PriviHealth — Privacy Policy
IMPORTANT: This application processes sensitive health data including HIV status, sexual history, and sexual health information. We are fully committed to protecting your privacy in accordance with applicable Indonesian law.
1. About This Policy
This Privacy Policy explains how PriviHealth ("we", "us") collects, uses, stores, and protects your personal information when you use our sexual health teleconsultation platform, including doctor chat consultation, laboratory test ordering (including HIV testing), and home medication delivery.
2. Data We Collect
2.1 Identity Information
- Full name
- Indonesian National ID Number (NIK)
- Date of birth and sex/gender
- Delivery address
- Phone number and email address
- ID card photo (if required for identity verification)
2.2 Health Data (Sensitive Data)
Sexual health data is sensitive data protected at the highest legal level under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and other applicable regulations.
- Doctor chat consultation history
- Symptoms and complaints you report
- Laboratory test results and history, including HIV tests
- Medication purchase history (HIV drugs, PrEP/PEP, STI medications, sexual performance drugs)
- Disclosed medical history and conditions
2.3 Transaction & Technical Data
- Payment history and transaction data
- IP address, device type, and access logs
- App usage data
- Location information (for medication delivery)
3. Legal Basis and How We Use Your Data
We process your data based on:
- Your explicit consent (for sensitive health data)
- Performance of the service agreement between you and us
- Legal obligations under Indonesian law
- Our legitimate interests in providing safe and effective services
Your data is used to:
- Provide doctor consultation services
- Process medication orders and home delivery
- Issue laboratory test referral letters
- Facilitate medical communication between you and the doctor
- Comply with legal, tax, and audit requirements
- Improve services and platform security (in anonymized/aggregate form)
- Verify identity and prevent fraud
4. Sharing Data with Third Parties
We NEVER sell your health data to anyone.
Your data may only be shared with:
- Doctors and medical personnel providing services to you through the platform
- Partner laboratories (only data required to perform the requested test)
- Partner pharmacies and delivery services (name, address, and order details only)
- Payment processors (encrypted financial data per PCI-DSS standards)
- Government authorities or law enforcement if required by applicable Indonesian law
- Technical and cloud service providers under strict confidentiality agreements
5. Data Security
- End-to-end encryption for all doctor chat communications
- Data at-rest encryption using the AES-256 standard
- Role-based access control — only authorized personnel may access health data
- Audit logs for all sensitive health data access
- Regular security and penetration testing
- Cybersecurity incident response procedures
6. Data Retention
- Electronic medical records: minimum 5 (five) years per Indonesian Ministry of Health regulations
- Transaction and financial data: 10 (ten) years per tax regulations
- Active user account data: for the duration of the active account plus 2 (two) years
- After retention periods end, data is securely deleted or anonymized
7. Your Rights
Under PDP Law No. 27/2022 and related regulations, you have the right to:
- Access your personal data we hold
- Correct inaccurate data
- Delete your data (subject to applicable legal retention obligations)
- Restrict or object to data processing in certain circumstances
- Data portability in a machine-readable format
- Withdraw consent at any time (not retroactive)
- Lodge a complaint with the Personal Data Protection Authority (when established) or other relevant authority
To exercise these rights, contact: support@privihealth.com
8. Cookies and Tracking Technologies
We use cookies and similar technologies to:
- Maintain your login session
- Ensure platform security
- Generate anonymous analytics for service improvement
You may manage cookie preferences through your browser settings. Refusing functional cookies may affect service performance.
9. Cross-Border Data Transfers
Your data is processed and stored on servers located in Indonesia. If any transfer outside Indonesia is required, we ensure an equivalent level of protection as required by the PDP Law.
10. Policy Changes
We will notify you via email or in-app notification at least 30 days before material changes take effect. Continued use of the service after the effective date of changes constitutes acceptance of the updated policy.
11. Contact Us
Data Protection Officer — PriviHealth
Email: support@privihealth.com
Address: Bali, Indonesia
Response time: within 3 (three) business days