MediSync Privacy Notice

Responsibility and contact

MediSync is the company operating this service and the personal information controller for the account, access, application-review and security processing it determines. A participating pharmacy, supplier or organization is responsible for the personal data it collects and the activities it directs through its own business workflows. Where MediSync handles records solely on that business's instructions, its responsibilities also depend on the applicable service arrangement; using MediSync does not remove either party's duties under privacy law.

MediSync physical address: Salitran 1, Dasmarinas City, Cavite, Philippines.

For privacy questions or rights requests, email support@medisync.carefever.com, use MediSync's in-app support, or follow our Data Deletion Instructions. Email and the public instructions are available without signing in. Contacting us does not prevent you from approaching the National Privacy Commission.

Information and sources

Registration uses your name, email address, password hash, email-verification records and acceptance records. Depending on the features you use, we also process contact and profile details; sign-in provider identifiers; role and organization memberships; pharmacy and supplier information; permits, licenses, IDs and application files; addresses and location information; inventory, order and transaction records; senior-citizen or PWD discount records such as name, identification number and transaction details, with birth dates and addresses in some older records; employee contact, pay and attendance records; messages, reviews and support conversations; and device, IP address, session, activity and security records.

We receive this information from you, authorized business representatives, participating businesses, linked Google or Facebook sign-in when used, service activity, documents you upload, and public or official verification and mapping sources. Submit only information relevant to the requested feature. Do not include other people's IDs, health details or other sensitive information unless you are authorized to do so and the feature requires it.

How and why information is used

We use account and contact information to register you, send verification messages, authenticate access and provide requested support. Business profiles, applications and records support review, role permissions, discovery and the operational features selected by a business. Session and activity records help detect misuse, investigate incidents and keep the service reliable. We also process records when needed to meet applicable legal obligations or handle legal claims.

For ordinary personal information, the ground depends on the activity: delivering the service or steps you request before a contract, complying with an applicable legal obligation, or pursuing necessary security and reliability interests where your rights do not override those interests. Where an activity relies on consent, the relevant request should explain its purpose and how consent can be withdrawn. A required registration field is needed to complete registration; refusing information needed for a later feature may prevent that feature from being provided.

Sensitive information

Health information and some identification, licensing, tax and employment records may be sensitive personal information under Philippine law. Their processing requires an applicable ground under section 13 of the Data Privacy Act, such as consent specific to the purpose or another statutory exception whose conditions are satisfied. Contract performance or a general legitimate interest alone is not sufficient. This notice is not consent to process all such information. The relevant collection step and business arrangement must identify the purpose, access and applicable ground.

Personal verification, role age and attendance selfies

Get verified uses your current ID and a fresh camera selfie to check the name saved to your account. It uses the same separate ID-reading, orientation/QR and AWS portrait-comparison services described below. Your selfie is not sent to OpenAI. You accept a specific notice before these checks. The blue badge reflects a completed personal check; it does not establish government authenticity, prove liveness or grant a business role. A new role application with current ID checks, a current passing selfie and the current final application agreement can also record this personal verification. Historical roles are not automatically converted into verified badges.

We retain checked ID images privately, verification and consent records, and a private eligibility date derived from a readable date of birth to determine when you meet the age-18 rule for new owner applications or pharmacy invitations. Personal verification can succeed without meeting that age rule. Other people see only the badge and verification time, not your documents, age evidence or face scores. A proposed change to a verified name is saved only after fresh verification; cancellation or failure preserves your current name and verification. Only committed ID submissions can be offered for later reuse, and they must meet the current checks. Selfies are never offered as a saved submission.

Checking in or out requires a fresh attendance selfie check against your current verified ID, including when your location reading is accurate and within the workplace radius. Eligible staff can also use the check when limited location accuracy qualifies for attendance recovery. A passing selfie check does not bypass location eligibility. AWS receives that ID portrait source and the fresh selfie for comparison under the disclosed provider controls. The attendance record stores distance, accuracy, the configured radius and non-image verification indicators for authorized workplace review; it does not store the selfie or raw location coordinates. Account-verification and attendance selfies are transient request inputs. Temporary account attempts expire after one hour; abandoned ID uploads are revoked and deleted through cleanup, and attempt metadata becomes eligible for cleanup seven days after expiry. Physical deletion depends on successful bounded cleanup. Completed identity evidence and committed private IDs remain while needed for the account and disclosed role or attendance checks, subject to applicable retention obligations and privacy requests.

Identity and application documents

Selecting a National ID, Passport, Driver's License or Postal ID image in the application form starts automated detail checking immediately, before final application submission or acceptance of the final agreements. To extract printed details and locate the document for its preview, OpenAI receives only your ID image and the selected document type and side. Validated document bounds from the checked image also help MediSync select the primary ID portrait for its separate AWS photo check; they do not supply a face-match result. The straightened preview does not replace the original image. If a verified preview lacks reliable crop geometry or readable Place of Birth or Marital Status on a National ID back, MediSync may repeat the same extraction once for that unchanged image and context to recover display details. This does not issue a new verification receipt, change the accepted ID verdict or replace the original image. Your account name is compared with those details on MediSync's server; it is not sent to OpenAI as an extraction hint. National ID back images also go to a separate QR decoding service, which reads the QR code without OCR. Processing may occur outside the Philippines. These checks compare document details and do not establish government authenticity or guarantee approval. When you enter the Identity step, the latest saved ID is automatically rechecked if it lacks current ID verification. Current successful checks may be reused for the same documents and account name. The final submission still requires acceptance of the Medisync Application Terms and the application Privacy Notice for processing your application and supporting documents. Reading a notice does not check those acceptance boxes.

You can remove a selected image or leave the application to stop further checks on this page; a request already transmitted may not be capable of being recalled. Unchecking the final Privacy box prevents application submission but does not undo completed ID checks. To withdraw consent or request deletion of information already sent, contact support. Withdrawal does not undo lawful earlier processing, and we will explain any remaining lawful retention reason. The Application Terms require you to own the business being registered. If you provide another person's permit, license or other document, you must have their specific permission or documented legal authority and give that person the relevant notice; your own consent does not stand in for theirs. We record scan provenance separately from final agreement acceptance, including document versions, account, request reference and server receipt time.

Pharmacy discount records

When a pharmacy applies a senior-citizen or PWD discount, the new sales record contains the customer's name, eligibility ID number and linked transaction details. The pharmacy uses these records to administer the discount and meet applicable sales-record and tax obligations. This is not permission for marketing or unrelated health profiling. The discount form does not request a birth date, home address, diagnosis or ID image; older records may contain birth dates and addresses collected before this change.

The pharmacy must explain this purpose to the customer and restrict records to authorized business staff and legally authorized reporting. Applicable statutory-record obligations may provide a ground for necessary processing where the conditions of section 13 of the Data Privacy Act are met. Other medical, prescription or customer-data uses need their own applicable ground. Ask the pharmacy about its records or contact MediSync for platform access, correction or privacy requests.

Owner photo checks

When photo verification is available, Start camera requests camera access. Capture and check sends your captured photo and submitted ID front to AWS Rekognition in Singapore for face detection, image-quality checks and comparison using direct image bytes. Your captured selfie is not sent to OpenAI. MediSync selects the primary ID portrait independently of selfie similarity, using validated document bounds tied to the checked ID image to exclude background faces. Ambiguous or incomplete portraits require a clearer ID front. The prepared primary portrait and complete selfie are compared by AWS. MediSync does not create face collections or run identity searches. Passing requires the configured quality checks and a similarity score of at least 99 out of 100; this threshold is an operating rule, not a measured accuracy guarantee. Retry check requests another assessment. These actions request checking before final application acceptance; they do not accept the final Privacy Notice for you.

A current passing check is required before continuing or submitting. The result describes apparent portrait consistency, not proof of identity, liveness or government authentication. Provider similarity is not an identity probability. Negative or inconclusive results remain blocking. Camera or service failures require recovery and a successful check; there is no manual-review substitute for a new submission. A current passing AWS photo check satisfies the owner-photo requirement for automatic approval. Approval occurs only on final Submit after every required identity, document, ownership and account eligibility check passes, the current Terms and Privacy Notice are accepted, and automatic approval is enabled. Earlier photo-only or diagnostic results require a new camera check. Existing approved access and historical decisions are preserved. Leaving the photo step stops the camera.

Final submission requires acceptance of the application Privacy Notice. Acceptance and check-request times are recorded separately. One selfie is stored privately only on submission. Automatic approval revokes selfie access in the transaction and deletes it after commit. For historical applications awaiting a decision, access is limited to the applicant and authorized reviewers until a decision. Failed deletions are retried. Outcomes, policy versions and decision source and time remain; images are not copied to an approved business profile. Unchecking acceptance prevents submission but does not recall information already sent.

Workplace attendance and payroll

The participating employer uses employee contact, pay, attendance and adjustment records to administer employment and payroll. Starting an attendance or break action requests device location for workplace verification. The verification map uses Google Maps. Submitted location readings, accuracy, distance, event times and review evidence are available to authorized workplace reviewers. The verification location watch ends when that verification closes; this feature does not authorize continuous off-duty tracking.

The employer must explain its attendance and payroll purposes, recipients, retention criteria and applicable lawful ground to employees before using these features. Necessary ordinary-data processing may relate to employment or applicable legal obligations; sensitive records require a ground that meets section 13. An account registration, browser location permission or an employer's checkbox is not blanket employee consent. Contact the employer for a record correction or if device location cannot be used, and contact MediSync for platform privacy requests. Avoid health diagnoses and unnecessary ID numbers in free-text payroll or attendance notes.

Organization access

A pharmacy owner must accept a separate organization-access agreement before new branch monitoring is shared. Authorized organization viewers can read disclosed stock, aggregate performance and renewal information only while current membership, permissions and subscription access allow it. Performance includes available earlier aggregate sales within the selected reporting period, but does not include customer identities, receipt details, payroll or personal employee information.

Raw compliance-file sharing is optional and separate from that operational agreement. The pharmacy owner selects the exact current typed FDA, business-registration, BIR, business-permit or professional files and accepts a separate sharing supplement. Selected files may be reviewed by the receiving organization owner and its current or future members whose roles include read-only compliance-document access and the relevant Applications, Branches or Renewals permission. Document access does not grant approval rights or access to other monitoring categories. Independent pharmacy-owner and authorized-administrator access remains governed by their existing permissions.

Typed files may still contain personal information. Sharing requires purpose-specific informed consent and specific representative authority for another person's data; unconfirmed files remain unshared. The system does not redact PDF or image contents. Identity scans, selfies, biometric or OCR evidence and unclassified attachments are excluded from this organization sharing.

Membership applications and approval can proceed without shared files. Approval retains the same selection while the pharmacy remains a branch. New or replaced file versions require a new selection; date-only corrections may retain access when the file is unchanged. The pharmacy owner may change or withdraw file sharing without leaving the organization or stopping separately accepted operational summaries. Cancellation, decline, unlisting, pharmacy ownership change, withdrawal or loss of the required permissions ends current file access. Previously downloaded copies cannot be recalled. Disclosed historical evidence, acceptance records and selection or withdrawal receipts remain under their applicable access and audit-retention rules. These agreements record authorization and safeguards; they do not themselves establish a legal basis for processing another person's data.

Who can receive information

Authorized MediSync personnel and participating business users receive information needed for their assigned functions. Public directory features show pharmacy and business-listing details, public registry information and designated business contacts where available. Personal owner-account names and email addresses are excluded from public pharmacy directory responses. Some organization profiles also list participating team members; the organization must have an appropriate basis and inform those members before publishing their details. Private application files and restricted account records are subject to access controls. Hosting, database, email, sign-in, mapping, document-verification and security providers process the information needed for their services. Application ID extraction sends the relevant ID image and selected document type and side to OpenAI; National ID back images also go to the separate QR decoding service. Google Cloud Vision reads ID text direction through the configured Cloud Run service to corroborate preview orientation, separately from QR decoding and identity checks. Account-name comparison stays on MediSync's server. We may disclose relevant records to issuing institutions, registries, professional advisers, courts or public authorities when legally authorized or required.

Medi and automated assistance

Medi uses OpenAI to generate replies. When you chat with Medi, your message and recent Medi conversation context are sent for processing, including any personal information you choose to type. Avoid passwords, OTPs, complete ID numbers or unnecessary health details in chat. The support assistant uses role-specific service guidance; it does not independently authorize account or business changes.

Administrator assistance may additionally use a minimized set of platform records allowed by the administrator's permissions. Those record tools are designed to exclude private documents, credentials, phone and identification numbers, precise coordinates, raw security evidence and unrestricted support conversations; an email address is included only for an explicit exact lookup. This filtering does not guarantee removal of information someone types into a prompt. Generated replies and automated document checks can be incomplete or incorrect. You can contact support to question a result or request review of an affected account or application decision.

Ask Medi accepts relevant screenshots, images, PDF and DOCX attachments, including prescriptions you are authorized to share. Files and extracted content are sent to OpenAI for processing. Medicine names are tentative and unclear handwriting requires confirmation; this does not validate a prescription or dose. Accepted attachments remain private with their conversation and expire after 30 days without a new message. Unsent files expire after 24 hours. Expired data is inaccessible before physical cleanup. Temporary provider file copies are deleted after processing, with expiry and cleanup retries; this does not mean the provider retains no data. Files expressly submitted to a support concern follow that ticket's separate retention. Prescriptions are not forwarded automatically.

Uploaded profile pictures are resized, stripped of original metadata and displayed as your account avatar, including in Messages. We retain up to five recent uploaded profile pictures so you can choose a saved picture again. Selecting the default picture preserves this history. Older pictures beyond the limit are retired from the selector, while the current picture is protected. Retired files are deleted through cleanup once no current profile or active prepared save references them; failed deletions are retried. Account deletion retires your saved picture history and includes its files in cleanup. Activity records summaries of profile/settings changes and authorized resource access without copying private document or prescription content.

Website feedback

When you submit website feedback, MediSync associates the review with your signed-in account and records your star rating, optional comment, public-name choice and submission or update time. Published reviews appear on the public Feedback page and may appear in the home page's Website feedback section. Anonymous is selected initially. Choosing your account name makes that display name public with the review; choosing Anonymous hides it from public review responses but does not remove the account association used to manage your reviews and protect the service. Do not include passwords, verification codes, private documents, health details or other people's personal information in a public comment.

Nonempty comments are sent to OpenAI for an automatic English, Filipino and Taglish profanity check before publication. The check request contains the comment, not your account name, email address or star rating. Star-only reviews do not require this check. Flagged comments require you to edit them; MediSync does not automatically rewrite or censor them for publication. A service failure leaves the new comment unpublished. Automated classification can be incomplete or incorrect; contact support if you need help with a result.

You can edit or withdraw your own reviews. The previous published version stays visible until an edited replacement passes the check and saves. Withdrawal removes the selected review from public lists and rating totals, while its private record and retry receipts remain for ownership and reliable recovery. Account deletion includes website-feedback and preparation records through the account deletion process; separate security records and backups follow their applicable retention controls. Public website feedback is separate from private support concerns.

Service providers outside the Philippines

Some providers process or store information outside the Philippines. Relevant provider services include hosting, email, sign-in, mapping, Google Cloud Vision OCR, OpenAI document extraction and automated assistance, and AWS Rekognition face verification in Singapore. AWS processing requires verified service-improvement opt-out and operating controls. Stateless comparison does not establish zero provider retention; applicable provider security and retention practices still apply. MediSync remains responsible for the processing it controls and for the safeguards required when it instructs a provider. MediSync requests that OpenAI not retain responses for later conversation state; this does not prevent provider processing or retention for security and abuse monitoring under the applicable service controls.

Browser storage and location

Session cookies and browser local or session storage support sign-in, coordination between tabs, preferences and location context. Restricting essential storage may prevent parts of the service from working. Pages may load external scripts, fonts, maps or tiles; loading those resources can send the provider request details such as an IP address and browser information.

Nearby pharmacy search can use device location with browser permission and keep location context in session storage. Mapping and reverse-geocoding providers process the location needed for the requested feature. Business attendance features may record a location reading, its accuracy, distance from a workplace and the attendance event for authorized workplace review. Device permission does not authorize unrelated location tracking or replace a required privacy-law basis.

Retention and deletion

Account and profile records are retained while needed to provide the account. Application, business, transaction and acceptance records may remain when needed for the relationship, an applicable legal duty, investigation or legal claim. Registration and password-reset codes expire after ten minutes. Expired code records are removed through bounded maintenance batches, so expiry and physical deletion can occur at different times. Separate rate-limit and security records have their own retention periods.

Medi support conversations become eligible for cleanup after 30 days without a new message. Removal occurs through cleanup routines, rather than an immediate deletion of every message on its thirtieth day. Administrator Medi conversations are eligible for cleanup after 30 days of inactivity, with exceptions for active jobs or pending workflow confirmations. Continuing a conversation restarts its inactivity period. Security event records normally become eligible for removal after 90 days. Security incident summaries, response activity and notification records normally use a 365-day cutoff, with recent incident activity extending the relevant period. Temporary import staging normally uses 12 hours and a file-count limit; that rule does not purge identity uploads. Actual deletion depends on successful cleanup jobs. Application documents are reviewed when an application is decided, withdrawn, replaced or the relationship ends; business records are reviewed at the relevant transaction, fiscal or employment milestone against their applicable obligations. Backups and external provider copies are governed by their actual recovery and service arrangements and may not disappear immediately with a primary record. Other records are kept only while needed for their disclosed purpose or a lawful retention reason. A deletion request is assessed against those obligations and the rights of other people; we will explain when relevant records must be retained or restricted instead of deleted.

Safeguards and your rights

We use safeguards such as access controls, password hashing, session and request protections, controlled file access and security logging. No service can guarantee absolute security. Report suspected misuse promptly; any legally required incident notifications remain our responsibility.

Subject to applicable law, you may request information and access, correction, erasure or blocking; object to processing; withdraw consent for processing that relies on it; request portability where applicable; and pursue remedies, including a complaint to the National Privacy Commission. A request may be limited to protect another person's information or meet a legal duty, but it is not waived by registering. We may request proportionate information to verify identity or authority. Never send your password or OTP for a privacy request. Explain the record or concern and the outcome you seek through the contact route above.

Updates

We will date updated notices and explain material changes through an appropriate service notice before the changed processing begins where required. When a new purpose requires consent, updating this notice does not replace obtaining that consent. The public privacy notice and registration notice describe the same practices.