Privacy Policy for Docya

Last updated: October 14, 2026

1. Introduction

Docya is an appointment book for doctors and other clinicians in the Philippines. Doctors create an account, set their working hours, and record appointments for their patients. Patients do not use the app. This policy explains what we collect, why, and the choices you have. It is written with the Data Privacy Act of 2012 (Republic Act No. 10173) in mind.

2. What We Collect

A doctor creates an account with an email address and password. We store on our servers:

• Doctor account and profile: email, first and last name, optional phone number, specialization and time zone
• Working hours: the weekly schedule the doctor sets
• Appointments: date and time, status (confirmed, cancelled, completed), and the patient's name and optional phone number, exactly as the doctor typed them, plus any private notes the doctor adds
• Text reminder records (only for doctors who have patient text reminders switched on): whether the patient agreed to a text, the patient's mobile number in the form +639XXXXXXXXX, when the text is due, whether it was sent, failed or skipped (and why), and the SMS provider's message reference

Notes may contain health information, which the Data Privacy Act treats as sensitive personal information. Doctors should record only what they are permitted and need to keep.

3. Patient Information

Patients do not have accounts and do not use Docya. A patient's name and phone number are entered by their doctor. For these details the doctor is the personal information controller: the doctor decides what to record and why, is responsible for having a lawful basis to record and keep it (for a text reminder, the patient's consent), for telling patients how their details are used, and for honouring the patient's rights over it (for example access and deletion requests). Docya stores and handles it on the doctor's behalf as a personal information processor, uses it only to provide Docya to that doctor, and shows it only to that doctor. For the doctor's own account details, we are the controller.

4. Who Can See Your Data

• A doctor sees only their own profile, working hours, and appointments. Other doctors cannot see them.
• We do not sell your data or share it for advertising.

Your sign-in session is stored on your device so you stay signed in. The app also remembers on your device whether you have seen the welcome cards and which of the getting-started steps you have finished; this stays on your device and is removed when you delete the app. If you use appointment reminders, the app also keeps your reminder choices and the list of reminders it scheduled on your device, and asks iOS to show you a notification before each appointment. Those reminders are created and shown on your device only; they are not sent through our servers. By default a reminder shows the time and date but not the patient's name; you can choose to include the name, in which case it may be visible on your lock screen.

5. What We Don't Collect

• No payment information
• No location or GPS data
• No analytics, advertising identifiers, or tracking

6. Service Providers

We use your email address only to run your account: to send the code that confirms your sign-up and the code that resets a forgotten password. Those emails are sent through an email delivery provider acting on our behalf. Accounts, database, and authentication are provided by Supabase, which processes and stores data on our behalf. Data is encrypted in transit and access is restricted by row-level security rules.

Patient text reminders are sent through an SMS provider, Semaphore, a Philippine SMS gateway. It receives the patient's mobile number and the text of the message in order to deliver it, and nothing else from us.

7. Patient Text Reminders

• Text reminders are a pilot. They are available only to doctors we have switched on. If that is not you, no text is ever sent for you or your patients.
• A text is sent only if the doctor confirms, when booking, that the patient agreed to receive it. Without that confirmation nothing is sent.
• One text is sent per appointment (it is tried again only if the first attempt fails). It names the doctor, the day and the time, and says how to change the appointment. It never says what the visit is for, and it is never advertising.
• Texts go only to Philippine mobile numbers, between 7:00 am and 8:00 pm in the doctor's time zone, and there are limits on how many texts a doctor can send and on how many texts one number can receive in a day.
• If the doctor cancels the appointment before the text is sent, it is withdrawn. Docya does not receive replies to the text; a patient who wants to change or stop it should contact the clinic.
• A patient who does not want a text can tell their doctor, or email us and we will pass the request on.

8. Your Rights and Control

Under the Data Privacy Act you have the right to be informed about how your personal data is used, to access it, to correct it, to object to its processing, to have it erased or blocked in the cases the law provides, to receive a copy in a usable form, and to claim damages if you are harmed by its misuse. Within Docya:

• Edit: update your profile and working hours any time from the app
• Cancel: cancel an appointment from the Appointments list
• Export: use "Export my data" in the Profile tab to get a copy of your profile, working hours and appointments
• Delete: use "Delete account" in the Profile tab to permanently delete your account, working hours, and every appointment (including the patient names and numbers in them and the reminder records). A patient who wants their details removed should ask their doctor, or email us and we will pass the request on.

9. Retention

We keep your data while your account exists. Reminder records are kept with the appointment they belong to and are deleted when that appointment or the account is deleted; we do not delete them sooner on a schedule. When you delete your account, your profile, working hours, appointments and reminder records are removed from our systems, except for routine backups that expire on their normal schedule.

10. Children's Privacy

Docya is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

11. Changes to This Policy

We may update this policy. We will change the "Last updated" date and, for significant changes, notify you in the app. Continued use means you accept the updated policy.

12. Transfers Abroad and the Data Privacy Act

Docya is built for doctors in the Philippines. Our database and sign-in service are hosted by Supabase in the Asia-Pacific region (Seoul, South Korea), so your data, and your patients' details that you enter, are stored and processed outside the Philippines. We remain responsible for the personal data we hold, including data handled for us by our providers, and we protect it with encryption in transit and access controls. By using Docya you agree to this transfer. Doctors are responsible for making sure that recording their patients' details in Docya is permitted where they practise.

If a personal data breach happens that affects you, we will tell the affected doctors and the National Privacy Commission as the law requires. You also have the right to complain to the National Privacy Commission; we would be glad to hear from you first so we can put things right. A plain-language summary of the Philippine laws that matter for Docya is on our Philippine law page.

© 2026 Docya. All rights reserved.
This privacy policy is effective as of October 14, 2026.