LUNAS ELECTRONIC MEDICAL RECORD
PRIVACY POLICY
Version: 1.0
Effective Date: October 10, 2026
Service Provider: MCC Softwares-Software Development Services
Business Address: 4th Road, 1st House, SPDA, Semba, Datu Odin Sinsuat, Maguindanao, Philippines
Privacy Contact: info@mccsoftwares.com
1. Introduction
MCC Softwares-Software Development Services ("MCC Softwares," "we," "our," or "us") respects the privacy and confidentiality of personal information processed through LUNAS Electronic Medical Record ("LUNAS EMR").
This Privacy Policy describes the categories of personal information involved in providing LUNAS EMR, the purposes of processing, the parties responsible for that processing, and the rights available to individuals under applicable Philippine law.
This Policy is intended to support transparency under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable National Privacy Commission issuances.
2. Scope of This Policy
This Policy applies to personal information processed in connection with:
Website visits and service inquiries
Clinic registration
Account creation and email verification
Subscription administration and payment records
Authentication and account security
Technical support and customer communication
Platform operations and maintenance
Patient and clinical information hosted for subscribing Clinics
The allocation of legal responsibilities differs depending on the category of information and the purposes for which it is processed.
3. Roles in Processing Personal Information
3.1 MCC Softwares as Personal Information Controller
For information MCC Softwares collects and determines the purposes of processing, such as customer registration, account administration, billing, support, and its own business records, MCC Softwares generally acts as a Personal Information Controller.
3.2 Clinics as Personal Information Controllers
For patient medical records collected and managed by a healthcare Clinic for its healthcare activities, the Clinic generally acts as the Personal Information Controller.
The Clinic determines the purposes and lawful basis of collecting patient information and manages its clinical use and retention obligations.
3.3 MCC Softwares as Personal Information Processor
When MCC Softwares hosts and processes patient records on behalf of a Clinic, it generally acts as a Personal Information Processor under the Clinic's documented instructions and the applicable Data Processing Agreement.
These descriptions do not override the actual legal classification of a particular processing activity.
4. Categories of Personal Information
Depending on the relevant services and activities, information processed may include the following.
4.1 Clinic Registration Information
Clinic name and business information
Clinic address and contact information
Administrator name and email address
Account username and authentication identifiers
Business and subscription information
4.2 Account and User Information
User name and email address
Account role and access permissions
Authentication and security-related information
Profile details supplied by the user
Login activity and relevant audit records
4.3 Payment and Subscription Information
Subscription plan and billing period
Payment amounts and payment status
Transaction references
Payment dates and subscription history
Limited information returned by authorized payment providers
MCC Softwares does not need to store complete payment card credentials to maintain subscription records. Payment-card processing must follow the actual integration arrangements of the selected payment provider.
4.4 Patient and Clinical Information
Depending on Clinic configuration, hosted patient information may include:
Patient name and identifying details
Contact information
Date of birth and demographic information
Medical history
Diagnoses, complaints, and clinical assessments
Allergies and medical conditions
Clinical measurements and vital signs
Prescriptions and treatment records
Laboratory-related records and attachments
Medical documents
Appointments and encounter histories
Billing and related clinic records
Health-related information is sensitive personal information under Philippine privacy law and requires appropriate safeguards.
4.5 Technical and Security Information
IP address
Browser and device information
Authentication events
Activity timestamps
Security and application audit logs
Error and diagnostic information
4.6 Customer Support Information
Support inquiries
Contact details
Troubleshooting information
Communications relating to assistance requests
Support personnel should request only the information reasonably necessary to address an issue.
5. Purposes of Processing
Personal information may be processed for the following purposes, where applicable:
Creating and administering clinic accounts.
Verifying registered email addresses.
Authenticating authorized users.
Providing subscribed software functionality.
Hosting and retrieving clinic-managed records.
Managing subscriptions and payments.
Providing customer assistance.
Detecting and investigating security incidents.
Maintaining audit trails and platform integrity.
Complying with applicable legal obligations.
Establishing, exercising, or defending legal claims.
Performing authorized technical maintenance and recovery.
Patient information processed on behalf of a Clinic shall not be used for unrelated commercial purposes contrary to the Clinic's lawful instructions or applicable law.
6. Lawful Bases of Processing
MCC Softwares and each Clinic are responsible for identifying the appropriate lawful bases for processing activities under their respective control.
Depending on the circumstances and data category, these may include performance of a contract, compliance with legal obligations, legitimate interests where permitted, consent where required, or another lawful ground recognized under applicable legislation.
Sensitive personal information requires compliance with the particular grounds and safeguards applicable to that information.
Consent is not presumed to be the lawful basis for every medical-record processing activity.
Acceptance of software Terms of Service does not, by itself, constitute patient consent to unrelated processing of medical information.
7. Patient Privacy Notices
The Clinic is responsible for providing patients with legally required privacy information concerning its clinical data processing.
Where consent is required, the Clinic is responsible for obtaining and maintaining appropriate consent records.
Patients seeking access, correction, or other rights regarding their medical records should ordinarily contact the Clinic responsible for those records.
MCC Softwares will provide reasonable assistance to Clinics with such requests in accordance with the Data Processing Agreement and applicable law.
8. Data Hosting and Storage
LUNAS EMR is intended to operate on a Hostinger KVM 2 Virtual Private Server using an application database and associated hosting infrastructure.
The country or region in which production data and backups are physically stored must be confirmed before this Policy is published.
Actual hosting and backup arrangements may involve infrastructure operated by contracted service providers.
MCC Softwares is responsible for assessing applicable service-provider safeguards and maintaining appropriate contractual protections.
9. Payment Service Providers
LUNAS EMR may use Maya or PayMongo for subscription payments, depending on the payment methods enabled in production.
When a Client initiates payment, information necessary to process the transaction may be handled by the applicable payment provider under that provider's legal terms and privacy notice.
The final production payment provider, specific information exchanged, and responsibility for each processing activity must be accurately documented before deployment.
10. Other Service Providers and Recipients
MCC Softwares may need service providers for activities such as hosting, payment processing, email delivery, security, backup, and technical operations.
Patient information must not be disclosed to unrelated third parties without an appropriate legal basis and authorization.
Categories of recipients, material subprocessors, and relevant international transfers must be disclosed as required by applicable law.
Production service-provider list: [TO BE COMPLETED BEFORE PUBLICATION]
11. Cross-Border Processing
The physical location of production servers, backup storage, email services, and other subprocessors must be verified.
Where personal information is transferred or made accessible across national borders, the parties shall apply applicable legal requirements and appropriate protections.
This Policy does not represent that all hosted data remains exclusively within the Philippines unless that has been verified.
12. Information Security
MCC Softwares will maintain appropriate technical and organizational safeguards proportionate to the sensitivity and risks of the personal information processed.
Security arrangements may include access restrictions, role-based permissions, authentication controls, security logging, controlled administrative access, and backup and recovery measures.
The actual implementation and effectiveness of these measures must be validated.
Clinic administrators are responsible for appropriately assigning permissions, maintaining secure accounts, and ensuring that staff use the system lawfully.
No internet-connected service can guarantee the absolute elimination of security risks.
13. Access by MCC Softwares Support Personnel
MCC Softwares support personnel may access patient information only with appropriate Clinic authorization, except where urgent security circumstances or applicable legal obligations justify access without prior authorization.
Any access must be limited to what is reasonably necessary for the authorized purpose.
Such access remains subject to applicable confidentiality, security, accountability, and audit requirements.
Support access is not permission to independently use patient records for unrelated purposes.
14. Data Backups
The intended LUNAS EMR backup policy includes daily and weekly database backups.
Backups are maintained for service recovery and business continuity purposes.
The exact backup storage location, encryption arrangements, retention schedules, restoration capabilities, and deletion procedures must be established in the operational security policy.
Backup copies are subject to applicable confidentiality and data protection requirements.
15. Retention of Personal Information
Personal information shall be retained only for as long as necessary for the applicable lawful purposes, contractual requirements, legitimate business needs, preservation of legal claims, or retention obligations established by law.
The Clinic is responsible for determining legally appropriate retention requirements for its patient medical records, subject to applicable healthcare and privacy obligations.
MCC Softwares shall process, retain, return, or delete Clinic-controlled patient information in accordance with the Data Processing Agreement and lawful instructions.
Specific retention schedule for terminated subscriptions and backup copies: [TO BE FINALIZED BEFORE PUBLICATION]
This provision does not authorize indefinite retention or immediate destruction of patient medical records.
16. Subscription Expiration and Access
Upon subscription or trial expiration, the Client's clinical creation and modification functions may be restricted.
Existing records remain accessible in read-only mode, with self-service export functionality, while the records remain retained and accessible under the applicable policy.
Expiration of a subscription does not transfer ownership or legal control of patient information to MCC Softwares.
The specific period and process for post-termination access must be finalized before the service is offered to real Clinics.
17. Personal Data Breaches
MCC Softwares will investigate suspected personal data breaches affecting the services it operates and cooperate with affected Clinics as required by law and the Data Processing Agreement.
Where MCC Softwares processes patient information on behalf of a Clinic, it will notify the Clinic without undue delay after becoming aware of a confirmed or reasonably suspected relevant breach, so the Clinic can evaluate and meet applicable reporting and notification obligations.
The parties shall identify the appropriate notifying authority and cooperate with lawful instructions from the National Privacy Commission or other competent authorities.
Statutory notification periods and requirements remain applicable regardless of internal contractual procedures.
18. Rights of Data Subjects
Subject to applicable law and its requirements, individuals may have rights including:
The right to be informed
The right to access personal information
The right to object to certain processing
The right to correction or rectification
The right to erasure or blocking where legally applicable
The right to data portability where applicable
The right to damages where legally justified
The right to lodge complaints with the National Privacy Commission
Requests relating to MCC Softwares' own account or business information may be submitted to info@mccsoftwares.com.
Requests concerning patient medical information should ordinarily be directed to the Clinic responsible for the patient's records.
Legal and healthcare record-retention requirements may limit certain deletion requests.
19. Cookies and Session Information
LUNAS EMR may use essential browser cookies or equivalent session mechanisms for authentication, security, and the operation of the service.
Optional analytics, tracking, advertising technologies, or nonessential cookies must be separately disclosed and handled in accordance with applicable law if introduced.
This Policy does not imply that third-party tracking services are currently enabled.
20. Children's Information
LUNAS EMR may contain patient records relating to children when entered by an authorized healthcare Clinic.
The Clinic is responsible for lawful collection and processing of such records, including any applicable parental or guardian requirements.
MCC Softwares processes such information only within its applicable role and legal obligations.
21. Changes to This Privacy Policy
This Policy may be updated to reflect changes in processing activities, security practices, service providers, or legal requirements.
The current version and effective date will be made available through LUNAS EMR.
Material changes will be communicated through an appropriate notification mechanism.
Where additional consent or acknowledgment is legally required, it will be requested separately.
22. Contact and Complaints
For privacy inquiries concerning MCC Softwares:
MCC Softwares-Software Development Services
4th Road, 1st House, SPDA
Datu Odin Sinsuat, Maguindanao
Philippines
Email: info@mccsoftwares.com
Designated Data Protection Officer / Privacy Contact: [TO BE FINALIZED]
Individuals may also contact the Philippine National Privacy Commission regarding concerns within its jurisdiction.
23. Privacy Policy Acknowledgment
Users may be asked to acknowledge that this Privacy Policy has been provided and made available for review.
Such acknowledgment confirms receipt or review of the notice and does not replace a legally required consent or another lawful basis for personal information processing.
END OF PRIVACY POLICY