VaxLink Privacy Policy

VaxLink is a preventive-health platform that connects Patients, vaccination program organizers, healthcare provider organizations, and authorized care providers. This policy applies when you use VaxLink websites, accounts, onboarding, campaign, screening, booking, service-delivery, notification, and vaccination-record features.

VaxLink is responsible for personal information when it determines why and how that information is processed through the platform. Participating organizations and healthcare providers may also be responsible for information they independently collect or use for their own operations or delivery of care. Their own privacy notices may also apply.

Specific notices and permissions shown during Patient onboarding, screening, campaign participation, booking, or provider review supplement this policy. This policy does not replace those purpose-specific choices.

We collect information directly from you, from an authorized representative acting for another person, from participating organizations or healthcare providers, and from the systems used to operate VaxLink.

VaxLink processes information to:

• Create, authenticate, secure, and support accounts.
• Review organization, provider, workforce, and affiliation requests.
• Help Patients discover programs, complete required preparation, request help, book appointments, and receive service updates.
• Support health screening, properly scoped clinical review, vaccination service delivery, and access to finalized records.
• Coordinate campaign participation without exposing unnecessary medical details to program organizers.
• Prevent fraud and abuse, investigate incidents, enforce access controls, maintain auditability, and keep VaxLink reliable.
• Meet legal, regulatory, healthcare-record, reporting, and dispute-resolution obligations.

Depending on the context, processing may be based on your consent, your request for or use of VaxLink services, compliance with a legal obligation, protection of life or health, delivery of medical treatment by authorized professionals, or a legitimate interest that does not override your rights. Sensitive health information is processed only when an applicable legal basis and appropriate safeguards are present, including consent where required.

If you decline or withdraw a permission that is required for a specific health feature, your verified account may remain available, but VaxLink may be unable to provide the affected feature.

VaxLink limits access according to role, organization, purpose, care relationship, assignment, appointment, and applicable permission. We may share information with:

• Patients and authorized representatives: their own or properly represented profile, journey, appointments, permissions, and vaccination records.
• Program organizers: organization-scoped participation and operational progress needed to run a program, not private screening answers or unrelated medical details.
• Healthcare providers: information necessary for care only when the provider is properly authorized and scoped to the relevant workflow.
• Platform administrators: limited, controlled, and auditable access where necessary for security, support, compliance, or approved operational review.
• Technology service providers: providers that support hosting, database and authentication, bot protection, transactional email, monitoring, and approved AI-assisted features. They may process information only for the services they provide under applicable safeguards.
• Authorities or other parties required by law: when disclosure is legally required or necessary to protect rights, safety, or the integrity of the service.

When you intentionally present or share a VaxLink vaccination credential, the recipient may see the limited verification information made available through that credential.

If you choose to sign in with Google, Google authenticates you and provides VaxLink with the limited account information needed for sign-in, such as your Google account identifier, name, email address, and basic profile information covered by the openid, email, and profile scopes.

VaxLink uses this information to create or link your VaxLink identity and complete the same role-safe account process used by the platform. We do not infer an organization, role, or healthcare access from your email domain. VaxLink does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google services, and the application does not store Google access or refresh tokens.

Google processes information under its own Privacy Policy. You may disconnect a linked provider through available account or support channels, subject to account-security requirements.

Some VaxLink workflows use configured rules to organize next steps, identify information that requires review, or support eligibility preparation. A rule result is not a medical diagnosis and may lead to review by an authorized healthcare professional.

Approved VaxLink features may also use artificial intelligence to generate guidance, summaries, or proposed administrative actions. Feature-specific screens provide additional privacy and appropriate-use notices. AI output does not independently grant access, approve a role, make a final clinical decision, or execute a protected administrative change without the required human and server-side controls.

VaxLink keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, while an account or service relationship remains active, and as needed for healthcare recordkeeping, safety, audit, security, dispute, and legal or regulatory obligations.

Retention can differ by record category. For example, account information, consent and audit evidence, health and vaccination records, organization applications, and security logs may have different requirements. Approved category-specific schedules and applicable law determine when records are deleted, blocked, anonymized, or securely disposed of. Closing an account does not require VaxLink to erase information that must lawfully be retained.

VaxLink uses administrative, physical, and technical safeguards designed to protect confidentiality, integrity, and availability. These safeguards include role-based access, database access policies, authentication controls, encrypted connections, auditability, monitoring, and restricted server credentials.

No system can guarantee absolute security. If you believe your account or information may have been compromised, contact VaxLink promptly and avoid sending sensitive medical details through ordinary email.

Some service providers may process information outside the Philippines. Where this occurs, VaxLink uses appropriate contractual, organizational, and technical safeguards and remains accountable for platform processing under applicable law.

Subject to the Data Privacy Act of 2012 and applicable exceptions, you may have the right to:

• Be informed about processing involving your information.
• Object to certain processing or withdraw consent.
• Request access to personal information about you.
• Request correction of inaccurate or incomplete information.
• Request erasure, blocking, or restriction when legally available.
• Request data portability when applicable.
• Seek damages or file a complaint when your privacy rights have been violated.

A withdrawal applies going forward and does not make prior lawful processing invalid. Some requests may be limited by healthcare recordkeeping, legal, security, or the rights of other people. We may verify your identity and authority before acting on a request.

You may also learn about your rights or file a complaint through the National Privacy Commission.

Where an approved VaxLink workflow allows a parent, guardian, representative, or caregiver to act for another person, the representative must have the authority to provide and manage that person's information. VaxLink may request verification and limit access to the represented person and the specific authorized purpose.

VaxLink may update this policy when its services, data practices, safeguards, or legal obligations change. The current version will show its last-updated date. When a change materially affects how information is processed, VaxLink will provide an appropriate additional notice and request a new choice where required.

For a privacy question, rights request, complaint, or concern, contact VaxLink at:

Please do not include screening answers, medical history, or other sensitive health details in your first email. VaxLink may provide a safer channel and request identity verification before handling an account-specific request.