Privacy Policy

Under RA 10173, a Personal Information Controller (PIC) determines the purpose and means of processing personal data. A Personal Information Processor (PIP) processes data on behalf of a PIC.

• ▸Your clinic (the dental practice): The PIC. Your clinic decides what data to collect about patients, why, and for how long. Your clinic bears primary legal responsibility to patients under RA 10173.
• ▸Sigurado (operated by AI Matters): The PIP. We process patient data only on your clinic's documented instructions. We do not use patient records for any purpose beyond operating the software for your clinic.

This arrangement is formalized in our Data Processing Agreement, which every clinic accepts upon enrollment.

We collect only what is necessary for the specific purpose stated. Under Section 11 of RA 10173, personal data must be collected for specified, explicit, and legitimate purposes.

We do not collect: government IDs, PhilHealth/SSS/TIN numbers (beyond what clinics choose to record), financial account numbers, or biometric data.

• 🔒

  Encryption in transit and at rest

  All data is transmitted over TLS 1.2+. Data at rest is encrypted by our infrastructure provider.

• 🏗️

  Multi-tenant isolation

  Each clinic's data is logically isolated using Supabase Row-Level Security (RLS). A logged-in user for Clinic A cannot query, view, or modify any data belonging to Clinic B — enforced at the database layer, not just application code.

• 📋

  Audit logs

  All write operations (visit records, payments, voided invoices, staff actions) are logged with a timestamp and the user who performed the action.

• 👤

  Minimum access principle

  Staff roles are scoped: secretaries can manage patients and visits; CPA users have read-only access to financial reports only. No role has more access than it needs.

• 🌏

  Data stored in the region

  Your clinic's data is stored in AWS ap-south-1 (Mumbai) via Supabase — the nearest compliant cloud region to the Philippines at time of writing. Data does not leave Asia-Pacific for storage.

Sigurado uses the following sub-processors to operate the service. Each processes only the data necessary for its specific function. Under RA 10173 and NPC Advisory 2024-01, cross-border transfers require that the receiving party provides comparable data protection.

We do not sell, rent, or share patient data with advertising networks, data brokers, or any third party for their own commercial purposes.

Section 16 of RA 10173 grants the following rights to every data subject (patient):

To exercise any of these rights, contact your clinic directly (they are the PIC and can fulfill most requests), or contact our Data Protection Officer at privacy@sigurado.xyz.

In the event of a personal data breach that is likely to give rise to a real risk of serious harm to data subjects, we are required by NPC Circular 2016-03 to:

1. Notify the National Privacy Commission within 72 hours of becoming aware of the breach.
2. Notify affected data subjects without undue delay, so they can take steps to protect themselves.
3. Document all breaches in our security incident log, regardless of whether notification is required.

Because patient health records are Sensitive Personal Information, the threshold for mandatory notification is lower than for ordinary personal data.

Patient records are retained for as long as the clinic is actively using Sigurado, and for a reasonable transition period after account closure to allow data export. Clinics are responsible for their own retention schedules under the Medical Act of 1959 and BIR regulations, which generally require keeping records for a minimum of ten (10) years.

Messenger PSIDs and consent records are retained until the patient withdraws consent or requests deletion.

If you believe your data privacy rights under RA 10173 have been violated and your concern has not been resolved by contacting us or your clinic directly, you may file a complaint with the National Privacy Commission:

For any questions about this privacy policy, to exercise your data subject rights, or to report a concern:

We will acknowledge your request within three (3) business days and respond substantively within fifteen (15) business days, consistent with NPC expectations.

We will post any updates to this page and update the “Last updated” date at the top. Material changes — particularly any that expand data sharing or change the stated purpose of processing — will be communicated to clinic administrators by email before taking effect.