LUNAS ELECTRONIC MEDICAL RECORD
DATA PROCESSING AGREEMENT
Version: 1.0
Effective Date: October 10, 2026
Data Processor: MCC Softwares-Software Development Services
Business Address: 4th Road, 1st House, SPDA, Semba, Datu Odin Sinsuat, Maguindanao, Philippines
Email: info@mccsoftwares.com
Data Controller: The healthcare clinic or organization identified in the registered LUNAS EMR account and represented by its duly authorized administrator.
1. Purpose and Parties
This Data Processing Agreement ("DPA") forms part of the contractual relationship between MCC Softwares-Software Development Services ("Processor") and the subscribing healthcare Clinic ("Controller") using LUNAS Electronic Medical Record ("LUNAS EMR").
The purpose of this DPA is to establish the responsibilities of the parties when MCC Softwares processes personal information, including sensitive patient health information, on behalf of the Clinic.
This DPA is intended to support compliance with Republic Act No. 10173, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission.
This DPA applies only to processing activities in which MCC Softwares acts as a Personal Information Processor for the Clinic.
Processing for MCC Softwares' independently determined account administration, commercial, and business purposes is governed by applicable privacy law and the Privacy Policy.
2. Definitions
For purposes of this DPA:
Personal Information means information from which an individual's identity is apparent or may reasonably be established, as defined by applicable law.
Sensitive Personal Information includes health information, medical histories, diagnoses, treatment details, and other categories protected by Philippine privacy legislation.
Controller means the Clinic that determines the purposes and means of processing patient information.
Processor means MCC Softwares when processing patient information on behalf of the Clinic.
Data Subject means the individual to whom personal information relates.
Processing includes collection, recording, storage, organization, retrieval, use, modification, transmission, restriction, deletion, and other operations involving personal information.
Security Incident means an event affecting or potentially affecting the confidentiality, integrity, or availability of information or related systems.
Personal Data Breach means a breach of security resulting in unauthorized or unlawful access, disclosure, alteration, loss, or other compromise of personal information, as applicable under law.
3. Scope and Duration
The Processor shall process personal information as necessary to provide LUNAS EMR services to the Controller.
Processing may include:
Electronic storage of patient records
Retrieval and display of medical information
Maintenance of patient information
Clinical documentation and encounter management
Prescription and medication records
Medical forms and documents
Appointment and patient queue records
Clinic billing and related operations
Technical maintenance and recovery
Authorized backup and restoration
Other Clinic-authorized processing supported by LUNAS EMR
This DPA remains applicable while the Processor processes Controller-controlled personal information, including any lawful post-termination retention or processing period.
4. Categories of Data Subjects
Data subjects may include:
Current and former Clinic patients.
Individuals receiving medical consultations or treatment.
Parents or guardians whose information is recorded in patient files.
Clinic employees and authorized personnel whose information forms part of Clinic-controlled records.
Other individuals whose information is lawfully entered into LUNAS EMR by the Controller.
5. Categories of Personal Information
Depending on Clinic configuration and actual use, the following may be processed:
Patient names and personal identifiers
Contact information and addresses
Dates of birth and demographic information
Medical history
Diagnoses and treatment information
Allergies and medical conditions
Clinical measurements and vital signs
Medication and prescription details
Laboratory-related information
Medical documents and attachments
Clinical encounter histories
Appointments and queue information
Billing and payment-related clinic records
Other lawful information entered into the Clinic's configured fields
The Controller must ensure that it collects only information appropriate and necessary for its legitimate healthcare purposes.
6. Controller Responsibilities
The Controller shall:
Establish an appropriate lawful basis for collecting and processing patient information.
Provide legally required privacy notices to patients and other data subjects.
Obtain consent where consent is legally required.
Ensure accuracy and appropriate use of medical records.
Determine who may access patient information.
Assign and periodically review user permissions.
Maintain confidentiality obligations for authorized Clinic personnel.
Handle patient inquiries and lawful data subject requests.
Determine and comply with applicable healthcare record-retention requirements.
Provide lawful and documented processing instructions to the Processor.
Cooperate in investigating relevant privacy and security incidents.
Maintain operational arrangements to ensure continuity of patient care.
The Controller remains responsible for its own clinical decisions, documentation practices, and compliance obligations.
7. Processor Responsibilities
The Processor shall:
Process Controller-controlled patient information only on documented lawful instructions, except where otherwise required by applicable law.
Provide the processing activities necessary to operate LUNAS EMR.
Maintain appropriate security and confidentiality safeguards.
Restrict access to authorized personnel and permitted service providers.
Implement reasonable controls intended to prevent unauthorized processing.
Assist the Controller with applicable data subject rights and compliance requests.
Cooperate in the investigation of relevant security incidents.
Maintain necessary records of processing and security activities.
Use authorized subprocessors subject to appropriate protections.
Follow lawful return, export, retention, and deletion instructions, subject to applicable requirements.
If the Processor reasonably believes an instruction violates applicable privacy law, it shall notify the Controller and seek clarification before acting, unless prohibited by law.
8. Documented Processing Instructions
The Controller instructs the Processor to process information for the ordinary functionality of LUNAS EMR as described in this DPA and the applicable service agreement.
The Controller may provide additional lawful instructions through authorized configuration, user activity, or approved support channels.
The Processor shall not independently use identifiable patient records for advertising, unrelated commercial analytics, sale, or marketing.
Any processing beyond the documented service purposes requires an appropriate lawful basis and applicable authorization.
9. Confidentiality
The Processor shall ensure that persons authorized to process patient information are subject to appropriate confidentiality obligations.
Access to sensitive information must be limited to legitimate operational, support, security, or legally required purposes.
The Processor shall take reasonable measures to prevent improper disclosure by its personnel and authorized contractors.
These confidentiality obligations survive the termination of this DPA for as long as protected information remains subject to confidentiality requirements.
10. Technical and Organizational Security
The Processor shall maintain safeguards appropriate to the risks of processing sensitive healthcare information.
The security program shall address, as applicable:
Authentication and access controls
Role-based authorization
Segregation of Clinic data
Protection against unauthorized administrative access
Audit logging and accountability
Secure transmission and storage
Software updates and security maintenance
Backup and recovery arrangements
Incident detection and investigation
Restricted production support access
Personnel confidentiality
Vulnerability management
Secure disposal of personal information
The exact technical controls, backup architecture, encryption arrangements, and verification procedures must be documented and validated operationally.
The Processor shall not represent unimplemented security features as active protections.
11. Data Hosting
The intended production hosting environment for LUNAS EMR is a Hostinger KVM 2 Virtual Private Server.
The hosting provider may process or store information as necessary to operate the infrastructure.
The geographic location of production infrastructure and backups must be confirmed and documented.
The Processor shall maintain appropriate safeguards and contractual arrangements with infrastructure providers.
Any material changes to hosting or processing arrangements that require notice or authorization under this DPA or applicable law shall be communicated to the Controller.
12. Subprocessors
The Processor may engage service providers necessary for the authorized operation of LUNAS EMR, subject to applicable law and the Controller's appropriate authorization.
Such providers may include infrastructure, email, backup, or security service providers.
The Processor shall maintain an up-to-date subprocessor list describing the provider, processing purpose, relevant information categories, and processing location where appropriate.
Authorized subprocessor list: [TO BE COMPLETED BEFORE PUBLICATION]
The Processor shall impose appropriate privacy and security obligations on subprocessors.
The Processor remains responsible for meeting its own obligations under this DPA when using authorized subprocessors.
Material subprocessor additions or changes shall be handled through the agreed authorization and notification process.
13. Access to Patient Information by Support Personnel
MCC Softwares personnel may access patient information only when necessary for authorized technical support, or when a lawful urgent security or legal circumstance justifies access without prior Clinic approval.
Ordinary support access to identifiable patient records requires appropriate Clinic authorization.
Access must be limited to the information reasonably necessary for the stated purpose.
Appropriate logs and accountability measures must be maintained.
Support authorization does not permit copying, retaining, or independently using patient records for unrelated purposes.
14. Data Backup and Recovery
The planned LUNAS EMR database backup schedule includes daily and weekly backups.
Backups are intended to support recovery from technical failure, accidental data loss, or other incidents.
The Processor shall protect backup information in accordance with applicable confidentiality and security requirements.
The location, retention duration, restoration targets, and deletion procedures for backups must be documented in the operational backup policy.
No specific recovery time or recovery point is guaranteed by this DPA unless separately agreed.
15. Personal Data Breaches and Security Incidents
The Processor shall take reasonable steps to identify, investigate, contain, and address suspected personal data breaches affecting Controller-controlled information.
When the Processor becomes aware of a relevant confirmed or reasonably suspected personal data breach, it shall notify the Controller without undue delay and provide available information reasonably necessary for the Controller to evaluate the incident.
Such information may include:
The nature of the incident
Categories of information potentially affected
Known or reasonably estimated scope
Measures taken to contain or mitigate the incident
Available information regarding the likely consequences
Relevant contact information for incident coordination
Additional information may be supplied as the investigation develops.
The Controller generally remains responsible for determining and carrying out legally required notifications to affected data subjects and regulators in its capacity as Personal Information Controller, with assistance from the Processor.
The parties shall cooperate to meet applicable statutory reporting deadlines.
16. Data Subject Requests
The Processor shall reasonably assist the Controller in responding to lawful requests regarding Controller-controlled personal information.
Such requests may involve access, correction, portability, erasure, or restriction of processing where legally applicable.
Where a data subject contacts MCC Softwares directly about Clinic-controlled records, MCC Softwares may refer the request to the responsible Clinic, subject to applicable law.
The Processor shall not independently disclose medical records to an unauthenticated individual claiming to be a patient.
Identity, authority, and the lawful basis for disclosure must be established before information is released.
17. Audit and Compliance Cooperation
The Processor shall maintain records and evidence reasonably necessary to demonstrate compliance with its obligations.
The Processor shall reasonably cooperate with lawful compliance inquiries, subject to confidentiality, security, and protection of other customers' information.
Any customer-requested security review or audit must be conducted through an agreed procedure that does not compromise platform security or another Clinic's information.
Applicable statutory rights and regulatory powers are not restricted by this provision.
18. Cross-Border Processing
If personal information is stored, accessed, or processed outside the Philippines, the parties shall comply with applicable cross-border privacy requirements.
The Processor shall provide relevant information about processing locations and safeguards as necessary for the Controller's compliance obligations.
The final production hosting region and applicable international processing arrangements must be verified before publication.
19. Subscription Expiration
When a Clinic's trial or paid subscription expires, ordinary clinical creation and modification functions may become unavailable.
Existing information shall remain accessible through read-only functionality and available self-service export mechanisms while retained and accessible under the applicable retention and termination arrangements.
Subscription expiration does not authorize the Processor to use patient information for an unrelated purpose.
The Controller remains responsible for continuity of patient care and compliance with applicable healthcare recordkeeping requirements.
20. Data Return, Retention, and Deletion
Upon termination of services, the Controller shall have an appropriate opportunity to retrieve or export its records in accordance with the agreed termination and retention arrangements.
The Processor shall handle retained copies and backups according to documented procedures, lawful Controller instructions, and applicable legal obligations.
The Processor shall not delete medical information in a manner inconsistent with applicable law or agreed retention obligations.
Personal information shall not be retained indefinitely without a valid purpose or lawful basis.
Post-termination data access and retention schedule: [TO BE FINALIZED BEFORE PUBLICATION]
Backup retention and secure disposal schedule: [TO BE FINALIZED BEFORE PUBLICATION]
Until these schedules are finalized, this DPA must not be interpreted as establishing an unlimited retention promise or an agreed deletion deadline.
21. Duration and Survival
This DPA takes effect upon the Clinic's valid acceptance and remains applicable for as long as the Processor processes Controller-controlled personal information under the service relationship.
Obligations relating to confidentiality, lawful retention, security, cooperation, and deletion survive termination to the extent necessary under law and the circumstances of processing.
22. Relationship with Other Agreements
This DPA supplements the Terms of Service and Subscription & Billing Terms.
In the event of an inconsistency concerning the lawful processing or protection of Controller-controlled personal information, the parties shall apply this DPA to the relevant privacy and processing issue, subject to mandatory applicable law.
The parties' roles regarding other business or account information may differ from the controller-processor relationship established here.
23. Governing Law
This DPA is governed by applicable laws of the Republic of the Philippines.
The parties shall cooperate in good faith to address disputes concerning processing obligations.
Nothing in this DPA prevents a competent regulator or court from exercising authority under applicable law.
24. Electronic Acceptance
The Clinic's authorized representative may accept this DPA electronically through LUNAS EMR, subject to applicable requirements for electronic contracts.
The system may record the accepting user's identity, Clinic, document version, date and time of acceptance, and associated audit information.
The Processor shall preserve the accepted agreement version for applicable legal and audit purposes.
25. Contact Information
Processor: MCC Softwares-Software Development Services
Address: 4th Road, 1st House, SPDA, Semba, Datu Odin Sinsuat, Maguindanao, Philippines
Email: info@mccsoftwares.com
Controller: The Clinic identified in its LUNAS EMR registration information.
Controller's Authorized Representative: The verified authorized administrator accepting this DPA on behalf of the Clinic.
Annex A — Description of Processing
Subject Matter: Cloud-hosted electronic medical record and clinic management services.
Nature of Processing: Collection through authorized user activity, storage, organization, retrieval, modification, transmission within authorized workflows, backup, export, and deletion according to lawful instructions.
Purpose: Supporting the Controller's healthcare administration, clinical documentation, patient management, and related Clinic operations.
Duration: During the service relationship and any lawful or agreed post-termination period.
Data Subjects: Patients, Clinic personnel, authorized representatives, and related individuals whose information is lawfully recorded.
Personal Information: Contact details, demographic information, clinical documentation, health records, medical documents, prescriptions, appointment details, and related Clinic data.
Processing Location: Hostinger production infrastructure and authorized supporting services, with geographic details to be confirmed.
Additional Security and Retention Specifications: [TO BE COMPLETED BEFORE PUBLICATION]
Annex B — Authorized Subprocessors
Infrastructure Provider: Hostinger — subject to verification of the contracting entity, hosting location, services, and contractual safeguards.
Additional Providers: [TO BE COMPLETED BEFORE PUBLICATION]
The Processor shall maintain the authoritative current subprocessor register and implement the required authorization and notice arrangements.
Annex C — Data Retention and Return Schedule
Account Expiration: Read-only access and self-service export, subject to the applicable retention and termination arrangements.
Post-Termination Export Window: [NOT YET DETERMINED]
Primary Data Retention Period: [NOT YET DETERMINED]
Backup Retention Period: [NOT YET DETERMINED]
Secure Deletion Procedure: [TO BE DOCUMENTED]
Exceptions for Legal Preservation: As required under applicable law.
These schedules must be completed and reviewed before production publication.
END OF DATA PROCESSING AGREEMENT