Privacy notice.
The short version. Sundo keeps the claims you photograph, the follow-ups you send, and the details an HMO needs to pay you. It never keeps a diagnosis, a chart or a prescription. Photographs are deleted twelve months after a claim is paid. If you connect Gmail, Sundo can send from your account when you tap send and cannot read your mail. Anything you want seen, corrected or removed, ask for it with the form on this page.
1. Who is responsible
Sundo is a product of POST205, a Philippine business owned by Toffer Lorenzana, who acts as the personal information controller for this site and for the Sundo app. Requests, questions and complaints go through the form on this page, and we answer within fifteen working days, usually far sooner. When you use Sundo to bill and follow up a claim, Sundo handles your patients' details on your instructions, as your personal information processor.
2. What we keep, and why
The waiting list at s.undo.ph. When you put your name down, we keep only what you enter:
| Whether you are the doctor or signing up for one | To know who we are talking to. |
|---|---|
| Your name | To address you. |
| Where you practise | To understand which clinics and cities the problem reaches. Optional. |
| Which HMOs you accept, and roughly how long they take to pay | To build the product around the payers doctors actually deal with. |
| What costs you the most time | To decide what to build first. Optional. |
| A mobile number or email | To message you about Sundo, and for nothing else. |
Your Sundo account. Accounts are approved one by one. For each doctor we keep the email used to sign in, the name that signs the follow-ups, and, if you choose to save them, your PRC licence number, TIN, withholding rate, and the bank or GoTyme account an HMO pays into. Account numbers are stored sealed and shown masked; they are used only on invoice replies you approve.
Each claim. The HMO, the patient's name as written on the form, the approval or member number, the service, the amount, the dates, and the photograph of the claim form. If you add them: the invoice, its photograph, and any other document you attach, such as a statement of account. For every message you send we keep the address it went to, the subject, the text, the date and the Gmail message id, so you have proof.
Gmail. If you connect Gmail, Google gives Sundo permission to send email from your account and to know your address. Nothing else. Sundo cannot read, search or delete your mail. A message leaves only when you tap send; nothing goes out by itself. The permission is stored sealed on our server and you can withdraw it at any time at myaccount.google.com/permissions or by signing out on the account page. Sundo's use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
The demo at s.undo.ph/demo. The demo runs in your browser. The claims you add and any photograph you take stay on your device and are never sent to us.
What we never keep. No diagnosis, chart, prescription, laboratory result or any other health information. The reader that fills in the fields from a photograph is asked for the HMO, the patient's name, the number, the service, the amount and the date, and for nothing else.
We also record the time of each entry and the browser identifier your device sends with every web request, which helps us tell people from automated submissions.
3. Legal basis
Waiting-list entries and accounts are processed on the basis of your consent, given when you sign up and when you sign in. Claims are processed to carry out your instructions: to bill an HMO and to follow up a fee you are owed. You may withdraw consent at any time by asking us to remove your entry or account.
4. Where it is kept, and who can see it
Accounts, claims and messages are stored with Supabase in its Singapore region, in a database and a private file store that only Sundo's own server can reach. Nothing is readable from a browser without your sign-in. Photographs are read by Anthropic's Claude model to fill in the fields; the photograph is sent for reading and is not used to train the model. Email to you, such as sign-in codes, goes through Resend. The site runs on Netlify. Follow-ups to HMOs are sent by Google from your own Gmail. No one at Sundo reads your claims unless you ask us to look at a problem, and we do not sell or share the list with anyone.
5. How long we keep it
Waiting-list entries: until you ask us to remove yours, or twelve months after the list closes, whichever comes first. Claims: for as long as your account is open. Photographs and attached documents: deleted twelve months after the claim is paid or dropped, or sooner when you delete the claim. The record that a follow-up was sent, with its date and reference, stays with the claim as your proof.
6. Your rights
Under the Data Privacy Act you may ask us, at any time, to:
- tell you what we hold about you and where it came from;
- correct anything that is wrong;
- remove your entry or your account entirely;
- stop using it for a particular purpose, or at all;
- give you a copy in a portable form.
Use the form on this page. If you believe we have handled your information wrongly, you may also lodge a complaint with the National Privacy Commission of the Philippines.
7. Quotes on the landing page
The landing page quotes doctors' public posts and press articles, as written, with names left out. Where the post is still public, we link to it. Where it is not, we keep a dated screenshot. If a quote is yours and you want it changed or taken down, ask through the form and it comes down.
8. Security
The site is served over HTTPS. The database and file store accept requests only from Sundo's server, with keys that never reach a browser. Gmail permissions and account numbers are sealed with a separate key. Sign-in is by a one-time code or link sent to your email; there is no password to lose. If we ever learn of a breach that affects you, we will tell you and the National Privacy Commission within seventy-two hours.
9. Changes
If this notice changes in a way that matters, we will update the date at the top and, where you have given us a way to reach you, tell you directly.