also hold a Patient Account for his or her own health records.
(c) “Medical Doctor Account” — an Account available only to a physician holding a valid and subsisting license issued by the Professional Regulation Commission (“PRC”), after verification by the Company.
(d) “Authorized User” — a person granted access to a Patient’s Health Data by the Patient or the Patient’s Legal Representative through the Service’s access-permission tools, including a Medical Doctor or Medical Doctor’s Assistant.
(e) “Consent” — any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of his or her personal information, evidenced by written, electronic or recorded means, as defined in Section 3(b) of the DPA and NPC Circular No. 2023-04 (Guidelines on Consent).
(f) “Data Subject” — an individual whose personal information is processed through the Service.
(g) “Healthbio”, healthbio online, Healthbio.online – is a health data platform that is a channel where users can log in, store data or content or complete transactions,
(h) “Health Data” — personal information about an individual’s health, including medical records, consultation notes, reports, images, laboratory results, prescriptions, diagnoses, treatment plans, billing and health insurance information, and other health information stored or processed through the Service. Health Data is sensitive personal information under Section 3(l) of the DPA.
(i) “Healthcare Facility” — a hospital, clinic, laboratory or other health facility duly licensed by the Department of Health (“DOH”) or other competent authority.
(j) “Legal Representative” — a parent exercising parental authority over a Minor Patient, a judicially appointed guardian, or any other person authorized by law, by a court, or by a valid written authority (such as a special power of attorney) to act on behalf of a Patient.
(k) “Medical Doctor” — a physician duly licensed by the PRC who holds a verified Medical Doctor Account.
(l) “Medical Doctor’s Assistant” — a secretary, nurse, assistant or other staff designated by a Medical Doctor through the Service to perform limited functions on the Medical Doctor’s behalf, regardless of the nature of their employment or engagement.
(m) “Minor Patient” — a Patient below eighteen (18) years of age.
(n) “Patient” — a natural person whose Health Data is stored in or accessible through the Service.
(o) “Patient Lacking Capacity” — a Patient eighteen (18) years of age or older who, by reason of a physical or mental condition, is unable to give valid consent, as determined under applicable law or by a competent physician or court.
(p) “Personal Data Breach” — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
(q) “Personal Information,” “Sensitive Personal Information,” “Processing,” “Personal Information Controller” (“PIC”) and “Personal Information Processor” (“PIP”) — shall have the meanings given to them under the DPA and its IRR.
(r) “Premium Services” — paid features of the Service, including teleconsultations and storage or functions beyond the free allocation.
(r) “Teleconsultation” — a remote medical consultation between a Patient and a Medical Doctor conducted through the Service.
Section 5. Scope
The Platform is a channel for repository and access of Health Data. It provides tools for uploading, storing, retrieving, and sharing Health Data; granting, reviewing and revoking access permissions; audit logging; basic record management; appointment scheduling; and, for Premium Services, a venue for Teleconsultations between Patients and Medical Doctors.
Each Account has a dashboard and features appropriate to its Account type and chosen plan. Basic features are free of charge within the applicable data allocation. Use beyond the free allocation, and Premium Services, are subject to the fees disclosed in the Service before purchase (see Rule V).
Section 6. No Medical Advice; Not for Emergencies
The Company is a technology service provider. The Company does not practice medicine, does not provide medical diagnosis or treatment, and does not employ, supervise, or control the clinical judgment of Medical Doctors. All medical advice, diagnoses, prescriptions, medical certificates and treatment plans are rendered solely by the Medical Doctor concerned, who remains an independent professional.
The Platform is not designed for emergencies. If you or another person is experiencing a medical emergency, proceed immediately to the nearest hospital.
Section 7. Roles of the Parties Under the Data Privacy Act
For transparency and proper allocation of accountability under the DPA:
(a) The Company acts as a Personal Information Controller with respect to Account registration data, identity and credential verification data, payment and transaction data, device and usage data, communications with the Company, and Health Data that Patients (or their Legal Representatives) upload to their own Patient Accounts.
(b) Each Medical Doctor acts as a Personal Information Controller with respect to the Health Data he or she collects, creates or records in the course of consulting with, diagnosing or treating a Patient, including clinical notes, chart notes, diagnoses, treatment plans, prescriptions and medical certificates (“Clinical Records”).
(c) The Company acts as a Personal Information Processor of each Medical Doctor with respect to Clinical Records, processing them only on the Medical Doctor’s documented instructions as set out in these Terms and in the Medical Doctor’s Undertaking (Annex C), which shall serve as the outsourcing agreement required under Section 14 of the DPA and Sections 43 to 45 of the IRR.
(d) Where Health Data is shared between a Patient and a Medical Doctor, or between Medical Doctors, at the Patient’s direction, each recipient becomes responsible as a PIC for his or her own subsequent processing of that data.
Section 8. Ownership and Licenses
Patient Health Data. Patients retain all rights over the Health Data they upload. By uploading, or authorizing the upload of, Health Data, the Patient grants the Company a limited, non-exclusive, royalty-free, revocable license to host, store, reproduce, transmit and display such Health Data solely for the purpose of providing the Service to the Patient and to the Authorized Users the Patient designates, including backup, disaster recovery and security operations. This license does not permit the Company to sell, rent, or use Health Data for advertising, and ends when the Health Data is deleted in accordance with the Privacy Notice, subject to legally required retention.
Clinical Records. Clinical Records remain the professional records of the Medical Doctor who created them, without prejudice to the Patient’s rights as a Data Subject, including the rights to access, obtain and retain a copy of his or her Health Data under Sections 16 and 18 of the DPA and applicable DOH and professional regulations.
Company Materials. All rights in the Service, including software, designs, text, logos, trademarks and trade names, belong to the Company or its licensors and are protected under Republic Act No. 8293, or the Intellectual Property Code of the Philippines. You are granted a limited, non-transferable, non-exclusive, revocable license to use the Service in accordance with these Terms.
RULE II — ELIGIBILITY, ACCOUNTS AND REPRESENTATION
Section 9. Eligibility
You may create an Account in your own name only if you are at least eighteen (18) years of age and have the legal capacity to enter into a binding contract. Every Account is a Patient Account unless and until the holder is verified as a Medical Doctor under
Rule IV.
Section 10. Accounts Managed on Behalf of Another Person
A Legal Representative may create and manage a Patient Account on behalf of a Minor Patient or a Patient Lacking Capacity. An adult Patient who has capacity may authorize a family member or other trusted person (such as a spouse, adult child or caregiver) to manage his or her Patient Account through the Service’s delegation feature, in which case the Patient’s own Consent is obtained and recorded.
A person who creates, accesses or manages an Account on behalf of another represents and warrants that he or she: (i) is the Legal Representative of, or has been validly authorized by, the Patient concerned; (ii) will act in the Patient’s best interest; and (iii) will give or withhold Consent on the Patient’s behalf only within the scope of that authority.
Such is without prejudice to the Company’s right to implement reasonable verification measures proportionate to the risk, which may include requesting a birth certificate, proof of guardianship, special power of attorney or valid identification. The Company may suspend or restrict an Account where it has reasonable grounds to believe the claimed authority does not exist.
When a Minor Patient reaches eighteen (18) years of age, or when a Patient Lacking Capacity regains capacity, the Patient may assume control of the Account. The Company will notify the Account holder and provide a mechanism for the transfer of control, after which the former representative’s access shall continue only if the Patient consents.
Section 11. Accuracy of Representations
You are responsible for the truth and accuracy of the information and authority you represent to the Company. To the extent permitted by law, the Company shall not be liable for loss or damage arising solely from a user’s misrepresentation of identity, authority or professional credentials, provided that the Company has observed the verification and security measures required of it under these Terms and applicable law. Nothing in this Section limits the Company’s own obligations as a PIC or PIP under the DPA.
RULE III — RIGHTS, DUTIES AND RESPONSIBILITIES OF PATIENTS
Section 12. Control Over Access and Sharing
The Platform provides tools that allow a Patient or Legal Representative to grant, view, modify, limit and revoke access to Health Data, and to view an access log showing who accessed the Patient’s records and when.
When a Patient grants a Medical Doctor access to his or her Health Data, the Platform will display, before confirmation: the identity of the Medical Doctor, the categories of Health Data to be shared, the purpose of access, and the duration of access. The Patient’s confirmation through the Service constitutes Consent to that specific sharing, which shall be recorded and time-stamped.
Access granted to a Medical Doctor continues until the earlier of: (i) the expiry of the period selected by the Patient; or (ii) revocation by the Patient. The Patient may revoke access at any time directly within the Service, without needing to contact the Company. Revocation does not affect processing done before revocation, nor the Medical Doctor’s obligation to retain Clinical Records already created as required by law.
Section 13. Patient Responsibilities
To protect your Health Data and other users, you agree to:
(a) Accuracy and authority — provide true, accurate and complete information, and upload only Health Data that pertains to you or that you are legally authorized to upload and share;
(b) Account security — keep your credentials confidential, use a strong password, enable two-factor authentication, and notify the Company immediately of any suspected unauthorized use of your Account or loss of credentials;
(c) Permission management — review the access permissions you have granted regularly, and revoke access promptly when no longer needed;
(d) Lawful use — not use the Service to store or transmit unlawful, infringing or malicious content, or the personal information of others without lawful authority; and
(e) Incident reporting — notify the Company through dpo@healthbio.online or the in-app reporting tool as soon as you become aware of any actual or suspected unauthorized access to, or disclosure of, your Health Data.
RULE IV — RIGHTS, DUTIES AND RESPONSIBILITIES OF MEDICAL DOCTORS
Section 14. Credentialing and Verification
A Medical Doctor Account shall be activated only after the Company verifies the applicant’s identity and PRC license, and such other credentials as the Company may reasonably require (e.g., specialty board certification, PTR number). The Medical Doctor warrants that all information submitted is true, correct and current, and shall promptly update it upon any change, suspension or revocation.
The Company may re-verify credentials at any time and may suspend or deactivate a Medical Doctor Account upon discovery of any misrepresentation, lapse, suspension or revocation of license, or any regulatory or disciplinary action affecting the Medical Doctor’s authority to practice.
Section 15. Medical Doctors as Personal Information Controllers
Each Medical Doctor is independently responsible, as a PIC, for complying with the DPA, its IRR, NPC issuances, the Code of Ethics of the Medical Profession, the Philippine Medical Act of 1959 (Republic Act No. 2382), and applicable DOH and PRC rules on telemedicine and medical records, including the DOH–NPC Joint Memorandum Circular No. 2020-0001 and the DOH–UP Manila Joint Memorandum Circular No. 2020-0001 (Telemedicine Practice Guidelines), as amended or superseded.
Each Medical Doctor shall execute the Medical Doctor’s Undertaking and Data Privacy Acknowledgment (Annex C) as a condition for activation of a Medical Doctor Account.
Section 16. Medical Doctor’s Assistants
A Medical Doctor may designate Medical Doctor’s Assistants through the Service. Each Assistant must have his or her own individual login credentials; sharing of credentials is strictly prohibited. The Medical Doctor shall: (i) limit each Assistant’s access to the functions strictly necessary for his or her role; (ii) ensure that each Assistant is bound by a written confidentiality obligation and has been trained on data privacy; (iii) promptly remove an Assistant’s access upon separation or change in role; and (iv) be responsible, as between the Medical Doctor and the Company, for the acts and omissions of his or her Assistants in using the Service, regardless of the nature of their employment or engagement.
Section 17. Access to Patient Health Data
(a) Consent-based access. A Medical Doctor and his or her Assistants may access a Patient’s Health Data only (i) within the scope, purpose and period of access granted by the Patient through the Service, or (ii) where otherwise permitted by Section 13 of the DPA, such as when processing is necessary to protect the life and health of the Patient and the Patient is unable to legally or physically give Consent.
(b) Continuing access. Once a Patient has granted access for a stated purpose and period, the Medical Doctor need not request fresh approval for each subsequent access within that scope. Access beyond the granted scope, purpose or period requires a new grant.
(c) Minimum necessary. Medical Doctors and Assistants shall access, use and disclose only the minimum Health Data necessary for the permitted purpose, consistent with the principle of proportionality under Section 11 of the DPA.
(d) Physician–patient relationship. The grant of access, by itself, does not create a physician–patient relationship. Such relationship arises when the Medical Doctor accepts the Patient for consultation, diagnosis or treatment, and shall be governed by the Code of Ethics of the Medical Profession and applicable law.
Section 18. Prohibited Acts
Medical Doctors and their Assistants shall not:
(a) access any Health Data without a valid grant of access or other lawful basis;
(b) copy, download, print, screenshot, photograph or otherwise record any Health Data from the Service, except Clinical Records and other Health Data generated from their own consultations with the Patient to the extent required for patient care, legal record-keeping, or professional obligations;
(c) disclose any Health Data to any third party except as authorized by the Patient or required by law;
(d) use any Health Data for marketing, research, or any purpose unrelated to the Patient’s care without the Patient’s separate, specific Consent and, for research, compliance with applicable ethics review requirements; or
(e) share login credentials or allow any unauthorized person to access the Service.
Any Health Data a Medical Doctor or Assistant extracts from the Platform becomes subject to the Medical Doctor’s own security controls and responsibility as a PIC. The Company shall not be responsible for the security of such extracted copies once they leave the Platform, without prejudice to the Company’s obligations with respect to data within the Platform.
Section 19. Clinical Records and Professional Independence
Medical Doctors shall exercise reasonable care to ensure that information they enter is accurate and current. Only the Medical Doctor who authored a Clinical Record (or an Assistant acting on his or her documented instruction) may amend it, and all amendments shall be logged with the date, time and author. Medical Doctors may maintain independent clinical records and backups where required by law or professional standards, subject to their own security controls.
Medical Doctors remain independent professionals and are solely responsible for their clinical decisions, diagnoses, prescriptions, medical certificates and treatment plans.
Section 20. Security Incidents Involving Medical Doctors
A Medical Doctor shall notify the Company within twenty-four (24) hours of discovering or reasonably suspecting any unauthorized access, breach or misuse of Health Data connected with the Service, including any compromise of his or her or an Assistant’s credentials or devices, and shall cooperate fully in the Company’s investigation, containment, mitigation and notification efforts under Rule VIII.
RULE V — TELECONSULTATIONS AND PREMIUM SERVICES
Section 21. Teleconsultations
Teleconsultations are conducted between the Patient and the Medical Doctor, who is solely responsible for determining whether a condition is appropriate for remote consultation and for referring the Patient to in-person care when necessary. Before the first Teleconsultation, the Patient will be informed of the nature, benefits and limitations of teleconsultation and asked to give specific Consent to it.
Teleconsultation sessions will not be audio- or video-recorded by the Company, but a time stamp of its occurrence as well as its duration may be recorded for purposes of billing. Electronic prescriptions and medical certificates issued through the Service are issued by and under the sole professional responsibility of the Medical Doctor, in accordance with applicable DOH, Food and Drug Administration (“FDA”), Philippine Drug Enforcement Agency (“PDEA”) and PRC rules.
Section 22. Fees, Billing and Refunds
Fees for Premium Services, additional storage and Teleconsultations will be clearly displayed, inclusive of applicable taxes, before you confirm any purchase. Payments are processed by third-party payment service providers regulated by the Bangko Sentral ng Pilipinas; the Company does not store full card numbers. Subscriptions renew automatically only if you opt in to auto-renewal, and you may cancel at any time before the next billing date.
Refunds are governed by the Refund Policy published in the Service, which shall not diminish your rights under Republic Act No. 7394 (Consumer Act of the Philippines) and Republic Act No. 11967 (Internet Transactions Act of 2023). Teleconsultation fees may be collected by the Company on behalf of the Medical Doctor, in which case the Company acts as a collection agent.
RULE VI — ADVERTISING
Section 23. Advertising Policy
Advertising supports the free basic features of the Service. The Company adopts the following safeguards:
(a) No use of Health Data for advertising. The Company will never use Health Data or any other sensitive personal information to select, target, or measure advertisements.
(b) Contextual advertising by default. By default, advertisements are shown on a contextual basis (e.g., based on the page or feature being viewed) and do not rely on a profile of you.
(c) Personalized advertising only with opt-in Consent. The Company will show advertisements based on non-sensitive information (such as your general location at city level, age range, language and in-app activity not involving Health Data) only if you give separate, opt-in Consent. You may withdraw this Consent at any time in your privacy settings without affecting your use of the Service.
(d) No sale of personal information. The Company does not sell or rent personal information and does not share information that identifies you with advertisers. Advertisers receive only aggregated, de-identified reports on advertisement performance.
(e) Health-related advertisements shall comply with applicable FDA, DOH and Ad Standards Council rules, and shall be clearly labeled as advertisements.
RULE VII — ACCEPTABLE USE
Section 24. Prohibited Uses
You shall not: (a) use the Service for any unlawful purpose or in violation of Republic Act No. 10175 (Cybercrime Prevention Act of 2012); (b) access or attempt to access any Account or data you are not authorized to access; (c) interfere with, disrupt, reverse-engineer, scrape or probe the Service or its security; (d) upload malware or harmful code; (e) impersonate any person or misrepresent your identity, authority or credentials; or (f) use the Service to harass, defame or harm any person.
RULE VIII — DATA SECURITY AND BREACH MANAGEMENT
Section 25. Security Measures
The Company shall implement reasonable and appropriate organizational, physical and technical security measures to protect personal information, in accordance with Section 20 of the DPA, Rule VI of the IRR, and NPC Circular No. 2023-06 (Security of Personal Data in the Government and the Private Sector). These include encryption of Health Data in transit and at rest, role-based access controls, multi-factor authentication, audit logs, vulnerability management, regular security assessments, and confidentiality obligations and training for personnel.
Section 26. Personal Data Breach Management
In the event of a Personal Data Breach involving sensitive personal information or information that may be used for identity fraud, and which is reasonably believed to give rise to a real risk of serious harm to affected Data Subjects, the Company shall notify the NPC and affected Data Subjects within seventy-two (72) hours upon knowledge of, or reasonable belief that, such breach occurred, in accordance with Section 20(f) of the DPA, Section 38 of the IRR, and NPC Circular No. 16-03 (Personal Data Breach Management), as amended, and through the channels required by the NPC. The notification to Data Subjects shall describe the nature of the breach, the personal information involved, the measures taken to address it, and the steps Data Subjects may take to reduce harm, together with the Company’s contact details.
While no system is completely secure, the Company’s acknowledgment of this risk does not diminish its obligation to observe the security standards required by law.
RULE IX — DISCLAIMERS, LIABILITY AND INDEMNITY
Section 27. Disclaimers
The Service is provided on an “as is” and “as available” basis. MDTI does not warrant that the Service will be uninterrupted or error-free. MDTI is not responsible for the clinical content of Clinical Records, the medical advice, diagnosis or treatment of any Medical Doctor, or the accuracy of Health Data uploaded by users.
Section 28. Limitation of Liability
To the extent permitted by law, MDTI shall not be liable for indirect, incidental, special or consequential damages, or for loss or damage arising from: (a) acts or omissions of Medical Doctors, their Assistants, or other users in the exercise of their professional or personal responsibilities; (b) misrepresentations by users of their identity, authority or credentials, subject to Section 11; (c) Health Data extracted from the Service by users, subject to Section 18; or (d) events beyond the Company’s reasonable control.
Nothing in these Terms shall exclude or limit the Company’s liability for fraud, bad faith, gross negligence, willful misconduct, or violation of the Data Privacy Act or other laws that cannot be waived or limited by contract, consistent with Articles 1170, 1171 and 1172 of the Civil Code of the Philippines, nor shall it limit any right of a Data Subject under the DPA, including the right to be indemnified for damages under Section 16(f) thereof.
Section 29. Indemnity
Each user shall indemnify and hold MDTI harmless from third-party claims, penalties and reasonable costs (including attorney’s fees) arising from that user’s breach of these Terms, violation of law, or misrepresentation, except to the extent caused by the Company’s own fault or negligence. For Medical Doctors, this includes claims arising from professional services rendered through the Platform.
RULE X — SUSPENSION, TERMINATION AND DATA ON EXIT
Section 30. Suspension and Termination
You may close your Account at any time through the Platform. The Company may suspend or terminate an Account, after notice where practicable, for material breach of these Terms, misrepresentation, unlawful use, a lapse in a Medical Doctor’s license, or where required by law or a lawful order.
Section 31. Your Data Upon Closure
Before closing an Account, you may download a copy of your Health Data in a structured, commonly used and machine-readable format, consistent with your right to data portability under Section 18 of the DPA. Upon closure, the Company will delete or anonymize personal information in accordance with the retention schedule in the Privacy Notice, except where retention is required by law, by a Medical Doctor’s obligation to maintain Clinical Records, or for the establishment, exercise or defense of legal claims.
RULE XI — MISCELLANEOUS PROVISIONS
Section 32. Amendments
The Company may amend these Terms or the Privacy Notice. Material amendments will be notified through the Service and by e-mail at least thirty (30) days before they take effect, and you will be asked to accept them. Where an amendment involves a new purpose for processing personal information that requires Consent, the Company will obtain your fresh Consent and will not presume it from continued use.
Section 33. Governing Law and Dispute Resolution
These Terms are governed by the laws of the Republic of the Philippines. The parties shall first endeavor to settle any dispute amicably within thirty (30) days from written notice. Failing settlement, disputes shall be brought exclusively before the proper courts of Cebu City, Philippines, to the exclusion of all other venues, without prejudice to the jurisdiction of the NPC over privacy complaints and of other regulatory agencies. Nothing in these Terms prevents a Data Subject from filing a complaint with the National Privacy Commission.
Section 34. Notices
Notices to you will be sent to the e-mail address or mobile number registered in your Account or posted in the Service. Notices to the Company shall be sent to admin@healthbio.online or to the principal office address Unit 815 Central Bloc Tower 1, V. Padriga St, Cebu IT Park, Apas, Cebu City, Cebu Philippines; privacy-related requests should be sent to the Data Protection Officer at dpo@healthbio.online.
Section 35. General Provisions
Severability. If any provision is held invalid, the remaining provisions shall remain in full force and effect.
Waiver. Failure to enforce any provision is not a waiver.
(c) Assignment. You may not assign your rights without the Company’s consent; the Company may assign these Terms in connection with a merger, acquisition or sale of assets, subject to notice to you and to the DPA.
(d) Force majeure. Neither party is liable for delay caused by events beyond its reasonable control.
(e) Language. These Terms may be made available in Filipino; in case of conflict, the English version prevails, and any ambiguity shall be interpreted in favor of the user.
Effective: October 5, 2026