Privacy Policy

01Who We Are

MyClinicSoft and the eMCR patient app are provided by DevCom Digital, a business registered in the Philippines ("we," "us"). This policy explains what personal information we handle, why, and the choices you have under the Data Privacy Act of 2012 (RA 10173).

Clinics and patients

When a clinic records information about its patients in MyClinicSoft, the clinic is the personal information controller for those records and decides how they are used. We act as its personal information processor: we store and process the records only to run the Service for that clinic. Patients who want to access, correct, or delete clinic records should contact the clinic first; we will help the clinic respond.

We are the controller for clinic staff accounts, eMCR accounts, billing information, and enquiries sent to us.

02Information We Collect

From clinics and their staff

• Staff account details: name, email, phone, role, and sign-in security settings
• Clinic details and settings
• Patient records the clinic enters, which can include health information such as consultations, diagnoses, prescriptions, lab results, and documents
• Billing records for the clinic’s subscription

From patients using eMCR or online booking

• Mobile number, verified with a one-time code
• Name and date of birth, used to match you to records your clinics hold
• Dependents you add, such as children
• Booking requests and check-ins
• Device push-notification tokens

Collected automatically

• IP address and browser or device information, used for security and rate limiting
• Audit logs of who viewed or changed records
• Error reports when something breaks

03How We Use Information

We use personal information to:

• Provide the Service: records, scheduling, billing, reminders, and patient access through eMCR
• Verify identity and keep accounts secure
• Send service messages, such as reminders, sign-in codes, and receipts
• Provide support and respond to enquiries
• Detect and fix errors and misuse
• Comply with legal obligations

Clinic patient data is processed on the clinic's instructions. We do not use it for our own marketing, we do not sell it, and we do not use it to train AI models.

04Data Protection & Security

Measures we use include:

• TLS encryption for data in transit
• Additional AES-256 encryption of sensitive fields
• Role-based access controls and two-factor authentication for staff
• Audit logs of access to and changes in patient records
• Rate limiting on sign-in and public forms
• Regular backups

If a personal data breach is likely to put people at real risk, we will notify the affected clinics and, where the law requires, the National Privacy Commission, within the periods set by its rules.

05Service Providers & Disclosure

We share personal information only with the service providers below, which process it for us under contract, or when the law requires it. Some are based outside the Philippines, mainly in the United States, so information may be transferred and stored abroad; we choose providers that keep it protected to a standard comparable to the Data Privacy Act.

We may also disclose information to comply with a law, court order, or lawful request from authorities, or as part of a merger or sale of the business, in which case this policy continues to apply.

06Your Rights

Under the Data Privacy Act you have the right to:

• Be informed about how your personal information is processed
• Access your personal information
• Object to processing, and withdraw consent where processing relies on it
• Have inaccurate information corrected
• Have information erased or blocked where the law allows
• Receive your information in a portable electronic format
• Claim damages for harm caused by unlawful processing
• File a complaint with the National Privacy Commission (privacy.gov.ph)

To use these rights, contact the clinic for clinic records, or our Data Protection Officer for anything we control. We may need to verify your identity first.

07Data Retention

Clinic records are kept for as long as the clinic's account is active, and the clinic decides its own retention periods for patient records within the law. After a clinic closes its account, we delete its data within 30 days of a written request from a clinic administrator, except for anything the law requires us to keep.

eMCR accounts are kept until you ask us to close them. Backups and logs are overwritten on a rolling basis.

08Cookies

We use only cookies needed to run the Service, such as keeping you signed in and protecting forms. We do not use advertising or third-party analytics cookies.

09Minors

Clinics may keep records of patients under 18, and a parent or guardian may add a child as a dependent in eMCR. Accounts in eMCR are held by adults; a dependent's access passes to them when they turn 18.

10Changes to This Policy

We may update this policy. We will post the new version here with a new date and tell clinic administrators about material changes by email or in the Service.

11Data Protection Officer

For privacy questions or to exercise your rights, contact our Data Protection Officer: