PRIVACY AND PERSONAL DATA PROTECTION POLICY

This Privacy and Personal Data Protection Policy (the “Policy”) sets out how PT Affinity Health Indonesia and Graha Sehat hospital (“we”) process and protect the personal information you provide to us. If we ask you to provide certain information that can be used to identify you, you can be assured that it will only be used in accordance with this Policy.

This Policy is issued to all our direct clients and/or prospective clients, employees, and suppliers of goods and/or services, and serves as our personal data protection notice.

 

1. Consent

This Policy serves to inform you that your Personal Data (as defined below) is being processed by us or on our behalf. We may process your Personal Data in accordance with this Policy if you have given your consent or if we rely on any legal basis available under applicable laws.

 

2. Description of Personal Data

We may process various information and/or data about you (“Personal Data”), including but not limited to your name, date of birth, race, religion, gender, company name, Indonesian identity card number, nationality, biometric information, genetic information, email address, address, contact numbers, credit card details, bank account details, health information, data concerning minors, food preferences, allergies, photographs, occupation, education, marital status, video recordings, CCTV images, medical records, health data and information, confidential personal health data, and any other Personal Data of yours that we subsequently collect from you.

 

3. Purposes

Your Personal Data is being or will be collected and further processed for the following purposes:

1. carrying out our pre-contractual activities and contractual obligations with you, and ensuring that you fulfil your pre-contractual and contractual obligations to us;
2. ensuring that you continue to receive medical care;
3. contacting you if your appointment date changes;
4. managing medical records and medical reports;
5. facilitating patient-related payment processes;
6. reporting Personal Data to relevant regulatory bodies and/or third parties under applicable laws, including laws governing the healthcare industry and personal data protection;
7. sharing Personal Data with our parent company group and related companies, within and/or outside Indonesia, in accordance with applicable laws;
8. conducting research, analysis, and development;
9. marketing and advertising purposes and surveys;
10. facilitating the personal needs of overseas patients, such as visa applications;
11. handling and responding to requests, enquiries, complaints, and legal matters;
12. facilitating human resource management activities relating to employees;
13. submitting and registering relevant forms and obtaining permits from competent authorities and/or relevant third parties under laws applicable to the healthcare industry;
14. education and training, using anonymised data where possible;
15. assessing creditworthiness and processing any payments relevant to you;
16. insurance, third-party administration, and other relevant third-party purposes;
17. exercising our contractual and legal rights and/or obtaining professional or legal advice;
18. internal records management;
19. carrying out internal activities such as evaluating marketing effectiveness, surveys and market research, trend analysis, statistical compilation, reporting, audits, compliance, risk management, and data analysis to improve our services;
20. complying with any legal or regulatory requirements, such as audits and/or requests from regulatory bodies;
21. conducting debt recovery procedures against customers who default on payments;
22. providing and improving our products and/or services, advertising, and providing you with information, such as events, offers, or promotions, relating to us, our products and/or services, our related companies, and our business partners, including but not limited to sending you electronic newsletters, marketing promotional materials, seasonal or birthday greetings and messages, gifts, and/or vouchers;
23. managing and enforcing your commercial transactions with us;
24. providing you with access to, and monitoring your use of, any online platforms, mobile applications, or websites owned, operated, or managed by us or on our behalf (“Platforms”), and administering and managing those Platforms; and/or
25. other purposes authorised by you, or directly related or incidental to the purposes stated above.

(collectively referred to as the “Purposes”).

 

4. Sources of Personal Data

Your Personal Data is being or will be collected:

1. directly from you or your representative when you or your representative complete forms to register for our products and/or services, including online forms at our facilities; contact us by email, letter, or telephone; or participate in customer surveys and promotions or marketing activities;
2. when you enquire about or use our products, services, or events, including but not limited to your use of our Platforms, through the Platforms and/or cookies;
3. from any information or documents you submit or provide to us for any of the Purposes, such as your identity card, passport, payslips, and/or bank statements, including but not limited to questionnaires or survey forms;
4. from third parties connected with you, such as your employer or prospective employer, agents, insurers, and other healthcare providers or facilities;
5. from other sources that you have authorised to disclose information relating to you;
6. from events;
7. from CCTV recordings;
8. from audio or video recordings;
9. from doctors’ letters;
10. from medical reports or records;
11. from any other Personal Data we subsequently collect from you; and
12. from any other information you may provide to us from time to time.

5. Providing Access, Correcting Errors or Inaccuracies, and Restricting the Processing of Personal Data

Under applicable laws, you have the right, among others, to receive information about identity, the legal basis, purposes and use of Personal Data, and the accountability of PT Affinity Health Indonesia; request access to and obtain a copy of your Personal Data; request that your Personal Data be completed, corrected, and/or updated; and contact us with any questions or complaints concerning your Personal Data. This includes available choices and methods for restricting the processing of your Personal Data, stopping and/or postponing its processing, or deleting and/or destroying it. You may exercise these rights by contacting us using the following details and submitting a written request:

For RS Graha Sehat

Attention: Hospital President Director

Address: c/o RS Graha Sehat, Jl. Panglima Sudirman No.2 Kraksaan, Probolinggo, Jawa Timur 67282

Telephone: +62 31 5993211 / 33003211

Email: pdp.rsps@rsd-health.id

 

a. Subject to applicable legal restrictions, contractual requirements, and a reasonable period of time granted to us, you have the right to withdraw or amend, in whole or in part, your previously given consent to the use of your Personal Data.

b. Depending on your request, there may be circumstances in which we refuse to comply with a request for access to data or correction of errors or inaccuracies. We will notify you in writing of our refusal and the reasons for it.

c. We may also require a Personal Data requester who is not the Personal Data subject to provide a consent form from the data subject authorising us and providing assurance that we may disclose or correct errors or inaccuracies in the Personal Data.

 

6. Mandatory Personal Data

You are required to provide us with the details marked with an asterisk (*) or stated as mandatory in our forms (collectively referred to as “Mandatory Personal Data”).

 

7. Consequences of Refusing or Failing to Provide Personal Data

If you refuse or fail to provide any Mandatory Personal Data, or restrict our processing of your Personal Data, this may result in the following consequences, for which we will not be responsible:

1. the parties being unable to formalise any contracts and/or agreements, facilitate the provision of our services, or employ personnel;
2. our being unable to maintain any existing relationship between you and us, provide the requested services and/or products, or continue to fulfil any contractual obligations owed to you, where applicable;
3. our being unable to inform you of our latest services and/or products and/or updated appointment dates;
4. our being unable to complete transactions relating to our products and/or services;
5. our being unable to comply with applicable laws, regulations, directives, court orders, guidelines, and/or codes that apply to us; and/or
6. termination of any arrangements, agreements, or contracts between you and us.

 

8. Disclosure of Personal Data

To the extent permitted by applicable laws, we may disclose your Personal Data to the following parties:

1. other entities within the CAH Medical Centres Group, formerly known as Ramsay Sime Darby Health Care, and our related companies, within and/or outside Indonesia, in accordance with applicable laws;
2. our medical specialists or consultants who treat patients at our hospitals;
3. insurance companies;
4. banks, financial institutions, and credit or debit card issuers for payment processing;
5. credit checking companies;
6. debt collection agents for recovering debts owed to us;
7. your employer;
8. your next of kin, personal contacts, or emergency contacts, as notified to us from time to time;
9. research organisations;
10. social welfare organisations;
11. medical and healthcare professionals;
12. external partners where a patient is transferred to a government hospital or another private hospital;
13. parents or guardians of minors;
14. service providers, suppliers, agents, contractors, and vendors who process data for us;
15. laboratories and diagnostic service providers that may operate outside the control of the private hospital environment;
16. data centres hosting hospital data;
17. external lawyers;
18. external auditors and accountants;
19. government bodies, their agencies, and other related organisations;
20. regulatory and/or statutory bodies, including the SATU SEHAT (One Health) platform;
21. accreditation bodies; and
22. any third party requested or authorised by you for any of the Purposes.

Our third-party data processors are required to process your Personal Data in accordance with the principles prescribed by us and/or applicable laws. They are also responsible for securing your Personal Data at an appropriate level of security in accordance with applicable data protection laws and accepted industry standards.

 

9. Protection of Personal Data

Your Personal Data will be stored and processed securely by us. We are committed to implementing safeguards and administrative procedures to prevent unlawful processing and the accidental loss, destruction, or damage of your Personal Data. Access to your Personal Data is restricted and granted only to relevant users for the performance of their duties or otherwise in accordance with this Policy.

 

10. Third-Party Personal Data

We may request your assistance when Personal Data relating to other individuals, such as your next of kin, is needed to process your Personal Data for the Purposes, and you agree to use your best efforts to assist us when required. If you provide any third party’s personal data to us, you must ensure that the third party has read this Policy and consented to our processing of their personal data for any of the Purposes before providing that personal data to us.

 

11. Transfer of Personal Data Outside Indonesia

To the extent permitted by applicable laws, we may transfer your Personal Data to a location outside Indonesia in accordance with this Policy.  

 

12. Accuracy of Your Personal Data

We will verify your Personal Data directly to ensure its accuracy, completeness, and consistency. You are responsible for ensuring that the information you provide to us is accurate, complete, not misleading, and kept up to date.

 

13. Processing and Retention Period

We will process and retain your Personal Data for as long as necessary to fulfil our purposes set out in Section 3 above, in accordance with our obligations under applicable laws and regulations.

After the retention period, your Personal Data will be deleted or anonymised so that it may be used for analytical purposes.

 

14. Personal Data of Minors and Others

For Personal Data relating to (i) an individual under 21 years of age or who is unmarried (a “Minor”), please note that consent from the Minor’s parents and/or guardian is required; and (ii) an individual with a disability (a “Person with a Disability”), please note that we require consent from that Person with a Disability and/or their guardian. Where applicable, you confirm that you are authorised to act on behalf of the Minor or Person with a Disability described above and consent, on their behalf, to the processing, including disclosure and transfer, of their Personal Data in accordance with this Policy. We may process your Personal Data, other than the Personal Data of the Minor or Person with a Disability, in accordance with this Policy if you have given your consent or if we rely on any legal basis available under applicable laws.

 

15. Changes to this Policy

We may amend this Policy from time to time as necessary, for example to comply with changes in business operations, laws, or regulations, and to provide our products and/or services to you.

We will notify you of any changes to this Policy through a notice on our Platforms or other appropriate means, such as updating this page. You should check this page from time to time to ensure that you remain informed of any changes. By continuing to use our products or services, communicating with us, accessing or using any of our Platforms, and/or indicating your agreement by ticking a box specifically provided for any changes to Personal Data processing, after being notified of any changes to this Policy, you will be deemed to have agreed to those changes.

 

VERSION DATED JUNE 2024