Privacy Policy

This Privacy Policy explains how PriviHealth (“we”, “us”) collects, uses, stores, and protects your personal information when you use our sexual health teleconsultation platform, including doctor chat consultation, laboratory test ordering (including HIV testing), and home medication delivery.

We collect identity information, sensitive health data, transaction data, and technical data required to provide safe, private, and medically appropriate services.

Sexual health data is sensitive data protected at the highest legal level under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and other applicable regulations.

We process your data based on your explicit consent, performance of the service agreement, legal obligations, and our legitimate interests in providing safe and effective services.

We NEVER sell your health data. Your data may only be shared with doctors, partner labs, pharmacies, delivery partners, payment processors, government authorities when required by law, and trusted service providers under strict confidentiality agreements.

Your data may only be shared with:

We protect your data with encryption in transit (HTTPS), encryption at rest provided by our hosting providers, role-based access control, audit logging of prescription and order activity, and incident response procedures.

We retain data as required by Indonesian regulations: medical records minimum 5 years, transaction data 10 years, and active account data for the duration of the account plus 2 years. Data is securely deleted or anonymized after retention periods end.

After retention periods end, data is securely deleted or anonymized.

You have the right to access, correct, delete, restrict, object, and transfer your data, withdraw consent, and lodge complaints with the Personal Data Protection Authority (when established) or other relevant authorities.

Under PDP Law No. 27/2022 and related regulations, you have the right to:

We use cookies to maintain your session, ensure security, and generate anonymous analytics for service improvement. You can manage cookie preferences in your browser settings.

We use cookies and similar technologies to:

Our platform runs on cloud infrastructure located outside Indonesia, including servers in Singapore. Your data is processed by the following service providers: Vercel (application hosting), MongoDB Atlas (database), Microsoft Azure (document storage), Cloudinary (image storage), Xendit (payments), and our email delivery provider. Data is transferred outside Indonesia only with safeguards that provide a level of protection equivalent to the PDP Law, including contractual confidentiality and security obligations.

We will notify you via email or in-app notification at least 30 days before material changes take effect. Continued use of the service after changes are effective constitutes acceptance of the updated policy.

Our Data Protection Officer is here to help with any privacy questions, requests, or concerns.