Effective Date: August 19, 2026
Last Updated: August 19, 2026
These Terms of Service ("Terms") govern access to and use of HERMES — Health Electronic Record Management & Enterprise System ("HERMES," "Platform," "System," "Service," "we," "us," or "our"), operated by HUMANLAB ("HUMANLAB").
By creating an account, subscribing to, accessing, or using HERMES, the subscribing clinic, hospital, healthcare facility, healthcare professional, administrator, employee, contractor, or other authorized user ("Customer," "you," or "your") agrees to these Terms.
If you do not agree to these Terms, you must not access or use HERMES.
For purposes of these Terms:
"Account" means an authorized account created to access HERMES.
"Authorized User" means an individual authorized by the Customer to access HERMES.
"Customer" means the clinic, hospital, healthcare facility, business, organization, or other entity subscribing to HERMES.
"Patient Data" means information relating to an identified or identifiable patient that is entered into, uploaded to, generated by, or otherwise processed through HERMES.
"Personal Data" has the meaning provided under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), and its implementing rules and regulations.
"Sensitive Personal Information" includes information relating to an individual's health, medical history, treatment, diagnosis, education, genetic information, or other information classified as sensitive under applicable law.
"Customer Data" means all information submitted, uploaded, entered, transmitted, or otherwise provided by or on behalf of the Customer or its Authorized Users through HERMES.
"Personal Information Controller" ("PIC") means the person or organization that controls the collection, holding, processing, use, or disclosure of personal data.
"Personal Information Processor" ("PIP") means a person or organization qualified to act as a processor of personal data on behalf of a PIC.
HERMES is a cloud-based electronic health record and clinic management platform designed to assist healthcare organizations with the digital management of:
HERMES is a software and information management platform.
HERMES does not independently provide medical diagnosis, treatment, medical advice, or professional healthcare services.
Healthcare decisions remain the sole responsibility of the licensed healthcare professionals and healthcare facility using the Platform.
The Customer is responsible for:
The Customer remains responsible for the legality of the data it enters into HERMES.
Where the Customer determines the purposes and means of processing Patient Data and uses HERMES to process such data on its behalf, the Customer generally acts as the Personal Information Controller (PIC) and HUMANLAB acts as the Personal Information Processor (PIP), subject to the actual circumstances of the processing.
The parties shall comply with Republic Act No. 10173, its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC").
The parties shall implement reasonable and appropriate organizational, physical, and technical measures to protect Personal Data against unauthorized access, unlawful processing, accidental loss, destruction, alteration, disclosure, or other security incidents.
The Customer shall not use HERMES in a manner that violates the DPA or other applicable privacy laws.
The Customer acknowledges that the processing of Personal Data through HERMES is subject to applicable privacy laws and the applicable HERMES Privacy Notice.
The Privacy Notice explains, among other matters:
The Customer is responsible for providing patients and other data subjects with appropriate privacy information concerning the Customer's own processing activities.
Personal Data shall only be processed through HERMES when a lawful basis exists under applicable law.
Depending on the circumstances, lawful processing may include:
The Customer shall determine and document the appropriate legal basis for its processing activities.
HERMES does not require consent as the legal basis for every processing activity where another lawful basis is applicable.
The Customer acknowledges that healthcare information may constitute Sensitive Personal Information under the DPA.
Because of the sensitive nature of healthcare records, Customer agrees to implement heightened access controls and confidentiality procedures appropriate to the risks associated with healthcare information.
Access to Patient Data shall be limited to Authorized Users who have a legitimate need to access such information.
Users must not:
Each Authorized User must have an individual account unless HERMES expressly provides otherwise.
Customers must not share accounts.
The Customer is responsible for managing:
The Customer must promptly disable accounts belonging to individuals who no longer have a legitimate business or clinical reason to access HERMES.
HERMES may maintain records of account activity, authentication events, access events, and changes to Patient Data for security, compliance, audit, and operational purposes.
HERMES may maintain audit logs relating to activities performed within the Platform.
Depending on the features enabled, audit records may include:
Audit logs may be used to:
Audit information shall be retained in accordance with applicable retention requirements and HERMES policies.
The Customer is responsible for ensuring that information entered into HERMES is accurate, complete, relevant, and updated when necessary.
HUMANLAB does not guarantee the accuracy of information entered by Customers or Authorized Users.
Where appropriate, HERMES may provide functionality for authorized users to correct or update records.
Corrections must be made in accordance with applicable healthcare recordkeeping requirements.
The Customer agrees not to upload, collect, or process Personal Data through HERMES that is unnecessary for the declared and legitimate purpose for which the information is being processed.
Customers should collect only information that is adequate, relevant, and reasonably necessary for the intended purpose.
HUMANLAB may restrict or remove functionality that it reasonably believes is being used to process unnecessary or unlawful Personal Data.
Personal Data shall not be retained longer than necessary for the purpose for which it was collected or processed, unless retention is required or permitted by law.
Retention periods may depend on:
HERMES may establish default retention periods for certain system information.
Where the Customer requests deletion, termination, or export of its data, applicable legal and contractual retention obligations shall be considered before deletion occurs.
Data that must be retained by law may not be immediately deleted.
When Personal Data is no longer required and there is no legal or legitimate reason for continued retention, it shall be securely deleted, anonymized, or otherwise disposed of in accordance with applicable law and HERMES procedures.
Deletion may include removal from active systems and, where technically and operationally appropriate, eventual removal from backups according to the applicable backup lifecycle.
Deletion from backups may not occur immediately.
HERMES supports the Customer in fulfilling applicable data subject rights.
Subject to applicable law, data subjects may have rights including:
The Customer remains primarily responsible for responding to requests made by its patients and other data subjects concerning the Customer's processing activities.
HUMANLAB shall provide reasonable assistance where the request concerns Personal Data processed through HERMES.
Requests may be subject to reasonable identity verification and applicable legal limitations.
HUMANLAB shall not sell Customer Data or Patient Data.
HUMANLAB may process or disclose Personal Data only when reasonably necessary for:
Where disclosure is legally required, HUMANLAB shall comply with applicable legal requirements.
HUMANLAB may use third-party infrastructure, hosting, database, authentication, email, storage, monitoring, analytics, payment, security, or other service providers necessary to operate HERMES.
Where such providers process Personal Data on behalf of HUMANLAB or the Customer, HUMANLAB shall take reasonable steps to ensure that appropriate contractual, organizational, physical, and technical safeguards are implemented.
Subprocessors shall only process Personal Data for authorized purposes.
The use of third-party processors shall be subject to applicable privacy and security requirements.
Customer Data may be stored on cloud infrastructure operated by HUMANLAB or its authorized infrastructure providers.
Because cloud systems may involve infrastructure located outside the Philippines, international or cross-border processing may occur where applicable.
Where cross-border processing or transfer occurs, HUMANLAB shall implement safeguards required by applicable law and applicable contractual arrangements.
The Customer acknowledges that no internet-based system can guarantee absolute security against every possible threat.
HUMANLAB shall maintain reasonable and appropriate security measures proportionate to the nature, scope, and risks of the Personal Data processed through HERMES.
Security measures may include:
Security controls may be modified as technology, threats, industry practices, and applicable requirements evolve.
HUMANLAB shall maintain procedures for identifying, investigating, responding to, and mitigating security incidents involving HERMES.
If HUMANLAB determines that a security incident has resulted in or is reasonably likely to result in a personal data breach requiring notification under applicable law, HUMANLAB shall take appropriate action in accordance with the DPA, its implementing rules, and applicable NPC issuances.
Where notification to the Customer is appropriate, HUMANLAB shall provide reasonably available information concerning the incident, subject to legal, security, and investigative restrictions.
The Customer shall cooperate with HUMANLAB in investigating and responding to incidents involving Customer Data.
The Customer remains responsible for determining and fulfilling its own notification obligations where required by law.
HUMANLAB's security controls do not replace the Customer's own security responsibilities.
The Customer must:
HERMES is an information management system and is not a substitute for professional medical judgment.
HUMANLAB does not:
The Customer and its healthcare professionals remain responsible for all clinical decisions and patient care.
As between HUMANLAB and the Customer, the Customer retains its rights and interests in Customer Data.
HUMANLAB does not acquire ownership of Patient Data merely because the data is stored or processed through HERMES.
The Customer grants HUMANLAB a limited, non-exclusive right to process Customer Data solely to provide, maintain, secure, improve, and support HERMES and to fulfill applicable legal obligations.
HUMANLAB shall not use identifiable Patient Data for unrelated commercial purposes without an appropriate lawful basis and required authorization.
HUMANLAB may create aggregated or appropriately de-identified information from system usage where permitted by applicable law.
Such information shall be processed in a manner intended to prevent identification of individual patients.
Aggregated or de-identified information may be used for purposes such as:
HUMANLAB shall not intentionally attempt to re-identify properly de-identified information except where legally permitted and reasonably necessary.
Users must not use HERMES to:
Where HERMES is operated as a multi-tenant platform, Customer environments are logically separated through appropriate application, database, access-control, and security mechanisms.
A Customer's Authorized Users shall only have access to information for which they have been authorized.
Customers must not attempt to access another organization's data.
Any suspected cross-tenant access or data exposure must be reported immediately to HUMANLAB.
HUMANLAB will use commercially reasonable efforts to maintain HERMES availability.
However, uninterrupted availability is not guaranteed.
The Platform may occasionally be unavailable due to:
HUMANLAB may maintain backups of Customer Data for disaster recovery, security, and operational continuity.
Backups are not intended to replace the Customer's own recordkeeping responsibilities.
HUMANLAB shall use reasonable measures to protect backups from unauthorized access.
Restoration of data may depend on the availability and integrity of backups at the time of an incident.
Subject to the Customer's subscription and applicable procedures, the Customer may request or use available tools to export Customer Data.
Export functionality may vary depending on the HERMES subscription plan and available features.
Data exports may contain sensitive information and must therefore be handled securely by the Customer.
HUMANLAB is not responsible for unauthorized disclosure occurring after Customer Data has been exported from HERMES and comes under the Customer's control.
HUMANLAB may suspend or terminate an account where:
Where reasonably possible, HUMANLAB shall provide notice before suspension or termination, except where immediate action is necessary to protect the Platform, Personal Data, users, or legal interests.
Upon termination:
Termination does not automatically eliminate legal obligations relating to records that must be retained under applicable law.
Use of HERMES may require a paid subscription.
Subscription fees, user limits, billing cycles, additional-user fees, and other commercial terms shall be specified in the applicable order form, subscription agreement, invoice, or pricing schedule.
Unless otherwise stated, subscription fees are non-refundable after the applicable billing period has commenced.
HUMANLAB may modify pricing with reasonable prior notice.
HERMES, including its software, interface, design, branding, documentation, workflows, source code, and underlying technology, is owned by or licensed to HUMANLAB.
Except for the limited right to use HERMES under these Terms, no intellectual property rights are transferred to the Customer.
The Customer retains its rights in Customer Data.
Each party shall protect confidential information received from the other party.
Confidential information may include:
Confidential information shall not be disclosed to unauthorized third parties except where legally required or otherwise permitted by applicable agreement or law.
Confidentiality obligations shall survive termination of the Service where appropriate.
Where appropriate, HUMANLAB and/or the Customer may conduct Privacy Impact Assessments ("PIAs") concerning processing activities involving HERMES.
PIAs may be used to identify privacy risks and determine appropriate organizational, physical, and technical safeguards.
The parties shall reasonably cooperate where information from the other party is required to assess privacy risks associated with the Platform.
Where required by applicable law, HUMANLAB shall designate a Data Protection Officer ("DPO") or appropriate privacy contact.
Privacy-related requests may be submitted through the designated privacy contact.
Data subjects may raise privacy concerns concerning the processing of their Personal Data with the applicable Personal Information Controller.
Where a complaint concerns processing performed by HUMANLAB as a Personal Information Processor, HUMANLAB shall reasonably cooperate with the Customer in addressing the matter.
Nothing in these Terms prevents a data subject from exercising rights available under the Data Privacy Act of 2012 or from lodging a complaint with the National Privacy Commission where permitted by law.
HUMANLAB may disclose information where required by:
HUMANLAB shall disclose only information reasonably necessary to comply with the applicable legal requirement, subject to applicable law.
Where legally permitted, HUMANLAB may notify the Customer of such requests.
Where Personal Data is processed or stored outside the Philippines, HUMANLAB shall implement appropriate safeguards required by applicable Philippine privacy law and applicable contractual arrangements.
Customers acknowledge that cloud-based infrastructure may involve processing across jurisdictions.
Where required, additional contractual or organizational safeguards may be implemented.
HUMANLAB may modify, update, add, or remove features from HERMES.
Changes may be made to:
Where a material change substantially affects the Customer's use of HERMES, HUMANLAB shall provide reasonable notice where practicable.
HUMANLAB may update these Terms from time to time.
The updated version shall indicate the applicable "Last Updated" date.
For material changes, HUMANLAB may provide notice through HERMES, email, or another reasonable communication method.
Continued use of HERMES after the effective date of updated Terms constitutes acceptance of the revised Terms, subject to applicable law.
HERMES is provided as a technology platform.
To the maximum extent permitted by applicable law, HUMANLAB does not guarantee that:
Nothing in these Terms excludes liability that cannot legally be excluded under Philippine law.
42.1 Exclusion of Indirect Damages. To the maximum extent permitted by applicable law, in no event shall either party be liable to the other for any indirect, incidental, special, consequential, exemplary, or punitive damages, including loss of profits, loss of revenue, loss of goodwill, or loss of data, arising out of or relating to these Terms or the use of HERMES, even if advised of the possibility of such damages.
42.2 Liability Cap. To the maximum extent permitted by applicable law, each party's total aggregate liability arising out of or relating to these Terms, whether in contract, tort, or otherwise, shall not exceed the total subscription fees actually paid by the Customer to HUMANLAB in the twelve (12) months immediately preceding the event giving rise to the claim.
42.3 Carve-Outs from the Cap. The limitations in Sections 42.1 and 42.2 shall not apply to, and shall not limit or exclude liability arising from:
42.4 Basis of the Bargain. The parties acknowledge that the limitations in this Section 42 are an essential basis of the bargain between the parties and that HUMANLAB's pricing reflects the allocation of risk set forth in this Section. Nothing in this Section is intended to exclude or limit liability that cannot lawfully be excluded or limited under the laws of the Republic of the Philippines.
To the extent permitted by applicable law, the Customer agrees to defend and indemnify HUMANLAB against claims, losses, damages, liabilities, and expenses arising from:
This provision does not limit rights or remedies available under applicable law.
HUMANLAB shall indemnify and hold the Customer harmless from third-party claims, fines, or penalties arising directly from HUMANLAB's failure to implement the security measures required under the HERMES Data Processing Agreement, or from HUMANLAB's unauthorized processing of Patient Data outside the Customer's documented instructions, except to the extent such claims arise from the Customer's own unlawful instructions or the Customer's failure to obtain a proper legal basis for processing. This indemnification is further detailed in the HERMES Data Processing Agreement.
Neither party shall be responsible for failure to perform obligations caused by circumstances beyond its reasonable control, including:
The affected party shall take reasonable steps to mitigate the effects of the event.
These Terms shall be governed by and interpreted in accordance with the laws of the Republic of the Philippines.
Subject to applicable law, disputes shall be submitted to the appropriate courts or tribunals of competent jurisdiction in the Philippines.
If any provision of these Terms is determined to be invalid, unlawful, or unenforceable, the remaining provisions shall continue in full force and effect to the extent permitted by law.
These Terms, together with the applicable Privacy Notice, Data Processing Agreement, subscription agreement, order form, and other incorporated policies, constitute the agreement governing the Customer's use of HERMES.
If there is a conflict between documents, the applicable agreement shall govern according to its stated order of precedence.
For questions concerning HERMES, account matters, privacy, security, or these Terms:
HUMANLAB
General Support: hermes.humanlab@gmail.com
Business Address: 70 Paraiso Street, Parang, Marikina City
Website: hermes.humanlabco.com
By checking the applicable boxes during registration and clicking "Create Account", the Customer confirms that:
The Customer's acceptance shall be electronically recorded together with the applicable version of the Terms of Service and Privacy Notice, date and time of acceptance, and other relevant registration information for purposes of maintaining an audit trail.
Required checkbox:
☐ I agree to the HERMES Terms of Service and acknowledge that I have read the Privacy Notice.
Required checkbox:
☐ I confirm that I am authorized to register this account on behalf of my clinic or organization.
The account cannot be created unless all required acceptance boxes have been checked.
This Terms of Service document is intended as a contractual and operational template and should not be treated as a substitute for advice from a Philippine-qualified lawyer or privacy professional.
Because HERMES processes healthcare information, the Customer and HUMANLAB should separately establish appropriate privacy documentation, security policies, retention schedules, incident-response procedures, and data-processing agreements consistent with Republic Act No. 10173, its Implementing Rules and Regulations, and applicable National Privacy Commission issuances.