Last updated: 25 August 2026. This policy explains what Kalingacollects from visitors to this website, why, and how you can exercise your rights under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the “DPA”).
1. Who is responsible for your information
Kalinga is a product of a company that is in the process of formal incorporation — see our internal incorporation checklist, not published here. Until that is complete, this site is operated as an unincorporated venture, and the registered legal entity name and address that will appear here are not yet final. We are not going to put a placeholder company name on a page about your personal data; instead, this paragraph will be replaced with the real, verified entity details as soon as incorporation is complete, and the “Last updated” date above will change when it is.
Until then, you can reach us — for a privacy question, a rights request, or anything else about this policy — at hello@kalinga.app. We have not yet designated a formal Data Protection Officer or registered with the National Privacy Commission; both are open items tracked internally and listed at the bottom of this page.
2. What we collect
This site collects only what is listed here — nothing more, and nothing collected silently.
When you join the waitlist or reserve a pre-order spot: your work email address (required), and optionally your clinic or practice name and your role. That is the entire form — see it for yourself before you submit it.
If you reserve a pre-order spot:submitting the form redirects you to Stripe’s own hosted checkout page to take payment. Stripe collects your payment details directly — your card number never reaches our servers. We receive back your email address, a Stripe checkout session identifier, and confirmation of whether the payment succeeded. Stripe emails you its own receipt; we do not separately store or see your card number, expiry date, or CVC.
Automatically, from visiting the site: our hosting providers (Vercel for this website, Railway for the API it talks to) generate standard web server logs as a normal part of serving any website — things like IP address and browser type. We use this only for keeping the site and API running and for basic abuse prevention (for example, limiting how fast one source can submit the waitlist form). We do not run any analytics, advertising, or tracking script on this site, and we do not use tracking cookies. There is no cookie consent banner because there is nothing here that needs one — the only thing this site stores in your browser is a single light/dark display preference, saved to your own device and never sent to us.
3. Why we collect it, and our legal basis
Under DPA Section 12, we process your information on these bases:
Waitlist and pre-order details — your consent, given by voluntarily filling in and submitting the form (Section 12(a)); and, for a pre-order specifically, because processing it is necessary to the contract you are entering into by reserving a paid spot (Section 12(b)).
Server/security logs — our legitimate interest in keeping the website and API operating correctly and securely for every visitor (Section 12(f)).
4. Who we share it with
We share information only with the providers necessary to run this website and process a pre-order:
- Stripe — processes payment for a pre-order. Receives your email address and payment details directly; we never see or store your card details.
- Vercel — hosts this website.
- Railway — hosts the API and the database where waitlist and pre-order submissions (email, clinic name, role) are stored.
We do not sell your information, and we do not share it for advertising or marketing purposes with anyone outside this list. We will disclose information if legally required to (for example, a valid court order), or as part of a merger or acquisition of the business, in which case the acquiring party would be bound by this same policy until it is updated.
5. Where your information is stored
Waitlist and pre-order submissions are stored in a database hosted by Railway. Vercel and Stripe both operate infrastructure outside the Philippines as part of their normal global service delivery, which means your information may be processed or transiently stored outside the country. We have not yet completed a formal assessment of these transfers under DPA rules on cross-border data sharing — that is listed as an open item below.
6. How long we keep it
We do not yet have a defined retention or disposal schedule for waitlist and pre-order submissions — this is a real gap, not an oversight we are hiding, and it is listed as an open item below rather than filled in with an invented number. Until a schedule is adopted, if you would like your information deleted, email us at hello@kalinga.app and we will do so manually, except for a pre-order record we are legally required to keep for tax or accounting purposes.
7. Your rights under the Data Privacy Act
As a data subject, DPA Section 16 gives you the right to:
- be informed that your personal information is being processed, which this policy is intended to satisfy;
- access your personal information that we hold;
- object to processing, including withdrawing consent at any time (for example, asking to be removed from the waitlist);
- correct any inaccurate or outdated information;
- have your information erased or blocked, subject to Section 6’s note on records we are legally required to retain;
- data portability, i.e. receive a copy of the information you provided in a usable format;
- be indemnified for damages from an inaccurate, incomplete, or unlawfully obtained processing of your information; and
- lodge a complaint with the National Privacy Commission (NPC).
To exercise any of these, email hello@kalinga.app. We have not yet adopted a formal committed response time for such requests — another open item below — but we will respond and will not make you wait indefinitely.
8. Children
This website is directed at clinic and hospital staff evaluating a business product, not at children. We do not knowingly collect information from children through this site.
9. Changes to this policy
If we change this policy, we will update the “Last updated” date above and, for a change that materially affects how we use information you have already given us, we will make that change clear rather than let it pass silently.