Data Processing Agreement

1. Roles of the Parties

The Clinic acts as:

• Personal Information Controller under Philippine law
• Data Controller under Singapore PDPA

MedicalPro acts solely as:

• Personal Information Processor under Philippine law
• Data Intermediary under Singapore PDPA.

MedicalPro processes data strictly based on the instructions of the Clinic.

2. Scope of Processing

MedicalPro may process personal data solely for:

• Medical record digitization
• Data encoding and migration
• Clinical management system onboarding
• Secure data hosting
• Patient account activation
• System communications

MedicalPro shall not use patient data for unrelated commercial purposes.

3. Patient Communications

Upon upload of patient contact information, the Platform may send automated messages including:

• Account activation
• Appointment confirmations
• Healthcare notifications
• Secure document access

These communications are operational and issued on behalf of the Clinic.

4. Information Security Safeguards

MedicalPro implements safeguards including:

• Administrative safeguards
• Technical safeguards
• Physical safeguards

designed to protect personal data against unauthorized access, loss, or disclosure.

5. Sub-Processors

MedicalPro may engage third-party service providers such as cloud hosting providers.

Such providers are required to maintain appropriate security safeguards.

MedicalPro remains responsible for compliance with this Agreement.

6. Cross-Border Data Transfers

Where data is transferred outside the Philippines, MedicalPro ensures appropriate protection measures and contractual safeguards.

Data hosting may occur in Singapore or other jurisdictions with adequate protection standards.

7. Data Breach Notification

If a confirmed data breach occurs affecting clinic data, MedicalPro shall notify the Clinic without undue delay and provide available information about the breach.

The Clinic remains responsible for regulatory notifications where required by law.

8. Data Retention and Deletion

Upon termination of services:

• Personal data may be deleted within 30 days unless retention is legally required
• Backups remain protected under internal retention policies

9. Confidentiality

MedicalPro shall maintain strict confidentiality of all health information processed on the Platform.

Confidentiality obligations survive termination of this Agreement.

1. Roles of the Parties — Two Data Sources, Two Roles

Because health information in MyHealth originates from two distinct sources, MedicalPRO's role differs depending on the source of the data:

• For health information created by a Clinic and shared with the Patient — the Clinic remains the Personal Information Controller (under Philippine law) and Data Controller (under Singapore PDPA and GDPR) for that data, exactly as stated in the Clinic Platform Terms of Service. MedicalPRO acts solely as Personal Information Processor / Data Intermediary in relation to this data, whether it is accessed through the Clinic Platform or through MyHealth.
• For health information the Patient enters directly into MyHealth (relating to care received outside the MedicalPRO network) — the Patient acts as their own Controller of that self-entered data. MedicalPRO acts as Processor, storing and securing that data strictly for the Patient's own use and at their direction.

This means a single MyHealth account may contain data governed by two different controllers depending on its source — the treating Clinic for clinic-issued records, and the Patient themselves for self-entered records. MedicalPRO's processing obligations and security standards are identical regardless of which category the data falls into.

2. Scope of Processing

MedicalPRO may process personal data solely for account activation and management, secure storage and retrieval of health records, appointment coordination, delivery of clinical documents, and system communications. MedicalPRO shall not use a Patient's identifiable health data for unrelated commercial purposes.

3. Information Security Safeguards

MedicalPRO implements administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or disclosure, consistent with the safeguards described in the Clinic Platform Data Processing Agreement. All Platform data is hosted on secure servers, and MedicalPRO operates a single-tenancy architecture in which each Clinic's data remains fully isolated. A Patient's MyHealth account accesses only the specific records a Clinic has authorized to be shared with that Patient.

4. Sub-Processors

MedicalPRO may engage third-party service providers, such as cloud hosting providers, to support MyHealth. Such providers are required to maintain appropriate security safeguards. MedicalPRO remains responsible for compliance with this Agreement.

5. Cross-Border Data Transfers

Where a Patient's data is transferred outside the Philippines, MedicalPRO ensures appropriate protection measures and contractual safeguards consistent with those described in the Clinic Platform Data Processing Agreement. Where a Patient is located in the European Economic Area, MedicalPRO ensures that any transfer of their data outside the EEA complies with GDPR requirements for international data transfers, including the use of appropriate safeguards such as Standard Contractual Clauses where applicable.

6. Data Breach Notification

If a confirmed data breach occurs affecting a Patient's data, MedicalPRO shall notify the affected Patient without undue delay, and in any event within 72 hours of confirming the breach, and shall provide all available information about the nature and scope of the incident.

Where the breach concerns data for which a Clinic is the Controller, MedicalPRO shall also notify that Clinic within 72 hours, consistent with the breach notification obligation in the Clinic Platform Data Processing Agreement, so that the Clinic can meet its own regulatory notification obligations.

7. Data Retention and Deletion

Personal data associated with a MyHealth account is retained for as long as the account remains active, and is deleted within 30 days of account closure, except where retention is required for legal compliance. MedicalPRO cannot recover data after permanent deletion. Patients are strongly advised to export any information they wish to retain before closing their account.

8. Confidentiality

MedicalPRO shall maintain strict confidentiality of all health information processed through MyHealth. Confidentiality obligations survive termination of this Agreement.

9. Consistency with the Clinic Platform Agreement

Where this Agreement and the MedicalPRO Clinic Platform Terms of Service both address the same category of data or the same processing activity, both documents are intended to be read consistently, as components of a single Platform-wide data protection framework. In the event of an unresolved conflict between this Agreement and the Clinic Platform Terms of Service concerning the same clinical record, the terms most protective of the Patient's data rights shall govern.