Privacy Policy

Effective 26 July 2026

Alaga (“we”, “us”) provides clinic management software to healthcare providers in the Philippines. This policy explains what information we handle, why, and what rights you have under the Data Privacy Act of 2012 (Republic Act No. 10173).

Who controls the data

Clinics that use Alaga are the personal information controllers of their patients’ data. Alaga acts as a personal information processor on their instructions: we store and process the data so the clinic can run its practice, and we do not use patient records for our own purposes.

Information we handle

• Clinic staff accounts — name, email address, role, and sign-in activity.
• Patient records entered by the clinic — name, contact details, date of birth, sex, address, clinical notes, appointments, prescriptions where applicable, and billing history. This includes sensitive personal information about health.
• Messaging identifiers— if clinic staff link a messaging account (such as Telegram or Facebook Messenger) to use the Alaga assistant, we store that account’s identifier so we can recognise them.
• Operational logs — technical records needed to run and secure the service.

How we use it

• To provide clinic management features to the clinic.
• To send appointment reminders and related messages a clinic asks us to send on its behalf.
• To answer a clinic owner’s questions through the Alaga assistant. Questions are processed by a third-party AI model provider to generate a response.
• To secure the service, prevent abuse, and meet legal obligations.

We do not sell personal information, and we do not use patient data to advertise to patients.

Service providers

We rely on a small number of processors: cloud hosting and database providers, an AI model gateway used by the assistant, and the messaging platforms a clinic chooses to enable. Some of these process data outside the Philippines. We use providers that offer appropriate safeguards and limit them to processing on our instructions.

Security

Data is encrypted in transit and at rest. Access is restricted to the clinic’s own workspace and controlled by role. The Alaga assistant is limited to clinic owners. A small number of Alaga staff may access a workspace to provide support or investigate a fault; such access is logged.

Retention

We keep clinic and patient records for as long as the clinic maintains its account, and afterwards only as long as required by Philippine law — medical records are subject to statutory retention periods. A clinic may ask us to export or delete its data.

Deleting your data

You can ask us to delete your workspace and the data in it at any time. Email hello@advark.ai from the address associated with your account, and tell us the name of the clinic workspace to delete.

• We acknowledge the request within 5 business days.
• We confirm you are authorised to make it — for a clinic workspace, that means a clinic owner.
• We then delete the workspace and its records, including patient records, appointments, invoices, and any linked messaging accounts, within 30 days.
• Backups are purged on their normal rotation, within 90 days of deletion.

Two limits apply. Philippine law sets minimum retention periods for medical records, so where a clinic is legally required to keep them we will export the records to the clinic rather than destroy them. We also keep the minimum information needed for tax and accounting records of our own.

Patients: your records belong to the clinic that treats you. Ask your clinic to delete or correct them; if you email us directly we will pass the request to the clinic and support them in responding.

Messaging accounts: to disconnect a linked Facebook, Messenger, or Telegram account without deleting your workspace, open Users → Assistant in Alaga and choose Disconnect. That removes the stored messaging identifier immediately.

Your rights

Under the Data Privacy Act you may be informed about, access, correct, object to, or request erasure or blocking of your personal data, request data portability, and lodge a complaint with the National Privacy Commission. Because clinics control their patients’ records, patients should contact their clinic first; we will support the clinic in responding.

Children

Clinics may hold records for minors as part of care. Those records are entered and controlled by the clinic, with consent handled by the clinic under Philippine law.

Changes

We will update this page when our practices change and revise the effective date above.

Contact

Questions about this policy or your data: hello@advark.ai