Philippine RA 10173 & Regional Healthcare Compliance

Privacy Policy & Data Protection Statement

MedicalPRO Network (“we,” “us,” or “our”) is committed to the highest standards of data privacy, ethical transparency, and statutory compliance under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), National Privacy Commission (NPC) circulars, and the Singapore Personal Data Protection Act (PDPA 2012).

Effective Date: January 1, 2026•Last Updated: October 27, 2026•Version: 2.4.0 (RA 10173 Compliant)

Zero Clinical Records (EMR)

MedicalPRO Network is exclusively a public provider directory and credential verification network. We do not store, host, or process patient Electronic Medical Records (EMR), clinical diagnoses, lab results, or consultation histories on this platform.

Statutory Register Sourcing

Pre-claim directory listings are derived strictly from publicly verifiable regulatory registries (PRC and DOH facility registers). Professional license numbers are strictly redacted on unclaimed profiles to prevent identity hijacking.

Full Data Subject Rights

Every licensed healthcare practitioner and healthcare facility retains the unequivocal right under RA 10173 Section 16 to request profile updates, rectification, or complete permanent delisting via our automated verification workflow.

1. Data Controller Identification & DPO Contact

The data controller responsible for the processing of personal data on the MedicalPRO Network directory platform is:

MedicalPro Group Pte. Ltd. (MedicalPRO Network)

Singapore Corporate Registry / Regional Operations

Designated Data Protection Officer (DPO): Privacy & Regulatory Compliance Group

Official DPO Inquiries Email: privacy@medicalprosoftware.com

Data Subject Opt-Out Portal: https://medicalpronetwork.com/opt-out

2. Categories of Information Processed

We process personal and organizational data strictly within defined, legitimate healthcare directory purposes:

Public Directory Information: Practitioner full name, clinical title (e.g., MD, DMD), primary and secondary medical specialties, subspecialties, clinic affiliations, facility addresses, publicly registered consultation phone numbers, and clinic schedules.
Account & Verification Data (Claimed Profiles): Official email addresses, mobile numbers for OTP (One-Time Password) challenge verification, professional PRC registration numbers (used strictly server-side for identity verification against regulatory rolls and not exposed publicly), and association memberships.
Technical Telemetry & Access Logs: IP addresses (anonymized for diagnostic and rate-limiting purposes), browser user-agent, operating system, and search query terms (e.g., specialty, city, hospital).
Opt-Out & Data Subject Inquiries: Requestor identity, representative role, authorized email, and audit logs of removal requests maintained for statutory compliance with the National Privacy Commission.

3. Legal Bases for Data Processing

Under Section 12 of Republic Act No. 10173 (DPA 2012) and Section 13 (Sensitive Personal Information), MedicalPRO Network processes personal information pursuant to:

Legitimate Interests (Sec. 12(f)): Processing is necessary for the legitimate interests pursued by the public and healthcare consumers in accessing accurate, up-to-date directory information regarding licensed medical practitioners and healthcare facilities in their locality.
Consent (Sec. 12(a)): For practitioners who register accounts, claim listings, or subscribe to enhanced directory features, processing is based on explicit, informed consent.
Statutory & Regulatory Compliance (Sec. 12(c)): Compliance with statutory notification and verification requirements under Philippine and regional health governance frameworks.

4. Data Sharing, Confidentiality & Sub-Processors

We do not sell, rent, trade, or monetize personal data to third-party data brokers, pharmaceutical advertisers, or insurance lead generators. Personal data is shared strictly with authorized infrastructure partners bound by Data Processing Agreements (DPAs):

Cloud Infrastructure: Amazon Web Services (AWS ap-southeast-1 region, Singapore), providing SOC 1/2/3, ISO/IEC 27001, and HIPAA-compliant hardware and encrypted database storage.
Authentication & Security: AWS Cognito and SMS/Email verification relays utilized solely for two-factor authentication and claim ownership challenges.
Statutory Inquiries: Only when compelled by a valid judicial subpoena, court order, or official mandate issued by the National Privacy Commission (NPC) or Department of Health (DOH).

5. Data Subject Rights Under RA 10173

As a data subject in the Philippines or Southeast Asia, you are entitled under Section 16 of the Data Privacy Act of 2012 to exercise the following rights at any time without fee:

Right to Object & Erasure

You have the absolute right to object to the indexing of your practitioner or facility profile and request its complete removal or delisting from search results.

Right to Rectification

You may dispute inaccurate, outdated, or incomplete directory information and have your listing corrected immediately.

Right to Access

You may request confirmation as to whether your personal information is being processed, along with copies of recorded profile entries.

Right to Lodge a Complaint

You may lodge a formal complaint with the National Privacy Commission (NPC) at complaints@privacy.gov.ph if your privacy rights have been violated.

Access the Automated Opt-Out / Delisting Portal

6. Data Security, Encryption & Retention

We implement industry-standard technical, physical, and organizational security measures to protect data against unauthorized destruction, modification, unlawful access, or accidental loss:

Encryption in Transit & at Rest: All traffic is enforced over TLS 1.3 with HSTS (HTTP Strict Transport Security). Directory databases are encrypted at rest using AES-256 bit encryption keys managed under AWS Key Management Service (KMS).
Strict Tenant Isolation: Data tables maintain tenant and database scoping boundaries to prevent multi-tenant data leakage.
Retention & De-Indexing: Verified opt-out requests are executed within 24 to 48 business hours across live directory indices. Automated robots directives and sitemap purges propagate delisting to external search engine crawlers (Google, Bing).

7. Contact Our Data Protection Officer

For any questions regarding this Privacy Policy, your Data Subject rights under RA 10173, or to submit a formal Data Subject Access Request (DSAR), please contact our Data Protection Office:

Data Protection Officer

MedicalPro Group Pte. Ltd. — Legal & Regulatory Division

Email: privacy@medicalprosoftware.com / dpo@medicalpronetwork.com

Postal Address: MedicalPro Group, Marina Bay Financial Centre, Singapore / Regional Operations Manila, Philippines.

For independent inquiries with the Philippine regulatory authority, you may visit the National Privacy Commission official website at privacy.gov.ph .