PRIVACY POLICY

1. ROLE OF THE PLATFORM

Medala operates as a technology platform that facilitates interactions between Users, licensed healthcare providers, partner clinics, pharmacies, laboratories, logistics providers, and related healthcare service providers.

Healthcare services are independently rendered by licensed healthcare professionals, while medicines are dispensed and fulfilled solely by licensed partner pharmacies and drugstores.

2. INFORMATION WE COLLECT

The Platform may collect and process the following information:

Personal Information

• full name;
• address;
• birth date;
• gender;
• mobile number;
• email address;
• government-issued identification;
• account credentials;
• and related personal information.

Health-Related Information

• consultation records;
• prescriptions;
• medical history;
• laboratory and diagnostic records;
• medication orders;
• healthcare communications;
• and related healthcare documentation.

Certain health-related information may constitute sensitive personal information or Protected Health Information (PHI) under applicable laws and regulations.

Technical Information

• device information;
• IP address;
• browser information;
• operating system;
• app usage data;
• cookies;
• and session-related information.

3. PURPOSE OF PROCESSING

The Platform may collect, use, process, and store information for legitimate purposes, including:

• facilitating healthcare consultations;
• facilitating paid healthcare consultations and related healthcare transactions;
• facilitating medicine ordering and fulfillment;
• processing payments, refunds, discounts, promotional credits, and financial transactions associated with healthcare services;
• identity verification;
• appointment management;
• customer support;
• payment processing;
• delivery coordination;
• fraud prevention;
• system security;
• legal and regulatory compliance;
• service improvement;
• analytics and reporting;
• and operational administration.

4. CONSENT TO ELECTRONIC HEALTHCARE COMMUNICATIONS

By using the Platform, Users consent to the electronic collection, storage, transmission, and processing of healthcare-related information necessary to facilitate:

• telemedicine consultations;
• prescriptions;
• medication fulfillment;
• healthcare coordination;
• customer support;
• and related services.

Users acknowledge and accept the inherent risks associated with internet-based systems and electronic communications.

5. SHARING OF INFORMATION

Information may be shared, disclosed, or transmitted only as reasonably necessary to:

• licensed healthcare providers involved in consultations;
• licensed pharmacies involved in medication fulfillment;
• accredited laboratories or healthcare partners;
• payment processors and financial service providers involved in payment transactions;
• logistics or delivery providers;
• cloud hosting providers;
• customer support providers;
• regulators or government authorities when legally required; and
• authorized service providers involved in the operation of the Platform.

The Platform does not sell personal information or health-related information to third parties.

6. RESTRICTED ACCESS TO HEALTH INFORMATION

Access to health-related information is restricted only to authorized personnel, healthcare providers, pharmacies, contractors, and service providers who require such access for legitimate healthcare, operational, compliance, security, or support-related functions.

The Platform implements reasonable safeguards designed to minimize unnecessary access to sensitive information.

7. SECURITY SAFEGUARDS

The Platform implements reasonable administrative, organizational, technical, and physical safeguards designed to protect personal and health-related information, including:

• encryption of data in transit and at rest;
• role-based access controls;
• authentication and session management;
• audit logging and monitoring;
• restricted internal access procedures;
• vulnerability assessments;
• and security monitoring practices.

While reasonable safeguards are implemented, no electronic system can guarantee absolute security.

8. USER RESPONSIBILITIES

Users are responsible for:

• maintaining the confidentiality of account credentials;
• safeguarding passwords and devices;
• protecting authentication methods and login sessions;
• and promptly reporting suspected unauthorized access or security incidents.

Users should avoid sharing account credentials with unauthorized persons.

9. DATA RETENTION

Personal and health-related information may be retained for periods reasonably necessary to:

• comply with legal obligations;
• facilitate continuity of healthcare services;
• resolve disputes;
• conduct audits;
• enforce agreements;
• and satisfy operational or regulatory requirements.

Thereafter, records may be securely deleted, anonymized, archived, or otherwise disposed of in accordance with applicable laws and internal retention policies.

10. DATA INCIDENT RESPONSE

In the event of a confirmed data breach or unauthorized disclosure involving sensitive personal or health-related information, the Platform shall take reasonable steps to:

• investigate the incident;
• contain and mitigate potential harm;
• notify affected individuals when legally required;
• and comply with applicable reporting obligations under applicable laws and regulations.

11. COOKIES AND ANALYTICS

The Platform may use cookies, analytics tools, and similar technologies to:

• improve user experience;
• analyze usage patterns;
• maintain security;
• and enhance Platform functionality.

Users may manage cookie preferences through their browser or device settings where applicable.

12. THIRD-PARTY SERVICES

The Platform may utilize third-party providers for:

• cloud hosting;
• payment processing;
• analytics;
• logistics;
• customer support;
• and related operational functions.

Such providers may process information only to the extent reasonably necessary to perform their services and are expected to implement reasonable safeguards for data protection.

13. MINORS AND DEPENDENTS

Where healthcare services are requested on behalf of minors or dependents, the User represents and warrants that they possess the necessary legal authority and consent to provide personal and health-related information for such individuals.

Parents, guardians, or authorized representatives are responsible for supervising Platform use by minors under their care.

14. USER RIGHTS

Subject to applicable laws, Users may have the right to:

• access their personal information;
• request correction of inaccurate information;
• request deletion where legally permissible;
• withdraw consent where applicable;
• and raise concerns regarding data privacy practices.

Requests may be subject to identity verification and legal or operational limitations.

15. CROSS-BORDER DATA STORAGE

Certain information may be processed or stored using cloud infrastructure and service providers located within or outside the Philippines. Such processing may involve jurisdictions including Singapore, the United States, or other locations where the Platform's technology or service providers operate.

Appropriate contractual, organizational, and technical safeguards are implemented to protect personal information in accordance with applicable data privacy laws.

16. CHANGES TO THIS PRIVACY POLICY

The Platform reserves the right to update or modify this Privacy Policy at any time.

Continued use of the Platform after updates constitutes acceptance of the revised Privacy Policy.

17. CONTACT INFORMATION

For questions, concerns, requests, or complaints relating to this Privacy Policy or data privacy matters, Users may contact: