Privacy Policy

1. Introduction

MediPaid Technologies Inc. ("MediPaid," "we," "us," or "our") and the Healthcare Finance Intelligence Council ("HFIC") are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites (https://medipaid.tech, https://hfic.medipaid.tech, and https://platoiq.medipaid.tech), our mobile and web applications, and use our services.

We comply with the Data Privacy Act of 2012 (RA 10173) of the Philippines, its Implementing Rules and Regulations, the issuances of the National Privacy Commission ("NPC"), and applicable international data protection standards including GDPR principles where applicable.

About HFIC

HFIC (Healthcare Finance Intelligence Council) is a neutral professional council powered by MediPaid that brings together healthcare operators, HMOs, clinics, diagnostic centers, TPAs, and healthtech builders for industry collaboration, research, and dialogue. Both MediPaid and HFIC users are subject to this Privacy Policy.

About DishCal PH

DishCal PH was previously named PlatoIQ. The name changed in August 2026; the service, the operator, and the data it holds are unchanged.

DishCal PH is a nutrition and medication tracking application built around Filipino food and the chronic conditions Filipino patients commonly manage. Unlike MediPaid's claims services and HFIC's member services, DishCal PH is used by individuals for their own health, not by organisations. Where this policy states a rule specific to DishCal PH, that rule governs for DishCal PH users.

2. Our Commitment to Data Privacy Act Compliance

MediPaid and HFIC operate in continuing compliance with the Data Privacy Act of 2012 and its implementing rules. In particular:

• We have designated a Data Protection Officer, whose contact details appear in §16.
• We process personal data only on a lawful basis identified in §5, and we obtain consent for all sensitive personal information.
• We observe the principles of transparency, legitimate purpose, and proportionality required by §11 of the Act.
• We maintain organisational, physical, and technical security measures proportionate to the data we hold, described in §9.
• We uphold the rights of data subjects set out in §16–18 of the Act, described in §11 of this policy.
• We maintain records of our processing activities and review them as our services change.

2.1 NPC Registration Status

Registration of a Data Protection Officer and Data Processing Systems with the NPC is mandatory under NPC Circular No. 2022-04 where prescribed thresholds are met — principally where an organisation employs 250 or more persons, processes the sensitive personal information of 1,000 or more individuals, or operates processing that poses a risk to the rights and freedoms of data subjects.

MediPaid does not presently meet these thresholds. We nonetheless comply in full with the substantive obligations of the Data Privacy Act, which apply to every personal information controller irrespective of registration status. We will complete NPC registration when our processing activities meet any applicable threshold, and this policy will be updated with our Certificate of Registration number at that time.

Registration is an administrative filing requirement. It is not a precondition to, or a substitute for, the protections described in this policy, all of which apply now.

3. Information We Collect

3.1 Information You Provide Directly

• Account Registration: Name, email address, organization, phone number, and role (MediPaid platform or HFIC membership).
• Assessment Forms: Information submitted through our assessment request forms.
• HFIC Membership: Organization details, membership tier, and industry category.
• Communication: Messages, emails, and inquiries sent to support@medipaid.tech.
• Healthcare Claims Data: De-identified claims information, payer details, and receivables data you upload (if applicable).
• Webinar & Event Registration: Registration for HFIC webinars, roundtables, and forums.

3.2 Information Automatically Collected

• Device Information: Device type, operating system, browser type, and IP address.
• Usage Data: Pages visited, time spent on site, features used, and interactions with our platform.
• Cookies & Tracking: Standard analytics and session cookies to improve user experience.

3.3 Sensitive Personal Information (DishCal PH)

The Data Privacy Act gives special protection to certain categories of information, and DishCal PH processes them. Please read this section carefully.

Through DishCal PH we collect, directly from you:

• Health conditions you select — which may include diabetes, hypertension, kidney disease, liver disease, cancer or malignancy, thyroid disorders, cardiovascular disease, and lung disease.
• Medications and dosage schedules, including the times you take them and your record of doses taken or missed.
• Allergies and dietary restrictions, including religious dietary observance such as halal.
• Physical characteristics — age, sex, height, weight, and activity level.
• Meal records — photographs of meals, written or spoken descriptions, and the nutritional values derived from them.
• Derived clinical values — calculated calorie and nutrient targets, adherence percentages, and the clinical summaries you generate.

This information is identified, not de-identified. It is linked to your account. We process it only with your consent, only to provide the features you have asked for, and never for advertising.

3.4 Account and Authentication Data (DishCal PH)

DishCal PH signs you in with a mobile number and a password, or an email address and a password. We store:

• your mobile number, and your email address if you give one;
• a cryptographic hash of your password, never the password itself — we cannot read it, and nobody at MediPaid can tell you what it is;
• the metadata of authentication attempts.

A one-time passcode sent by SMS is used to confirm that the mobile number is yours when you register, and to let you reset a forgotten password. It is not required every time you sign in.

An email address given at checkout is passed to our payment provider so it can send your invoice and receipt; see §7.

3.5 What We Deliberately Do Not Collect

• We do not collect precise geolocation.
• We do not access your contacts or photo library beyond the single image you choose to submit.
• DishCal PH's voice input is transcribed on your own device by your browser's speech recognition. We receive the resulting text only — never an audio recording.
• We do not receive or store card numbers, bank credentials, or e-wallet credentials. See §8.

4. How We Use Your Information

• To provide, maintain, and improve our healthcare finance intelligence services.
• To manage HFIC membership, webinars, roundtables, and forums.
• To process assessments, pilots, and client onboarding.
• To send service updates, notifications, and security alerts.
• To respond to inquiries and customer support requests.
• To analyze usage patterns and optimize platform performance.
• To comply with legal obligations and regulatory requirements.
• For legitimate business interests such as fraud prevention and data security.

For DishCal PH specifically:

• To compute your daily calorie and nutrient targets from the details you provide.
• To estimate the nutritional content of meals you photograph or describe (see §7).
• To generate clinical summaries when you request them, for you to share with your own healthcare provider.
• To remind you of scheduled medication doses.
• To manage your plan, subscription, and billing.

5. Legal Basis for Processing

Withdrawing consent. You may withdraw consent at any time. Withdrawal does not affect processing already carried out. Because DishCal PH's health features cannot function without health data, withdrawing consent for them ends your ability to use those features — we will tell you this plainly rather than degrading the service silently.

6. Our Role: Controller and Processor

Our legal role differs by product, and it determines who you should contact.

• Personal Information Controller. For DishCal PH, for our corporate websites, and for HFIC membership, MediPaid determines the purposes and means of processing. Contact us directly using §16.
• Personal Information Processor. For MediPaid claims services and EHOS, we process data on behalf of, and under the documented instructions of, the clinic, hospital, or HMO that engaged us. That organisation is the controller. If you are a patient of such a facility, address requests about those records to the facility; we will support them in responding and will not act on those records except on their instruction or as law requires.

7. Artificial Intelligence and Automated Processing

DishCal PH uses a third-party large language model to estimate nutritional content from a meal photograph or description.

• What is sent: the image or text you submit, plus the health conditions and dietary restrictions on your profile so the resulting advice is relevant to you. Your name, mobile number, and account identifiers are not sent.
• Who processes it: Anthropic PBC (United States), as our sub-processor, under commercial terms providing that data submitted through their API is not used to train their models.
• What it is not: the estimate is an approximation, not a diagnosis, prescription, or professional dietary advice. Every result is labelled as an estimate in the application and is editable by you before it is saved.
• No solely-automated decisions producing legal effects or similarly significant effects on you are made about you.
• You may decline it entirely and enter nutrition values manually. The feature is not required to use DishCal PH.

Subscription entitlement — whether a payment succeeded, whether paid features are unlocked — is determined by automated rules described in §8. These are administrative, and you may contact us to have any entitlement decision reviewed by a person.

8. Payments

DishCal PH subscription payments are processed by Xendit, a payment service provider regulated by the Bangko Sentral ng Pilipinas.

• Card numbers, bank credentials, and e-wallet credentials are entered directly into Xendit's hosted checkout. They never pass through, and are never stored on, MediPaid systems.
• We retain only: the plan chosen, the amount and currency agreed, subscription status, billing dates, the history of successful and failed charges, and a token issued by Xendit permitting the charge you authorised.
• Recurring charges. When you subscribe you authorise a recurring charge on a screen stating the amount, the frequency, the first charge date, and the next charge date. You may cancel at any time within the application. We retain no payment method after cancellation takes effect.
• Xendit's handling of your payment data is governed by Xendit's own privacy policy.

9. Data Sharing & Disclosure

We do NOT sell, trade, or rent your personal information to third parties. We do not share health data for advertising. We may share information in the following circumstances:

9.1 Service Providers and Sub-processors

We share only what is necessary, under written agreements requiring confidentiality, security, and processing limited to our instructions:

Personal data is stored in Singapore, the nearest available hosting region to the Philippines. One-time passcodes are delivered by a Philippine-domiciled provider, so mobile numbers used for authentication do not leave the country.

9.2 HFIC Member Networking

HFIC is designed for industry collaboration. We may share your organization name and role with other HFIC members for networking and dialogue purposes, unless you opt out. Your full contact details are never shared without explicit consent. This does not apply to DishCal PH. DishCal PH health data is never shared with HFIC members or any networking feature.

9.3 Your Own Healthcare Providers

DishCal PH lets you generate a clinical summary and send it to your doctor by print, PDF, or messaging application. This is always initiated by you. We do not transmit it on your behalf and we do not retain a record of who you sent it to.

9.4 Legal Requirements

We may disclose information when required by law, court order, or government authority, or to protect our legal rights and the safety of our users. We will notify you unless legally prohibited from doing so.

9.5 Business Transfers

In the event of merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy continuing to apply. We will notify you accordingly.

10. Data Security

We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS) and encryption at rest.
• Secure database encryption (PostgreSQL encryption).
• Row-level security — access control enforced by the database itself, not only by application code, so an authenticated account can reach only its own records.
• Passwordless authentication for DishCal PH, removing the risk of reused or leaked passwords.
• Segregation of secrets — credentials are held in managed environment configuration, never in source code or client-side application code.
• Least privilege — privileged database credentials are used only by server-side processes; administrative access is limited to personnel who require it.
• Access controls, authentication protocols, and logging of security-relevant events.
• Regular security audits and updates.

While we strive to protect your information, no transmission over the internet is 100% secure and we cannot guarantee absolute security of your data.

10.1 Breach Notification

We will notify both affected data subjects and the National Privacy Commission within seventy-two (72) hours of knowledge of a personal data breach, where the breach involves sensitive personal information and is likely to give rise to a real risk of serious harm — in accordance with §20(f) of the Data Privacy Act and NPC Circular 16-03.

11. Data Retention

We retain personal data only as long as necessary for the purpose it was collected for, or as law requires. The periods below are maximums.

Your DishCal PH health records are not deleted, hidden or disabled because a subscription lapses. If a payment fails or you never subscribe, your account returns to the permanently free plan — logging, history and every medication you have already saved keep working exactly as before — and everything you recorded is preserved intact and remains visible to you.

12. Your Rights Under Philippine Law (RA 10173)

As a data subject, you have the right to:

1. Be Informed — of the processing of your personal data, before it happens.
2. Access — request access to your personal information.
3. Rectification — correct inaccurate or incomplete data.
4. Erasure or Blocking — request deletion or suspension of your data, subject to legal obligations.
5. Data Portability — receive your data in a structured, commonly used, machine-readable format.
6. Object — opt out of certain processing activities, including direct marketing.
7. Damages — be indemnified for damages sustained through unlawful processing.
8. Lodge a Complaint — file complaints with the National Privacy Commission.

Your heirs and assigns may exercise these rights after your death or incapacity.

How to exercise them. Contact our Data Protection Officer at dpo@medipaid.tech, or support@medipaid.tech with "Data Request" in the subject line. We will respond within fifteen (15) working days. We may ask for proof of identity, which we use only to verify the request. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or repetitive requests, and will tell you before doing so.

13. De-identified and Aggregate Data

We may derive statistical and aggregate insights — for example, which Filipino dishes are most commonly logged by patients managing hypertension — to improve our products and for research and public-health purposes.

Before any such use, direct identifiers are removed and results are reported only at a level of aggregation where no individual can be singled out. We do not attempt to re-identify de-identified data and we contractually prohibit recipients from doing so.

14. Cookies & Tracking Technologies

We use cookies for session management and user authentication, remembering user preferences, analytics and usage tracking, and security and fraud prevention. You can disable cookies in your browser settings, though some functionality may be limited.

We do not use advertising or cross-site tracking cookies. DishCal PH additionally stores data in your device's local storage so the application works offline; this stays on your device and is cleared when you log out.

15. Third-Party Links, Children's Privacy, and International Transfers

Third-Party Links. Our websites may contain links to third-party services (GitHub, Vercel, Formspree, Luma, Google Forms). We are not responsible for their privacy practices. Please review their privacy policies independently.

Children's Privacy. Our services are not directed to individuals under 18 years of age, and we do not knowingly collect information from minors without the consent of a parent or legal guardian. Where a parent or legal guardian uses DishCal PH to manage a minor's care, that adult is responsible for providing consent on the minor's behalf. If we become aware of collection without proper consent, we will promptly delete the information and notify the parent or guardian.

International Data Transfers. As MediPaid and HFIC operate in Southeast Asia, your data may be transferred and processed in jurisdictions outside the Philippines, principally Singapore and the United States. Where this occurs, we remain accountable for your data under §21 of the Data Privacy Act, and we impose contractual safeguards obliging the recipient to a standard of protection comparable to that required under Philippine law.

16. Contact Information

Philippines Data Protection Authority: National Privacy Commission (NPC), 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City 1307 · complaints@privacy.gov.ph · https://www.privacy.gov.ph

17. Changes to This Privacy Policy

We may update this policy periodically. We will notify you of material changes via email or prominent website notice. Where a change materially affects your rights or expands how we use your data, we will give notice before it takes effect and, where the law requires it, obtain your fresh consent.

18. Medical Disclaimer

DishCal PH provides nutritional information and tracking tools. It does not provide medical advice, diagnosis, or treatment, and is not a substitute for the judgement of a qualified healthcare professional.

Calorie and nutrient targets are estimates produced by a standard formula (Mifflin-St Jeor) adjusted for the conditions you select; they are not a clinical prescription. Medication reminders are a convenience, not a clinical safety system, and will not alert you when the application is closed.

Always consult your physician or a registered dietitian before making decisions about your diet or medication, and never disregard professional advice because of something you read in our products.