Skip to content
Book AppointmentBookPolicy ContactEmergency HelpEmergency

Site Information and Policies

All Hearts App Privacy Policy

This policy explains how the All Hearts app collects, uses, and protects your personal and health data.

Effective since
Updated

1. Introduction

Welcome to the All Hearts app, the official app of Heartology Cardiovascular Hospital ("Heartology", "we"). All Hearts is designed to make it easier for patients to register online, receive a digital queue number, and follow their queue progress in real time.

We are committed to maintaining the confidentiality, integrity, and security of all your Personal Data and Health Data in accordance with:

  • Law No. 27 of 2022 on Personal Data Protection (the "PDP Law")
  • The Medical Practice Law
  • Minister of Health Regulations on Medical Records and Health Information Systems
  • The Indonesian Code of Medical Ethics and medical confidentiality standards

This Privacy Policy explains how we collect, use, process, store, and protect Personal Data through the All Hearts app.

By using this app, you confirm that you have read, understood, and agreed to this Privacy Policy.

2. Personal Data We Collect

We may collect the following Personal Data:

A. Identity Data

  • Full name
  • Medical Record Number (MRN)
  • Date of birth
  • Sex
  • National ID (KTP) number (if required for verification)

B. Contact Data

  • Phone number
  • Email
  • Address (optional)

C. Health Data

Connected to the Teramedics Hospital Information System (HIS):

  • MRN and visit history
  • Attending doctor
  • Service schedule
  • Destination clinic

(Note: the app does NOT display clinical medical records or other sensitive medical data without specific authorization.)

D. App Usage Data

  • App activity logs
  • Access times
  • Device and operating system

E. Location Data (optional)

  • If you turn on the location feature to estimate your distance to the hospital.

F. Notification Data

  • Push notification tokens (Firebase/Apple Push).

We process data on the basis of:

  1. The user's explicit consent
  2. The provision of health services and patient administration
  3. The hospital's legal obligations
  4. Legitimate interests relating to operations, security, and service improvement

4. Purposes of Processing

Your data is used for:

  1. Online registration and doctor appointment scheduling
  2. Issuing digital queue numbers
  3. Real-time queue progress monitoring
  4. Schedule reminders and queue progress notifications
  5. Identity matching with the Teramedics HIS (MRN linking)
  6. Preventing duplicate patient records
  7. Improving service quality and app security

We do not use your data for:

  • Third-party advertising
  • Selling data
  • Automated profiling without consent

5. Integration with the Teramedics HIS

The app synchronizes with the hospital system to:

  • Verify your MRN
  • Retrieve doctor schedules
  • Record visit registrations
  • Display digital queue numbers

Access takes place through encrypted internal API connections.

When you create an account, you give consent to:

  • Processing of your identity
  • Processing of your patient administration data
  • Sending notifications
  • MRN data integration

You may withdraw your consent at any time through the "Privacy" menu or by contacting the DPO (see the final section).

7. Sharing Data with Third Parties

Heartology may share data with:

A. Third-Party Data Processors (Data Processors)

  • App IT vendors
  • Cloud server providers
  • Push notification providers

They are bound by:

  • A non-disclosure agreement (NDA)
  • A Data Processing Agreement (DPA)
  • A prohibition on using data outside Heartology's instructions

B. Regulators

Where required by law:

  • The Ministry of Health
  • Law enforcement authorities on the basis of a valid court order

No Sale of Data

Heartology does not sell, trade, or distribute patient data.

8. Cookies and Tracking Technologies

Where used:

  • Crash analytics
  • Performance tracking

No form of tracking serves advertising purposes; tracking is used only to improve the quality of the app.

9. Notifications and Communication

You will receive:

  • Schedule reminders
  • Queue progress information
  • Service updates (optional)

You can turn off notifications at any time in your device settings.

10. Data Security

We apply:

  • Encryption of data in transit (HTTPS/TLS 1.2+)
  • Encryption of data at rest
  • Role-based access control (RBAC)
  • Internal audit logs
  • Firewall and WAF
  • Regular security testing
  • Incident handling in accordance with the PDP Law

11. Data Retention

A. Patient Administration Data

Follows medical record regulations: at least 5 years after the last visit.

B. App Activity Data

Kept for a maximum of 24 months.

Data will be deleted or anonymized when the retention period ends.

12. User Rights (PDP Law)

You have the right to:

  1. Access your data
  2. Correct inaccurate data
  3. Delete data (right to erasure)
  4. Withdraw consent
  5. Restrict processing
  6. Object
  7. Request a copy of your data (data portability)
  8. File a complaint with Heartology or a regulator

Requests can be submitted to the DPO.

13. Data Transfers Outside Indonesia

If data is ever processed using servers or vendors outside Indonesia:

  • You will be informed in advance
  • Processing remains subject to a DPA and international security standards

Our servers are currently located in Indonesia.

14. Changes to This Privacy Policy

Heartology may update this policy at any time.

Significant changes will be announced through the app.

15. Contacting the Data Protection Officer (DPO)

Data Protection Officer (DPO)
Heartology Cardiovascular Hospital
Jl. Birah III No. 4, Rawa Barat, Kebayoran Baru,
South Jakarta, DKI Jakarta 12180, Indonesia
Email: dpo@heartology.id
Phone: 1500-258

Questions about a Policy or Your Data?

Send your question through Heartology's official contact. Mention the policy you are asking about so your question reaches the right team.

info@heartology.idHeartology general contact
Back to top