Bridgette is built on a simple belief: your health data belongs to you. This policy explains exactly how we collect, use, protect, and never sell your personal and health information.
1. Who We Are
Bridgette is operated by Bridgette Health Inc., a stock corporation duly organized and existing under the laws of the Republic of the Philippines, with SEC Registration No. 2026060254007-00, incorporated on June 10, 2026. Our principal office is located at Level 21, Unit 2116, Park Triangle Corporate Plaza, North Tower, 32nd Street corner 11th Avenue, Bonifacio Global City, Taguig City, 1632.
Bridgette Health Inc. is registered with the Bureau of Internal Revenue (BIR) under TIN 807-383-615-00000 and has obtained its Barangay Business Clearance from Barangay Fort Bonifacio, Taguig City. Our Mayor’s Permit is in process and NPC (National Privacy Commission) registration is in progress. Bridgette is designed from the ground up to comply with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and all issuances by the National Privacy Commission.
For general inquiries about this policy, contact us at hello@bridgette.com.ph.
2. Data Protection Officer
Our Data Protection Officer (DPO) is responsible for overseeing compliance with the Data Privacy Act and for handling all privacy-related complaints, requests, and inquiries.
Data Protection Officer: Janah Rosales Soriano
Email: management@bridgette.com.ph
Address: Bridgette Health Inc., Level 21, Unit 2116, Park Triangle Corporate Plaza, North Tower, 32nd Street corner 11th Avenue, Bonifacio Global City, Taguig City, 1632
You may contact the DPO directly for any concerns about how your personal or health data is processed, or to exercise your rights under the DPA.
3. What Data We Collect
Account Information
When you create an account, we collect your full name, email address, date of birth, biological sex, and role (patient or healthcare provider). For providers, we may also collect your PRC license number and clinic affiliation.
Health Data
When you use Bridgette, you may upload or enter laboratory results, medical records, medications, diagnoses, allergy information, and consultation notes. You control what data you add.
Lifestyle Data
If you choose to use our lifestyle logging features, we collect food logs, sleep logs, workout and activity logs, and data from connected wearable devices such as Apple Watch.
Consultation Recordings (Scribe Hub)
When healthcare providers use Scribe Hub, audio recordings of consultations are captured with patient consent and transcribed into text. Audio recordings are deleted immediately after transcription is complete and are never permanently stored. Only the transcribed text and the provider-approved SOAP note become part of the consultation record.
Usage Data
We collect basic analytics about how you use the app to improve the service, including device type, app version, feature usage patterns, and crash logs. We do not track your browsing activity outside of Bridgette.
4. How We Use Your Data
We use your data to:
- Provide and maintain the Bridgette health wallet service
- Display your health trends, lab results, and lifestyle patterns
- Generate AI-powered health summaries and insights (Basic and Premium plans)
- Enable secure sharing of your health story with your chosen healthcare providers
- Transcribe consultations and generate SOAP notes via Scribe Hub
- Send you notifications you have opted into (appointment reminders, data access requests)
- Improve our product and fix issues
We never sell your personal or health data to anyone. We never use your health data for advertising. We never share your data without your explicit consent.
5. AI Processing and De-identification
When Bridgette generates AI-powered summaries, meal analyses, or longevity insights, your health and lifestyle data is de-identified before being sent to our AI processing partners. De-identification means that your name, email address, date of birth, and any other information that could directly identify you is stripped from the data before it leaves our servers. The AI processing partners see only the health and lifestyle content, not who it belongs to.
Our AI processing partners include:
- Anthropic (Claude API) for health insights, summaries, and per-meal food analysis
- Groq for audio transcription and SOAP note generation
These partners process data according to their own privacy policies and enterprise data processing agreements. AI calls are configured for zero or minimal data retention where available, meaning your de-identified data is not retained by these partners for training purposes.
6. Data Sharing and Your Control
You are always in control of who sees your health data.
- Provider sharing: You choose which providers can access your data by generating a secure share link. You can revoke access at any time.
- Family plans: Each family member's data is completely private and separate. Billing is shared, but health data is never shared without each individual's explicit consent.
- OFW Observer access: If you grant an OFW family member observer access, they receive read-only activity indicators, not your raw health data. You control exactly what is visible.
- Caregiver access: Caregivers (family members or non-relatives) can be granted permission-tiered access to your health data, from view-only activity indicators to elevated access. You control the level and can revoke at any time.
- Dependent profiles: Parents or guardians manage dependent profiles for minors (under 18). When the dependent reaches 18, full ownership and control of their health data transfers to them.
Institutional and LGU Programs (coming soon)
Bridgette is preparing to offer sponsored programs through institutional clients such as local government units and employers. Under these programs, individuals enroll voluntarily, each enrollee owns and controls their own health record, and any reporting to the institutional client is limited to de-identified, aggregated group-level data (minimum cohort size of 25 individuals per reporting unit). Individual health data is never disclosed to the institutional client, and aggregate data is never used for employment, HR, disciplinary, or performance evaluation purposes. Separate consent forms will apply to enrollees when these programs launch.
7. Data Storage and Security
Your data is stored securely on Supabase infrastructure hosted in the Asia-Pacific region (Singapore). We implement the following security measures:
- Encryption in transit using TLS 1.2 or higher
- Encryption at rest for all stored data
- Row-level security ensuring users can only access their own data
- Secure authentication with email verification and multi-factor capability
- Private storage buckets accessed only through signed, time-limited URLs
- Audit logging and access monitoring
- Secrets management and key rotation
- Regular security reviews
8. Data Retention
Your health data is retained for as long as your account is active. If you choose to delete your account, you will be required to provide an email address where a complete export of your health data will be sent before deletion. Your health story belongs to you, and we will always return it to you before removing it from our systems. After your export is delivered, all data associated with your account will be permanently deleted within 30 days from production systems and within 90 days from backups, except where retention is required by Philippine law.
Scribe Hub audio recordings are deleted immediately after transcription is complete. Generated SOAP notes are retained as part of the consultation record once the provider has reviewed and approved them.
Waitlist data collected on bridgette.com.ph is retained until you are onboarded to the product or until you withdraw consent, and in any case no longer than 12 months from collection absent onboarding.
9. Your Rights Under the Data Privacy Act
Under the DPA, you have the following rights:
- Right to be informed about how your data is collected and processed
- Right to access your personal data in our possession
- Right to object to the processing of your data
- Right to erasure or blocking of your data
- Right to rectification of inaccurate or incomplete data
- Right to data portability to obtain your data in a structured format
- Right to file a complaint with the National Privacy Commission
- Right to damages for any violations of your privacy rights
To exercise any of these rights, contact our Data Protection Officer at management@bridgette.com.ph. We will respond within 15 business days.
10. Cookies and Tracking
The Bridgette mobile app does not use cookies. Our website (bridgette.com.ph) uses only essential cookies required for basic functionality. We do not use third-party advertising cookies or tracking pixels.
11. Children's Privacy
Bridgette allows dependent profiles for minors managed by a parent or legal guardian. Minors under 18 cannot create their own accounts. When a dependent reaches 18, they gain full control of their own health data and can manage their account independently.
12. International Data Transfers
Your primary data is stored in the Asia-Pacific region (Singapore) via Supabase. In addition, de-identified data is processed by AI partners located outside the Philippines (primarily the United States), including Anthropic and Groq, because no Philippine region is currently available for these services. Cross-border transfers are covered by Data Processing Agreements with each partner and by your consent as described in this policy. Bridgette remains accountable for your data throughout the transfer and processing lifecycle in accordance with the DPA and NPC issuances on cross-border data transfers.
13. Sub-Processors
We use the following sub-processors to deliver the Bridgette service:
- Supabase Inc. — database, authentication, and storage (Singapore)
- Anthropic PBC — AI health insights, summaries, and food analysis (United States)
- Groq Inc. — AI transcription and SOAP note generation (United States)
- Netlify Inc. — website hosting for bridgette.com.ph (United States)
- Apple Inc. and Google LLC — in-app subscription billing for patient plans
- Xendit (primary) or PayMongo (alternative under evaluation) — web-based subscription billing for provider plans
Each sub-processor is bound by a Data Processing Agreement that requires them to protect your data at the same standard we do.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will notify you through the app and update the effective date at the top of this page. Continued use of Bridgette after changes constitutes acceptance of the updated policy.
15. Contact Us
If you have questions, concerns, or requests regarding your privacy or this policy:
Bridgette Health Inc.
Level 21, Unit 2116, Park Triangle Corporate Plaza, North Tower
32nd Street corner 11th Avenue, Bonifacio Global City, Taguig City, 1632
General inquiries: hello@bridgette.com.ph
Data Protection Officer: management@bridgette.com.ph
You may also file a complaint directly with the National Privacy Commission at privacy.gov.ph.