This section governs the processing of member personal data in connection with the Association Hub, and is designed to interlock with the equivalent Part III of the MedicalPRO Clinic Platform, MyHealth, and Vendor Platform Agreements, so that no personal data processed anywhere on the Platform is left without a clearly assigned Controller.
1. Roles of the Parties
The Association acts as the Data Controller (under Singapore PDPA and GDPR-equivalent standards) and Personal Information Controller (under Philippine law) in respect of the member data it uploads to the Association Hub. The Association determines what member data is collected, for what purpose, and on what basis, subject to the warranties given in Part I, Section 3 of the Terms of Service.
MedicalPRO acts as Data Processor / Personal Information Processor in respect of this data, processing it strictly on the Association's instructions and for the purposes described in this Agreement. MedicalPRO does not independently determine the purpose or legal basis for processing member data — that responsibility rests with the Association.
Where an individual member subsequently activates their own MedicalPRO Clinic Platform account, that member becomes their own Controller for the data they enter into that account, consistent with the Controller structure set out in the Clinic Platform Agreement. From that point, two distinct data relationships may exist in parallel: the Association's ongoing control over the membership record it maintains, and the member's own control over their independent Clinic Platform account.
2. Scope of Processing
MedicalPRO may process member personal data solely for membership record hosting, renewal and status tracking, communication delivery, badge display, and content access control. MedicalPRO shall not use member data for unrelated commercial purposes, including for the benefit of any Vendor or any other Association.
3. Information Security Safeguards
MedicalPRO implements administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, or disclosure, consistent with the safeguards described in the Clinic Platform, MyHealth, and Vendor Platform Data Processing Agreements. MedicalPRO operates a single-tenancy architecture in which each Association's data remains fully isolated from other Associations' data.
4. Sub-Processors
MedicalPRO may engage third-party service providers, such as cloud hosting providers, to support the Association Hub. Such providers are required to maintain appropriate security safeguards. MedicalPRO remains responsible for compliance with this Agreement.
5. Cross-Border Data Transfers
Where member data is transferred outside the Philippines, MedicalPRO ensures appropriate protection measures and contractual safeguards consistent with those described in the Clinic Platform Data Processing Agreement.
6. Data Breach Notification
If a confirmed data breach occurs affecting member data, MedicalPRO shall notify the Association within 72 hours of confirming the breach and provide all available information about the nature and scope of the incident. The Association remains responsible for any regulatory notifications required by applicable law, and for any notification to affected members that its own governing documents or applicable law may require.
7. Data Retention and Deletion
Upon cancellation or termination of the Association's subscription, the Association may request and download its membership data within 30 days of the term end date, after which all Association-uploaded member data will be permanently deleted, except for data belonging to members who have independently activated their own Clinic Platform account, which is retained under that member's own account and governed by the Clinic Platform Agreement.
MedicalPRO cannot recover data after permanent deletion.
8. Confidentiality
MedicalPRO shall maintain strict confidentiality of all member data processed on the Platform, other than data the Association has itself designated for public display, such as a Public-visibility badge or directory listing. Confidentiality obligations survive termination of this Agreement.
9. Consistency Across the Platform
Where this Agreement and the MedicalPRO Clinic Platform Agreement both address data arising from the same individual — for example, a member who has also activated their own Clinic Platform account — both documents are intended to be read consistently, as components of a single Platform-wide data protection framework. In the event of an unresolved conflict concerning the same individual's data, the terms most protective of that individual's data rights shall govern.