Translation. This is an English translation provided for convenience. The legally binding text is the Indonesian version at adievia.co.id/privacy; where the two differ, the Indonesian version prevails.
This policy is based on Law No. 27 of 2022 on Personal Data Protection (the PDP Law) and Government Regulation No. 33 of 2026 as its implementing regulation.
More detailed policies for specific users: the Website Privacy Policy for visitors of adievia.co.id, and the Adievia Praktik Privacy Policy (Indonesian, at /privacy/praktik-mandiri/) for patients and users of that application. Patient data in Adievia HMS is also governed by the privacy policy of the hospital using it.
1. About us
PT Adievia Medika Teknologi ("Adievia", "we") provides Adievia HMS (SIMRS Adievia, a hospital management information system) and Adievia Praktik (a system for independent physician and dentist practices). This is a company-level policy: it explains how we process personal data in both products, in the company's operations (relationships with customers and partners, technical support, billing, and compliance — managed in COS Adievia (Company Operating System), our electronic system for those purposes), and on the adievia.co.id website. The products and the website have their own, more detailed privacy policies for their users that complement this policy; where they differ, the provision that gives greater protection to the data subject applies.
Our role: For patient and staff data processed in services provided to healthcare facilities, the healthcare facility (hospital/clinic) acts as the Personal Data Controller and Adievia acts as the Personal Data Processor, processing data on their instructions. For data we manage ourselves — e.g. direct user accounts, customer and prospect contacts, practice licence verification, and our staff accounts — Adievia acts as the Controller.
2. Personal data we process
- Identity & contact: name, national ID number (NIK), date of birth, sex, address, phone, email, BPJS number.
- Health data (specific personal data): medical records, diagnoses, laboratory/radiology results, prescriptions & medication history, allergies, medical procedures.
- Administrative & financial data: bills, payments, claims data.
- Staff data: user names, credentials, roles/access rights; and employment data (identity, national ID number (NIK), emergency contact, salary bank account, BPJS numbers, position, employment contract, and pay) managed in COS Adievia — the NIK and bank account number are stored encrypted, and opening them is logged.
- Customer & partner data: names and contacts of customer representatives, contract signatories, tax ID (NPWP), and the user accounts we provide; for Adievia Praktik practice owners, STR/SIP licence numbers and documents for practice licence verification.
- Website visitor data: contact form and demo request contents, demo access accounts, conversations with the AI assistant, and the ad click identifier (gclid) if you arrive from one of our ads.
- WhatsApp conversations with Adievia: WhatsApp number (or, if you hide it, your WhatsApp username and the account identifier issued by Meta), WhatsApp profile name, text message content, photos you send with their captions, and their time; for documents, voice messages, or videos only the type is recorded.
- Technical data: activity logs, IP addresses, devices (for security & audit).
3. Purposes & legal bases
We process personal data for: providing healthcare services and electronic medical records; administration & billing; reporting to national systems (SATUSEHAT, BPJS, SIRS) as required by law; system security & audit; technical support; practice licence verification for Adievia Praktik customers; responding to enquiries, demo requests, and AI assistant conversations on the website, as well as messages you send to our business WhatsApp number — including contacting you via WhatsApp at the phone number you entered yourself in a website form; measuring the effectiveness of our ads; and administering the company's contracts, employment, and tax obligations.
Legal bases (PDP Law Article 20) include: compliance with legal obligations, performance of a contract, vital interests/healthcare, legitimate interests (for example system security, audit trails, following up with prospects, and responding to messages you send us), and/or the data subject's consent — depending on the context.
4. Sharing & disclosure
Data may be shared with: the relevant healthcare facility (as Controller); government systems (SATUSEHAT/Ministry of Health, BPJS) as required; trusted infrastructure providers/sub-processors bound by agreements; and Google Ads to measure the effectiveness of our ads (section 5). We do not sell personal data.
5. Data location & transfers
Data is processed and stored in Indonesia: on Google Cloud Platform, Jakarta region (asia-southeast2) for services we manage, or on servers owned by the healthcare facility for installations at that facility. Backup copies are also located in Indonesia.
The exceptions — transfers outside Indonesia — are listed one by one below.
WhatsApp messages. Adievia Praktik sends notifications through the WhatsApp Business Platform (Meta Platforms), which processes them outside Indonesia. In Adievia HMS, WhatsApp messaging only runs if the healthcare facility enables it; such messaging is carried out on the instructions of the healthcare facility as controller, with content it determines, and is likewise processed by Meta outside Indonesia. What leaves Indonesia from Adievia Praktik is limited to: the recipient's phone number, one-time codes, queue numbers, practice name, session time, and the practice's phone number. Operational alerts to Adievia staff sent via WhatsApp are limited to the practice name and the type and number of events; they contain no patient data and no excerpt of error messages, which can only be read in COS Adievia.
Adievia Praktik messages to patients and practices do not contain medical record content, diagnoses, clinical notes, prescriptions, examination results, or free text written by staff. Their content is built from fixed templates in the program code, not left to the care of users.
The basis for transferring messages to patients is the data subject's consent (PDP Law Article 56(4)), requested in the patient account sign-up flow. Patients who do not give it can still be served through registration by practice staff, in which case none of their personal data leaves Indonesia. Because Government Regulation No. 33 of 2026 (effective 16 January 2027) limits consent to non-repeated transfers (Article 173), we are moving this basis to adequate and binding safeguards (PDP Law Article 56(3); GR 33/2026 Article 165(2)) in the form of a contractual instrument with Meta — the same basis used for operational alerts to staff.
WhatsApp conversations with Adievia. If you contact PT Adievia's business WhatsApp number — for example through the chat button on the website — your messages and our replies pass through the WhatsApp Business Platform (Meta Platforms), which processes them outside Indonesia.
- What is processed: WhatsApp number (or your WhatsApp username and the account identifier from Meta if your number is hidden), WhatsApp profile name, message content, photos you send with their captions, and their time. Photos are stored in COS Adievia together with the conversation; staff open them only when needed to respond to you, and every opening is logged. We do not download documents, voice messages, or videos — only their type is recorded.
- Purpose: responding to your questions about our products and services. First messages and messages outside service hours (Monday–Friday 08.00–17.00 WITA) receive an automatic reply; the first reply links to this policy.
- Messages we start: if you enter a phone number in a website form, our staff may start a WhatsApp conversation with that number to follow up on your submission, using a message template approved by Meta. We do not send WhatsApp messages to numbers you have not given us yourself. If you reply, the terms of this conversation apply.
- Where it is stored: conversations are stored in Indonesia (Google Cloud Jakarta) — in COS Adievia, where staff reply, and as an encrypted technical archive in our WhatsApp gateway (without photos; photos are stored only in COS Adievia) — for the periods in section 6.
- Please do not send patient data, health data, or identity documents via WhatsApp — including photos of prescriptions, test results, or identity cards. For appointments or queues at a doctor's practice, contact the practice where you are treated.
- Safeguards: the WhatsApp Business Data Processing Terms and Data Security Terms, which bind Meta as processor. The transfer basis is adequate and binding safeguards (PDP Law Article 56(3); GR 33/2026 Article 165(2)).
- Your choice: if you prefer not to use WhatsApp, contact us by email or at the address in section 9; no personal data of yours leaves Indonesia through that channel other than as described under Email below.
Email. PT Adievia's email — staff correspondence, automated emails from COS Adievia, from the website (contact form, demo access, verification codes), and account or billing emails from our applications — is sent through Google Workspace (Google LLC), which stores copies of email in data centres outside Indonesia.
- Purpose: operational correspondence — support replies to customers, notifications to staff, responses to website forms, account and billing emails, and receipt of data subject requests.
- What is stored: email addresses, names, practice or institution names, correspondence content, and account codes or links. Automated notifications to staff from COS Adievia deliberately contain no customer names, practice names, or ticket content; Adievia Praktik operational alerts to staff contain the practice name and the type and number of events, with no patient data and no excerpt of error messages.
- Medical records are not sent through our email. Adievia HMS provides a feature for healthcare facilities to send copies of medical records to entitled requesters; that sending uses the email server designated by the healthcare facility as controller, not an Adievia email account.
- Safeguards: a data processing agreement binding Google as processor (Cloud Data Processing Addendum) — processing only on our instructions, incident notification, deletion after the service ends, and ISO 27001/27018 security certifications. The transfer basis is adequate and binding safeguards (GR 33/2026 Article 165(2)); until the Personal Data Protection Agency publishes its list of equivalent countries and standard contractual clauses, we reassess this instrument every year.
- Your rights: can still be exercised through the contacts in section 9; Google forwards requests it receives to us.
- Risks and mitigation: the main risks are access in the recipient country and email account compromise, which we mitigate with two-factor authentication and limits on email content.
The adievia.co.id website. Three services on our website are processed by their providers outside Indonesia:
- AI assistant: the messages you type and the conversation history are sent to Google Cloud's AI service (Vertex AI) to compose answers, and may be processed outside Indonesia. We keep the transcript on our server in Indonesia. Please do not write health data or personal data that is not needed in the conversation.
- Form protection (Google reCAPTCHA): device and browser signals and IP addresses are processed by Google to distinguish people from automated programs when a form is submitted.
- Ad measurement (Google Ads): the Google Ads tag writes no advertising cookies before you consent, but technical visit data (IP address, browser type) and the ad click identifier (gclid) may be received by Google to measure whether a submitted form came from our ads. We do not use it for retargeting or personal profiles.
- Safeguards: the AI assistant and reCAPTCHA are covered by the same Cloud Data Processing Addendum as email (Google as processor); ad measurement is subject to Google Ads data protection terms. The transfer basis is adequate and binding safeguards (GR 33/2026 Article 165(2)).
- Your choices: advertising cookies can be refused or withdrawn through "Cookie Settings" on the website; instead of the AI assistant and the contact form, you can reach us through the contacts in section 9. Details are in the Website Privacy Policy (adievia.co.id/en/privacy/website/).
Third-party resources in the browser. Some product and website pages may load fonts, maps, icons, or weather data directly from third-party providers (including Google Fonts, Google Maps, and OpenStreetMap). When that happens your browser connects to that provider's server — which may be outside Indonesia — and sends your IP address and browser type; we send no other data through those resources.
Other than as described in this section, there is no transfer of Personal Data outside Indonesia. If one arises in the future, it will be carried out in accordance with PDP Law Article 56 and GR 33/2026, and notified in advance.
6. Storage & retention
Data is kept for as long as needed for the purposes above and as required, then deleted, destroyed, or anonymised. Main retention periods:
| Data | Retention |
|---|---|
| Medical records and patient data (we as processor) | As instructed by the healthcare facility and under medical records rules (Permenkes 24/2022) |
| Other product service data | As set by the product privacy policy and the healthcare facility's instructions |
| Company financial documents, contracts, and invoices | 10 years after the end of the financial year |
| Employment data | For the duration of employment, then 10 years after the end of its last financial year |
| Security logs of COS Adievia and the website (login sessions, login attempts, IP addresses) | At most 12 months |
| Email delivery logs of COS Adievia | 24 months |
| Audit trail of actions in COS Adievia and the website | 10 years |
| Contact forms and demo requests from the website — on the website and in COS Adievia, with our replies | 24 months from receipt |
| AI assistant conversations on the website | 12 months from the last conversation |
| WhatsApp conversations with Adievia, including photos (COS Adievia) | 12 months from the last message in the conversation |
| WhatsApp gateway technical archive (encrypted) | Raw data of received messages: 30 days; records of incoming and outgoing messages: 90 days |
| Website user accounts (demo access) | Deleted 24 months after last login, or sooner on request |
| Database backups | COS Adievia: 14 days on the server, encrypted off-server copies at most 30 days; website: 90 days in Google Cloud storage, Jakarta |
Scheduled destruction of the logs, AI assistant conversations, WhatsApp conversations, and gateway archive above is not notified individually; the periods are announced through this policy. Contact form senders and website account holders are notified by email before and after their data is destroyed. Full details are in the Personal Data Retention & Destruction Policy.
7. Security
We apply reasonable technical & organisational measures: encryption in transit (TLS 1.2/1.3); AES-256 encryption at rest (Google Cloud default); role-based access control (RBAC); authentication & MFA; password hashing (bcrypt or argon2id); audit logs; login attempt limits; and encrypted backups in Indonesia.
8. Your rights as a data subject (PDP Law Articles 5–13)
You have the right to: obtain information about & access to your data; correct/update your data; delete or end processing within the limits allowed by law; withdraw consent; object to certain automated decision-making; obtain a copy of your data; and file objections/claim compensation.
Note: for data whose Controller is a healthcare facility, some requests will be forwarded to/coordinated with the facility concerned.
9. How to contact us
Requests concerning personal data can be sent to privasi@adievia.co.id (PT Adievia Medika Teknologi, BTN Puri Asri Estate Blok Taman Lembah Permai No. 15, Desa Polewali, Kec. Gantarang, Kab. Bulukumba, South Sulawesi 92561, phone +62 812-4278-0123). We respond within 3×24 hours of receiving the request (GR 33/2026 Articles 71, 77, 92, and 99), after the requester's identity is verified.
10. Data breaches
If a personal data protection failure occurs, we run our internal incident response procedure: notifying the Controller/Data Subjects and the authority under the PDP Law and GR 33/2026 Article 114 (within 3×24 hours at the latest).
11. Changes to this policy
This policy may be updated; the latest version is published at https://adievia.co.id/privacy/ (ID) and https://adievia.co.id/en/privacy/ (EN) with its effective date.
Change history
Changes in 1.6 (20 Oct 2026): photos in WhatsApp conversations with Adievia — photos you send to our business WhatsApp number (for example screenshots of a problem) are now downloaded and stored in COS Adievia together with the conversation, for the same retention period; staff open them only when needed and every opening is logged. Documents, voice messages, and videos are still not downloaded. Also stated is what has been running since version 1.5: WhatsApp usernames and the WhatsApp account identifier for senders who hide their number; opening WhatsApp messages from our staff, only to numbers you entered yourself in a website form; and copies of website form submissions in COS Adievia, where staff read and answer them. The website ops console, discontinued on 23 September 2026, is removed from the retention table. Employment data is now managed in COS Adievia, with the NIK and bank account number encrypted.
Changes in 1.5 (14 Sep 2026): WhatsApp conversations with Adievia — messages to PT Adievia's business WhatsApp number (for example from the chat button on the website) are now answered by staff from COS Adievia; the data processed, the transfer to Meta, automatic replies, and retention periods are described. The retention period of our WhatsApp gateway archive is stated. The content of Adievia Praktik operational alerts to staff is described as the system has worked since 13 September 2026: without error message excerpts.
Changes in 1.4 (13 Sep 2026): transfers of personal data outside Indonesia are listed in full with their purpose, safeguards, and risks (GR 33/2026 Article 164) — email managed by Google Workspace, third-party services on the website (AI assistant, reCAPTCHA, ad measurement), and third-party resources loaded by the browser; the WhatsApp transfer basis is moved in line with GR 33/2026 and the content of operational alerts via WhatsApp is stated; the scope is clarified to cover company operations and the website; legitimate interests are named as a basis; the data location of installations at healthcare facilities is stated; retention periods per data category are listed; and the response deadline for requests becomes 3×24 hours (not working hours).
Changes in 1.3 (10 Sep 2026): the electronic document signing service, formerly offered as a separate product, was discontinued and removed from the scope of this policy. This policy now covers Adievia HMS and Adievia Praktik.
Changes in 1.2 (8 Sep 2026): the role of that signing service as an "anchor ledger" inside both products was withdrawn — the anchor receiver module was removed and its database schema dropped.
Changes in 1.1: the scope was clarified to cover all PT Adievia products, and the Data location & transfers section was written as it is — WhatsApp notifications in Adievia Praktik are indeed processed by Meta outside Indonesia. Version 1.0 stated there were no transfers abroad at all.
Adopted in Bulukumba on 20 October 2026 by Sudarman, S.T., Director of PT Adievia Medika Teknologi, with a certified electronic signature (VIDA).