A. Definition

Each of the following words or terms used in the Terms and Conditions of this Privacy Policy shall have the following meanings below, unless the word or term in question in its usage expressly provides otherwise:

1. Personal Identity Data ("Personal Data") of Customers means any and all personal data and health data of the Customer that the Customer agrees to provide by the Customer or to Prodia, including but not limited to name, date of birth, gender, religion, education, address, telephone number, email, marital status, occupation, ethnicity, ID card number/other identity, photo, or other information as well as documents and other data as requested on the account registration form or health information including any and all health data of the Customer in the medical record including health condition, medication, allergy, vaccination, immunization, action, medical history, prescription, report, recommendation and other medical information or health condition. Customer data is certain individual data that is stored, maintained, and kept correct and protected confidential. Personal data protection is one of the human rights that is part of personal self-protection. The Customer Data which is mine is an integral part of the Medical Record owned by Prodia, where the provision of Medical Record has been regulated in the Regulation of the Minister of Health Number 24 of 2022 on Medical Records issued by the Minister of Health officially, to ensure that the process of Health service runs optimally.
2. Customer is the party who obtains health service in Prodia
3. Prodia is a company that organizes business activities in the field of promotive, preventive, curative, and rehabilitative healthcare services for Customers
4. Medical Record is a document containing data on the Customer's identity, examination, treatment, actions and other services provided to the Customer.
5. "SATUSEHAT" is a platform or service system for data integration and interoperability between Health Service Facilities connected to PeduliLindungi and organized by the Ministry of Health.
6. Customer Financial Data ("Financial Data") Includes billing information such as Customer's bank account number, insurance member number, credit card number, and other information used by Customer in the transaction process with Prodia.
7. Operational data, whether provided by Customer and/or Prodia, includes Customer's name and password, purchases or orders made by Customer, preferences, feedback, survey responses, reviews and comments on the website or through the application, transaction data that occurs in the service including data when Customer will register, log in application, reservation, payment, review, and others (not limited to any and/or all Customer interactions in using the Service).
8. Customer Technical Data ("Technical Data") includes Technical information, including the internet protocol address (IP address) used by the cell phone or other equipment to access Prodia's Services, log-in information, type and version of operating system, time zone, location, and Customer visit information, including the Services and services seen or used, response time, and customer interaction information.
9. Customer Medical Data ("Medical Data") is the data generated from the Customer and Prodia's services or the result of interaction and communication between the Customer and the Health Professionals at Prodia. This Medical Data includes but is not limited to height and weight information, or disease history information including pre-diagnosis results, consultation results in the form of medical records or laboratory results.

B. General Provisions

Customers understand that Prodia is an authorized Health facility, which can provide services as a Health facility in accordance with its license. And for the Examination conducted by customer, customer understand that Prodia requires customer data in conducting the Examination process and all services (until examination results are complete), both Personal Data and Medical Information data related to customer health condition based on the assessment and screening conducted previously by the Nurse/Doctor.

Medical Information will be collected by Prodia and subsequently provided to medical experts, doctors, or geneticists and/or other parties appointed by Prodia.

By signing this Consent Form customers give consent to Prodia to disclose Medical information to medical experts, doctors, or geneticists and/or other parties appointed by Prodia (Domestic/Overseas)*, to be used for the purpose of examination, treatment, medication of customers, (education or research)** in accordance with the provisions stipulated in this Consent Form.

* Examinations that are referred within and outside the country will be informed by Prodia's staff.

C. Examination Result

Customers understand that the result of Customer Examination is part of Prodia's Medical Record, and will treat it confidentially whereby customer guarantee that the result of Customer Examination will only be received by Customer or Customer authorized attorney and will treat the result confidentially. Customer are fully responsible and release Prodia and/or its subsidiaries from all claims and losses upon the disclosure of Confidential Information in the result of the examination due to my misuse or negligence.

Customers hereby agree to the disclosure of medical records by Prodia and understand all risks arising in accordance with the prevailing laws and regulations.

D. Customer Data Disclosure

Customer understands and agrees that Customer Data and Medical Information are confidential Personal data. In addition, Customer is also aware of the provisions of the regulations governing the protection of personal data that Customer data can be disclosed based on the applicable laws and regulations.

E. Type of Data Stored

1. Personal Identity Data ("Personal Data") of Customers
2. Customer Financial Data ("Financial Data")
3. Operational data, whether provided by Customer and/or Prodia
4. Customer Technical Data ("Technical Data")
5. Customer Medical Data ("Medical Data")

F. Legal Basis of Terms and Conditions Privacy Policy

1. Law No. 27 of 2022 on Personal Data Protection
2. Minister of Health Regulation Number 24 Year 2022 on Medical Records
3. Minister of Health Regulation No. 36of 2012 on Medical Secrets
4. Government Regulation Number 10 of 1966 onCompulsory Keeping of Medical Secrets

G. Responsibility for Storage and Ownership of Medical Data

1. The identity, diagnosis, disease history, examination history and treatment history of the Customer must be kept confidential by doctors, health workers, management officers and leaders of health facility organizers.
2. The contents of the medical record belong to the Customer.
3. The opening of medical recordsin the form of an explanation of the contents of the Customer's medical record by the doctor, without giving the medical record.
4. The Customer agrees that all information and Customer Medical Data, including some information classified as medical secrets and medical records based on the prevailing laws and regulations in the Republic of Indonesia, will be stored and/or processed by Prodia. All such information and Medical Data will be stored and processed by prioritizing the principle of confidentiality in accordance with the prevailing laws and regulations.
5. Prodia guarantees the confidentiality of the CustomerMedical Data and will not disclose the Medical Data to any party, unless otherwise stipulated in accordance with the laws and regulations for the following matters:
1. In the interest of Customer's health.
2. Fulfill law enforcement requests in the case of law enforcement in court orders.
3. Customer's own request and/or consent.
4. Requests from agencies/institutions based on statutory provisions.
5. Educational research interests and medical audits, without mentioning the Customer's identity.
6. For corporate customers, a request for a copy of customer ID card number is used or the billing process.

H. Customer Data Security

1. Prodia will protect and ensure the security of theCustomer Personal Data processed.
2. Prodia will maintainthe confidentiality of the Customer Personal Data processed.
3. Prodia will supervise all parties involved in the processing of Customer Personal Data.
4. Prodia will protect against unlawful Personal Data processing.

I. Disclosure of Customer Data

1. In the event that Prodia is required to disclose Customer Data based on statutory regulations including but not limited to the request of the Ministry of Health of the Republic of Indonesia for use in the SATUSEHAT platform, Prodia guarantees that it will only provide Customer data information according to the type of data requested as well as the purpose and in a lawful manner in accordance with applicable laws and regulations.
2. Prodia has no obligation for the confidentiality of Customer Data, in the event that
   1. it is already known by the public,
   2. it is known by Prodia from other parties without any breach of confidentiality
   3. it is required by the prevailing laws and regulations
   4. it is required by legal process.
3. In order to maximize the quality and optimal service experience, Prodia is entitled to the accurate and true information of the Customer. If there is any inaccuracy and untruth on the data provided by the Customer, then it is entirely the responsibility of the Customer and Prodia in this case is free from any compensation, risk or claim arising from the Customer and any party in relation to the inaccuracy and untruth of the data received by Prodia.

J. Customer Rights as Data Owner

After the Customer fulfills the necessary requirements in accordance with applicable laws and regulations, the Customer is entitled:

1. Obtain information about the clarity of identity, the basis of legal interests, the purpose of the Customer's data request for Personal Data.
2. Complete, update, and/or correct errors and/or inaccuracies in Customer Personal Data.
3. Obtain access to and copies of Customer Personal Data in accordance with the provisions of laws and regulations.
4. End the processing, delete and/or destroy Customer Personal Data in accordance with the provisions of laws and regulations.
5. Withdraw the consent to the processing of Customer's Personal Data that has been given to Prodia.
6. Object to decision-making actions based solely on automated processing, including profiling, that give rise to legal consequences or have a significant impact on the Customer.
7. Delay or restrict the processing of Customer Personal Data.
8. Customer Rights Point 2 to Point 7 shall be submitted by the Customer through a registered request submitted electronically or non-electronically to Prodia.
9. Customer has the right to obtain information on Prodia's health services delivered through Prodia's channels (Phone, SMS WhatsApp, Email, and other Prodia's Service Communication Media) but not limited to information and/or regulations on health services to the extent permitted by the applicable law in the Republic of Indonesia.

K. Prodia's Rights as Data Manager

1. Prodia has the right to ensure the accuracy of Customer Personal Data by conducting verification.
2. Prodia may update and/or correct any errors in Customer Personal Data.
3. Prodia reserves the right to record all processes related to the processing of Customer Personal data.
4. Prodia refuses to provide access to any changes made to Customer Data in relation to the following matters:
   1. Changes that endanger the safety and health of the Customer and/or other persons;
   2. Changes that result in the disclosure of other parties' Data; and/or
   3. Changes that are contrary to the national defense and security.
5. Prodia has the right to stop the processing of Personal Data in the event that Customer withdraws the consent to the processing of Personal Data with the provisions stipulated in the laws and regulations.
6. Prodia has the right to postpone and restrict the processing of Personal Data either partially or in accordance with the provisions stipulated in the laws and regulations.
7. Prodia has the right to terminate the processing of Customer Data if:
   1. The relevant retention period has been exceeded;
   2. The relevant purpose has been achieved; and/or;
   3. Requested by Customer with conditions.
8. Prodia has the right to delete Personal Data in the following cases:
   1. delete Personal Data;
   2. the Customer has withdrawn consent to the processing of Personal Data;
   3. if there is a request for from the Customer;
   4. Personal Data obtained and/or processed by unlawful means.
9. Prodia may destroy the Personal Data in the following cases:
   1. It has expired its retention period and is authorized to be destroyed based on the archive retention schedule;
   2. There is a request from the Customer;
   3. Not related to the settlement of legal process of a case; and/or;
   4. The Customer Data is obtained and/or processed in an unlawful manner.
10. Prodia may change or delete the terms and conditions of this data privacy policy at any time which will be informed by Prodia to the Customer from time to time. In the event of any change or deletion of the terms and conditions of this data privacy policy, the Customer will give his/her consent to the latest version of the terms and conditions of the data privacy policy when the Customer uses Prodia's Services after the change or deletion occurs.
11. Prodia has the right to limit or stop the Customer from using Prodia's Services if any suspicious activity of the Customer is found, such as violating the provisions in the Terms and Conditions, data privacy policy, or the prevailing laws and regulations.
12. Prodia has the right to use third party service providers to provide services involving data processing, for reference checks, professional advice (including legal, accounting, financial and business consulting), technology, website, research, data processing, insurance, forensics, marketing, and security services. In order to avoid misuse of Customer data, Prodia and third parties may enter into confidentiality agreements to maintain the confidentiality and security of Customer data.
13. Prodia has the right to disclose Personal Data if necessary, such as disclosing Customer's personal information for law enforcement and legal needs, executing other agreements, or to protect the rights and security of Prodia and Customer.
14. Prodia has the right to provide the data of health examination result of the Customer's Employee who is appointed to perform health service examination in Prodia's branches, this is done as stipulated in the cooperation agreement agreed by the Parties.
15. Prodia may give access to the Customer to their Personal Data along with the track record of the Personal Data processing in accordance with the retention period of the Personal Subject Data, Prodia shall provide access no later than 3 x 24 (three times twenty-four) hours since Prodia receives the request for access in a recorded manner and evaluated by Prodia.
16. Prodia may perform data update, termination of personal data processing, data correction, data deletion with a maximum time of 3x24 (three times twenty-four) hours.

L. Transmission of Customer Data to Parties Located Outside the Indonesian Territory

Prodia may transfer personal data to third parties both within and outside the country. Such action may be carried out after obtaining the consent from the Customer. If the Customer's data will be transferred outside the territory of Indonesia, the destination country must have at least the same standard of personal data protection as Indonesia, unless there is a contract between the data controller and the data recipient outside the territory of Indonesia and there is an international agreement between countries.

M. Privacy Data Retention Period

The data retention of Electronic Medical Record in Prodia is conducted for a minimum of 25 (twenty five) years since the date of the Customer's last visit in accordance with the prevailing regulations.

N. Kontak Prodia

If you have any questions, requests or complaints related to the data privacy and or data security policy, please contact Prodia by sending an e-mail to info@prodia.co.id.