1. Introduction
Geopro Global Solutions Inc. ("Company," "we," "us," or "our") is the Personal Information Controller (PIC) for Easethetics, a cloud-based clinic management platform. We are registered with the National Privacy Commission (NPC) of the Philippines and have a designated Data Protection Officer (DPO).
This Privacy Policy explains how we collect, use, store, share, and protect your personal information in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (IRR), and applicable NPC issuances. This policy applies to all users of our products: Easethetics V2, Easebook, Easelife, and Easemart.
By using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described herein.
2. Information We Collect
2.1 Personal Information
We collect the following personal information as defined under Section 3(g) of RA 10173:
- Full name, date of birth, age, and gender
- Email address and phone number
- Home address and emergency contact information
- Profile photos
- Employment information (for clinic staff and employees)
- Account credentials (username and securely hashed password)
2.2 Sensitive Personal Information
As defined under Section 3(l) of RA 10173, we collect and process the following sensitive personal information with your explicit consent:
- Medical records, clinical notes, and treatment history
- Allergies, current medications, and medical conditions
- Prescriptions and prescription history
- Clinical photographs and before/after images
- Health-related attachments and documents
2.3 Financial Information
- Transaction history and payment records
- Payment method details (processed securely through EasePay)
- Membership points, tier status, and spending history
- Installment plan details
- Subscription and invoice records
2.4 Technical Information
- IP address and device information
- Browser type and version
- Firebase Cloud Messaging (FCM) tokens for push notifications
- Session data and cookies
2.5 Usage Information
- Appointment history and service preferences
- Communication logs (SMS and email correspondence sent through the platform)
- Platform usage patterns and feature interactions
3. How We Collect Information
We collect information through the following means:
- Directly from you: When you register an account, book an appointment, complete a transaction, or communicate with us.
- From clinics: When clinic staff enter your information into the platform as part of providing their services (e.g., medical records, treatment notes).
- Automatically: Through cookies, session tracking, and analytics tools when you access the platform.
4. Legal Basis for Processing
We process your personal information based on the following lawful criteria under Sections 12 and 13 of RA 10173:
- Consent: You have given your consent to the processing, particularly for sensitive personal information such as medical records (Section 13(a)).
- Contractual Necessity: Processing is necessary for the performance of a contract to which you are a party, such as your subscription agreement (Section 12(b)).
- Legitimate Interest: Processing is necessary for our legitimate interests, such as improving our services, ensuring platform security, and preventing fraud, provided these interests are not overridden by your rights (Section 12(f)).
- Legal Obligation: Processing is necessary to comply with a legal obligation, such as tax reporting or regulatory requirements (Section 12(c)).
5. How We Use Your Information
We use your information for the following purposes:
- Service Delivery: Managing clinic operations, patient records, appointments, point-of-sale transactions, inventory, and employee schedules.
- Appointment Management: Scheduling, reminders, and follow-up communications via SMS and email.
- Billing and Payments: Processing subscription fees, generating invoices, managing payment transactions, and tracking membership points.
- Communications: Sending transactional notifications, appointment reminders, marketing campaigns (with consent), and platform updates.
- Analytics and Improvement: Analyzing usage patterns to improve platform features, performance, and user experience.
- Security: Protecting the platform and users against unauthorized access, fraud, and other security threats.
- Legal Compliance: Fulfilling our obligations under Philippine law and responding to lawful requests from authorities.
6. Information Sharing and Third Parties
We share your information with the following third-party service providers, strictly for the purposes of delivering our services:
| Service Provider |
Purpose |
Location |
| EasePay |
Payment processing |
Philippines |
| GeoPro SMS |
SMS communications |
Philippines |
| SendGrid (Twilio) |
Email delivery |
United States |
| Firebase / FCM (Google) |
Push notifications |
United States |
| Amazon Web Services (AWS S3) |
Cloud file storage |
Asia Pacific |
| Google Analytics |
Website analytics |
United States |
| AyrShare |
Social media management |
United States |
| GeoWebSaaS |
Live chat (WebSocket) |
Philippines |
| Rollbar |
Error monitoring |
United States |
We do not sell your personal information. We may also disclose your information when required by law, court order, or government regulation.
7. International Data Transfers
Some of our third-party service providers are located outside the Philippines (primarily in the United States). When your data is transferred internationally, we ensure adequate safeguards are in place in accordance with NPC Circular 2016-02, including:
- Ensuring the receiving country has adequate data protection standards.
- Implementing contractual safeguards with service providers.
- Limiting the data shared to what is necessary for the specific service.
8. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, and resolve disputes. Our retention practices include:
- Active accounts: Data is retained for the duration of your subscription and active use of the platform.
- Medical records: Retained in accordance with Philippine medical record retention requirements and clinic policies.
- Financial records: Retained as required by Philippine tax and accounting regulations.
- Deleted data: We use a soft-delete approach where records are marked as deleted but may remain in our systems for a reasonable period before permanent removal, as required for data integrity and legal compliance.
- Post-termination: Upon account termination, you may request a data export within thirty (30) days. After this period, data will be deleted or anonymized in accordance with our retention schedule.
9. Data Security
We implement appropriate organizational, technical, and physical security measures to protect your personal information, including:
- Authentication: Session-based authentication with secure credential storage.
- Encryption: Encrypted connections (HTTPS/TLS) for all data in transit.
- Access Control: Role-based access control (RBAC) ensuring users only access data relevant to their role and permissions.
- File Security: Hashed file storage paths for uploaded documents and media.
- Monitoring: Error monitoring and logging to detect and respond to security incidents.
- Infrastructure: Cloud hosting on managed infrastructure with regular security updates.
While we strive to protect your personal information, no method of transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents in accordance with NPC requirements.
10. Rights of Data Subjects
Under Sections 16 through 18 of RA 10173, you have the following rights:
- Right to be Informed: You have the right to be informed of the collection and processing of your personal data, including the purpose, scope, and method of processing.
- Right to Access: You have the right to request access to your personal data held by us, including information about how it has been processed and shared.
- Right to Object: You have the right to object to the processing of your personal data, including processing for direct marketing purposes.
- Right to Erasure or Blocking: You have the right to request the suspension, withdrawal, blocking, removal, or destruction of your personal data from our systems.
- Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data.
- Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format.
- Right to Damages: You have the right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
- Right to File a Complaint: You have the right to file a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.
To exercise any of these rights, please contact us at support@easethetics.ph. We will respond to your request within a reasonable period, not exceeding thirty (30) days.
11. Sensitive Personal Information
We process sensitive personal information (such as medical records and health data) only with your explicit consent, as required by Section 13 of RA 10173. This consent is obtained at the time of data collection. You may withdraw your consent at any time; however, this may affect our ability to provide certain services.
Sensitive personal information is subject to enhanced security measures and access restrictions. Only authorized personnel with a legitimate need to access such information may do so.
12. Children's Privacy
Easethetics does not impose age restrictions on its services, as clinics serve patients of all ages. However, for patients under eighteen (18) years of age, clinics are responsible for obtaining appropriate parental or guardian consent before entering their personal and sensitive information into the platform, in accordance with Section 17 of the IRR of RA 10173.
13. Cookies and Tracking Technologies
We use the following cookies and tracking technologies:
- Session Cookies: Essential for maintaining your authenticated session while using the platform. These cookies are temporary and expire when you close your browser or log out.
- Functional Cookies: Used to remember your preferences, such as selected branch and display settings.
- Analytics (Google Analytics): We use Google Analytics (ID: G-X7D9W80HJ7) to collect anonymized usage data to understand how the platform is used and to improve our services. Google Analytics may set its own cookies. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
You may configure your browser to refuse cookies, but this may limit your ability to use certain features of the platform.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws. We will provide at least thirty (30) days' notice of material changes through the platform, email notification, or other appropriate means. The "Effective Date" at the top of this policy indicates when the latest revisions took effect.
Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:
If you believe your data privacy rights have been violated, you may file a complaint with the:
