Privacy Policy.

1. The two roles we hold

Read this first, because it decides which notice applies to you.

For laquest.net, our marketing, our events, our recruitment and our own business operations, LaQuest is the controller. We decide what is collected and why, and this Policy governs it.

For the systems we build and run for institutions, LaQuest is a processor. When a hospital uses HIMS, a laboratory uses LIMS, a local government uses BrMIS or an employer uses LaQuest Payroll, the institution is the controller of the patient, citizen, sample or employee records inside that system. LaQuest processes them only on that institution's documented instructions, under a data processing agreement covering purpose, security, sub-processors, breach notification, assistance with requests, and return or deletion at the end of the engagement.

2. Who we are

LaQuest operates through three registered entities. Which one is the controller of your personal information depends on where you are, and the selector above names it.

• LaQuest LLP, India. Level 1, Southern Park, Near Select City Walk Saket, New Delhi 110017, Delhi, India
• LaQuest Philippines Inc. 8th Floor, Unit B2, Commerce and Industry Plaza Building, McKinley Town Center, Campus Avenue, Fort Bonifacio, Taguig, 1635 Metro Manila, Philippines
• LaQuest International Inc. 2055 Limestone Road, STE 200-C, Wilmington, Delaware 19808, United States

3. What we collect

We collect what you give us, what is generated when you use our website and services, and, where a contract allows it, information from partners.

• Contact and professional details: name, job title, organisation, business email, phone number and country, usually through our forms, demo requests, briefings and events.
• What you tell us: the content of your enquiry, including anything you choose to attach.
• Recruitment details: applications and CVs submitted through our careers route.
• Support records: tickets, correspondence and account identifiers needed to run and support a service you hold.
• Technical and usage data: device, browser, pages visited and approximate location, through cookies and similar technologies set out in our Cookie Policy.

Cookies. We use strictly necessary cookies and storage to run laquest.net and remember your cookie choice. We use analytics cookies (Google Analytics and Zoho PageSense) only if you choose Accept in the cookie bar at the foot of the page; if you choose Reject, or make no choice, they are not set. Our basis is your consent, given under the Philippine Data Privacy Act of 2012 and, for visitors in the EU, UK and EEA, the GDPR and ePrivacy rules. You can withdraw consent at any time from Cookie settings in the footer, and it does not affect anything done before. Questions go to privacyofficer@laquest.net. Details are in our Cookie Policy.

We do not ask for sensitive personal information through this website, and we ask that you do not send it to us in an enquiry or a support ticket.

Sensitive personal information. The Data Privacy Act treats some categories separately, including information about race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetic or sexual life, proceedings for any offence, government issued identifiers such as social security numbers, and information specifically established by law to be kept classified. Biometric identifiers are treated with the same care. We process these only where the Act permits it, which in practice means your consent, an existing law or regulation, protection of life and health, a lawful purpose of a public authority, or the establishment or defence of legal claims. Where a system we operate for an institution holds such information, the institution is the controller and decides the grounds on which it is processed.

4. Why we use it

• To answer enquiries and route them to the practice that can help.
• To deliver, support and secure the services you hold with us.
• To run recruitment.
• To send updates about our work, our partners and our events, where you have agreed to receive them. You can stop at any time using the link in the message or by writing to us.
• To operate and improve laquest.net, using analytics that respect your cookie choices.
• To meet legal, regulatory, audit and contractual obligations, and to establish or defend legal claims.

5. The scope and method of our processing

We process personal information by electronic means, on systems we operate ourselves and on cloud services operated for us under contract. Processing is limited to what the purposes above require, and covers collection through our forms and correspondence, recording and organisation in our customer relationship and support systems, storage, retrieval by authorised staff, use, disclosure to the recipients listed below, and erasure or anonymisation at the end of the retention period. We do not process personal information for any purpose beyond those stated without telling you first.

6. Our basis for using it

Depending on which law applies to you, we rely on your consent, on the performance of a contract or steps taken before one, on compliance with a legal obligation, and on our legitimate interests in running and protecting the business, weighed against your interests and rights. Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect processing already carried out.

7. Automated decisions and profiling

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects. We use analytics to understand how laquest.net is used, and we may score or segment business enquiries so that they reach the right practice, but a person makes every decision that affects you. Where a system we operate for an institution applies automated processing to records inside it, the institution decides whether to do so and must tell the people concerned.

Automated access. Personal information we hold is accessible through the administrative interfaces of the systems that store it, and through no other automated route. Access is granted by named account, limited by role to the records a person needs for their work, logged, and reviewed. We do not provide programmatic or bulk access to your personal information to any third party except where this Policy says we share it, and then only through the contracted service concerned.

8. Who we share it with

We do not sell personal information, and we do not rent or trade it.

• Service providers who host and run our systems, including our customer relationship, support desk, booking and analytics platforms, under contracts that restrict what they may do with the data.
• Technology partners, where you have asked us to bring one into a specific engagement.
• Our other group entities, where needed to deliver or support what you hold with us.
• Professional advisers, auditors, and authorities where the law requires it.
• A successor, in a merger, acquisition or reorganisation, under the same protections.

Where we engage another organisation to process personal information on our behalf, we remain accountable for it. Each is appointed under a written agreement that limits them to our instructions, requires security measures at least equal to our own, requires them to tell us without delay of any breach, and prohibits them from engaging anyone further without our agreement.

9. Moving data between countries

LaQuest operates from the Philippines, India and the United States, and uses cloud services that may process data in other countries. Where personal information crosses a border we put contractual and organisational safeguards in place appropriate to the law that applies, and the receiving entity remains bound by this Policy.

Transferring information abroad does not transfer our responsibility for it. We remain accountable for personal information we send outside the country it was collected in, including information held by a service provider on our behalf.

10. How long we keep it

We keep personal information only as long as it is needed for the purpose it was collected, to meet a legal or contractual obligation, or to resolve a dispute, and then delete or anonymise it.

• Enquiries and marketing contacts: reviewed periodically and removed when there is no longer a reason to keep them.
• Recruitment: applications are deleted after the period stated in our careers notice, unless you have asked us to keep them on file.
• Support and service records: for the term of the agreement and the period afterwards set in it.
• Website access logs: kept for a short period for security monitoring and then deleted.

11. How we protect it

We apply measures proportionate to the risk and to the nature of the information, in the three categories the Implementing Rules set out.

• Organisational. A designated Data Protection Officer, a documented security policy governing the processing of personal information, role based access, confidentiality undertakings, privacy and security training, background checks where the role requires it, and contracts with everyone who processes on our behalf.
• Physical. Controlled access to offices and equipment, clear desk and screen practice, secure handling and disposal of media, and restrictions on removing records from a site.
• Technical. Safeguards protecting our networks against unauthorised use or interference, encryption in transit, access control and authentication, segregation of environments, secure development practice, backup, and patching.
• Finding and fixing weaknesses. A process for identifying reasonably foreseeable vulnerabilities in our networks, regular monitoring for security breaches, and preventive, corrective and mitigating action against incidents that could lead to one.

No system is perfectly secure. We review these measures periodically and after any incident.

12. If something goes wrong

We maintain a personal data breach management procedure covering prevention, detection and response.

Where a breach involves sensitive personal information, or information that could be used to enable identity fraud, and there is a real risk of serious harm, we notify the National Privacy Commission and the people affected within seventy two hours of knowing of the breach, in the manner the Act and the Commission's issuances require. Where the law of another jurisdiction applies to the affected information, we follow its notification duties as well.

Where the breach affects a system we operate for an institution, that institution is the controller. We notify it without delay and support it in meeting its own duties to the Commission and to the people affected.

13. Your rights

Your rights depend on where you are and on which of our entities is the controller. The selector at the top of this page names that entity and the law that applies. The rights each law gives you are set out below. Whichever applies, the route to exercise them is the same and is described in the next section. We verify who you are before acting on a request, and we answer within the period the applicable law allows.

India

• To access a summary of the personal data being processed and the processing activities undertaken.
• To correction, completion, updating and erasure of your personal data.
• To nominate another person to exercise your rights in the event of death or incapacity.
• To withdraw consent as easily as it was given.
• To a readily available grievance redressal route.
• To escalate to the Data Protection Board of India if a grievance is not resolved.

Philippines

• To be informed that your personal information is being processed, and why.
• To object to processing, including processing for direct marketing.
• To reasonable access, on demand, to the personal information processed, the sources it came from, the names and addresses of recipients, the manner in which it was processed, the reasons for any disclosure, information on any automated process used as the sole basis of a decision affecting you, the date it was last accessed and modified, and our identity and address as controller.
• To have inaccurate or outdated information corrected.
• To have information erased or blocked where the grounds in the Act apply.
• To damages where you have suffered because of inaccurate, unlawful or unauthorised use.
• To data portability, where processing is by electronic means and based on consent or contract.
• To lodge a complaint with the National Privacy Commission at any time.
• Your lawful heirs and assigns may invoke these rights after your death, or if you become incapable of exercising them yourself.

United States

• To know what personal information we collect, use, disclose and, where relevant, sell or share.
• To access a copy of the personal information we hold about you.
• To correct inaccurate personal information.
• To delete personal information, subject to the exceptions the law allows.
• To opt out of sale or sharing of personal information, and of targeted advertising.
• Not to be discriminated against for exercising any of these rights.
• To raise a complaint with your state Attorney General, or with the California Privacy Protection Agency where California law applies.

Elsewhere

• To be informed about how your personal information is used.
• To access, correct and, where grounds exist, erase your personal information.
• To object to direct marketing at any time.
• To withdraw consent where consent is the basis we rely on.
• To lodge a complaint with the National Privacy Commission of the Philippines.

14. How we hold ourselves to this

Compliance is not only a statement on a page.

• A Data Protection Officer is designated and is accountable for compliance.
• We keep records of our processing activities and review them.
• We carry out privacy impact assessments before introducing a system or a change that presents a risk to personal information, and we keep the results.
• We build privacy and security into systems by design and by default, rather than adding them afterwards.
• We train staff on data protection and require written confidentiality undertakings.
• We are registered with the National Privacy Commission, as set out further down this page.

15. Requests from authorities

We disclose personal information to a government agency, a regulator, a court or a law enforcement body only where we are legally obliged to, or where the law otherwise permits it. We assess each request, we require it in writing and in proper form, we disclose no more than is necessary, and we keep a record. Where a request concerns records held inside a system we operate for an institution, we refer the requesting body to that institution as the controller, unless we are prohibited from doing so.

16. Other websites

laquest.net links to other sites, including our help centre, our booking service and the sites of partners. This Policy does not cover them. We encourage you to read the notice of any site you go on to use.

17. Children

This website and our services are meant for professionals and institutions. We do not knowingly collect personal information from children. Where a system we operate for an institution holds records about minors, the institution is the controller of those records and its own notice applies.

18. Changes to this Policy

We may update this Policy. The date at the top shows when this Policy was last updated, and material changes are announced on this page.