Privacy Policy

1. What Data We Collect

We collect the following categories of data through our platform:

a. Personal Data

• Name, contact information (email, phone), login credentials
• Professional credentials and affiliations (for users)
• Device, IP, and usage data

b. Health Information

When enabled by your healthcare provider:

• Patient demographic data
• Medical history, diagnoses, treatments, prescriptions
• Lab results, clinical notes, and other health-related information

Health data is only collected or processed as directed by your healthcare provider, who acts as the "Personal Information Controller" (under DPA) and "Covered Entity" (under HIPAA).

2. How We Use Your Data

We use your personal and health-related data to:

• Deliver and operate our EHR platform
• Provide technical support and resolve issues
• Maintain data security and platform integrity
• Analyze usage to improve platform performance and services
• Comply with legal obligations or regulatory audits

We do not sell or use personal data for advertising or commercial profiling.

3. Data Sharing and Disclosure

We may share data in the following limited circumstances:

• With authorized healthcare providers who use the platform for patient care
• With third-party service providers (e.g., hosting, analytics) under contractual agreements that ensure confidentiality and data protection
• As required by law, regulation, subpoena, or court order
• In emergencies or to protect the rights, safety, or health of individuals

Any sharing complies with both the DPA and HIPAA minimum necessary standards.

4. Data Security

We implement physical, technical, and administrative safeguards to protect personal data, including:

• Data encryption (at rest and in transit)
• Access controls and audit logging
• Regular vulnerability assessments
• Staff training on data privacy and security

5. Data Retention and Storage

We retain data only as long as necessary to fulfill the purposes described in this policy, or as required by law.

• Patient records are stored in compliance with the Philippine Department of Health regulations on record retention and may be stored longer to fulfill legal or clinical obligations.
• Upon account termination or expiration, we follow strict offboarding and data deletion protocols, unless otherwise agreed.

6. Your Rights

Under the DPA of 2012, you have the right to:

• Be informed about how your data is used
• Access your personal information
• Request correction of inaccurate data
• Object to processing or request data deletion (subject to contractual and legal limits)
• Lodge a complaint with the National Privacy Commission (NPC)

Where HIPAA applies, you may also request a copy of your health information or an accounting of disclosures.

To exercise any of these rights, contact us at agimat@amagi.io.

7. Children’s Privacy

Our platform is not intended for use by children under 13 unless authorized and supervised by a healthcare provider or legal guardian.

8. Updates to this Policy

We may update this policy from time to time to reflect changes in our services or applicable laws. We will notify you of material changes through the platform or by email. Continued use of the platform constitutes your acceptance of the updated policy.

9. Contact Us

Contacting the Data Protection Officer (DPO)

If you have any questions about this Privacy Policy, or wish to exercise any of your rights under applicable data privacy laws, you may contact our Data Protection Officer (DPO) at: