Privacy Policy
Effective date: May 30, 2026 · Last updated: May 30, 2026
1. Who We Are (Personal Information Controller)
StackWise, the operator of the Smiley clinic management platform, is the Personal Information Controller (PIC) as defined under Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR).
Contact: Data Privacy Officer (DPO)
Email: privacy@stackwise.com
Address: Philippines
Under Section 21 of the DPA, you have the right to be informed of who controls your data. This section fulfills that requirement.
2. Data We Collect
We collect the following categories of information:
| Data Type | Classification | Purpose |
|---|---|---|
| Patient Name, Date of Birth | Personal Information | Patient identification and login |
| Clinic Contact Details (email, phone, address) | Personal Information | Account creation and communication |
| Admin & Dentist Email + Password (hashed) | Personal Information | Authentication |
| Dental Records (procedures, diagnoses, treatment notes) | Sensitive Personal Information | Clinic operations, patient care |
| Appointment History & Schedules | Personal Information | Scheduling and reminders |
| Device & Usage Data (IP address, browser, pages visited) | Personal Information | Security and analytics |
Note: Health and dental records are Sensitive Personal Information under Section 3(l) of the DPA. Processing this data requires explicit consent and heightened security measures, which we comply with.
3. Legal Bases for Processing
Under Section 12 and 13 of the DPA, we process your data on the following lawful grounds:
- Consent: You actively agree to this Privacy Policy when registering a clinic or using the platform as a patient.
- Performance of Contract: Processing is necessary to deliver the clinic management services you subscribed to (Section 12[b]).
- Legitimate Interest: We process minimal usage data to keep the platform secure and functional.
- Compliance with Legal Obligation: Philippine health regulations may require retention of certain medical records.
4. How We Use Your Data
- Provide, operate, and improve the Smiley clinic management platform
- Authenticate users and prevent unauthorized access
- Enable dentists and admins to manage patient records and appointments
- Send appointment reminders (SMS/email) where the clinic enables this feature
- Respond to support requests and technical issues
- Comply with applicable Philippine laws and regulations
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
5. Data Sharing and Third-Party Processors
We share data only with trusted sub-processors who are contractually bound to protect it. Under Section 14 of the DPA, processors must comply with our instructions and applicable law.
| Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database & authentication hosting | USA (SCCs apply) |
| Email/SMS Providers | Appointment reminders (if enabled) | Philippines / Cloud |
For transfers outside the Philippines, we ensure safeguards such as Standard Contractual Clauses (SCCs) are in place in accordance with NPC Advisory No. 2017-01.
6. Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Patient Dental Records | Duration of clinic subscription + 10 years | DOH record-keeping guidelines |
| Account Credentials | Active account lifespan | Security |
| Appointment Logs | 3 years from appointment date | Operational records |
| Usage / Access Logs | 12 months | Security auditing |
Upon account deletion or clinic termination, personal data is anonymized or securely deleted within 30 days, except where retention is required by law.
7. Your Rights as a Data Subject (Philippine DPA, Chapter IV)
Under Sections 16–20 of the DPA, you have the following rights:
- Right to be Informed: You have the right to know how your data is collected, processed, and stored (Section 16).
- Right to Access: You may request a copy of your personal information held by us (Section 16[c]).
- Right to Rectification: You may request correction of inaccurate or outdated data (Section 16[d]).
- Right to Erasure or Blocking: You may request deletion or blocking of data that is unlawfully processed or no longer necessary (Section 16[e]).
- Right to Object: You may object to processing based on legitimate interest (Section 18).
- Right to Data Portability: You may request your data in a structured, commonly used format (Section 18[b]).
- Right to Damages: You may claim compensation if you suffered damages due to inaccurate, incomplete, or false data (Section 16[f]).
To exercise these rights, email our DPO at privacy@stackwise.com. We will respond within 15 working days as required by NPC Circular 16-01.
8. Security Measures
Under Section 20 of the DPA, we implement reasonable and appropriate organizational, physical, and technical measures to protect your data:
- All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Passwords are hashed and never stored in plain text
- Role-based access control: dentists can only access their clinic's patients
- Regular security reviews and vulnerability assessments
- Supabase infrastructure complies with SOC 2 Type II standards
If a personal data breach occurs, we will notify the National Privacy Commission (NPC) within 72 hours of discovery and inform affected data subjects without unreasonable delay, as required by Section 20(f) of the DPA.
9. Cookies and Tracking
We use the following cookies and similar technologies:
| Cookie | Type | Purpose |
|---|---|---|
| Session Cookie | Strictly Necessary | Keeps you logged in during your session |
| CSRF Token | Strictly Necessary | Prevents cross-site request forgery attacks |
| Analytics (future) | Optional | Aggregate usage statistics; you can opt out |
Strictly necessary cookies do not require consent. Optional analytics cookies, if implemented, will be subject to prior consent in line with NPC Advisory No. 2020-01.
10. Children's Data
Smiley is not directed to children under 13 years of age as primary account holders. However, clinics may register patients who are minors. In such cases, the clinic (as an independent Personal Information Controller for its patients) is responsible for obtaining parental consent as required by Section 13(e) of the DPA.
11. Filing a Complaint
If you believe your data privacy rights have been violated, you may file a complaint with the:
Website: www.privacy.gov.ph
Email: complaints@privacy.gov.ph
Address: 3F Core G, GSIS Complex, Roxas Blvd., Pasay City, Metro Manila, Philippines
We encourage you to contact our DPO first so we can resolve concerns directly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice in the app at least 30 days before taking effect. Continued use after the effective date constitutes acceptance of the revised policy.