Privacy Policy

ClinicPH respects your privacy and is committed to protecting personal data. This policy explains what we collect, how we use it, and your rights.

We comply with the Data Privacy Act of 2012 (RA 10173) of the Republic of the Philippines.

ClinicPH is operated by Zadrach Caunca (sole proprietor), based in Antipolo, Rizal, Philippines. The Data Protection Officer can be reached at support@clinicph.health.

Account data: Name, email, phone number, clinic name, clinic type, TIN, PhilHealth accreditation.

Clinic operational data: Patient records, appointments, consultations, billing, inventory — entered by your clinic staff.

Technical data: IP address, browser type, device info, usage patterns (for security and service improvement).

Payment data: Payment references and receipts. We do not store credit card numbers.

• Provide and maintain the ClinicPH service
• Process payments and manage subscriptions
• Send transactional emails (receipts, reminders, security)
• Improve features and troubleshoot issues
• Comply with legal obligations

We do not sell your data to third parties. We do not use your clinic data for advertising.

Clinics using ClinicPH are the Personal Information Controllers for their patients under RA 10173. ClinicPH acts as a Personal Information Processor on your behalf.

As a processor, we apply reasonable security measures but clinics retain primary responsibility for complying with the Data Privacy Act, including obtaining patient consent.

We share data only with:

• Neon (PostgreSQL hosting) — stores our database, encrypted at rest
• Vercel — hosts our application and file storage
• Resend — sends transactional emails
• Google — OAuth authentication (if you use “Sign in with Google”)
• Law enforcement — only when legally required

We use industry-standard encryption (HTTPS, database encryption at rest), password hashing (bcrypt), session tokens, and rate limiting. No system is 100% secure — if you notice a breach, email us immediately.

Under RA 10173, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data (subject to legal/contractual retention)
• Object to processing
• Data portability (request your data in a machine-readable format)
• File a complaint with the National Privacy Commission (NPC)

To exercise these rights, email support@clinicph.health. We respond within 30 days.

We retain your data for as long as your account is active. After cancellation, data is retained for 30 days to allow recovery, then archived for up to 1 year for legal/tax compliance, then deleted.

We use essential cookies (authentication, session management) and Vercel Analytics (privacy-friendly, no tracking cookies). We do not use third-party advertising cookies.

ClinicPH is not intended for children under 18. We do not knowingly collect data from minors except as clinic patient records added by authorized clinic staff.

Our database is hosted in the US (Neon US East region), which may involve international data transfer. By using ClinicPH, you consent to this transfer. Our service providers comply with international security standards.

We may update this policy periodically. Material changes will be notified via email.

Questions or concerns about privacy? Email support@clinicph.health.

You may also file a complaint with the National Privacy Commission: privacy.gov.ph.