In using the Electronic Registration System, please take note of the following:

1. Fields marked with an asterisk (*) are mandatory. The system will not proceed unless all required fields are correctly filled out.

2. Click the [Submit Registration] button to complete your application. An electronic mail (email) and/or SMS will be sent to inform you of the next steps to complete the registration process.

3. Depending on your partner clinic’s turnaround time, all electronically submitted registration forms and information shall be processed by the clinic within a reasonable period. You warrant that all information you provide is true, accurate, and complete. Any false or misleading information may affect the quality of services provided to you.

4. By filling out this form, you acknowledge and consent to the Privacy Notice provided upon accessing the microsite. For any concerns related to data breach, misuse, correction, or other data privacy matters, you may contact privacy@carespanasia.com.

5. CareSpan Asia Inc. shall not be responsible for any user or third party’s inadvertent or malicious use of the website, including but not limited to tampering, submission of false information, hacking attempts, DDoS attacks, modification, penetration testing, SQL or command injection, fuzzing, malware distribution, spam, circumvention of access controls, or intellectual property infringement.

6. CareSpan Asia Inc. reserves the right to update these terms with thirty (30) days’ notice for any material changes. Continued use of the system constitutes your acceptance of the updated terms.

7. You warrant that you are of legal age and qualified to register under the PhilHealth YAKAP Program.

8. All information provided through this system is considered User-Generated Content. You retain ownership of your personal data as the data subject. CareSpan Asia Inc. complies with the Data Privacy Act and undertakes to suspend or remove any processing, collection, or storage of data upon request or as required by law.

9. CareSpan Asia Inc. reserves the right to temporarily suspend services due to security concerns. Permanent access termination shall have the same effect as the termination of these terms and conditions, provided that notice is given. Public announcement or online publication shall constitute sufficient notice.

CARESPAN ASIA INC. and its affiliate companies are committed to protect your personal data privacy. We diligently follow and comply with the Data Privacy Act of 2012 (R.A. No. 10173), and the relevant issuances of the National Privacy Commission (“NPC”) and other regulatory bodies.

This Personal Data Privacy Notice is updated as of November 18, 2025, Version 4.

For more information on our data sharing agreement with the clinic or any other requests, kindly e-mail our Data Protection Officer at privacy@carespanasia.com.

1.What is CARESPAN?

CareSpan is engaged in the business of developing, designing, and managing a fully integrated digital network, which includes mobile healthcare application for personal management of health and well-being and is a digital platform accredited by PhilHealth for YAKAP Administration.

2. What information do we collect?

We ask consent from the Data Subjects or those who desire to be registered in PhilHealth YAKAP their personal and sensitive information before encoding the information in our system. This may include confidential information under PhilHealth Circular No. 29 s[1]2015 which may apply as follows if relevant: Confidential information includes, but is not limited to, protected health information or patient records from hospital, clinics, or facility visits. It may also include Member and their dependents’ personal information, including photographs, biometric identifiers, retinas or iris scans, fingerprints, voiceprints, or scan of hand or face geometry. Privileged health information such as patient records, medical diagnoses, medical procedures, and related documents. Furthermore, we also collect the following information:

A. Full name;

B. Age and Date of Birth;

C. Marital Status;

D. Medical History Details;

E. Residential address and mobile number or email;

F. Other information indicated in the documents.

G. PhilHealth ID and unique Medical Number.

3. Why do we collect personal and sensitive personal information?

The information collected, encoded, or processed will be used to implement and carry out the execution of the PhilHealth Yaman ng Kalusugan Program (YAKAP).

The Data Subject is informed and agrees that, for the purposes of awareness and updates on CareSpan programs, their information will be used for direct marketing, whether digital or not, which includes but not limited to: Social Media ads, Algorithm based ads, SMS notifications, e-mail notification, accredited or ordinary courier service in cases where the Data Subject has limited access to internet. The same shall be used to notify the data subject of any incident.

The Data Subject is informed and agrees that, for purposes of contract necessity to our partners, clients, and affinity groups, we share with them only your Philhealth Id Number, Unique Medical number, birth date, and gender, for purposes of disbursement and release of payment/grants/capitations due the Company for sustained financial operations. No other information which shall personally identify you is shared.

4. When do we collect personal or sensitive information, who collects?

The information is collected during the encoding process through partner clinics by our trained and outsourced encoders from ATREIDES HEALTH INC. and CARETECH ASIA INC. to process their information and include them in the system. Authorized representatives of the Partner Clinic, CareSpan, and CareTech are the Personal Information Data Processors. The Clinic itself is also a Personal Information Controller to whom you have disclosed information to and should have their own policies in place.

Affiliates shall mean third-parties who have entered into a data sharing agreement, outsourcing agreement, and memorandum of agreement with CareSpan Asia inc.

CareSpan Asia Inc. and its affiliates respect the physician-patient privileged communication between the patient and the medical professional and does not collect information from such source. Only the output created and verified by the clinic and its professionals are collected.

5. How do we store the data collected?

CareSpan stores the information collected on the data subjects in our Electronic Medical Records (“EMR”).

CareSpan undertakes to protect personal and sensitive information against accidental or unlawful destruction, alteration, disclosure, and other unlawful processing by implementing through physical, organizational, and technical security measures depending on the information.

This privacy notice shall be conspicuously posted and published in or outside accredited partner clinics and at every instance of collection of personal or sensitive personal information.

Hence, personal and sensitive information shall be retained for as long as the Data Subject does not expressly revoke his consent to the processing, collection, and storage upon proper notice to the Corporation.

6. How do we dispose of the data collected?

Once a record has passed its retention period, as defined by relevant data sharing agreements, and is no longer required by PhilHealth for legal, operational, or regulatory purposes, all personal and sensitive information will be securely disposed of and destroyed.

A. Hard Copies (Physical Data): All hard copies of personal and sensitive information will be securely disposed of using authorized methods, including:

• Shredding

• Incineration or pulping

B. Soft Copies (Digital Data): All Personal Data in digital format designated for destruction will be managed as follows:

• The data will be permanently and irreversibly deleted from our live production environment.

• The data will be securely destroyed from all backup media.

• For storage media in our Cloud environment (AWS), we follow secure decommissioning practices, including cryptographic erasure and physical destruction of media by our cloud provider, in accordance with the NIST 800-88 Guidelines for Media Sanitization.

7. What are the risks involved in processing your personal and sensitive information?

Risk refers to the possibility or probability of incidents that may harm a data subject or organization, including unauthorized collection, disclosure, use, or access to personal and sensitive information. Any exposure to breach, cyber-attack, phishing, malware, and unauthorized access shall be considered covered under “Risk”.

8. How do we keep your personal information secure?

Only authorized personnel shall be granted access to the personal and sensitive information encoded through the EMR and secured in a database. Reasonable security safeguards to protect the information gathered from loss, unauthorized access, use or disclosure.

We also respect the rights of the Data Subjects and immediately comply with any request pertaining to their personal information.