Data Processing Agreement

1. Roles of the Parties

The Clinic acts as:

• Personal Information Controller under Philippine law
• Data Controller under Singapore PDPA

MedicalPro acts solely as:

• Personal Information Processor under Philippine law
• Data Intermediary under Singapore PDPA.

MedicalPro processes data strictly based on the instructions of the Clinic.

2. Scope of Processing

MedicalPro may process personal data solely for:

• Medical record digitization
• Data encoding and migration
• Clinical management system onboarding
• Secure data hosting
• Patient account activation
• System communications

MedicalPro shall not use patient data for unrelated commercial purposes.

3. Patient Communications

Upon upload of patient contact information, the Platform may send automated messages including:

• Account activation
• Appointment confirmations
• Healthcare notifications
• Secure document access

These communications are operational and issued on behalf of the Clinic.

4. Information Security Safeguards

MedicalPro implements safeguards including:

• Administrative safeguards
• Technical safeguards
• Physical safeguards

designed to protect personal data against unauthorized access, loss, or disclosure.

5. Sub-Processors

MedicalPro may engage third-party service providers such as cloud hosting providers.

Such providers are required to maintain appropriate security safeguards.

MedicalPro remains responsible for compliance with this Agreement.

6. Cross-Border Data Transfers

Where data is transferred outside the Philippines, MedicalPro ensures appropriate protection measures and contractual safeguards.

Data hosting may occur in Singapore or other jurisdictions with adequate protection standards.

7. Data Breach Notification

If a confirmed data breach occurs affecting clinic data, MedicalPro shall notify the Clinic without undue delay and provide available information about the breach.

The Clinic remains responsible for regulatory notifications where required by law.

8. Data Retention and Deletion

Upon termination of services:

• Personal data may be deleted within 30 days unless retention is legally required
• Backups remain protected under internal retention policies

9. Confidentiality

MedicalPro shall maintain strict confidentiality of all health information processed on the Platform.

Confidentiality obligations survive termination of this Agreement.