website privacy.

This policy details how PT ADIEVIA MEDIKA TEKNOLOGI ("Adievia", "we") processes personal data on the adievia.co.id website as controller. It complements the company Privacy Policy; where the two differ, the provision that gives you greater protection applies. The Indonesian version at /privacy/website/ is the binding text.

This policy does not apply to patients of hospitals using Adievia HMS — patient data is governed by each hospital's privacy policy — nor to patients and users of the Adievia Praktik application, which is governed by the Adievia Praktik Privacy Policy.

Changes in 1.8 (19 Sep 2026). Demo and trial-space access length and the request limit per email are now set by our team and stated in your link email, within fixed bounds: access of at most 240 minutes and at most 10 requests per email per day. The adv_demo and adv_coba cookies last as long as that access.

Changes in 1.7 (18 Sep 2026). The Adievia Praktik trial space (coba.adievia.co.id) no longer opens directly: access is requested at /demo/praktik (in Indonesian) and granted through a single-use link emailed to you, as for the HMS demo. Added: trial-space request data and the adv_coba cookie (30 minutes).

Changes in 1.6 (18 Sep 2026). Added the history of Google Analytics, which ran on this site in June–July 2026 (see [06]); earlier versions did not mention it. Clicking "Accept" on the cookie banner now only permits ad conversion measurement — ad personalisation consent (ad_personalization), which was previously also sent to Google, is now always denied, in line with the promise that advertising cookies are not used for retargeting.

Changes in 1.5 (14 Sep 2026). The WhatsApp button on the site now leads to PT Adievia's business WhatsApp number (+62 851-9092-9289), which our team answers from COS Adievia. Added: WhatsApp conversation data, automatic replies, the transfer to Meta, and retention periods, following the company Privacy Policy v1.5.

Changes in 1.4 (13 Sep 2026). The HMS demo and patient portal no longer open directly: access is requested at /en/demo/access and granted through a single-use link emailed to you. Added: access request data, access records in our internal system, and the adv_demo cookie. Since 14 Sep 2026 demo access and that cookie last 10 minutes (previously 20 minutes).

Changes in 1.3 (13 Sep 2026). Version 1.2 wrongly stated that website data never leaves Indonesia, that IP addresses are hashed after 24 hours, and that the contact form accepts attachments; the AI assistant and demo access accounts were not mentioned. All of this has been rewritten to match the running system. Retention periods per data type are now listed, and the response deadline for requests is 3×24 hours.

[01] Scope

• Visitors to adievia.co.id
• Contact form senders at /en/contact and demo access requesters at /en/demo/access
• Users of the HMS demo (demosimrs.adievia.co.id) and patient portal demo (demoweb.adievia.co.id), including institution registrants inside the demo
• Demo access account holders at /en/register and /en/login
• Users of the "AVI" AI assistant in the corner of the page
• People who message our business WhatsApp number through the WhatsApp button on the site

[02] Data we collect

Data you provide

• Contact form: name, email, hospital/organisation name, position, subject, and message. The form does not accept attachments.
• Demo access request: name, email, institution name and type, and position, purpose of trying the demo, and WhatsApp number if you provide them.
• Institution registration inside the HMS demo: name, email, phone number, institution name, position, hospital type, number of beds, province and city, and the purpose of trying the demo.
• Demo access account: name, email, phone number, institution, position, and password (stored as a bcrypt hash, never in plain form). If you choose "Continue with Google", we receive your name, email, account ID, and profile photo link from Google — no password.
• AI assistant: the messages you type and the assistant's answers.
• WhatsApp conversations: if you message our business WhatsApp number — your WhatsApp number, WhatsApp profile name, text message content, and its time. We do not download photos, documents, or voice messages; only their type is recorded. Please do not send patient data or health data via WhatsApp.

Data collected automatically

• IP address and browser type (user agent) — stored with forms, AI assistant conversations, and login sessions, for security and spam prevention.
• reCAPTCHA score when a contact form, demo access request, or account registration is submitted.
• Demo access records in COS Adievia, our internal system on Google Cloud Jakarta: a fingerprint of your email (a cryptographic function output — not the address), a masked hint (first letter and email domain), institution name, request number, and when the link was issued, opened, ended, or revoked. Used for the daily limit of requests per email and one active access per email — both counted per product — and for blocking abuse.
• Ad click identifier (gclid) if you arrive from one of our Google ads (see [06]).
• Aggregate visit statistics — pages, referrers, country, device type — through Umami, which we run ourselves on our server, without cookies and without storing IP addresses.

What we do not collect

Google Analytics (see its history in [06]), Facebook Pixel, TikTok Pixel, retargeting pixels, precise location, biometric data, or cross-site personal profiles.

[03] How we use data, and on what basis

• Responding to enquiries, demo requests, and proposals — legitimate interests and pre-contractual steps at your request.
• Providing demo access — access links at your request as a pre-contractual step; demo access accounts as performance of a contract (Terms of Service). Per-email limits and abuse blocking — legitimate interests.
• WhatsApp conversations — replying to the messages you send; first messages and messages outside service hours (Mon–Fri 08:00–17:00 WITA) receive an automatic reply with a link to the privacy policy — legitimate interests.
• AI assistant — answering your questions; transcripts are read by our team to follow up on questions and improve answers — legitimate interests.
• Security and spam prevention (IP address, reCAPTCHA, login sessions) — legitimate interests.
• Measuring ad effectiveness — advertising cookies with your consent; gclid on legitimate interests (see [06]).
• Legal compliance where required by regulation or requested by a competent authority.

What we do not do: sell data, automated profiling, retargeting, or newsletters without consent.

[04] Storage, security, and retention

• The website database runs on a server in Google Cloud's Jakarta region, encrypted at rest (Google Cloud default), with TLS-encrypted connections.
• Access is limited to authorised Adievia staff, through an internal console with company Google account login.
• Daily backups: 14 days on the server and 90 days in Google Cloud Storage, Jakarta region.

Before your form or account is destroyed because its retention period has ended, we notify you by email at the recorded address no later than 3×24 hours beforehand, and again afterwards. AI assistant conversations contain no contact details, so their destruction is not notified individually; the period is announced on this page. WhatsApp conversations are also destroyed without individual notice; the period is announced on this page and in the company Privacy Policy linked in the first automatic reply.

[05] Your rights

Under Law No. 27 of 2022 on Personal Data Protection, you have the right to obtain information about and access to your data together with a copy, to correct it, to request deletion or restriction of processing, to withdraw consent, to object to fully automated decisions, and to file objections or claim compensation.

How: email privasi@adievia.co.id with the subject "PDP Request". We respond within 3×24 hours of receiving the request, after your identity is verified.

[06] Cookies and tracking tags

• Essential cookies — Google reCAPTCHA Enterprise (_GRECAPTCHA) to distinguish people from automated programs on the contact form, demo access request, and account registration.
• Demo access cookie adv_demo — essential. Set for the adievia.co.id domain when you open a demo access link. It holds only an access number and an expiry signed by our server — no name or email — and expires with your access (at most 240 minutes). The demo cannot open without it, so it does not depend on your advertising cookie choice.
• Trial-space cookie adv_coba — essential. Set only for coba.adievia.co.id when you open an Adievia Praktik trial-space link, and never sent to other sites. It holds only an access number, the product, and an expiry signed by our server — no name or email — and expires with your access (at most 240 minutes).
• Advertising cookies — only after explicit consent. Google Ads conversion tracking (gtag.js, ID AW-18192112136, cookies _gcl_au / _gcl_aw) to measure whether a submitted form came from a click on one of our Google Ads campaigns. The script loads on every visit in Consent Mode v2 with all storage denied: before you click "Accept", no advertising cookie is written and ad identifiers are redacted, but the tag may still send cookieless signals (IP address, browser type, page) to Google for modelled measurement. The conversion event is sent once, when a contact form is submitted successfully. We do not use it for retargeting, personal profiling, or cross-site audience building.
• Google Click ID (gclid) — cookieless ad measurement. If you arrive by clicking a Google ad, the URL carries a gclid. We store that value in your browser's localStorage for at most 90 days, and if you then submit the contact form it is saved with the form data. Its only purpose is to upload conversion counts back to Google Ads so we know which ads produce prospects. A gclid identifies an ad click, not you across sites. It does not depend on your cookie choice — if you object, clear this site's data in your browser, or ask us to remove it from our form records via privasi@adievia.co.id.
• localStorage — theme (dark/light) and language preferences, stored in your browser and never sent to our server. The AI assistant keeps a conversation identifier in sessionStorage, which is cleared when the tab closes.

History: Google Analytics, June–July 2026. From 5 June 2026 until July 2026 this site also loaded Google Analytics 4 (ID G-TZHH97L72H) in the same Consent Mode: before you clicked "Accept", only cookieless signals were sent; afterwards the _ga cookie was written. That data — pages viewed, approximate country and city, and device type — is still held as reports in our Google Analytics account. Since July 2026 this site no longer sends data to Google Analytics. If you still have a _ga cookie from that period, choosing "Reject" clears it (best effort).

Changing your choice: click "Cookie Settings" in the footer to bring the banner back. Choosing "Reject" clears any stored _gcl_* cookies (best effort) and returns advertising storage to denied.

Additional options: set ad preferences at Google Ad Settings, or install an ad blocker. These choices do not prevent you from submitting the contact form.

[07] Third parties and transfers outside Indonesia

Google Workspace, Vertex AI, and reCAPTCHA are bound by the Cloud Data Processing Addendum as our processors: processing only on our instructions, incident notification, and deletion after the service ends. The WhatsApp Business Platform is bound by the WhatsApp Business Data Processing Terms and Data Security Terms as our processor. Ad measurement is subject to Google Ads data protection terms. The transfer basis is adequate and binding safeguards (GR 33/2026 Article 165(2)). The main risk is access by authorities in the recipient country; we mitigate it by limiting the data sent, two-factor authentication on company accounts, and asking you not to write health data in AI assistant conversations. Details are in section 5 of the company Privacy Policy.

[08] Privacy contact

• Email: privasi@adievia.co.id (subject: PDP Request)
• Phone: +62 812-4278-0123
• WhatsApp: +62 851-9092-9289
• Address: PT Adievia Medika Teknologi, BTN Puri Asri Estate Blok Taman Lembah Permai No. 15, Desa Polewali, Kec. Gantarang, Kab. Bulukumba, South Sulawesi 92561

[09] Changes to this policy

Changes are listed on this page with their effective date. Changes that reduce your protection are announced on this page at least 30 days before they take effect, and notified by email to form senders of the last 12 months.

[10] Jurisdiction

This policy is governed by the laws of the Republic of Indonesia, in particular UU 27/2022 and GR 33/2026. Disputes are resolved at the Bulukumba District Court.