Privacy Policy

Introduction This Privacy Policy ("Privacy Policy") details the data protection and privacy practices of The Med Club Health Group, Inc. and its affiliates (collectively, "EONS HEALTH," "EONS," "we," "our," or "us"). This Privacy Policy applies to the website located at www.eonshealth.ph, our mobile applications, and all related digital health and telehealth services (collectively, the "Services" or "Platform"). We are deeply committed to safeguarding your privacy. This Privacy Policy is designed in strict compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the regulatory issuances of the National Privacy Commission (NPC) of the Philippines. This Privacy Policy is incorporated directly into our Terms of Service. All capitalized terms not defined herein share the meanings assigned to them in the Terms of Service. PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT USE THE SERVICES. 1. Definition of Terms To ensure complete transparency, we use the following definitions established by Philippine law: Personal Information (PI): Any information from which the identity of an individual is apparent or can be reasonably and directly ascertained. Sensitive Personal Information (SPI): Data pertaining to your race, marital status, age, color, religious/philosophical/political affiliations, health, education, genetic or sexual life, government-issued IDs, and health records. Personal Information Controller (PIC): The person or organization who controls the collection, holding, processing, or use of personal information. Personal Information Processor (PIP): Any qualified natural or juridical body to whom a PIC may outsource the processing of personal data. 2. Our Role in Your Privacy EONS HEALTH operates as a digital health platform bridging patients with independent healthcare providers. Therefore, data responsibilities are divided as follows: EONS HEALTH as the Controller (PIC): When you browse the Platform, register an account, make a payment, or contact our customer support, EONS HEALTH acts as the PIC. We dictate how your general contact, financial, and technical data is processed. Medical Partners as the Controller (PIC) / EONS HEALTH as the Processor (PIP): When you engage in a telehealth consultation, submit a medical intake form, or receive a prescription, the independent licensed medical group or physician acts as the PIC for your Sensitive Personal Information (health records). They are legally responsible for your clinical care. In this context, EONS HEALTH acts strictly as the PIP, providing the secure digital infrastructure to store and route your medical data exclusively upon the documented instructions of your treating Provider. 3. The Information We Collect and the Sources of Such Information We collect various types of information through your use of the Services to ensure safe, effective, and legally compliant healthcare delivery. Information You Provide Directly to Us: Identity and Contact Data: Your full legal name, residential address, shipping address, telephone number, email address, date of birth, sex at birth, and government-issued identification (e.g., Driver's License, Passport) required for identity and age verification. Health and Medical Data (SPI): Detailed information regarding your medical history, current symptoms, past surgeries, known allergies, current medications, lifestyle preferences, uploaded medical photographs, and laboratory results. Financial Data: Billing information, including credit card numbers, e-wallet details, and billing addresses. This data is collected directly by our PCI-DSS compliant third-party payment processors. EONS HEALTH does not store your full financial data on our servers. Communications: Records of correspondence when you contact customer service, submit feedback, or utilize the secure messaging features to speak with Providers or pharmacists. Information Generated Through the Services: Clinical Records: Provider consultation notes, differential diagnoses, recommended treatment plans, and electronic prescriptions. Transactional Data: Details about your booked consultations, products ordered, pharmacy fulfillment status, and delivery tracking information. Information We Collect Through Automated Means: Device and Technical Data: Your Internet Protocol (IP) address, browser type and version, operating system, device identifiers (e.g., MAC address, Apple IDFA), and network connection type. Usage Data: Platform analytics including landing pages, exit pages, time spent on specific pages, clickstream data, search queries, and error logs. Location Data: Coarse location data (e.g., city or region derived from your IP address) to ensure you are physically located within the Philippines, as required by our Terms of Service. We will request explicit permission before accessing precise GPS location data. Information From Third-Party Sources: Medical Laboratories: With your explicit consent, we may receive diagnostic test results directly from affiliated laboratories to integrate into your EONS HEALTH medical record. Logistics Partners: Real-time delivery status updates, proof of delivery photos, and tracking information from our third-party courier partners. 4. Purposes for How We Use Your Information We process your personal data only when we have a lawful basis to do so. We utilize your data for the following specific business and clinical purposes: Clinical and Operational Fulfillment: To verify your true identity and age. To facilitate secure telehealth consultations between you and independent licensed Providers. To generate, securely store, and manage your Electronic Health Records (EHR). To transmit approved electronic prescriptions to licensed partner pharmacies for accurate dispensation. To coordinate the physical delivery of medications and wellness products to your designated address. Account Management and Customer Support: To process your payments, issue official receipts, and manage refunds or chargebacks. To communicate with you regarding appointment reminders, medication schedules, and order statuses. To provide technical support, troubleshoot platform errors, and respond to your inquiries. Platform Improvement and Analytics: To conduct internal research, analyze user demographics, and monitor platform performance. To test new features, optimize the user interface, and ensure content is presented effectively for your specific device. Security, Legal, and Regulatory Compliance: To prevent, detect, and investigate fraudulent activities, unauthorized access, or breaches of our Terms of Service. To comply with the strict regulatory reporting requirements of the Department of Health (DOH), Food and Drug Administration (FDA), and Philippine Drug Enforcement Agency (PDEA). To establish, exercise, or defend our legal rights in the event of disputes or litigation. Marketing and Communications (Subject to Consent): To send you newsletters, health insights, and promotional offers regarding EONS HEALTH products and services. You may opt out of these communications at any time. 5. How We Share and Disclose Your Information EONS HEALTH treats your medical data with uncompromising confidentiality. We do not sell your personal data to data brokers or third-party marketers. We share your data only under strict confidentiality and data-sharing agreements in the following circumstances: Affiliated Healthcare Providers: Your health data, intake forms, and medical photos are securely transmitted to the licensed physicians, diagnostic centers, and medical groups responsible for evaluating your health and providing clinical care. Licensed Pharmacy Partners: If a prescription is issued, we transmit the required statutory details (patient name, age, address, and prescribed medication) to an accredited pharmacy to fulfill and label your order in compliance with the Pharmacy Law. Logistics and Delivery Services: We share your name, contact number, and delivery address with third-party couriers (e.g., Grab, Lalamove, LBC) solely to execute the physical delivery of your products. Third-Party Service Providers: We employ trusted vendors to perform business functions on our behalf. These include secure cloud hosting providers (e.g., AWS, Google Cloud), payment gateways (e.g., PayMongo, Stripe), SMS/email routing services, and data analytics platforms. These PIPs are contractually bound to use your data only for the specific services they provide to us and are subject to the same DPA standards. Corporate Affiliates: We may share data within The Med Club Health Group, Inc. and its subsidiaries to streamline operations, provide customer support, and enhance our service offerings. Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or part of our assets, customer data and electronic health records may be transferred to the acquiring entity, subject to the continued maintenance of strict privacy safeguards. Legal and Emergency Disclosures: We will disclose your information to government regulators, law enforcement (e.g., NBI, PNP), or judicial authorities if strictly required by a valid subpoena, court order, or legal mandate. We may also disclose data if we believe in good faith that it is necessary to protect the physical safety of you, our Providers, or the public (e.g., in cases of a medical emergency or self-harm). 6. Your Rights Under the Data Privacy Act (RA 10173) EONS HEALTH fully recognizes and respects your rights as a data subject under Philippine law. You possess the following rights: Right to be Informed: You have the right to know how your data is collected, processed, and stored, as detailed in this Privacy Policy. Right to Object: You may object to the processing of your personal data, specifically for direct marketing or automated profiling. Right to Access: You may request a summary or a copy of the personal data we hold about you. Right to Rectification: You may request the immediate correction of any inaccurate, outdated, or incomplete personal data in your profile. Right to Erasure or Blocking: You may request the deletion, blocking, or removal of your data if it is no longer necessary for the purposes collected, or if you withdraw your consent. (Please see "Data Retention" below regarding mandatory medical record preservation). Right to Damages: You have the right to claim compensation if you suffer damages due to the unlawful or unauthorized use of your data. Right to Data Portability: You may request a copy of your data in a secure, commonly used electronic format to transfer to another service provider. Right to File a Complaint: You have the right to lodge a formal complaint with the National Privacy Commission (NPC) if your privacy rights are violated. How to Exercise Your Rights: To submit a data access, correction, or deletion request, please email our Data Protection Officer at legal@eonshealth.ph with the subject line "Data Subject Request." To protect your medical privacy, we will require you to provide a valid government-issued ID to verify your identity before processing your request. We will respond to all verified requests within thirty (30) days. 7. Data Security Measures We implement enterprise-grade physical, technical, and organizational security protocols to protect your Sensitive Personal Information. Technical Safeguards: All data transmitted between your device and our servers is encrypted using industry-standard TLS/SSL protocols. Data at rest in our databases is secured utilizing Advanced Encryption Standard (AES) algorithms. Organizational Safeguards: EONS HEALTH employees and contractors are bound by strict Non-Disclosure Agreements (NDAs). Access to production databases and medical records is governed by the Principle of Least Privilege (PoLP) and requires multi-factor authentication (MFA). Physical Safeguards: Our Platform is hosted on world-class, ISO-certified cloud infrastructure (e.g., AWS/GCP) which maintains rigorous physical security, biometric access controls, and 24/7 monitoring. While we proactively defend our infrastructure, no system connected to the Internet is completely immune to cyber threats. You are responsible for keeping your account password confidential and secure. In the event of a personal data breach, we will notify the NPC and affected data subjects within seventy-two (72) hours as required by law. 8. Retention of Your Information We retain your personal data only for as long as is legally or operationally necessary. Account Data: General profile information is retained for as long as your account remains active. Medical Records (Mandatory Retention): The Department of Health (DOH) and standard Philippine medical-legal practices mandate that patient medical records, consultation notes, and prescription logs must be retained for a minimum period (typically ten (10) to fifteen (15) years). Therefore, even if you request the deletion of your EONS HEALTH account, our Medical Partners are legally obligated to securely archive your clinical records for the duration of the statutory retention period to comply with medical malpractice statutes and DOH audits. Financial Records: Transactional logs and billing records are retained for ten (10) years in compliance with Bureau of Internal Revenue (BIR) regulations. Once the retention period expires, your data will be permanently and securely deleted or anonymized so that it can no longer be associated with you. 9. Cookies, Analytics, and Online Advertising We utilize cookies and similar tracking technologies to enhance your browsing experience and optimize our Platform. Strictly Necessary Cookies: Required for the core functionality of the Platform, such as keeping you securely logged in and saving your intake form progress. Performance and Analytics Cookies: We use tools like Google Analytics to collect aggregated, de-identified data regarding page views, traffic sources, and platform performance. Marketing and Pixel Tags: We may utilize tracking pixels (e.g., Meta Pixel) to deliver targeted advertisements for EONS HEALTH services on third-party websites and social media platforms. Managing Cookies and Do Not Track (DNT): You can configure your web browser to refuse all non-essential cookies or alert you when a cookie is being sent. If you disable cookies, certain features of the Platform may not function correctly. Currently, our systems do not uniquely respond to automated "Do Not Track" (DNT) signals from browsers. 10. Third-Party Links and Services The Platform may contain links to external websites, articles, or services that are not operated by EONS HEALTH. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or data practices of any third-party sites or services. 11. Children's Privacy The Services are strictly intended for adults. We do not knowingly permit individuals under the age of eighteen (18) to create an account, nor do we knowingly collect personal data directly from minors without verifiable parental or legal guardian consent. If we discover that a minor has provided us with personal data unlawfully, we will take immediate steps to terminate the account and purge the data from our servers. 12. Cross-Border Data Transfers EONS HEALTH is based in the Philippines, and our primary operations target users within the country. However, to provide reliable, highly available Services, we utilize premier cloud infrastructure providers whose servers may be located outside the Philippines (e.g., Singapore or the United States). By using the Services, you consent to the transfer, storage, and processing of your data on these secure international servers. We ensure that all cross-border data transfers comply with the Data Privacy Act of 2012 and that our overseas PIPs provide a comparable standard of data protection. 13. Revisions to Our Privacy Policy We reserve the right to update or modify this Privacy Policy at any time to reflect changes in regulatory frameworks, technological advancements, or our operational processes. If we make material changes to how we treat your Sensitive Personal Information, we will notify you via email or through a prominent notice on the Platform prior to the change becoming effective. The "Effective Date" at the top of this document will always indicate the latest revision. Your continued use of the Services following the posting of an updated Privacy Policy constitutes your acceptance of the changes. 14. Contacting Us / Data Protection Officer If you have any questions, concerns, or complaints regarding this Privacy Policy, our data protection practices, or if you wish to exercise your rights under the Data Privacy Act of 2012, please contact our Data Protection Officer (DPO) at: EONS HEALTH / The Med Club Health Group, Inc. Attn: Data Protection Officer (DPO) Email: legal@eonshealth.ph (Registered corporate office details in Quezon City, Philippines, available upon written request)