Privacy Policy

JagaHealth (operated by PT Spark Lexicon Innovalley, hereinafter "JagaHealth", "we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our telemedicine platform and related services.

This Policy is governed by and compliant with: • Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (PDP Law) • Peraturan Pemerintah No. 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik • Permenkes No. 24 Tahun 2022 tentang Rekam Medis • Permenkes No. 20 Tahun 2019 tentang Penyelenggaraan Pelayanan Telemedicine • Kebijakan dan standar interoperabilitas Platform SatuSehat (Kemenkes RI)

By using JagaHealth, you consent to the data practices described in this Policy.

We collect the following categories of data:

2.1 Personal Identity Data Name, date of birth, gender, NIK (Nomor Induk Kependudukan), email address, phone number, and profile photo.

2.2 Health & Medical Data Medical history, diagnoses, prescriptions, vital signs (blood pressure, heart rate, temperature, oxygen saturation), lab results, SOAP notes, and any information shared during consultations.

2.3 Usage Data Device type, operating system, IP address, app usage logs, session duration, and feature interactions.

2.4 Communication Data Content of video consultations (stored only where clinically required), chat messages, and support inquiries.

2.5 Payment Data Transaction ID and payment method type. Full card/account details are processed by our certified payment gateway and are not stored on JagaHealth servers.

We use your data solely for the following purposes:

• Facilitating doctor-patient telemedicine consultations • Generating and managing digital medical records and prescriptions • Synchronizing health data with Platform SatuSehat as required by Kemenkes RI • Processing pharmaceutical orders via the integrated online pharmacy • Sending appointment reminders, health updates, and service notifications • Improving platform safety, performance, and clinical quality • Complying with legal obligations and regulatory reporting • Fraud detection and platform security

We do not use your health data for marketing profiling or sell it to third parties.

We may share your data with the following parties:

4.1 Healthcare Providers Licensed doctors, nurses, and allied health professionals on the JagaHealth platform who are directly involved in your care.

4.2 Partner Facilities Hospitals and clinics that are part of the JagaHealth partner network, strictly for care coordination.

4.3 SatuSehat Platform As required by Permenkes No. 24 Tahun 2022, relevant medical record data may be transmitted to the national SatuSehat health data platform operated by Kemenkes RI.

4.4 Regulated Third-Party Processors Cloud infrastructure providers, payment processors, and analytics tools — all bound by data processing agreements compliant with Indonesian data protection law.

4.5 Legal Obligations We may disclose data to competent authorities where required by law, court order, or to protect public health and safety.

We will never sell your personal or health data to advertisers or data brokers.

JagaHealth employs industry-standard and healthcare-grade security measures:

• AES-256 encryption for data at rest • TLS 1.3 for all data in transit • Role-based access control (RBAC) for healthcare staff • Multi-factor authentication for provider accounts • Regular security audits and penetration testing • Data stored on servers located within the territory of Indonesia in compliance with applicable regulations

Despite our best efforts, no system is completely immune to security breaches. We will notify affected users and relevant authorities promptly in the event of a data breach, in accordance with UU PDP.

Under UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi, you have the right to:

• Access — Request a copy of your personal and health data held by JagaHealth • Rectification — Request correction of inaccurate or incomplete data • Erasure — Request deletion of your data, subject to legal medical record retention requirements (minimum 5 years under Permenkes No. 24/2022) • Restriction — Request limitation on processing of your data • Portability — Receive your data in a structured, machine-readable format • Objection — Object to processing for purposes other than direct care • Withdraw Consent — Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, contact us at: admin@jagahealth.com

We retain your data for the following periods:

• Medical records: Minimum 5 (five) years from the date of the last service, as required by Permenkes No. 24 Tahun 2022 • Account data: Duration of active account plus 2 (two) years after account closure • Transaction records: 5 (five) years for financial and audit compliance • Usage logs: 12 (twelve) months for security and performance purposes

After retention periods expire, data is securely deleted or anonymized.

JagaHealth services are primarily designed for users aged 18 and above. Minors may use the platform only with explicit parental or guardian consent and under their supervision. We do not knowingly collect data from children under 13 without verifiable parental consent.

We may update this Privacy Policy periodically to reflect changes in law, technology, or our services. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect. Continued use of JagaHealth after notification constitutes acceptance of the updated Policy.

For privacy-related inquiries, data subject requests, or to reach our Data Protection Officer:

PT Spark Lexicon Innovalley Email: admin@jagahealth.com General: admin@jagahealth.com Phone: +62-821-406-2635 Address: Yogyakarta, Indonesia