Asalus Corporation (Doing Business under the name and style of Intellicare)., recognizes the value of Informational Privacy in the conduct of its business. As a group operating across the entire Philippines, we adhere to the provisions of the Data Privacy Act of 2012 of the Philippines and the directives of the National Privacy Commission.

This Privacy Statement describes Intellicare’s policies and practices regarding the collection and use of personal information provided by our users or collected by us on the sites and applications where this Privacy Statement is posted, whether on our digital properties or applications we make
available on third-party sites or platforms.

Note this Privacy Statement may be updated from time to time whenever we undertake new practices if we adopt new privacy policies when responding to regulatory requirements changes or for other purposes. Notice shall be made by posting such changes on our sites and applications or by other means consistent with applicable law.

Intellicare is a Philippine-based entity with a registered Data Privacy Officer responsible for ensuring your personal information’s confidentiality, integrity, and availability. If you have privacy concerns or if you wish to enforce your rights to be informed, to object, to access, to correct, to erasure, to complain, or to data portability, please direct your query to Intellicare DPO as follows:

DATA PRIVACY OFFICER
Intellicare
4F Feliza Building, VA Rufino St., Legaspi Village
Makati City, Philippines
+632.87894000 | dpo@Intellicare.net.ph

Intellicare collects various types of information so we can provide you with the best and most efficient service possible in the market. We group this information according to source as follows:

1. From You as a member/guest
   • Platform registration information you provide when registering through our platforms such as Agora App, Member’s Portal, HR Portal and ERCS Express
     1. For Agora, registration requires submitting your ID, selfie picture, and details such as complete name, birthdate, membership account number, address, and gender.
     2. For ERCS Express, we require your complete name, membership card number, birthdate, address, email address, facility where you wish to have your medical procedure, name of your preferred physician, and chief complaint. Note, ERCS is used when availing of the services of Intellicare.
     3. For Member Access Portal, we require you, as a member, to provide your password and username. Through this portal, you may also submit your reimbursement requests, which include medical documents to support your claim, official receipts, and relevant information as may be required by Intellicare. In addition, through this platform, you may also be required to provide the details of your candidate dependent for enrolment under your
        plan.
     4. For HR Access Portal, an authorized user shall be required to provide the username and password to access the platform.
   • Transaction Information you provide when you request information, contact us through various platforms, purchase, or request a service from us, such as your postal address, telephone or mobile number, and email;
   • Reimbursement Information you provide when you request reimbursements covered by your plans, such as your name, official receipts, medical record, and bank details for payment;
   • Visitor Information you provide when you visit our office premises or hubs.
2. From Third Parties
   1. Membership Registration information your Plan Sponsor provides (typically, this
      information is from your employer or insurance provider). This information is limited to your name, age, gender/sex, employment rank and tenure, contact details such as email and mobile number;
   2. Information from third parties where our platforms are available concerning the use of our applications;
   3. Activity Information about your use, and the use by any person(s) you authorize through your account (for instance, our member’s portal, if available to you), of our sites and applications, such as the content you view or post, how often you use our services, and your preferences;
   4. Location Information, including precise or approximate location information provided by a mobile or other device interacting with one of our sites, applications, or physical properties (including through beacon technologies) or associated with your IP address or other online or device identifier, where we are permitted by law to process this information
3. From Accredited Facilities
   1. Your utilization-related information is generated whenever you use our services through our accredited network of facilities, such as hospitals. This includes your medical information pertaining to your availments, including diagnosis, medical abstract, and procedures undertaken.
4. Other sources
   1. Pictures or videos captured through our platforms and/or CCTV Cameras installed within our premises;
   2. Call Recordings when you call our hotlines;
   3. Usage, viewing, technical, and device data when you visit our sites, use our applications on third-party sites or platforms, open emails we send, or connect with our wireless Internet access services  and other similar technologies, including your
      browser or device type, unique device identifier, and IP address;
   4. Public Forum Information posted about us by you made available to all.

In general, Intellicare processes your data to provide you with services you have requested or purchased from us, including membership and contact center services, events, publications and other content. We use this information to refine services to better tailor them to your needs and to communicate with you about other services Intellicare offers. Most of the time, Intellicare needs to process your personal data to fulfill our role as your provider of membership services, with all the
attendant benefits Intellicare provides. Sometimes Intellicare has a legitimate interest in processing data to better understand the needs, concerns, and interests our members and other customers so can operate optimally as a business. And sometimes, Intellicare relies upon your consent, in which case we will keep a record of it and honor your choices.

1. HMO/TPA Membership Administration for Members

Intellicare processes your personal information for HMO/TPA membership administration, to deliver member benefits to you and your plan sponsor, such as processing your reimbursement requests; intermediating in the administration of medical care, liaising with third party specialist doctors, clinics, hospitals, and/or medical institutions in relation to your medical care (including by
providing them with access to your medical records); and to inform you of Intellicare-related events, content, and other benefits or opportunities associated with your membership. Intellicare may also use this information for us to personalize your experience at our touchpoints and for us to conduct market research by understanding and analyzing customer behavior, location, preferences, and demographics in order to improve our services.

Intellicare relies on fulfillment of contract as the lawful basis under the Data Privacy Act of 2012 for processing members’ personal information.

2. Utilization Records for Members

We collect your availment information from our accredited network of facilities as part of our contractual arrangement with them. The purposes for collecting this information include the following:

1. To verify if the person who availed our HMO services is a bona fide member
2. To support our payments to facilities and/or physicians you chose to provide the required medical services covered by your plan.
3. To determine if you have exceeded your plan limitations, i.e. Maximum benefit limit
4. To create a record of your availments as part of our actuarial practices
5. For actuarial (pricing) purposes.
6. To provide your plan sponsor anonymized data on your utilization. Note anonymity may be removed only when permitted by law.

Intellicare relies on the fulfillment of the contract as the lawful basis under the Data Privacy Act of 2012 for processing members’ personal information.

3. Contact Center Services

Intellicare operates a contact center as part of its business. We collect information from our callers to perform the following:

1. Administration of Membership Benefits
2. Adjudication of claims
3. Respond to queries

Information is collected through your disclosures; however, we rely on legitimately secured data (i.e., from our clients, your insurance provider, or plan sponsor) to verify your concern.

Intellicare relies on fulfilling the contract as the lawful basis under the Data Privacy Act of 2012 for processing this information.

4. Other Business and Legal Purposes

We may also collect, use, and/or disclose your personal data for purposes connected or relevant to our business for us to comply with our legal obligations and requirements; enforce obligations owed to us and administering debt recovery and debt management; prevent, detect, and investigate crime; analyze and manage commercial risks; maintain our accounting books for record keeping; conduct any form of investigation relating to disputes, billing, fraud, offenses
or prosecutions, among others; and meeting or complying with any applicable rules, laws, regulations, codes of practice or guidelines issued by any legal or regulatory bodies which are binding on us (including but not limited to responding to regulatory complaints, disclosing to regulatory bodies, and conducting audit checks, due diligence and investigations).

5. Events

Intellicare hosts live, in-person or online events throughout the year. These include wellness conferences and other activities. If you register for one of our events and you are a member, we will access the information in your member account to provide you with information and services associated with the event.

If you are not a member and you sign up for one of our events, we will collect the following information: name, email, company, title, industry, address, phone number, meal preferences, if applicable, and the like.

Intellicare uses the information provided by event attendees to provide them with event services, including badge printing, tailoring sessions to meet the audience profile and to determine the sessions likely to require the biggest rooms, and related purposes connected with the event.

If you are a presenter at one of our events, we will collect information about you including your name, employer and contact information, and photograph, and we may also collect information provided by event attendees who evaluated your performance as a presenter. We may also make and store a recording of your voice and likeness in certain instances.

Intellicare relies on a legitimate interest basis for collecting, storing and processing this information.

We keep a record of your participation in Intellicare events as an attendee or presenter. This information may be used to provide you with membership services or to tell you about other events and publications. It may also be used to help Intellicare understand our members’ needs and interests to better tailor our products and services to meet your needs.

6. Your correspondence with us

If you correspond with us by email, the postal service, or other form of communication, we may retain such correspondence and the information contained in it and use it to respond to your inquiry; to notify you our other services; or to keep a record of your complaint, request, or similar concern. Note, Intellicare has a legitimate interest in maintaining personal information of those who communicate voluntarily with us.

1. Websites

As is true of most other websites, Intellicare’s website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of our website, including a history of the pages you view. We use this information to help us design our site to better suit our users’
needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

Intellicare has a legitimate interest in understanding how members, customers and potential customers use its website. This assists us with providing more relevant products and services, with communicating value to our sponsors and corporate clients, and with providing appropriate staffing to meet member and customer needs.

a. Cookies

Our websites may use “cookies” to store and track information such as the number of users and their frequency of use, profiles of users, and their online preferences. Cookies do not capture information that would personally identify you, but the information collected may be used to assist us in analyzing the usage of our websites and to improve your online experience with us. You can disable the cookies by changing the setting on your browser. However, this may affect the
functionality of our websites.

b. External Links

Our websites may also contain links to other websites that are not owned or maintained by us and over which we have no control. These links are provided only for your convenience. This Privacy Statement only applies to our website. When visiting these third-party websites, you should read their privacy policies.

2. Other Portals

We have built platforms available through your mobile phones or through separate webpages linked to our website to improve the quality of our services. Please take time to read the privacy notices posted on these platforms before proceeding.

1. General

We do not otherwise reveal your personal data to persons or businesses outside Intellicare for their independent use unless:

• you request or authorize it;
• the information is provided to comply with the law (for example, to comply with a search warrant, subpoena, or court order),
• enforce an agreement we have with you, or to protect our rights, property, or safety, or the rights, property, or safety of our employees or others;
• the information is provided to our agents, vendors, or service providers who perform functions on our behalf;
• to address emergencies or acts of God; or
• to address disputes, claims, or to persons demonstrating legal authority to act on your behalf;

2. Aggregated Information

We may also gather aggregated data about our members and Site visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for actuarial, marketing, or promotional purposes.

3. On Utilization Record Generated

The following shall be provided access to your utilization record, subject to compliance with the requirements of the Data Privacy Act of 2012:

• Your employer. Your employer routinely requests utilization reports of all its employees covered by the Health Plan we provide. Said report contains the
  amount of utilization, treatment, and diagnosis. We only grant access should there be (a) warranty from your employer’s end that your consent has been provided, in
  which case, we will solely rely on that representation OR (b) where you have explicitly consented to the same.
• Your Spouse/Partner/Immediate Family Member. Only when it is necessary to protect your life as a patient.
• The Principal Member. Whenever you are a dependent-minor or a dependent under guardianship, the principal shall be given access to your utilization record, upon request. For all other cases, we will only disclose should you, the dependent, provide authorization allowing the principal member to have access to your records.
• Government/the Courts/regulatory agencies. Only when required by law and or to protect our legitimate interests.

The Data Privacy Act of 2012 provides certain rights for data subjects. A good explanation of them (in English) is available on the website of the Philippine National Privacy Commission Website (https://www.privacy.gov.ph/know-your-rights/.

This Privacy Statement is intended to provide you with information about what personal data Intellicare collects about you and how it is used. If you have any questions, please contact us at dpo@Intellicare.net.ph.

If you wish to confirm Intellicare is processing your personal data, or to have access to the personal data Intellicare may have about you, please contact us at dpo@Intellicare.net.ph.

You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Intellicare might have received the data from us; what the source of the information was (if you didn’t provide it directly to Intellicare); and how long it will be stored.

You have a right to correct (rectify) the record of your personal data maintained by Intellicare if it is inaccurate. You may request that Intellicare erase that data or cease processing it, subject to certain exceptions. You may also request that Intellicare cease using your data for direct marketing purposes, if initially you have provided your consent.

You also have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Intellicare processes your personal data. When technically feasible, Intellicare will—at your request—provide your personal data to you or transmit it directly to another
controller.

Reasonable access to your personal data will be provided at no cost you if you are a member, conference attendees and others upon request made to Intellicare at dpo@Intellicare.net.ph. If for some reason access is denied, Intellicare will provide an explanation as to why access has been denied.

For questions or complaints concerning the processing of your personal data, you can email Intellicare’s data privacy officer at dpo@Intellicare.net.ph.

To help protect the privacy, security, integrity and confidentiality of your personal data, we maintain physical, technical and administrative safeguards. We review, update and test our security procedures on an ongoing basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and
security of your information. We commit to taking appropriate disciplinary measures to enforce our employees’ privacy responsibilities.

While best practice precautions will be taken to ensure that the information you provide is protected against unauthorized or unintended access, we cannot be held responsible for unauthorized or unintended access that is beyond our control.

The personal data collected from you by us is retained for the period of time that the purpose for which the personal data was collected continues. Please refer to the below Data Retention Schedule specifying the prescribed periods of retention depending on the classification of
documents:

Retention Guidelines are as follows:
1. Medical Records – 15 years on the basis of the Healthy Privacy Code.
2. Human Resource – 3 years from Cessation of Employment on the basis of the Labor Code.
3. Finance – 5 years for physical, 10 for electronic, on the basis of Generally Accepted Accounting Principles.
4. Legal – 10 years on the basis of the Prescriptive Period under the Civil Code
5. Others – 5 years on the basis of our Company Policy.

We will destroy the personal data thereafter, unless it is necessary to retain the personal data longer for our satisfaction and compliance with legal, regulatory or accounting requirements, or to protect our interest.

If you have questions, concerns, or complaints or would like to exercise your rights, don’t hesitate to get in touch with Intellicare’s DPO:

DATA PRIVACY OFFICER
4F Feliza Building, VA Rufino St., Legaspi Village
Makati City, Philippines
+632.87894000 | dpo@Intellicare.net.ph