Privacy Notice

WSI Health Sciences AI is operated by Web Solutions Inc. (WSI), a Philippine company. For the accounts we create and administer on this platform we act as a Personal Information Controller. Where a school uploads or manages its own student records inside the platform, the school is the controller and WSI acts as a Personal Information Processor under that school's instructions. The processor terms are set out in our Data Processing Agreement.

The product is a research and learning tool for health sciences education. It is not clinical decision support, not medical advice, and not a substitute for professional judgment. We do not collect patient records and the platform must not be used to store them.

• Account data. Email address, password (stored only as a hash by our authentication provider), the school or institution name, assigned role such as student, faculty, librarian, editor, reviewer or administrator, and the date the account was created.
• Organization data. The institution name, its generated workspace slug, and the membership records that link accounts to that institution.
• Pilot enquiry data. Name, work email, institution, role, tier of interest and any message you send through the Request a Pilot form.
• Usage data. The questions and topics you submit to the research and learning features, and technical logs such as timestamps, request metadata, IP address and browser user agent generated by our hosting provider.
• Cookies. Session cookies strictly necessary to keep you signed in. We do not use advertising cookies and we do not sell personal data.

We do not ask for sensitive personal information as defined in Section 3(l) of RA 10173, such as health, government identifiers, or religious affiliation. Please do not enter patient identifiers or your own health information into question fields.

• To create and operate your account and your school workspace, including role based access. Legal basis: performance of a contract with you or with your institution (Section 12(b), RA 10173).
• To generate evidence grounded answers and lesson content that you request. Legal basis: contract, and your consent when you submit a question.
• To respond to pilot enquiries and to prepare a proposal. Legal basis: consent and steps taken at your request prior to entering a contract.
• To keep the service secure, prevent abuse, and debug failures. Legal basis: legitimate interests, balanced against your rights (Section 12(f), RA 10173).
• To meet legal, tax and regulatory obligations. Legal basis: compliance with a legal obligation (Section 12(c), RA 10173).

Where processing rests on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal, and it may mean we can no longer provide the account.

We do not sell personal data and we do not share it for advertising. We disclose the minimum necessary to the following sub-processors, each bound by contract to process personal data only on our instructions and to apply appropriate security measures:

We also query public scholarly indexes to retrieve citations: Europe PMC, OpenAlex, Crossref, Philippine public health sources such as DOH and WHO Western Pacific. These are read only lookups of published bibliographic records. Your identity is not sent to them.

We may also disclose data to your institution's designated administrator (who manages your account), to professional advisers, and to a competent authority where we are legally required to do so.

Our hosting and model sub-processors operate outside the Philippines. Where personal data is transferred abroad, WSI remains accountable for it under Section 21 of RA 10173 and relies on contractual commitments with each sub-processor that require a comparable level of protection.

On written offboarding we delete the organization record and its membership records. Authentication accounts belonging to individual people are handled separately on request, because one person may belong to more than one institution.

• Right to be informed about how your personal data is collected and used.
• Right to access a copy of the personal data we hold about you.
• Right to correct inaccurate or outdated personal data.
• Right to erasure or blocking, subject to the institution's own records obligations.
• Right to object to processing, including withdrawing consent for marketing contact.
• Right to data portability for data you provided in a structured electronic format.
• Right to damages for inaccurate, false, or unlawfully obtained personal data.
• Right to lodge a complaint with the National Privacy Commission.

To exercise any of these, email privacy@wsi.asia with enough detail to identify your account. We respond within a reasonable period and in any case within the timelines set by the National Privacy Commission. If you are not satisfied, you may complain to the National Privacy Commission at privacy.gov.ph.

We apply organizational, physical and technical measures proportionate to the data we hold: row level security so one institution cannot read another's records, privileged database keys held only on the server and never shipped to the browser, encrypted transport (HTTPS) for all traffic, managed credential storage by our authentication provider, and least privilege role assignment inside each workspace.

If a personal data breach affects sensitive personal information or information that may enable identity fraud, and there is a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of knowledge of the breach, in line with the Data Privacy Act of 2012 and NPC Circular 16-03. Institutional administrators are notified in parallel so the school can meet its own controller obligations.

We update this notice when our processing changes. The date at the top reflects the latest version. For material changes affecting institutional accounts, we notify the school administrator in writing before the change takes effect.