Patient Privacy

At Heartology Cardiovascular Hospital, we prioritize the confidentiality and security of your health data as part of our commitment to high-quality care.

This page explains:

• What information we collect during the care process.
• How we use and protect your personal data.
• Your rights as a patient regarding access to, updates to, or requests to delete your data (in accordance with applicable laws).

This policy refers to patient data protection under Indonesia's Health Law (Undang-Undang Kesehatan) and international standards.

At Heartology Cardiovascular Hospital, we collect various types of information to ensure you receive safe and personalized care. The data we process includes:

1. Personal Identity Data
   • Full name, address, date of birth, and contact details (phone/email).
   • Official identification number (national identity card/KTP, passport) or health insurance number.
   • Demographic data (gender, age, preferred language).
2. Health Information and Medical Records
   • Medical history, diagnoses, test results (lab, ECG, MRI, etc.).
   • Treatment records, prescriptions, surgery reports, and medical procedures.
   • Allergies, chronic conditions, or relevant family history.
3. Administrative and Payment Data
   • Insurance information (policy, member number, claims).
   • Payment details (bank account, credit card, if applicable).
   • Transaction records for services provided.
4. Digital Interaction Data
   • Website visit history (IP address, cookies) when you use online services.
   • Records of communication via email/chat (for example: appointment confirmations).
   • Feedback or patient satisfaction surveys.

Important Note!

• We only collect the data that is necessary for medical, administrative, or legal purposes.
• Sensitive information (such as religion or genetic data) is processed only with your explicit consent, unless required by law.

At Heartology Cardiovascular Hospital, the information you provide is used responsibly for the following purposes:

1. For Health Care Services
   • Providing accurate diagnosis, care, and treatment
   • Coordinating among the specialist doctors on your care team
   • Sending test results and medical reports
   • Providing emergency services when needed
2. For Hospital Administration
   • Patient registration and identity verification
   • Billing and health insurance claims
   • Electronic medical record keeping
   • Sending appointment reminders
3. For Service Quality Improvement
   • Evaluating and developing the quality of our services
   • Training medical staff (with anonymized data)
   • Medical research (only with the patient's written consent)
4. For Legal and Regulatory Purposes
   • Meeting obligations to report certain diseases
   • Investigating complaints or medical issues
   • Complying with lawful court requests
5. For Health Communication and Education (With Consent)
   • Sending newsletters and health information
   • Invitations to disease prevention programs
   • Patient satisfaction surveys

Our Data Use Principles:

1. Data Minimization: Only the information that is necessary is used
2. Clear Purpose: Data is not used beyond medical and legal purposes
3. Anonymization: Identities in data used for research are always kept confidential
4. Consent: Use beyond direct care requires the patient's permission

At Heartology Cardiovascular Hospital, we apply the highest security standards to protect your health and personal information:

1. Electronic Security Systems
   • Data storage with high-level encryption (AES-256 standard)
   • Firewall and intrusion detection systems running 24/7 to prevent unauthorized access
   • Two-factor authentication for medical staff accessing sensitive data
   • Routine monitoring for suspicious activity in the system
2. Physical Access Control
   • Server areas and medical archives with restricted access and CCTV surveillance
   • Mandatory identification cards for all staff who handle patient data
   • A digital logbook recording every access to medical records
3. Confidentiality Protocols
   • Confidentiality agreements (NDAs) required for all staff and partners
   • Need-to-know principle: data is shared only as needed for care
   • Regular training on data privacy for all employees
4. Special Data Protection
   • Data anonymization for research purposes
   • System separation between medical data and financial administration
   • Separate storage for highly sensitive information (such as psychiatric or genetic data)
5. Disaster Recovery
   • Daily data backups on separate servers in a secure location
   • An emergency response plan for recovering data if an incident occurs
   • Routine testing of backup systems every 3 months
6. Partners and Service Providers
   • Strict audits of vendors that handle patient data
   • Data protection agreements in all partnerships
   • Security verification of integrated third-party systems

Steps Patients Can Take:

1. Keep your medical record number and online account password confidential.
2. Report it immediately if you receive suspicious communications claiming to come from Heartology Cardiovascular Hospital.
3. Verify the identity of staff before providing sensitive information.

At Heartology Cardiovascular Hospital, the confidentiality of patient data is a top priority. We share your health information with outside parties only in clear and limited situations, while continuing to comply with applicable data protection regulations.

1. When Do We Share Information?
   • For Medical & Care Purposes
     • Referral Doctors/Specialists: Only information relevant to your care
     • Partner Laboratories/Hospitals: Test results or medical reports that are needed
     • Pharmacies: Prescriptions so your medication can be filled
   • For Health Administration
     • Insurance Companies: Claims for treatment costs (according to policy coverage)
   • For Legal Compliance
     • Government Agencies: When required by law (for example: reporting certain diseases)
     • Law Enforcement: Based on an official request from the authorities
   • For Service Improvement
     • Health Technology Vendors: EMR (Electronic Medical Record) system providers bound by strict confidentiality agreements
     • Medical Researchers: Anonymized data for health studies (only with the patient's written consent)
2. Principles We Apply
   1. Data Minimization: Only information that is truly necessary is shared.
   2. Confidentiality Agreements: All third parties are required to sign an NDA (Non-Disclosure Agreement).
   3. Periodic Audits: Ensuring third parties meet our data security standards.
   4. Patient Consent: For use beyond direct care, unless required by law.
3. Patient Control Rights
   • You have the right to:
     1. Request a list of third parties that access your data.
     2. Give or withdraw consent to data sharing (except for legal compliance).
     3. Report any inappropriate use of data that you find.
4. Examples of Situations in Which We Will Not Share Information
   • Commercial marketing purposes (without express permission).
   • Requests from family/friends without official authorization.
   • Complete medical record data without a clear medical purpose

At Heartology Cardiovascular Hospital, we recognize and respect your rights over the health and personal data we manage. In accordance with applicable data protection regulations, these are the rights you can exercise:

1. Right of Access
   • Patients have the right to:
     • Request a copy of the medical records and personal data we hold
     • Know the purpose of use, the recipients, and the data retention period
     • Receive an explanation of medical terms they do not understand
2. Right to Correction
   • Patients have the right to:
     • Update inaccurate or incomplete data (for example: address, phone number)
     • Complete relevant medical information (for example: the latest allergy history)
3. Right to Deletion
   • Patients have the right to request deletion of their data when:
     • The data is no longer needed for the purpose for which it was originally collected
     • You withdraw your consent (and there is no other legal basis)
     • The data is processed unlawfully
4. Right to Restriction of Processing
   • Patients may request that the use of their data be restricted when:
     • The accuracy of the data is disputed and is being verified
     • The processing is unlawful, but you do not want the data deleted
     • We no longer need the data, but you need it for legal purposes
5. Right to Data Portability
   • You can receive your data in a digital format that is structured and machine-readable
   • You can transfer the data to another health care provider
6. Right to Object to Processing
   • Patients have the right to:
     • Object to the use of their data for direct marketing
     • Question processing based on our legitimate interests
7. Right Not to Be Subject to Automated Decisions
   • You have the right to request human intervention in important decisions (such as automated diagnoses)
   • You can express your views and appeal against such decisions

How to Exercise These Rights:

1. Request Form: Available from Customer Service or on the website
2. Identity Verification: To prevent unauthorized access
3. Free of Charge: No administrative fee is charged*
4. Response Time: A maximum of 30 days for complex requests

* Except for repeated or excessive requests

If Your Rights Are Not Fulfilled

You can:

1. File a complaint with Heartology's Data Protection Officer
2. Report to the Ministry of Health or the Data Protection Commission
3. File a lawsuit in accordance with applicable regulations

At Heartology Cardiovascular Hospital, we use digital technology to improve your experience when accessing our health services online. Here is a full explanation of our practices:

1. Types of Cookies We Use
   • Essential Cookies
     • Enable basic website functions
     • Example: Keeping you logged in during your visit
     • Cannot be turned off without affecting the user experience
   • Preference Cookies
     • Store your choices (language, font size)
     • Allow the website display to be personalized
   • Analytics Cookies
     • Analyze visit patterns (frequently opened pages)
     • Measure the effectiveness of our health content
     • Use a trusted service (Google Analytics)
   • Marketing Cookies
     • Activated only with your explicit consent
     • Show information relevant to health needs
2. Other Tracking Technologies
   • Tracking Pixels
     • Measure the effectiveness of digital health campaigns
     • Example: Understanding the impact of articles on heart disease prevention
   • Heatmaps
     • Analyze how users interact with the website
     • Used to improve the layout of health information
   • Server Logs
     • Record IP addresses for system security
     • Kept for a maximum of 30 days
3. Benefits of Using These Technologies
   • Speeding up page loading times
   • Tailoring health content to visitors' needs
   • Improving the security of our online systems
   • Optimizing the health information we provide
4. Your Control and Choices: You have full control over:
   • Initial consent: A cookie notice banner when you first visit
   • Preference settings: Can be changed at any time through the settings panel
   • Blocking: Through your browser settings.
5. Data Protection
   • All tracking data is encrypted
   • Not used to identify individuals
   • Not directly linked to patient medical records
6. Policy for Third-Party Services
   • Google Analytics: Uses IP address anonymization
   • Meta Pixel: Activated only with consent
   • Analytics tools: Cross-tracking features are turned off
7. Policy Changes: This policy may be updated as technology develops. Changes will:
   • Be clearly displayed on this page
   • Be announced through a dedicated banner
   • Take patient feedback into account

Heartology Cardiovascular Hospital may update this Privacy Policy from time to time to adapt to:

1. Reasons for Policy Updates
   • Developments in data protection regulations, such as Law No. 27 of 2022 on Personal Data Protection (UU PDP) and health regulations
   • Improvements to our services and digital technology
   • Input from patients and stakeholders
   • Changes in best practices in the digital health industry
2. Types of Changes That May Be Made
   • Minor changes: Adjustments to wording or technical explanations
   • Substantive changes: Adding types of data collected or new processing purposes
   • Legal changes: Adjustments to new regulations
3. How We Inform You of Changes
   • Clear notification on our website with the latest version and date
   • Announcement banner specifically for important changes
   • Notification email for registered patients (if the changes are significant)
   • Renewed consent required for fundamental changes in data processing
4. Implementation Timeline
   • Minor changes: Effective immediately upon publication
   • Major changes: A 14-day transition period after the announcement
   • Legal changes: In accordance with the applicable regulations
5. How to Track Changes
   • Policy version with the revision date in the document footer
   • Change history available for comparing versions
   • Highlighted changes for important revisions
6. Patient Rights Regarding Changes
   • The right to be consulted on substantive changes
   • The right to request an explanation of the impact of changes
   • The right to withdraw consent if you do not agree with the changes
   • The right to access previous versions within a certain period
7. Contact for Questions
   • Our Data Protection Team is ready to help:
     • Email: [KONFIRMASI: alamat email Tim Perlindungan Data; di situs lama tersamarkan, kemungkinan info@heartology.id]
     • Phone: 1500 258
     • Dedicated contact form on the website

Heartology Cardiovascular Hospital takes the protection of your privacy very seriously. If you have questions, concerns, or reports related to how personal data is managed, our team is ready to help through the following channels:

1. Data Protection Officer
   • Email: [KONFIRMASI: alamat email Petugas Perlindungan Data; di situs lama tersamarkan, kemungkinan info@heartology.id
   • Phone: 1500 258
   • Operating Hours: Monday to Friday, 08.00 to 17.00 WIB
   • Responsibilities:
     • Handling data access or correction requests
     • Receiving reports of privacy violations
     • Explaining the privacy policy
2. Complaint Handling Procedure
   • Submission: Submit your complaint through an official channel
   • Verification: The team will verify your identity
   • Initial Response: Within 3 business days
   • Resolution: A maximum of 30 days for complex cases
3. Information to Include
   • Full name and medical record number (if any)
   • A clear description of the privacy issue
   • Date/time of the incident (for data breaches)
   • Supporting documents (screenshots, emails, etc.)
4. Alternative Reporting Options (If you are not satisfied with our response, you can contact:)
   • Personal Data Protection Commission: (www.kpdp.go.id)
   • Ministry of Health: (1500-567) [KONFIRMASI]
   • IDEA (Association of Medical Specialists): (www.idea.or.id)
5. Communication Security
   • Email Encryption: Use the subject “[PRIVASI]” for priority handling
   • Secret Code: Can be requested for sensitive communications
   • Official Confirmation: All responses will include a ticket number