Privacy Policy

Provider: CAYDA Consulting & Solutions Inc.
Effective date: 8 October 2026

This Privacy Policy explains how personal data is processed through CAYDA HealthFlow under Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission. It applies to patients, parents and guardians, practitioners, clinic staff, and anyone who uses HealthFlow’s public booking, queue-tracking or document-verification pages.

1. Who is responsible for personal data

HealthFlow supports physicians and clinics in managing patient registration, consultations, clinical records, telemedicine, clinical documents, billing and related workflows.

For patient and clinical information, the physician, clinic or healthcare facility determines the purposes of processing and acts as the Personal Information Controller (PIC). CAYDA acts as Personal Information Processor (PIP) and processes that information on the PIC's documented instructions to provide and support HealthFlow. Where a patient is seen at more than one clinic, each clinic is a separate PIC for the records it creates.

Where a patient with an account verifies their mobile number, records that clinics created under the same details may be linked to that account so the patient can see their visits.

CAYDA separately acts as PIC for personal information that it processes for its own purposes, including account administration, professional-credential verification, subscription and billing, security, support and audit, the public doctor directory and symptom search, and document verification.

CAYDA Consulting & Solutions Inc. may be contacted at 6th Floor, 1CISP Building, 11 Mapagbigay corner Maunlad, Pinyahan, Quezon City, NCR 1100, Philippines. The Data Protection Officer is Anna Liza Yuson, reachable at dpo.cayda@protonmail.com.

2. Personal data processed

• Patient and guardian details, including name, date of birth, sex or gender, contact details, address, photograph, communication preferences, senior citizen or PWD status and ID number where applicable, and guardian details and relationship for minors.
• Clinical and care information, including appointments, intake information, medical history, vital signs, consultation notes and examinations, diagnoses, clinical documents and uploaded clinical files.
• Telemedicine information, including chat messages and files exchanged during a video or chat consultation.
• Consultation recordings: where the patient consents, audio of an in-person or video consultation and its transcript, used to prepare a draft clinical note.
• Billing and clinic transaction information, including invoices, payment and refund records, proof-of-payment images, receipt references, and HMO authorization and reimbursement information used by the clinic for its own tracking.
• Practitioner and clinic-user information, including contact details, date of birth, professional licence and registration numbers, uploaded verification documents, signature, professional profile information, taxpayer identification number, payment account details, and sign-in and security settings.
• Security and technical information, including IP address, browser information, sign-in and access records, audit records, and message delivery records.
• Information entered on public pages, including name, mobile number and booking details when booking without an account, and symptoms entered into the doctor search.

Personal data is collected from the data subject, from a parent or guardian, from physicians and clinic staff during care, and from CAYDA’s payment provider when it confirms a subscription payment. CAYDA may check a practitioner’s licence against the PRC’s public register.

3. Purposes and legal bases

Patient and clinical information is processed to provide the clinic's requested health-service workflows and recordkeeping functions. Depending on the particular processing, the clinic may rely on consent, contract-related necessity, legal obligations, medical-treatment grounds, or another lawful basis available under applicable law. Sensitive personal information is processed only where an applicable basis under Section 13 of the Data Privacy Act exists, including specific consent where required, medical treatment carried out by a medical practitioner or institution with appropriate safeguards, or processing provided for by law or regulation. Where processing relies on consent, consent may be withdrawn. Withdrawal does not affect processing already lawfully carried out or records the clinic must retain on another lawful basis.

For CAYDA's own PIC-side processing, CAYDA relies as applicable on contract or pre-contract steps, legal obligations, and legitimate interests such as service security, fraud prevention, credential verification, customer administration and protection of legal rights. Users are also asked where appropriate to consent to overseas processing and to automated transcription of consultation recordings, and may be asked to confirm their consent again when this Policy changes.

4. Automated assistance

HealthFlow may use automated tools to produce a draft clinical note from a consultation recording or from a practitioner’s handwritten notes. Recording is used only with the patient’s consent. A patient may decline, and the consultation continues without recording. The draft is reviewed, edited and signed by the attending physician. The doctor search uses automated tools to suggest doctors whose specialty fits the symptoms entered; it does not diagnose. HealthFlow does not make a clinical decision, diagnosis, treatment decision or other decision producing a legal or similarly significant effect on the patient. These tools are provided by CAYDA’s cloud provider, and the content is not used to train the AI models.

5. Service providers and cross-border processing

CAYDA uses service providers for cloud hosting and storage, sign-in, email and text messaging, video calls, speech-to-text and AI drafting and search, and payment processing for CAYDA subscriptions. Personal data is stored in Singapore. Some processing, including AI drafting, may take place in other countries in the Asia Pacific region. Text messages are sent through a Philippine provider. Card and e-wallet details for subscriptions are entered on the payment provider’s own page and are not received or stored by CAYDA. A current list of service providers is available from the DPO on request.

CAYDA requires appropriate contractual and security safeguards from service providers and remains accountable for processing performed on its behalf, including outside the Philippines, as required by applicable law. CAYDA does not sell personal data or use it for advertising.

6. Who can see your information

• Within a clinic, a patient’s information is available to the treating physician and to staff authorized by the clinic. A physician at another clinic sees a patient’s records only with the patient’s consent. HealthFlow does not send data to HMOs, PhilHealth, laboratories or pharmacies; the clinic shares documents with them directly. Personal data is disclosed to authorities only where required or permitted by law.
• Some HealthFlow pages can be opened from a link or QR code without signing-in, such as booking, queue-tracking, waiting-room and document verification pages. Anyone with such a link can open it, so it should not be shared unnecessarily. These pages show limited information: the waiting-room display does not show patient names and the verification page does not show the patient or the document’s contents.
• Verified practitioners with an active subscription are listed in HealthFlow’s public doctor directory. A listing shows the practitioner’s name, the professional profile they publish, their clinics, availability, and verification status. Practitioners manage this information from their profile. Patients pay consultation fees to the clinic directly; CAYDA does not receive them.

7. What is stored on your device

• HealthFlow does not use tracking or advertising cookies. It stores only what it needs to work: the user’s language choice, the sign-in session, and a copy of the app so it loads on a poor connection. Clinical records are not kept on the device, except that a clinic’s queue screen may keep its last view for a limited time so it can be read during an outage. Signing out removes personal data stored by HealthFlow from the device.

8. Retention and deletion

• Clinical records are retained for as long as the physician or clinic uses HealthFlow. After the practice subscription ends, CAYDA returns a copy of the records to the practice on request and then deletes them from active systems within the periods set out in the Terms of Service or the practice’s agreement, unless a longer period is required by law or a documented legal hold applies. The clinic remains responsible for keeping medical records for the period the law requires.
• Audit and access records are retained for seven years from the date of the record, then deleted. A record that identifies no one may be kept to show that the audit trail was not altered.

System and security logs are kept for limited periods, no longer than 400 days, and then deleted automatically. Uploaded and generated files are retained for up to 10 years from the date they were stored and are deleted earlier with the practice’s records. Deleted data may remain for a short time in encrypted backups and storage copies until they expire, and is not accessible through the application.

• Where the audit trail must keep a reference to a patient or user, the referenced record is anonymized so that it no longer identifies the individual.
• Account, message-delivery and subscription records are deleted or anonymized with the practice’s records, or earlier on a verified request to the DPO where applicable. An email address that cannot receive email or has reported CAYDA email as spam is kept on a do-not-send list until removed. The clinic remains responsible for retaining its own accounting and tax records for the period required by law.

9. Data-subject rights

Data subjects have the rights provided by the Data Privacy Act, including the rights to be informed, access personal data, correct inaccuracies, object where applicable, seek erasure or blocking in circumstances allowed by law, obtain data portability where applicable, seek indemnification for damage, and lodge a complaint with the National Privacy Commission. The lawful heirs of a deceased data subject may exercise rights to the extent provided by law. Patients can view and download their own records and correct their contact details from their account.

For patient and clinical information, requests should normally be directed first to the physician, clinic or healthcare facility that controls the record. CAYDA will assist the applicable PIC in responding. Requests relating to CAYDA's own processing may be sent to the DPO at dpo.cayda@protonmail.com. CAYDA responds within the period required by law. Information not included in the self-service download can be requested through the responsible clinic.

10. Security

CAYDA uses organizational, physical and technical measures to protect personal data, including: separation of each practice’s data and role-based access controls; multi-factor authentication for clinic and administrative users, also available to patients; encryption of data in storage and in transit; logging of access to and changes in records; automatic session time-outs; and security monitoring and automated vulnerability scanning. CAYDA personnel access a practice’s data only when needed for support or to meet a legal obligation; that access is restricted, authenticated, and logged. Exporting or deleting a practice’s records is done only on the practice’s request or at the end of the applicable retention period.

11. Personal data breaches

CAYDA maintains incident-response procedures. CAYDA will notify the applicable PIC without undue delay after becoming aware of a breach involving personal data that the PIC controls, and will provide information reasonably needed for the PIC’s compliance. Where notification to the National Privacy Commission or affected data subjects is required, the responsible PIC will make it within the period prescribed by applicable law.

12. Minors

Where HealthFlow is used for a patient under 18, the clinic verifies the parent or guardian relationship and obtains the authority or consent required. A guardian relationship cannot be created by claiming it in the app; once the clinic has recorded it, the guardian may book appointments for the minor. Access to the minor’s clinical records is requested through the clinic.

13. Changes and contact

CAYDA may update this Policy when the product, processing arrangements or legal requirements change. Material changes will be brought to users' attention in an appropriate manner, and re-consent will be obtained where legally required.

A practice may receive more detailed terms on processing, security and retention in its agreement with CAYDA. Those terms apply to that practice; this Policy describes how HealthFlow handles personal data generally.

Privacy enquiries: dpo.cayda@protonmail.com. General product enquiries: info@cayda.com.