Privacy Policy and Data Governance Statement
Last Updated: May 13, 2026
Exakt Medical Services Corporation (“Company,” “Exakt,” “we,” “us,” or “our”) is a Philippine-based system integrator and technology solutions provider for national government agencies (NGAs), local government units (LGUs), public and private healthcare facilities and institutions, and select private sector clients.
We design, develop, and operate web portals, mobile applications, cloud-based SaaS platforms, APIs and system integrations covering smart infrastructure, digital governance, digital healthcare, and security/digital economy services.
Our offerings include:
- reliable network and data center infrastructure (CCTV, connectivity, IoT) to support public safety and services;
- government workflow and e-government systems (e-signatures, e-forms, document management, blockchain recordkeeping) to enable paperless transactions and anti-red tape reforms;
- real-time digital healthcare solutions (EMR/EHR systems, disease surveillance for dengue and other conditions, telemedicine, digital pharmacies, diagnostics and prescription management) to improve LGU health service delivery; and
- cybersecurity, payment gateway and revenue systems (SSL, firewalls, fraud monitoring, payment processing) for secure revenue collection and leakage prevention.
This Privacy Policy and Data Governance Statement covers all systems and services under our control – including websites, mobile apps, APIs, cloud infrastructure (both local and international), third-party integrations, logs and telemetry – and governs our collection, use, disclosure, retention and security of personal and sensitive personal data.
For clarity, the following terms are used throughout this Policy:
“Personal Information” (PI) means any information, recorded in any form, from which an individual’s identity is apparent or can be reasonably and directly ascertained by the entity holding the information. Examples include names, birthdates, addresses, contact details, user IDs and account credentials.
“Sensitive Personal Information” (SPI) includes PI about an individual’s health, medical records, genetic or sexual life, as well as government-issued identifiers (social security, tax ID, health insurance records, licenses). In our healthcare services, SPI typically consists of patient medical history, diagnoses, treatment plans, prescriptions, lab results, and consultation notes.
“Processing” means any operation performed on personal information, such as collection, recording, organization, storage, retrieval, consultation, use, transmission, sharing, erasure or destruction. Use of analytics, logging, monitoring, encryption or transformation of data also constitute processing.
“Data Subject” refers to a natural person to whom personal information pertains (e.g. patients, medical staff, citizens whose data is collected by government systems).
“Personal Information Controller” (PIC) is an organization (or person) that controls the collection, holding, processing or use of personal data. Exakt Medical Services Corporation is a PIC for the data collected in its systems.
“Personal Information Processor” (PIP) is any person or entity who processes personal data on behalf of the controller (e.g. cloud hosting companies, analytics service providers).
“Integration Partner” means a third-party system or organization that connects to our platforms via APIs or data interfaces (e.g. government databases, partner healthcare networks, external medical equipment).
“Healthcare Provider” means licensed medical professionals or institutions (doctors, nurses, clinics, hospitals, laboratories, pharmacies) that collect or receive patient data in the course of providing medical care.
We collect and process the following categories of personal information in the course of our operations:
Personal Information: Identity and contact data such as full name, date of birth, gender; addresses and phone numbers; email and account login credentials; billing and payment information (e.g. bank account or card details for transactions); government IDs and licenses. These are collected when individuals register for accounts, consent to services, or are entered into our systems (e.g. patient registration forms, government employee records).
Sensitive Personal Information: Health-related data including medical histories, diagnoses, treatment plans, prescription records, laboratory and diagnostic results, radiology images or reports, consultation notes, and any other medical records. We also may collect biometric or genetic data if required by a specific healthcare service. This category is treated with heightened protection.
Technical Data: Information about user devices and usage, such as device identifiers (UUIDs, MAC addresses), mobile device information, IP addresses, operating system and browser details, geolocation data (with consent), and metadata. We log authentication data (login timestamps, session tokens) and security logs. These are collected automatically through our platforms for security, troubleshooting and service optimization.
Integration/System Data: Machine-to-machine or system data including API call logs, system event logs, audit trails, transaction records, interoperability datasets exchanged with other government or health systems, encrypted payloads, and telemetry data. For example, system-to-system messages exchanged with a city health department’s dengue surveillance system, or logs of health claims submitted to PhilHealth. This data does not identify individuals by itself but may contain personal data in context of transactions.
We collect data through web/mobile forms, API integrations with partner systems, manual entry by authorized personnel, and automated means (cookies, SDKs, network logs). All collection is for specified purposes under this policy.
Our processing of personal data is governed by Republic Act No. 10173 (Data Privacy Act of 2012) and its IRR. Lawful bases for processing include:
Consent: We process personal data with the freely given, specific, informed consent of the data subject (obtained through consent forms, click-through agreements, or explicit opt-ins). For sensitive data (health), we obtain specific consent for the intended purpose.
Contractual Necessity: Processing is necessary to fulfill our contractual obligations to the data subject or to take steps at their request before entering into a contract. For example, processing patient data to provide telemedicine consultations or implementing a government IT project.
Legal Compliance: When processing is required to comply with a legal obligation under Philippine law or regulation (e.g. mandatory health reporting, taxation, auditing, court orders), we process the necessary data.
Medical and Vital Interests: Processing of health information is permitted when necessary to protect the life or health of the data subject (e.g. emergency care when consent cannot be obtained). Likewise, in a public health crisis, we may process data for disease control in compliance with health laws.
Public Health/Emergency: Processing may occur to respond to national emergencies or public safety requirements, or to fulfill a government function that includes processing personal data. For instance, outbreak surveillance for dengue or COVID-19 under government mandate.
Legitimate Interests: We may process personal data for our legitimate business interests (such as internal security, fraud prevention, system maintenance) where those interests do not override the fundamental rights of data subjects. Such processing is carefully scoped and documented, and individuals have the right to object or restrict processing if they believe their rights are outweighed.
We process personal data only for legitimate, specified purposes, including:
Healthcare Delivery: To operate EMR/EHR systems (e.g. patient registration, medical history, lab results) and support clinical workflows. To enable doctors and nurses to access patient data for diagnosis and treatment.
Telemedicine and e-Consultation: To facilitate remote doctor-patient consultations, video visits, and online prescribing, transmitting patient histories and vitals securely to remote providers.
Diagnostics & Prescriptions: To manage diagnostic test orders/results and digital prescriptions, ensuring correct medications are dispensed.
Hospital and Clinic Administration: Scheduling, billing, and claims processing for medical procedures and medications (including integration with PhilHealth and insurers).
System Integration: To support interoperability between agencies and systems (e.g. sharing health records with authorized government health portals, integrating government e-payment collections, or interfacing with court/law enforcement systems under lawful request).
Analytics and Research: To analyze anonymized health and operational data for quality improvement, reporting (e.g. disease trend analysis, resource planning), and legitimate research projects, always in accordance with laws on privacy and ethics.
Cybersecurity and Fraud Monitoring: To detect and prevent unauthorized access, fraud, malware, or other security threats to our systems (e.g. intrusion detection, anomaly detection, risk scoring).
Compliance and Audits: To maintain records and logs required by law, auditors, or regulatory agencies (e.g. DOH reporting, NPC audits).
Business Operations: For internal purposes such as system support, account administration, customer service, and performance monitoring of our services.
Every purpose is explicitly declared at or before the time of collection (in registration forms, terms of use or privacy notices) and data is not used for purposes beyond those declared without further consent or legal authority.
We only share personal data with third parties on a need-to-know basis, under strict conditions of confidentiality and security:
Healthcare Providers: We share patient personal data and medical records with other healthcare entities (e.g. referring physicians, specialist clinics, hospitals, labs, pharmacies) only as necessary for the patient’s care. For example, we may transmit a patient’s EMR to an outside laboratory for testing, or share prescription orders with a pharmacy. Such disclosures are limited in scope (purpose-limited), encrypted in transit, and governed by business associate or data-sharing agreements mandating confidentiality and compliance with applicable healthcare privacy laws.
Government Agencies: We may disclose personal or health data to government bodies under lawful requirements. This includes sharing data with the National Privacy Commission or Department of Health for compliance and regulatory reporting; with PhilHealth or insurance agencies for claims validation; with courts or law enforcement upon valid legal orders or subpoenas. All such transfers are done only to the extent required by law and under formal processes. We require the recipient agency to treat the data confidentially and use it only for the specific stated purpose.
Service Providers: We engage trusted third-party service providers (subprocessors) to perform certain functions on our behalf. This includes cloud hosting companies, IT support vendors, data analytics firms, payment processors, email/communication services, and mobile app infrastructure. All service providers are contractually bound to implement security controls (consistent with RA 10173 Sec.20(d)) and may use the data only as instructed by us. We disclose only the minimum personal data necessary for them to provide their service (e.g. a payment gateway only receives account/billing data, not full health records). Service providers handling SPI in large scale must also be registered as PIC/PIP under NPC rules.
Integration Partners: Our platforms may exchange data with partner systems via APIs or secure file transfers. For instance, we may integrate with third-party health information exchanges, identity verification services, or external health device platforms. Each integration partner must agree to data protection terms specifying purpose limitation, encryption, non-retention beyond need, and strict confidentiality. Data flows are logged and monitored.
In all disclosures, we enforce purpose limitations and confidentiality through written contracts. We require partners to implement at least comparable security measures (as demanded by Sec.21 of the DPA). No data is shared for marketing or unrelated purposes.
Some of our cloud infrastructure and partners may be located or hosted outside the Philippines. Cross-border transfers of personal data (e.g. hosting services in other jurisdictions, international API calls) are conducted under strict safeguards. We ensure a lawful basis for any off-shore processing (consistent with Sec.6 of RA 10173) and implement contractual and technical protections such as:
Data encryption in transit and at rest. Only approved cryptographic algorithms and secure channels (TLS) are used for international data transfers.
Data Processing Agreements or Standard Contractual Clauses with foreign providers, requiring compliance with Philippine data privacy laws and confidentiality obligations.
Adherence to the NPC’s cross-border guidelines (accountability principle), ensuring that data subjects’ rights are preserved when data is processed abroad.
Logical segregation of sensitive data by region, and controls to ensure that no data leaves the cloud region without authorization.
We also monitor and audit cross-border flows. In summary, any offshore processing is subject to the same accountability and risk assessment as local processing, and we mitigate risks through legal agreements and technology controls.
Our websites and applications use cookies and similar technologies to improve functionality and collect analytics. Examples include:
Session Cookies: Temporary cookies that maintain user sessions (for logged-in users) and preferences. They do not store sensitive data, expire at session end, and are essential for site functionality.
Persistent Cookies and Local Storage: May be used for “remember me” login features or to save language/currency preferences. Users can delete or block cookies via their browser settings.
Analytics and SDKs: We may employ tools (e.g. Google Analytics, application performance monitoring SDKs, crash-reporting services) to track aggregate usage statistics (page views, error logs, app performance metrics). These tools may set their own cookies or identifiers; however, the data collected is generally anonymized or pseudonymized and used only in aggregate.
Advertising and Social Plugins: We do not use data for third-party advertising networks on our core services. However, integrated social media widgets or video embeds may set cookies under the provider’s policy. We encourage users to review the respective privacy policies of those social networks.
We do not track sensitive health details or personal data via cookies. All analytics data is treated as technical data under Sec.3(a.iii). above. Users have the ability to opt-out of non-essential cookies via their browser or device settings, and our Cookie Notice (on the website) explains how to manage these.
We implement a comprehensive set of administrative, physical and technical controls to protect personal data, in line with RA 10173 Sec.20 and ISO/IEC 27001:2022 best practices. Key security measures include:
Encryption: All personal and sensitive data is encrypted in transit (using TLS/SSL) and at rest (e.g. AES-256 or equivalent). For example, health records in our database and backups are stored encrypted. Encryption keys are securely managed.
Network Security: Firewalls, intrusion detection/prevention systems and Web Application Firewalls protect our networks and servers. Network segmentation isolates sensitive systems (e.g. production databases) from public-facing infrastructure. Regular vulnerability scanning and penetration tests are conducted to identify and remediate weaknesses.
Access Control: We enforce Role-Based Access Control (RBAC) – employees and contractors are granted the minimum permissions needed (“least privilege”). Access to sensitive systems requires multi-factor authentication (MFA) and strong password policies. Administrator and privileged access is audited and logged.
Monitoring and Logging: System and application logs are continuously collected and monitored for anomalies. We use Security Information and Event Management (SIEM) tools and automated alerting to detect unauthorized access or unusual activities. Logs are retained per policy and reviewed regularly.
Security Policy and Governance: We maintain documented information security policies, including an Acceptable Use Policy, Data Classification Policy, Incident Response Plan, and Vendor Security Policy. These policies are reviewed and updated annually. All personnel with system access are trained on security and confidentiality obligations.
Secure Development: Our software development lifecycle (SDLC) incorporates secure coding standards. Code is reviewed, tested, and scanned for vulnerabilities before deployment. We apply security patches to operating systems and applications promptly. We follow privacy-by-design and data minimization in development.
Physical Security: Data centers and offices are protected by physical access controls (keycards, locks, CCTV). Hardware containing data is securely disposed of (e.g. disk wiping) when decommissioned.
Third-party Security: Vendors and subprocessors are vetted for security. Contracts require them to comply with equivalent security measures and to notify us of any breaches. (Per DPA Sec.24, we ensure third parties register with the NPC if handling sensitive data of ≥1000 individuals.)
We continually align with ISO/IEC 27001:2022 requirements (our ISMS is certified) and NPC guidelines on organizational and technical safeguards. (Note: certification is limited to our ISMS scope and does not guarantee absolute security.)
NPC Registration: Exakt Medical Services Corporation is duly registered with the National Privacy Commission (NPC) under Registration No. PIC-014-288-2025. We renew our registration annually; the current certificate is valid until 03 November 2026. Per NPC rules, this registration serves as proof of our compliance with DPA registration requirements, but it is not an endorsement or certification of security measures.
Internal Governance: We have a Data Protection Officer (DPO) and privacy team overseeing compliance. An executive-level privacy officer is designated as accountable for DPA compliance; per law, this person’s identity is available on request. We conduct regular Data Protection Impact Assessments for high-risk projects (especially new health or analytics systems). A formal risk management program identifies and mitigates privacy and security risks. Organizational policies (Information Security Policy, Privacy Policy, Incident Response Plan, Vendor Management Policy, Access Control Policy, etc.) are in place and enforced. We perform periodic internal and external audits of our data processing and security controls. Vendors and subprocessors undergo security due diligence and must comply with data protection requirements in contracts. We also adhere to relevant standards and best practices (e.g. OWASP for application security, COBIT for governance).
We retain personal data only as long as necessary for the purposes collected, in accordance with RA 10173 retention principles, and in compliance with any legal retention requirements. In general:
Medical and health records are retained according to healthcare regulations (e.g. Philippine health facility rules or insurance requirements). For example, hospitals typically retain patient records for several years (often 5–10 years or more, depending on local regulations) after the last treatment date to satisfy medical and legal needs.
Administrative, financial and billing records are kept for periods required by tax, auditing and financial laws (commonly 5–7 years).
System logs, security logs and backup copies are retained in accordance with regulatory requirements or industry standards (commonly 1–3 years) and then securely purged or archived.
We do not retain personal data indefinitely; at the end of its retention period, data is either securely deleted or permanently anonymized. Data no longer needed to comply with legal claims, contracts or legitimate interests is deleted or destroyed.
Our retention schedule is documented in a Data Retention Policy. All retention times are reviewed periodically, especially after changes in law or operational needs.
We uphold all rights granted to individuals under RA 10173 (Sec.16–19) and NPC guidelines. Data subjects (or their lawful representatives) may exercise the following rights:
Right to Be Informed: Data subjects are informed about processing of their data – purposes, recipients, storage period, etc. – through this policy, notices on forms, or direct communications. At the time of data collection, we disclose how the data will be used and their rights.
Right of Access: Individuals may request and obtain a copy of their personal information and related information (sources of data, recipients, processing methods, etc.) in our custody.
Right to Rectification: Individuals may correct or update inaccurate or incomplete data. Upon verification, we will make corrections promptly and inform downstream recipients of the change.
Right to Erasure/Blocking: A data subject can ask us to suspend, withdraw consent, or delete their personal data (or restrict processing) if the data is no longer necessary, was collected unlawfully, or is inaccurate. We will comply unless retention is required for legal claims or public interest, in which case access may be limited but not destroyed.
Right to Data Portability: Where applicable (i.e. data processed electronically in structured format), individuals can request a copy of their personal data in a commonly used electronic format, to be transferred to another controller.
Right to Object: Individuals may object to processing based on legitimate interests (including profiling) or for direct marketing. We will stop the contested processing unless overriding legitimate grounds exist or statutory requirements prevail.
Right to File a Complaint: Data subjects can lodge a complaint with our DPO or support team, or with the NPC at any time, regarding our processing of their data. Contact details for inquiries are provided below.
To exercise any right, the data subject must submit a request to our Data Protection Officer or support team (see Contact Information below). The request may be written or in any clear documented form (there is no mandatory form), as long as it contains sufficient information to identify the requester and the data or action concerned. Reasonable proof of identity (government ID or equivalent) is required before we act on the request. We do not require a fee for access or correction requests (we may charge only a minimal fee to cover reproduction or administrative costs, without being excessive). We will respond to requests “without undue delay” and within thirty (30) working days of receipt (for simplicity, 45 calendar days maximum). If a request is complex, we may extend the period by up to another 15 working days, but we will inform the requester of any delay and reasons. For requests involving government records, we comply with Republic Act 11032 (Ease of Doing Business Act), which mandates that government entities respond to records requests within three (3) working days.
We will keep a record of all data subject requests and our responses to demonstrate compliance.
We maintain a formal Incident Response Plan to address any data breach or security incident. This includes:
Detection and Monitoring: Continuous monitoring of systems and networks to detect unauthorized access, anomalies or suspicious activities. We use intrusion detection systems and log analysis to identify incidents early.
Containment: Upon suspected breach, we promptly isolate affected systems, change access credentials, and implement short-term fixes to prevent further data loss.
Investigation: We assemble a response team (IT, Security, Legal, DPO) to determine the scope, cause and impact of the breach. A documented investigation is conducted to identify how data was compromised.
Notification: In accordance with RA 10173 Sec.20(f) and NPC guidelines, if sensitive personal information or personal data that could enable identity fraud are believed to have been acquired by unauthorized parties, we will notify the NPC and affected individuals “without undue delay”. The notice will include the nature of the breach, data categories involved, and measures taken to mitigate the breach. Notification is done as soon as we have sufficient information (typically within 72 hours of detection), unless delaying is necessary to ensure systems are secure or for law enforcement reasons.
Mitigation and Remediation: We will take corrective actions to remedy vulnerabilities (patch systems, update credentials, enhance monitoring). We will also assist affected data subjects by advising them on protective steps (e.g. monitoring accounts) and implement credit monitoring if relevant.
Review: After resolution, we perform a post-incident review to improve our security posture and update policies to prevent recurrence. All incidents are logged and used to refine our risk management.
We comply with all applicable breach notification laws and work cooperatively with regulators during investigations. Regular drills and employee training ensure preparedness for incident handling.
Our services are primarily aimed at government, institutional or adult users. We do not knowingly collect personal data from children under 18 years of age except where parental or guardian consent is obtained and processing is appropriate (e.g. pediatric health records with parental authority). If a minor’s data is collected (for example, telemedicine involving a child), we require verifiable consent from a parent or legal guardian. Any processing of minors’ information includes additional safeguards – data is accessed only by licensed pediatric healthcare providers, and disclosures are handled with parental notification. If we become aware that we have inadvertently collected data from a child without proper consent, we will promptly delete it.
Our website and applications may include links or integrations with third-party products or services (e.g. social media plugins, third-party health apps, external payment gateways). We do not control these third-party systems and are not responsible for their privacy practices. Each third party has its own privacy policy, and users should review those policies before providing personal data to those services. Where our services require use of third-party services (such as cloud platforms, payment processors, communication services), we ensure those providers enter into agreements requiring them to handle data in compliance with this policy and the DPA (as noted in Sec.6(a.iii) and 9). Exakt Medical Services Corporation. does not take responsibility for any processing done by external sites or apps that users may choose to link to or use in conjunction with our services.
We may update this Privacy Policy from time to time. When we make material changes (e.g. new processing activities, new legal bases), we will revise the policy text and prominently post the updated version with the “Last Updated” date. We will also notify users through in-app notifications or email if a significant change affects how we handle their personal data. These notifications will explain the nature of the changes and any choice or action required. Under the principle of transparency, we commit to informing data subjects of updates in clear, plain language. Non-material adjustments (like clarifications) may be implemented without individual notice, but we encourage users to review this policy periodically.
We are here to help.
Send us a message for your inquiries and concerns.
Exakt Medical Services Corporation
5/F Hallare Building, 10 East Capitol Drive, Brgy. Kapitolyo, Pasig City, 1603 Metro Manila, Philippines
Telephone: +63 (2) 8631-8991
Email: dpo_exaktmed@exakt.com.ph for privacy-related inquiries and Data Subject Requests.
For additional support or technical issues, email medsupport@exakt.com.ph. Users may also submit requests via our website contact form (https://exaktmedical.com/#contact).
You may lodge any privacy concern or complaint with the National Privacy Commission at privacy.gov.ph (Mail: Atty. Johann Carlos S. Barcena, CESO III, Privacy Commissioner and Chairman, 25th-27th Floors, The Upper Class Tower, Quezon Ave. Corner Scout Reyes Street, Quezon City, Philippines; Email: complaints@privacy.gov.ph).
DPO Office Hours: The Data Protection Officer is available Monday through Friday, 10:00 AM – 5:00 PM, to address questions and assist with exercising data subject rights. We strive to respond to all inquiries promptly and in accordance with NPC guidelines.
Exakt Medical Services is a proud Certified Service Provider (CSP) for PhilHealth YAKAP. The logos of PhilHealth, YAKAP, local government units (LGU), and health facilities (HF) are trademarks and intellectual property of their respective owners. Uses of the PhilHealth, YAKAP, LGU, and HF names in this website are for identification purposes only and do not imply an endorsement, ownership, or affiliation with them.
© 2026 Exakt Medical Services, Corp. All Rights Reserved.
The Exakt Medical Services, EUDHS, PH-SCaN, and associated campaign names and logos are owned by Exakt Medical Services Corporation.