Data Privacy & Security

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), information about a person's health — including dental history, treatments and clinical notes — is sensitive personal information. It may only be collected and used as the law allows, and it must be protected accordingly.

The dental clinic generally decides why and how its patients' information is collected and used. The clinic remains responsible for:

• collecting patient information lawfully, with the privacy notices and consents its practice requires;
• deciding which staff have accounts and what each role may do;
• its own policies, staff training and day-to-day handling of records, including printed copies;
• its other obligations under the Data Privacy Act, such as any privacy impact assessment it needs.

ALM IT Solutions provides and operates the software and infrastructure the clinic uses to keep its records, and processes patient information on the clinic's behalf. Our obligations are set out in the Data Processing Agreement.

Every user should only open the records they need for their work and are authorized to access.

• Every clinical and administrative page requires signing in. Only the public information pages are open.
• Each clinic's records are kept separate from every other clinic's. The database itself enforces this separation on every request.
• Inside a clinic, access depends on the user's role (for example clinic administrator, dentist or receptionist). Regulatory identifiers such as TIN, PRC, PTR and S2 numbers are limited to clinic administrators and, for account management, ALM IT Solutions platform administrators.
• ALM IT Solutions platform administrator accounts manage clinic accounts and subscriptions. They require multi-factor authentication and are not given access to clinics' clinical records.
• After repeated failed attempts, the sign-in page temporarily blocks further attempts.
• Uploaded files are stored privately and opened only through short-lived links.
• Important actions are recorded in an audit log that clinic administrators can review.
• Patient signatures cannot be changed once captured.
• Connections to the Service are encrypted (HTTPS).
• The in-app issue report form is text-only and asks users not to include patient information.

• Multi-factor authentication is currently required only for platform administrator accounts, not for clinic users.
• ALM DentaSync does not hold independent security certifications (such as ISO 27001 or SOC 2). Nothing on this page is a certification or a third-party audit result.
• No software can remove every risk. Safeguards are reviewed and improved as the Service develops.

The Service runs on Lovable Cloud, which provides the application hosting, database, file storage and sign-in services, and is delivered through Cloudflare's network. ALM IT Solutions does not run its own servers for the Service. Data stored with these providers is protected by their managed security, including encryption of stored data. See the Privacy Policy for more.

If we confirm a personal data breach affecting a clinic's information, we will notify the clinic administrator within 24 hours of confirming it, tell the clinic what we know, and help the clinic meet its own obligations to notify the National Privacy Commission and affected patients.

• Patients: please contact your dental clinic first. The clinic decides on requests about its records, and we help clinics where the Service is involved.
• Clinics and users: report a suspected security problem or privacy incident to ALM IT Solutions at info@almitsolutions.net, or with Report an Issue inside the Service. Describe what happened without including patient information.