privacy-policy

Effective: 15 October 2026 · Version 2026.10

The Healthcare CyberSecurity Technology Alliance, Inc. (HCTA) is a non-stock, non-profit alliance of healthcare technology and security leaders, registered with the Securities and Exchange Commission of the Philippines. This Privacy Policy explains how we collect, use, store, share and protect personal data through the HCTA Member Portal, this website, and our events. It is prepared in compliance with Republic Act 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and National Privacy Commission (NPC) issuances, and is aligned with the principles of the EU General Data Protection Regulation (GDPR) where we process data of EU-based individuals.

1. Personal Information Controller and DPO

HCTA acts as the Personal Information Controller (PIC). You may contact our Data Protection Officer at dpo@hctalliance.com or at Level 21, North Tower, Park Triangle Corporate Plaza, Bonifacio Global City, Taguig City, Philippines.

2. Personal data we collect

2.1 Membership registration and profile

First name, middle initial, last name and suffix; company/institution, position, work email and mobile number; membership type, member ID, committee memberships and status; your password (stored only as a salted one-way hash); and optional details such as a profile photograph or biography you choose to publish in the Member Directory.

2.2 Portal accounts

Name and email address for free portal accounts used to view public news, galleries and announcements.

2.3 Corporate applications

Company name, office address, company phone, and the applicant’s name, position, email and mobile number; thereafter corporate staff records and invite-code usage.

2.4 Events

RSVPs, waitlist status, attendance records (including QR check-in timestamps), certificate issuance, any dietary or accessibility requirements you provide, and event photographs or video where you participate in recorded sessions.

2.5 Communications and community

Member-to-member messages (delivered portal-to-portal; we never expose raw contact details between members), discussion-forum posts, anonymous poll responses, support tickets and attachments, and notification preferences.

2.6 Security Center tools

Domains you register for security scanning, the associated DNS verification records, scan results and scan history. Scanning is passive and restricted to domains you verify you control.

2.7 Website interactions and technical data

Contact inquiries (name, email, message), IP address, browser and device information, pages viewed, and security-relevant event logs, used for security, fraud prevention, troubleshooting and internal analytics.

3. Why we process your data

• To verify identity and eligibility and to administer membership;
• To operate events — registration, check-in, certificates and communications;
• To provide member services: directory, forums, messaging, resources, training and Security Center tools;
• To protect the Portal and its members — security monitoring, audit logs and incident response;
• To comply with legal obligations, including breach notification under RA 10173;
• To keep you informed of Alliance programmes, with consent where required;
• To publish anonymised or aggregated sector statistics that never identify individuals.

4. Lawful bases of processing

Under RA 10173 we rely on: consent (given at registration and for optional communications and photographs), contract (processing necessary to provide the services you requested), legitimate interests (Portal security, fraud prevention, Alliance administration), and legal obligation (record-keeping and NPC reporting). Where GDPR applies, the corresponding bases are Art. 6(1)(a), 6(1)(b), 6(1)(f) and 6(1)(c); special categories of data are processed only with explicit consent or another Art. 9 condition.

5. Sharing and disclosure

We do not sell personal data. We disclose personal data only to: (a) service providers under written agreements (hosting, email delivery, media storage); (b) fellow members, limited to the profile fields you publish and the messages you send; (c) the NPC, law enforcement or courts when required by law; and (d) a successor in the event of a merger, reorganisation or transfer of the Alliance’s assets.

6. Cross-border transfers

Some processors operate outside the Philippines. Where data is transferred internationally we apply data processing agreements with confidentiality and security commitments and — for EU data subjects — standard contractual clauses or recognised adequacy arrangements.

7. Retention

We retain personal data only as long as necessary for the purposes above, then securely delete or anonymise it: membership records for the duration of membership plus a reasonable audit period; attendance and certificates for the life of the membership; support tickets and messages while your account is active; and security logs in line with security and legal requirements.

8. Security measures

• Encryption in transit (TLS) and at rest;
• Role-based access control with an audit trail of administrative actions;
• Two-factor authentication options for privileged accounts;
• Continuous monitoring and an incident-response plan mapped to the 72-hour NPC notification window;
• Staff confidentiality undertakings and periodic privacy and security training.

9. Breach notification

If a personal data breach occurs that affects your rights, we will notify the NPC and affected data subjects within 72 hours of awareness, per NPC Circular 16-03 (and Art. 33-34 GDPR for EU data subjects).

10. Your rights

Under RA 10173 you may: be informed; object to processing; access your data; correct inaccuracies; demand erasure or blocking; claim damages; obtain a portable electronic copy; and file a complaint with the NPC. GDPR data subjects additionally hold the rights to restriction of processing and to withdraw consent at any time.

11. Cookies

The Portal uses essential session cookies to keep you signed in and remember your consent choices. We do not use advertising or cross-site tracking cookies. This website may load third-party resources (fonts, map embeds, logo look-up services) which may set cookies under their own policies — see our Cookie Policy.

12. Minors, third-party links and changes

Our services are not directed at individuals below 18 and we do not knowingly collect their data. External websites we link to are governed by their own policies. We may update this policy to reflect changes in law or our services; material changes will be announced on the Portal and by email where appropriate.

13. Contact and complaints

To exercise any right or raise a concern, contact our Data Protection Officer at dpo@hctalliance.com. You may also lodge a complaint with the National Privacy Commission (privacy.gov.ph) or, for EU data subjects, your local supervisory authority under the GDPR.