1. Roles of the Parties
The Vendor acts as the Data Controller (under Singapore PDPA and GDPR-equivalent standards) and Personal Information Controller (under Philippine law) in respect of the personal data it enters into its own CRM records, including Clinic contact details. The Vendor determines what contact data it collects, for what purpose, and how long it is kept for its own commercial use.
MedicalPRO acts as Data Processor / Personal Information Processor in respect of this data, storing and securing it strictly on the Vendor's instructions and for the purpose of providing Vendor Platform services. MedicalPRO does not use Vendor CRM data for any purpose other than operating the Platform.
This role allocation is distinct from, but consistent with, the Controller/Processor structure applied to Clinics under the Clinic Platform Agreement and to Patients under the MyHealth Agreement. Each module of the Platform has its own clearly identified Controller for the data specific to that module.
2. Scope of Processing
MedicalPRO may process personal data solely for Vendor account activation and management, catalog and quote hosting, CRM record storage, invoice generation, and system communications. MedicalPRO shall not use Vendor or Vendor-supplied contact data for unrelated commercial purposes, including for the benefit of any other Vendor.
3. Information Security Safeguards
MedicalPRO implements administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or disclosure, consistent with the safeguards described in the Clinic Platform and MyHealth Data Processing Agreements. MedicalPRO operates a single-tenancy architecture in which each Vendor's data remains fully isolated from other Vendors' data.
4. Sub-Processors
MedicalPRO may engage third-party service providers, such as cloud hosting providers, to support the Vendor Platform. Such providers are required to maintain appropriate security safeguards. MedicalPRO remains responsible for compliance with this Agreement.
5. Cross-Border Data Transfers
Where a Vendor's data, or data the Vendor has entered concerning a third party, is transferred outside the Philippines, MedicalPRO ensures appropriate protection measures and contractual safeguards consistent with those described in the Clinic Platform Data Processing Agreement.
6. Data Breach Notification
If a confirmed data breach occurs affecting Vendor data, MedicalPRO shall notify the Vendor within 72 hours of confirming the breach and provide all available information about the nature and scope of the incident. The Vendor remains responsible for any regulatory notifications required by applicable law concerning personal data it controls, including Clinic contact data recorded in its CRM.
7. Data Retention and Deletion
Upon cancellation or termination of the Vendor's subscription, the Vendor may request and download its data within 30 days of the subscription end date, after which all Vendor data will be permanently deleted. MedicalPRO cannot recover data after permanent deletion.
8. Confidentiality
MedicalPRO shall maintain strict confidentiality of all Vendor business and CRM data processed on the Platform. Confidentiality obligations survive termination of this Agreement.
9. Consistency Across the Platform
Where this Agreement and the MedicalPRO Clinic Platform or MyHealth Agreements both address data arising from the same underlying relationship (for example, a quote or order connecting a Vendor to a specific Clinic), all relevant documents are intended to be read consistently, as components of a single Platform-wide data protection framework.