Legal
Effective 29 September 2026 · Version 2.0
This Privacy Policy explains how Medtax Solutions Inc. (“Medtax,” “we,” “us,” “our”) collects, uses, protects, and shares personal data when you use the Medtax platform and services for BIR tax compliance, including the app and this website at medtax.ph. Separate privacy policies govern our other services. This Privacy Policy is provided in accordance with Republic Act No. 10173 (the “Data Privacy Act of 2012” or “DPA”), its Implementing Rules and Regulations (“IRR”), and applicable issuances of the National Privacy Commission (“NPC”). It describes the purposes and legal bases for processing, the categories of personal data involved, recipients and transfers, retention, security measures, and your rights as a data subject.
We collect the following categories of personal data:
We use your personal data to:
Where Medtax uses automated tools or an AI assistant in processing personal data, Medtax will disclose the relevant purposes and material aspects of such processing and will implement safeguards required by applicable law. Personal data will not be used to train a third-party AI model unless a lawful basis exists and the processing is disclosed as required by law.
We process personal data only on a lawful basis under the DPA. Depending on the processing activity, the legal basis may include: (a) processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract; (b) compliance with a legal obligation applicable to Medtax; (c) legitimate interests pursued by Medtax or a third party, subject to the rights and freedoms of the data subject; and (d) consent, where required or appropriate. For sensitive personal information, including tax returns and other information falling within Section 13 of the DPA, Medtax will process the information only where a specific statutory exception under Section 13 applies, including specific consent where applicable. Section 13(b) will not be relied upon as a blanket authorization for all processing of TINs or tax information; where processing is based on a legal obligation, Medtax will identify and maintain records of the applicable law or regulation.
You are the taxpayer and, where you are an individual, the data subject for personal information relating to your practice. Depending on the processing activity and the purposes and means of processing, Medtax may act as a Personal Information Processor (“PIP”) when processing tax and practice data on your behalf and as a Personal Information Controller (“PIC”) for account, security, administrative and other processing for which Medtax determines the purposes and means. The applicable role will be determined by the actual processing activity, not solely by the label used in this Policy. You are responsible for the accuracy and completeness of the information and documents you provide and for ensuring that you have a lawful basis to provide personal information relating to other individuals.
We disclose personal data only to recipients who have a legitimate and specified purpose for receiving it and only to the extent necessary and proportionate to that purpose. Medtax does not sell, rent, or trade personal data. Depending on the service, we may disclose or make personal data accessible to:
We do not add your data to marketing lists or share it with data brokers. We will not use your personal data for a new purpose that is incompatible with the declared purpose unless permitted by law and, where required, after providing the appropriate notice or obtaining consent.
Tax documents, books of account, and returns are retained for the period required by applicable Philippine tax, accounting, privacy, and other laws. Under Section 235 of the National Internal Revenue Code, as amended by Republic Act No. 11976, books of accounts and other accounting records are generally preserved for five (5) years subject to the statutory rule and applicable exceptions. The applicable retention period may therefore differ depending on the type of record and the circumstances. Account and other personal data not subject to a legal retention requirement are kept only for as long as necessary for the declared, specified, and legitimate purposes, for the establishment, exercise, or defense of legal claims, or for legitimate business purposes consistent with applicable law. After the applicable retention period, personal data will be securely disposed of, destroyed, or anonymized in accordance with applicable law and Medtax’s records-retention procedures.
You may request deletion or blocking of your personal data, subject to the limitations and exceptions under the DPA and other applicable laws. Medtax will delete or securely dispose of personal data that it is no longer required or permitted to retain, subject to legal retention requirements, the establishment, exercise or defense of legal claims, and other lawful retention grounds. Returns, books, tax documents, and other records required to be retained by law will remain in restricted access for the applicable statutory period. Where an account is archived before deletion under Medtax’s subscription policy, the retained data will remain subject to this Privacy Policy and the applicable retention schedule.
We implement reasonable and appropriate organizational, physical, and technical measures designed to protect personal data against accidental or unlawful destruction, alteration, loss, unauthorized disclosure, or access. These measures include encryption of data in transit (TLS) and at rest, secure password hashing, access controls on a need-to-know basis, confidentiality obligations for personnel, and periodic review of security practices. Medtax will maintain appropriate safeguards for outsourced processing and subprocessors.
Under the Data Privacy Act of 2012, you have the right to:
To exercise these rights, contact the Data Protection Officer using the details in Section 14. Medtax may require reasonable verification of your identity before acting on a request. Requests will be handled within the period required by applicable law, subject to lawful exceptions and limitations. Where Medtax acts only as a processor for tax or practice data, Medtax may refer the request to the applicable controller or act in accordance with the controller’s lawful instructions.
If a personal data breach occurs that is subject to mandatory notification under the DPA and applicable NPC issuances, Medtax will notify the National Privacy Commission and affected data subjects within the period prescribed by law. Where the notification requirements of the DPA and NPC rules apply, this currently includes notification within seventy-two (72) hours upon knowledge of, or reasonable belief that, a qualifying personal data breach has occurred, subject to applicable exceptions, postponement rules, and other NPC requirements. Medtax will also maintain appropriate incident-response, documentation, and reporting procedures.
We use only functional cookies (such as session and CSRF-protection cookies) needed for the platform to work. We do not use advertising, tracking, or third-party analytics cookies. Interface preferences stored in your browser stay on your device.
Medtax is intended for licensed professionals and is not directed to children. We do not knowingly collect personal data from minors. If we learn that personal data of a minor has been collected contrary to applicable law, we will take reasonable steps to address the situation, including deletion where legally appropriate.
We may update or amend this Policy from time to time to reflect changes in our services, processing activities, technology, or applicable law. We will post the revised version with a new effective date and provide any notice or obtain any consent required by law. Material changes affecting the purposes or manner of processing will be communicated in a reasonably prominent manner.
For privacy questions or to exercise your rights, contact our Data Protection Officer:
Medtax Solutions Inc.
Suite 9D, Valero Tower, Bel-Air, Salcedo Village, Makati City, Philippines 1227
Email: dpo@medtax.ph · Phone: +63 976 298 9000
You may also file a complaint with the National Privacy Commission at www.privacy.gov.ph.
Medtax has designated a Data Protection Officer (“DPO”) to oversee privacy and data protection compliance. The DPO may be contacted using the details in Section 14. You may also lodge a complaint with the National Privacy Commission where you believe your rights under the DPA have been violated.