Privacy Policy

Introduction

Getmeds Philippines, Inc. and 2MG Incorporated (collectively, "Getmeds," "the Company," "we," "us," or "our") are committed to protecting the privacy and security of the personal data of our customers, patients, healthcare professionals, job applicants, employees, and other visitors to our website (the "Site"). This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC").

This Privacy Policy describes how we collect, use, store, share, and protect personal data obtained through the Site, and explains the rights available to you as a data subject under the DPA. By accessing or using the Site, you acknowledge that you have read and understood this Privacy Policy.

Scope and Application

This Privacy Policy applies to all personal data collected through www.getmeds.ph and any affiliated Getmeds digital platforms, including online ordering, prescription upload and verification, delivery services, careers/application pages, newsletter or marketing sign-ups, and general browsing activity. It applies to all users of the Site, including customers, patients, caregivers, healthcare professionals, job applicants, and business partners.

This Policy does not apply to information collected offline (e.g., in-store transactions) or by third-party websites linked from the Site, which are governed by their own privacy policies.

Definitions

• "Personal Data" refers to any information, whether recorded in material form or not, from which the identity of an individual is apparent or can reasonably be ascertained.
• "Sensitive Personal Information" refers to personal data about an individual's health, medical records, government-issued identification numbers, and similar categories defined under Section 3(l) of the DPA.
• "Processing" refers to any operation performed on personal data, including collection, recording, storage, use, consolidation, retrieval, disclosure, or destruction.
• "Data Subject" refers to an individual whose personal, sensitive personal, or privileged information is processed by Getmeds.
• "Data Protection Officer (DPO)" refers to the individual designated by Getmeds to be accountable for its compliance with the DPA.

Personal Data We Collect

The categories of personal data we collect through the Site depend on how you interact with us, and may include:

We collect this information directly from you (e.g., account registration, checkout, prescription upload, job application forms), automatically through cookies and similar technologies, and, where applicable, from authorized third parties such as delivery partners or payment processors.

Purpose and Legal Basis for Processing

We process personal data only for legitimate, specified, and declared purposes, and only on the basis of the lawful criteria set out under Sections 12 and 13 of the DPA, including:

• Consent — where you have given clear, informed consent, particularly for the processing of sensitive personal information such as prescription and health-related data;
• Contractual necessity — to process and fulfil your orders, deliveries, and account management;
• Legal obligation — to comply with FDA, DOH, and other applicable regulatory requirements for the sale and dispensing of medicines;
• Vital interest — to protect the life, health, or safety of a data subject in urgent circumstances; and
• Legitimate interest — for fraud prevention, Site security, and service improvement, balanced against your rights and freedoms.

Specific purposes include: processing and delivering orders; verifying and validating prescriptions with licensed pharmacists; managing your account; providing customer support; sending order and service-related notifications; processing job applications; complying with FDA/DOH pharmaceutical regulations; and, where you have opted in, sending marketing or promotional communications.

Sharing and Disclosure of Personal Data

Getmeds does not sell personal data. We may share personal data, on a need-to-know basis and under appropriate contractual safeguards, with:

• Affiliated entities within the Getmeds/2MG group of companies for order fulfillment and service continuity;
• Licensed pharmacists and healthcare professionals for prescription verification;
• Third-party service providers such as logistics/delivery partners, payment gateways, and IT service providers, who are contractually bound to protect your data and process it only for the purposes we specify;
• Government and regulatory authorities, including the FDA, DOH, and NPC, where required by law, regulation, or a valid legal order; and
• Professional advisers (e.g., auditors, legal counsel) as necessary for legitimate business purposes.

Any cross-border transfer of personal data will only be made to recipients that provide a comparable level of data protection, consistent with NPC guidance on cross-border data sharing.

Cookies and Tracking Technologies

The Site uses cookies and similar tracking technologies to operate core functions (e.g., keeping you logged in, maintaining your cart), remember your preferences, and analyze Site traffic and usage patterns. You may configure your browser to refuse cookies; however, this may limit certain features of the Site. Where required, we will request your consent to non-essential cookies through a cookie consent banner prior to activation.

Data Storage, Retention, and Disposal

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, tax, or accounting requirements (including FDA recordkeeping rules for pharmaceutical transactions), or to resolve disputes. Upon expiration of the applicable retention period, personal data is securely disposed of or anonymized in a manner that prevents further processing, reconstruction, or recovery.

Data Security Measures

We implement organizational, physical, and technical security measures proportionate to the nature and sensitivity of the personal data we process, including:

• Access controls and role-based restrictions limiting data access to authorized personnel only;
• Encryption of data in transit (e.g., SSL/TLS) and, where applicable, at rest;
• Secure servers and regular system monitoring for vulnerabilities;
• Confidentiality obligations and data privacy training for employees and contractors with access to personal data; and
• A documented Data Breach Response Protocol / Security Incident Management Procedure for detecting, containing, and reporting security incidents.

Data Breach Notification

In the event of a personal data breach that poses a real risk of serious harm to affected data subjects, Getmeds will notify the National Privacy Commission and affected data subjects within the period prescribed under the DPA and its IRR (generally within seventy-two (72) hours of knowledge of, or reasonable belief that, a breach has occurred), through our internal breach response protocol.

Rights of Data Subjects

As a data subject, you are entitled to exercise the following rights under Sections 16 to 18 of the DPA, subject to applicable exceptions:

• Right to be informed that your personal data will be, is being, or has been processed;
• Right to access your personal data upon reasonable request;
• Right to object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling;
• Right to erasure or blocking of your personal data upon discovery of unlawful processing, or where data is incomplete, outdated, false, or unlawfully obtained;
• Right to rectification of inaccurate or incomplete personal data;
• Right to data portability, where technically feasible; and
• Right to damages for any damage sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data.

Requests to exercise these rights may be sent to our Data Protection Officer using the contact details in Section 14 below. We will respond within a reasonable period and in accordance with applicable regulatory timelines.

Children's Privacy

The Site is not intended for use by individuals under eighteen (18) years of age without the involvement of a parent or legal guardian. Where personal data of a minor is submitted (e.g., in connection with a prescription or purchase made on a minor's behalf), such data shall be provided and consented to by a parent or legal guardian, and processed solely for the purpose for which it was submitted.

Updates to this Privacy Policy

Getmeds may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or NPC guidance. The updated Privacy Policy will be posted on the Site with a revised "Last Updated" date. Where changes are material, we will provide additional notice as appropriate.

Contact Us / Data Protection Officer

For questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, or to exercise your rights as a data subject, you may contact our Data Protection Officer:

You may also file a complaint directly with the National Privacy Commission through www.privacy.gov.ph if you believe your data privacy rights have been violated.