Privacy Policy

This Privacy Policy explains how LisensyaLab, Inc. (“LisensyaLab”, “we”, “us”) collects, uses, discloses, and protects personal data when you use the LisensyaLab mobile application, our websites, and related services (together, the “Service”).

We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

By creating an account or using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

1. Personal data we collect

Information you give us

• Account details — your name, email address, and password (stored only as a cryptographic hash, never in readable form).
• Study profile — the licensure examination you are preparing for, your field of specialization where applicable, and your school or institution if you join through a school program.
• Support and enquiry correspondence — the contents of messages you send us, including any information you choose to include.

Information generated as you use the Service

• Learning activity — the questions you answer, whether each answer was correct, your diagnostic assessment results, quiz and mock-exam scores, topic-level accuracy, streaks, and study timestamps. This is what allows the Service to build your personalized study path.
• Leaderboard entries — your display name and score, shown to other users within the same examination track where you take part in rankings.
• Device and technical data — device model, operating system version, application version, approximate region inferred from your IP address, and diagnostic logs used to detect faults.
• Push notification token — a Firebase Cloud Messaging identifier assigned to your device, used solely to deliver notifications you have enabled.

Payment information

Subscriptions purchased directly from us are processed by our third-party payment provider. Subscriptions purchased through the Apple App Store or Google Play are processed by Apple or Google. We do not collect or store your full card number, CVV, or bank credentials. We receive only a transaction reference, the amount, the payment method type, and whether the payment succeeded.

2. Why we process your data

We process personal data for the following purposes, each with a lawful basis under RA 10173:

• To provide the Service — creating your account, serving questions, scoring answers, generating your study path and progress reports. Basis: performance of our contract with you.
• To process payments and manage subscriptions — including trials, renewals, and receipts. Basis: performance of contract; compliance with tax and accounting obligations.
• To improve question quality and the Service — analyzing aggregate answer patterns to identify defective or ambiguous questions and to improve the question bank. Basis: legitimate interests.
• To communicate with you — service announcements, security notices, and, where you have enabled them, study reminders and push notifications. Basis: performance of contract; consent for optional marketing.
• To keep the Service secure — detecting fraud, abuse, and unauthorized access. Basis: legitimate interests; legal obligation.

We do not sell your personal data, and we do not use your learning activity to make automated decisions producing legal effects concerning you.

3. Institutional and school accounts

Where your access is provided through a school, review center, or other institution, that institution may receive aggregate and individual progress reporting for its enrolled learners — for example, completion rates, accuracy by subject, and activity levels. The institution acts as a separate personal information controller for the purposes for which it uses those reports. We do not disclose your payment details to the institution.

4. Disclosure to third parties

We share personal data only as described below, and only to the extent necessary:

• Cloud hosting and database providers that operate the infrastructure on which the Service runs.
• Payment providers, to process your subscription and handle chargebacks or refunds.
• Push notification and email delivery providers, to send the messages you have enabled.
• Professional advisers (legal, accounting, audit) under duties of confidentiality.
• Government authorities, where disclosure is required by a valid legal order or by law.
• A successor entity, in the event of a merger, acquisition, or reorganization — subject to this Policy continuing to apply.

Some of these providers process data outside the Philippines. Where personal data is transferred abroad, we take reasonable steps to ensure a comparable level of protection, as required by RA 10173.

5. Retention

We retain your account and learning data for as long as your account remains active. If you delete your account, we delete or irreversibly anonymize your personal data within ninety (90) days, except where a longer period is required — for example, transaction records retained for the period prescribed by Philippine tax and accounting rules. Aggregated statistics that can no longer identify you may be retained indefinitely.

6. Your rights

Under the Data Privacy Act you have the right to:

• Be informed about how your personal data is processed.
• Access the personal data we hold about you.
• Object to processing, including for direct marketing.
• Rectify inaccurate or incomplete data.
• Erasure or blocking of data that is unlawfully obtained, outdated, false, or no longer necessary.
• Data portability — to obtain a copy of your data in a commonly used electronic format.
• Damages for violations of your rights.
• Lodge a complaint with the National Privacy Commission.

To exercise any of these rights, email [email protected]. We will respond within a reasonable period and, in any case, within the timeframes required by law. We may ask you to verify your identity before acting on a request.

To delete your account and personal data, see Delete your account, which sets out the request procedure, what is deleted, and what we are required to retain.

7. Security

We apply organizational, physical, and technical measures to protect personal data, including encryption of data in transit (HTTPS/TLS), hashed password storage, access controls limiting staff access to what their role requires, and regular database backups. No system is perfectly secure; if a personal data breach occurs that poses a real risk of serious harm, we will notify the National Privacy Commission and affected users as required by law.

8. Children and minors

The Service is intended for candidates preparing for Philippine professional licensure examinations and is directed at users eighteen (18) years of age or older. We do not knowingly collect personal data from children. Where a user is a minor enrolled through an institution, processing is undertaken with the consent of a parent or legal guardian. If you believe a minor has provided personal data to us without such consent, contact us and we will delete it.

9. Cookies and similar technologies

Our website uses only the storage necessary to operate the site and keep you signed in. We do not use third-party advertising cookies or cross-site tracking. Our web pages load fonts from Google Fonts, which may record your IP address as part of serving those files.

10. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will notify you in the application or by email before they take effect. The “Last updated” date above always reflects the current version.

11. Contact us

For any question about this Policy, or to reach our Data Protection Officer:

• Email — [email protected]
• Address — LisensyaLab, Inc., 658 Muralla Street, YIC Building, Mapua University, Intramuros, Manila 1002, Philippines

You may also contact the National Privacy Commission at privacy.gov.ph.