Privacy notice

Your pharmacy is the Personal Information Controller: you decide what customer and patient data to collect and why. Hidalgo Studio is the Personal Information Processor: we store and process that data only to run Hidalgo Rx for you, following your instructions, as described in the Data Privacy Act of 2012 (Republic Act No. 10173).

• Your pharmacy details: name, address, TIN, branches. To set up your workspace and print sales slips.
• Your team: names, roles, permissions, email addresses, hashed PINs, time clock entries. To control access and pay staff.
• Stock: products, batches, lots, expiry dates, suppliers, purchase orders, transfers, counts. To run inventory.
• Sales: items sold, prices, payment method, cashier, discounts, voids. For daily operations and BIR reporting.
• Customers: name, phone, notes, maintenance medicines. For refill reminders and purchase history.
• Security records: sign-in history (time, browser) and an audit log of sensitive actions. To protect your account.

Sensitive personal information. Senior Citizen and PWD ID numbers, and prescription details (doctor, PRC license number, patient, medicines), are sensitive personal information under RA 10173. We store them only because the law requires pharmacies to record them for discounts and prescription drugs. Only your own team can see them, according to their roles.

Hidalgo Rx runs on Lovable Cloud. Your database is hosted on Amazon Web Services in the US West (Oregon) region, USA. Data is encrypted in transit (TLS/HTTPS) and at rest. The hosting provider keeps daily backups for about 14 days.

Every pharmacy's records are kept separate. The database itself checks, for each request, that the person belongs to that pharmacy and has the right permission. Cost and profit figures are hidden from staff who aren't allowed to see them.

Only your pharmacy's own users, according to their role and permissions you set in Team. Hidalgo Studio support staff access your data only when needed for support or maintenance, and they are bound by confidentiality. We do not sell your data or use it for advertising.

We keep your data for as long as your account is active. The owner can download all of it at any time (Settings → Your data), as CSV files in one ZIP.

If you close your account, we export your data first, then permanently delete it 30 days after closure. You can cancel within those 30 days. Backups expire on their normal schedule after that.

If we learn of a security breach affecting your data, we will notify your pharmacy promptly with what happened and what data was involved, so you can meet your own obligations to the National Privacy Commission and to affected customers.

Apol Hidalgo, Hidalgo Studio
Mobile: 0927 324 1836
Web: rx.hidalgostudio.online