Data Processing Agreement

The Clinic is the personal information controller: it decides why and how the personal information of its patients and staff is processed. ALM IT Solutions is the personal information processor: it processes that information only to provide the Service to the Clinic. Words defined in the Data Privacy Act have the same meaning in this Agreement.

ALM IT Solutions processes personal information only to provide, secure and support the Service for the Clinic. Processing lasts for the Clinic's subscription and the 6-month read-only period after cancellation, and ends when the Clinic's data is deleted under section 8.

• Patients of the Clinic: identity, contact and demographic details; sensitive personal information about their health, including medical and dental history, dental charts, treatments, prescriptions, consent forms and signatures, clinical documents and photos; charges and payments.
• The Clinic's staff who use the Service: name, email address, role, profile details, and sign-in, security and audit records.

The Clinic will:

• have a lawful basis for the personal information it enters, and give patients the privacy notices and obtain the consents its practice requires;
• keep the information it enters accurate and only enter what it needs;
• give accounts only to authorized staff, with the right roles, and disable accounts promptly when staff leave;
• tell ALM IT Solutions promptly about any suspected unauthorized access to its account or records;
• keep its own copies of records it must keep by law, and export what it needs before its data is deleted under section 8.

ALM IT Solutions will:

• process the Clinic's personal information only on the Clinic's documented instructions — this Agreement and the Clinic's use of the Service — unless the law requires otherwise, in which case it will tell the Clinic first unless the law forbids it;
• not use the Clinic's personal information for its own purposes, not sell it, and not use it for advertising;
• make sure that everyone at ALM IT Solutions who can access the information is bound by confidentiality;
• maintain organizational, physical and technical security measures appropriate to sensitive personal information, as described on the Data Privacy & Security page, and not reduce their overall level of protection;
• help the Clinic, as far as the Service allows, to respond to patients exercising their rights under the Data Privacy Act — such as access, correction and erasure — and pass on to the Clinic any such request it receives directly;
• give the Clinic the information it reasonably needs for its privacy impact assessments and for inquiries from the National Privacy Commission;
• on written request, provide the information reasonably necessary to show that it meets this Agreement.

If ALM IT Solutions confirms a personal data breach affecting the Clinic's information, it will notify the Clinic administrator within 24 hours of confirming it. The notice will describe, as far as known, what happened, the information and people affected, the likely consequences, and the measures taken or proposed. ALM IT Solutions will update the Clinic as it learns more and cooperate so the Clinic can meet its own obligations to notify the National Privacy Commission and affected patients.

The Clinic authorizes ALM IT Solutions to use these sub-processors:

• Lovable Cloud — application hosting, database, file storage, sign-in and account emails;
• Cloudflare — the network that delivers the application.

ALM IT Solutions uses only providers whose terms include data protection commitments, and remains responsible to the Clinic for their processing as the Data Privacy Act provides. Their facilities may be located outside the Philippines. ALM IT Solutions will tell clinic administrators at least 30 days before adding or replacing a sub-processor; a Clinic that objects may cancel its subscription without a cancellation fee.

When the Clinic's subscription is cancelled, the Clinic keeps read-only access for 6 months so it can view, print and export its records. After that, ALM IT Solutions permanently deletes the Clinic's account and personal information from the Service; copies held in the hosting provider's backups are removed as those backups expire. ALM IT Solutions may keep information it must keep by law, such as its own invoices and payment records, only for as long as required.

ALM IT Solutions will tell clinic administrators at least 30 days before a material change to this Agreement takes effect. For the processing of personal information, this Agreement prevails over any other terms of the Clinic's subscription.