Privacy Policy

HealthBlocks 360, Sigla Health, and www.healthblocks.ph / https://healthblocks.ph

Effective Date: June 22, 2026 | Last updated: June 22, 2026

HealthBlocks Inc. ("HealthBlocks," "we," "us," or "our"), with principal office at 145 Mother Ignacia St., Brgy. South Triangle, Diliman, Quezon City, 1101 Metro Manila, Philippines, respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use the HealthBlocks 360 application, the Sigla Health mobile application, and our website at www.healthblocks.ph (collectively, the "Platform"), and describes your rights regarding your information under the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines (the "DPA") and other applicable data protection laws.

By creating an account, accessing, or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Platform. If you are using the Platform on behalf of, or as authorized by, a healthcare provider, employer, insurer, or other organization ("Client Organization"), please also refer to any additional notice provided by that Client Organization, which may supplement this Policy.

1. Scope of This Policy

1.1  This Privacy Policy applies to personal data we collect through the Platform, including the HealthBlocks 360 web/enterprise application, the Sigla Health consumer mobile application, and our website at www.healthblocks.ph, as well as through related customer support, sales, and marketing interactions.

1.2  This Policy does not apply to third-party websites, applications, or services that may be linked from the Platform, or to information collected by a Client Organization independently of the Platform (e.g., through its own intake forms), which remains subject to that Client Organization's own privacy practices.

1.3  Assumptions About Users; Data Accuracy. The Platform is intended to be used by, or under the direction and supervision of, licensed medical or healthcare professionals. We assume that any individual who enters, uploads, or transmits Health Data or other information into the Platform — whether their own information or information concerning a patient or other individual — is either (a) a licensed medical or healthcare professional, or (b) acting under the instruction, supervision, or authorization of a licensed medical or healthcare professional. Accordingly, you, and any medical or healthcare professional directing your use of the Platform, are solely responsible for verifying the accuracy, completeness, and appropriateness of any Health Data or other information that you, or individuals under your supervision, enter into the Platform. HealthBlocks does not independently verify the clinical accuracy of user-entered data and does not provide medical advice; the Platform is a tool intended to support, and not to replace, professional medical judgment.

1.4  No Control Over User Conduct or Use of the Platform. We do not regulate, monitor, or control how you or other users choose to use the Platform, including its mailer, SMS, and other communication or notification features, beyond providing the underlying tools and technical functionality. You are responsible for using the Platform, and any features you activate, in a manner consistent with applicable laws, professional and ethical standards, and the assumptions described in Section 1.3, and HealthBlocks is not responsible for how you or another user chooses to configure, operate, or make use of the Platform's features.

2. Information We Collect

2.1  We collect the following categories of information, depending on how you use the Platform:

(a) Account and Identity Data:  name, email address, mobile number, date of birth, gender, username and password, profile photo, and government-issued identification where required for identity verification.

(b) Health Data:  information relating to your physical or mental health that you input into, or that is generated by, the Platform, such as vital signs, symptoms, diagnoses, medications, treatment history, laboratory results, wellness and fitness metrics, and information synced from connected devices or wearables. Health Data is treated as "sensitive personal information" under the DPA and is subject to heightened protection.

(c) Automatically Collected Information (Usage and Device Data):  when you access or use the Platform, we automatically collect technical and usage information, including: your IP address; browser type and version; device type, model, and unique device identifiers; operating system and version; mobile network or carrier information; app version; time zone and language settings; log-in and log-out timestamps; pages or screens viewed, features used, and referring/exit pages; and crash logs and other diagnostic data.

(d) Communications Data:  information you provide when contacting customer support, submitting a help ticket, or otherwise corresponding with us, including the content of such communications.

(e) Billing and Transaction Data:  subscription plan, payment method details (processed by our payment processor; we do not directly store full card numbers), billing address, and transaction history.

(f) Location Data:  approximate or precise location, where you enable location-based features and grant the relevant device permission.

2.2  We collect this information: (a) directly from you, when you register, complete your profile, or use Platform features; (b) automatically, through your use of the Platform (e.g., analytics, cookies, and similar technologies); (c) from connected third-party devices or applications you authorize to sync with the Platform; and (d) from a Client Organization, where the Platform is made available to you through your employer, healthcare provider, or insurer.

3. How We Use Your Information

3.1  We use the information we collect for the following purposes:

• to create and manage your account and provide the features and functionality of the Platform;

• to enable healthcare providers, care teams, or authorized Client Organization personnel to review your Health Data for care coordination purposes, where applicable;

• to provide customer support, respond to inquiries, and troubleshoot technical issues;

• to process subscriptions, payments, and billing;

• to send you service-related communications, including appointment reminders, health alerts, and account notifications;

• to conduct research and development, testing, and quality assurance to maintain, secure, and improve the Platform;

• to generate aggregated or de-identified analytics and usage reports for Client Organizations regarding their own users;

• where you choose to activate it, to provide optional AI-assisted analysis of your report data, as described in Section 5 below;

• to detect, prevent, and address fraud, security incidents, or technical issues;

• to comply with applicable laws, regulations, and legal process; and

• with your separate consent, for marketing or promotional communications, which you may opt out of at any time.

3.2  Legal Bases for Processing. We process your personal data on the following legal bases recognized under the DPA: (a) your consent, particularly for the processing of Health Data and other sensitive personal information; (b) the necessity of processing to perform our contract with you (e.g., providing the Platform's core features); (c) compliance with a legal obligation; and (d) our legitimate interests (e.g., securing the Platform and preventing fraud), balanced against your rights and freedoms.

4. How We Share Your Information

We do not sell your personal data. We may share your information with the following categories of recipients, only as necessary for the purposes described in this Policy and under appropriate confidentiality and data protection safeguards:

(a) Technology, R&D, and Support Partners.  We engage Converge Studios Inc., our authorized technology, research and development, and support partner, to help operate, maintain, and support the Platform. CSI accesses personal data, including Health Data, strictly on our instructions and under contractual confidentiality, security, and data protection obligations, and only to the extent necessary to perform research and development, engineering, technical support, and account/customer success functions.

(b) Authorized Resellers.  Where the Platform is sold to you through an authorized reseller (including CSI, acting in its reseller capacity), we share account, contact, and billing information reasonably necessary for sales, onboarding, invoicing, and account management. Resellers do not receive your Health Data for marketing or unrelated commercial purposes.

(c) SMS/Messaging Providers.  To deliver text messages such as appointment reminders, one-time passcodes, and account notifications, we share your mobile number and relevant message content with our SMS and messaging service providers.

(d) Email and Mail Providers.  To deliver account notifications, service communications, and, where you have consented, marketing communications by email or physical mail, we share your contact information with our email delivery and mailing service providers ("Mailers").

(e) Video/Teleconsultation Processing Providers.  Where the Platform offers video-based teleconsultation features, we share necessary information (such as your name, appointment details, and the audio/video stream of the session) with our video-conferencing and video-processing service providers, solely to enable and support the teleconsultation session.

(f) Client Organizations.  If you access the Platform through a Client Organization (e.g., your employer, health plan, or healthcare provider), we share relevant information with that Client Organization as necessary to provide the Platform to you and as authorized by your agreement with that Client Organization.

(g) Healthcare Providers and Care Coordination.  Where you authorize it, we may share your Health Data with healthcare providers or care team members you designate, for purposes of care coordination and treatment.

(h) Legal and Safety.  We may disclose information where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of HealthBlocks, our users, or the public.

(i) Business Transfers.  In connection with a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections.

(j) Aggregated/De-identified Data.  We may share information that has been aggregated or de-identified such that it no longer identifies you, for research, benchmarking, or analytics purposes, and as described in Section 5 below with respect to our optional AI-assisted analysis feature.

We require all service providers and partners who process personal data on our behalf to implement appropriate security and confidentiality safeguards and to use such data only for the purposes we authorize, and we do not permit any recipient listed above to sell your personal data or use it for their own independent marketing purposes without your separate consent.

4.2  User-Transmitted Content. As noted in Section 1.4, the SMS, email, and video-teleconsultation features of the Platform allow you, healthcare providers, or other users to directly type, speak, write, or otherwise transmit content through those channels (for example, the text of an SMS or email message, or what is said or shown during a video teleconsultation). We do not control, monitor, filter, or review the content that you or another user chooses to communicate through these channels, and we are not responsible for the accuracy, appropriateness, or consequences of any information you or another user chooses to include in such communications. Our role, and that of our SMS, email, and video-processing service providers referenced above, is limited to facilitating the transmission and, where applicable, technical processing of these communications. You are responsible for the content you choose to share through these channels, and we encourage you to share only the information reasonably necessary for the purpose of the communication.

5. Optional AI-Assisted Analysis Feature

5.1  The Platform offers an optional feature, which is not activated by default, that allows you to choose to have your report data analyzed with the assistance of a third-party artificial intelligence model (currently, Google's Gemini) to help generate insights or summaries related to your report data (the "AI Analysis Feature").

5.2  The AI Analysis Feature is opt-in only: it is not automatically enabled, and your report data will not be sent for AI analysis unless and until you take an affirmative action to activate the feature. You may deactivate the feature at any time, which will stop future submissions of your report data for this purpose.

5.3  De-identification. Before any report data is transmitted to the AI Analysis Feature's underlying model, we remove or strip identifying information (such as your name, contact details, and other direct identifiers) so that no personally identifiable information is sent to, or processed by, the third-party AI provider. The AI provider receives only de-identified report data for the purpose of generating the requested analysis.

5.4  The de-identified data sent for AI analysis is processed by the third-party AI provider in accordance with that provider's own terms and data handling practices for API-submitted data; we select AI providers that contractually commit not to use API-submitted data to train their general-purpose models. We remain responsible for ensuring the AI Analysis Feature is offered consistently with this Policy and applicable law.

5.5  If you do not wish for your report data to be analyzed by this optional feature, simply do not activate it; your use of the rest of the Platform is not affected by your choice.

5.6  No Control Over AI Output. We do not control, and cannot guarantee the accuracy, completeness, or appropriateness of, any output, insight, or summary generated by the third-party AI model used in the AI Analysis Feature. Such output is generated algorithmically by the AI provider based on the de-identified data submitted, and is provided for informational purposes only. It is not medical advice, and consistent with Section 1.3, any output from the AI Analysis Feature should be independently reviewed and verified by a licensed medical or healthcare professional before being relied upon.

6. Data Retention

6.1  We retain your personal data, including Health Data, for as long as your account remains active, and for such additional period as is reasonably necessary to fulfill the purposes described in this Policy, comply with our legal and regulatory obligations (including applicable medical record retention requirements), resolve disputes, and enforce our agreements.

6.2  When you request deletion of your account or personal data, we will delete or de-identify your information from our active/production systems, subject to any retention required by law. Please note that your data may continue to exist for a limited period in encrypted backup, disaster-recovery, or archival systems maintained in the ordinary course of our data management practices; such backup copies are not actively used and are permanently deleted or overwritten as those backups are rotated out on our standard retention schedule.

7. How We Protect Your Information

7.1  We implement administrative, technical, and physical safeguards designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, consistent with the DPA's requirements for organizational, physical, and technical security measures. These include encryption of Health Data in transit and at rest, role-based access controls, authentication requirements, access logging and monitoring, regular security testing, and staff confidentiality and data-protection training.

7.2  Access to Health Data by our personnel and CSI's authorized support developers, QA staff, and customer success personnel is limited on a need-to-know basis, individually logged, and subject to confidentiality obligations, as further described in our internal data governance policies and our data sharing agreement with CSI.

7.3  No method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

7.4  No Guarantee of Availability. We do not guarantee that the Platform, or any of the third-party services integrated with it — including the AI Analysis Feature, mailer, SMS/messaging provider, video-teleconsultation processing provider, or our cloud hosting infrastructure (GCP and Converge Cloud) — will be available, uninterrupted, error-free, or free from delay at all times. Availability may be affected by factors outside our control, including outages, maintenance, or issues at a third-party provider. We are not responsible for any loss, delay, or inability to access or transmit information arising from the unavailability of the Platform or any such third-party service.

8. Your Rights

8.1  Subject to the requirements and exceptions under the DPA, you have the right to:

• be informed that your personal data will be, is being, or has been processed;

• access your personal data that we hold;

• object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling;

• request correction of inaccurate or outdated personal data;

• request the erasure or blocking of your personal data under certain circumstances (e.g., where the data is incomplete, outdated, unlawfully obtained, or no longer necessary for the purposes for which it was collected);

• be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data;

• obtain a copy of your personal data in an electronic or structured format (data portability); and

• lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

8.2  To exercise any of these rights, please contact our Data Protection Officer using the details in Section 13 below. We will respond to your request within the time required by the DPA. We may need to verify your identity before acting on your request.

9. Children’s Privacy

9.1  The Platform is not directed to children under the age of eighteen (18), except where a minor's account is created and managed by a parent, legal guardian, or authorized healthcare provider in connection with the minor's care. We do not knowingly collect personal data directly from children without such authorization. If we become aware that we have collected personal data from a child without appropriate parental/guardian consent or authorization, we will take steps to delete such information.

10. Cookies and Similar Technologies

10.1  The Platform (HealthBlocks 360 and Sigla Health) and our website at www.healthblocks.ph currently use only strictly necessary cookies and similar technologies — that is, cookies required for the website and Platform to function properly, such as maintaining your session, enabling security features, and remembering your login state. We do not currently use performance/analytics, functional/preference, targeting, or marketing cookies.

10.2  Because we use only strictly necessary cookies, which are required for the Platform and website to operate and do not require your prior consent under applicable law, we do not currently present a cookie consent banner or preference management tool. If this changes in the future — for example, if we begin using analytics or marketing cookies — we will update this Policy and implement an appropriate consent mechanism before doing so.

10.3  You may still control or disable cookies generally through your browser or device settings. Please note that because the cookies we use are strictly necessary, disabling them may prevent the website or Platform from functioning properly or at all.

11. International Data Transfers

11.1  Your personal data, including Health Data, is stored and processed in cloud data centers located in the Philippines and Singapore. The Platform's primary infrastructure is hosted on Google Cloud Platform (GCP), with certain components hosted on Converge Studios Inc.'s own cloud infrastructure ("Converge Cloud") in connection with the research and development, engineering, and support services CSI provides for the Platform. Where your personal data is processed or stored in Singapore, on Converge Cloud, or transferred to any other country in connection with the Platform, we take reasonable steps to ensure that such data continues to be protected in a manner consistent with the DPA and this Policy, including through contractual safeguards with the relevant cloud service provider and other recipients, such as data processing agreements and, where applicable, cross-border transfer mechanisms recognized under the DPA and its Implementing Rules and Regulations.

12. Changes to This Policy

12.1  We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or legal requirements. We will post the updated Policy on the Platform and revise the "Last Updated" date above. Where changes are material, we will provide additional notice (e.g., through the Platform or by email) and, where required by law, obtain your renewed consent before the changes take effect.

13. Contact Us / Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or wish to exercise your rights under the DPA, please contact our Data Protection Officer:

HealthBlocks Inc.
Attn: Data Protection Officer
145 Mother Ignacia St., Brgy. South Triangle, Diliman, Quezon City, 1101 Metro Manila, Philippines
Email: privacy@healthblocks.ph

You may also contact us via the form below.