Data Processing Agreement
This agreement is between you, the physician or clinic using RxPH, and EXEVIO d.o.o., Vukovarska 6, Rijeka, Croatia (MBS 040306757, OIB 53022148424), who provides RxPH ("we"). It is part of the Subscriber Terms, and it covers your patients' personal data that you keep in RxPH.
For that data you are the controller (you decide what is collected and why) and we are your processor, under the Philippine Data Privacy Act (RA 10173) and the EU General Data Protection Regulation. Our own data about your account and billing is covered by our privacy notice, not by this agreement.
1. What we process
| Purpose | Running RxPH for you: keeping your patients' records and consultations, writing and issuing prescriptions and other documents, letting patients fill in and read their own record, and letting anyone holding a document's code open it, check that it is genuine, and record that it was dispensed |
| Patients' data | Name, date of birth, sex, civil status, address, phone, email; medical, family and social history; diagnoses; your notes and attached files; prescriptions; records of dispensing |
| Sensitive data | Health information, civil status, age and education |
| Whose data | Your patients, and the pharmacy staff who record dispensing |
| Where | On servers in Falkenstein, Germany, in the European Union. An encrypted backup copy, updated every hour, is also kept on a storage device we control in the Philippines |
| How long | For as long as you have an account, and then as described in section 8 |
2. We act only on your instructions
We process your patients' data only to provide RxPH as you use it and as these terms and the Subscriber Terms describe. We never sell it and never use it for advertising or marketing. To improve RxPH we may study how its features are used, in anonymised form that cannot be linked to you or to any patient. If the law ever required us to do something else with the data, we would tell you first, unless the law forbids that. If we think an instruction of yours would break data protection law, we will tell you immediately.
3. Confidentiality
Anyone on our team who handles the data is bound to keep it confidential, and stays bound after they leave.
4. Security
We protect the data with the measures in Annex C, we will not weaken them, and we follow the Data Privacy Act and the National Privacy Commission's rules.
5. Other companies we use
We use the companies in Annex B, and you agree to them. Each is bound to protect the data at least as well as we are, and we remain responsible for them. Before we add or replace one, we will tell you at least 30 days ahead, by email or in RxPH. If you object on reasonable data-protection grounds and we cannot resolve it, you may end your subscription without penalty and take a copy of your data.
6. If something goes wrong
If we become aware of a breach affecting your patients' data, we will tell you within 24 hours, by email and by any other means we have. We will tell you what happened, what kind of data it affects, whose and how much, the likely consequences, what we are doing about it, and who to contact. We will send anything we do not know yet as soon as we know it. We will help you notify the National Privacy Commission and your patients, and we will not contact your patients about it ourselves unless you ask us to or the law requires it. We keep a record of every breach and what we did about it.
7. Helping you
Your patients have the right to see, correct, copy and erase their data. You can do all of this yourself in RxPH, and a patient who has confirmed their email address can read, correct and take a copy of their own record. What they see is their own details and history, the prescriptions and other documents you issued them, and, for each consultation you saved, its diagnoses, your instructions and the files you chose to share; never your own notes. If a request cannot be handled in RxPH, we will help you within five working days. If a patient contacts us directly, we will pass the request to you rather than answer it ourselves.
We will also help you meet your duties under the Data Privacy Act and the GDPR where our part of the processing makes it relevant, including security, breach notifications, data protection impact assessments and consulting the regulator.
8. How long data is kept, and what happens at the end
While you have an account, your records stay until you delete them. How long to keep your patients' records is yours to decide as their doctor.
When the agreement ends, we will give you your data if you want it, and then delete our copies, except issued prescriptions. By accepting this agreement you instruct us to keep those, and to keep them verifiable, for 10 years from the day they were issued (or, for a patient who was a minor, until 10 years after their 18th birthday), because your patients and their pharmacies hold copies that must still check out. If you want us to keep anything else, or to keep it longer, tell us. Backups are deleted within 35 days.
9. Showing that we comply
We will give you the information you need to see that we keep to this agreement, and allow an audit by you or an auditor you choose, on reasonable notice, at most once a year unless a breach or a regulator requires more, and at your cost unless the audit finds that we are materially failing to comply.
10. Data moving between countries
Your patients' records are stored in the European Union, and an encrypted backup copy of them, with the key kept apart from it, on a storage device we control in the Philippines. Because you are in the Philippines, when data comes back to you from us, the European Commission's Standard Contractual Clauses (Module Four, processor to controller) apply, and are part of this agreement. For those Clauses, Croatian law applies, the courts of Rijeka decide disputes, and section 1 and Annex A are their Annex I. We stay accountable for the data while it is in our care, including anything we pass to the companies in Annex B.
11. Your part
You confirm that you have a lawful basis for the processing (as a medical practitioner treating your patients, or with their consent), that you have told your patients what the law requires you to tell them, and that you do not offer your services to people in the European Union.
12. If documents disagree
On data protection, this agreement takes precedence over the Subscriber Terms. The Standard Contractual Clauses take precedence over this agreement.
Annex A: Contacts
You: the physician or clinic named on the RxPH account, at the contact details held there, and your Data Protection Officer if you have told us of one.
Us: EXEVIO d.o.o., Vukovarska 6, Rijeka, Croatia. Data Protection Officer: Dino Budimilić, dpo@rxph.app.
Regulators: the National Privacy Commission of the Philippines, and AZOP, the Croatian Personal Data Protection Agency.
Annex B: Companies we use
| Company | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting the servers | Falkenstein, Germany |
| Stripe Payments Europe, Ltd | Your subscription payments: your billing details only, never patient data | Ireland |
| Postmark (AC PM LLC, an ActiveCampaign company) | Sending email: sign-in codes, and short notices with a link. A notice to you names the patient; one to a patient names your clinic and the kind and date of a document, or the date a record that never reached you will be deleted. No diagnosis, medical history, medicine, document content or file is ever written into an email | United States, under Standard Contractual Clauses |
Annex C: Security measures
- All connections encrypted.
- Records and files encrypted where they are stored, with the key kept apart from them.
- Backups, updated every hour, encrypted the same way, and each deleted within 35 days.
- No passwords: signing in takes a single-use code that expires in ten minutes, and then a passkey on the doctor's own device (Face ID, a fingerprint or the device PIN). Our own staff sign in the same way.
- Every doctor's records kept separate from every other doctor's.
- A patient's own sign-in works only at an email address they have confirmed with a code, and only they can change it, with a code sent to the address they already have.
- Document codes too long to guess, and what an issued document says never changes. It can only be voided.
- Patient pages are kept out of search engines and are not stored by browsers.
- A record of when each prescription is opened.