Elska Skin Clinic Interim Privacy Notice

1. Who we are

The personal data controller is Elska Skin Clinic, operated by CV Tiga Pilar Mustika (NIB 9120005361116). Its registered address is Ruko Sentra Niaga Puri Indah Blok T6 No. 19, Kembangan Selatan, Kembangan, West Jakarta Administrative City, DKI Jakarta Province 11610.

We run two clinics:

• Elska Skin Clinic Puri Indah — Rukan Puri Niaga 2, Jl. Puri Kencana Blok J-1 No. 2-X, RT.5/RW.2, Kembangan Selatan, West Jakarta 11610;
• Elska Skin Clinic Kelapa Gading — Rukan Artha Gading, Jl. Boulevard Artha Gading No. 20 Blok B, Kelapa Gading Barat, North Jakarta 14240.

Contact: [email protected] or each clinic's official WhatsApp number shown on the site.

2. Data we process

• Website data: pages visited, time of visit, referral source, device and browser type, approximate location and cookie identifiers (see section 3).
• WhatsApp data: your name and WhatsApp number, the clinic you choose, and the content of your conversation with us.
• Clinic data: registration, payment and medical record data.
• Health data: skin or hair concerns, the treatment you ask about or choose, medical history, clinical photos and medical records. This is specific personal data (Art. 4(2) PDP Law), which we protect with extra care. Data of patients under 18 is provided and consented to by a parent or guardian.

3. Cookies and analytics

When you visit this website, Google Analytics cookies load through Google's tagging tools. We use them to count visits and understand which pages are viewed. Analytics data is processed by Google, including outside Indonesia.

How to opt out of analytics:

• block or delete cookies in your browser settings; or
• install Google's Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout), available for desktop browsers.

If you play a YouTube video or open Google Maps from this website, Google may process your data under its own policy.

4. Booking via WhatsApp

The booking button opens WhatsApp to the official number of the clinic you choose, with a generic pre-filled message. That message contains no health data. Data you send on WhatsApp is processed by Elska Skin Clinic and WhatsApp (Meta). Your messages may include health information, such as the treatment or skin concern you mention, and we treat this as specific personal data. Please don't send photos or detailed medical information until our medical team asks.

5. Purposes and legal bases

• Scheduling and confirming bookings and answering questions: at your request, to provide the service you ask for.
• Consultations, treatments and medical records: to provide healthcare and to comply with legal obligations. Where the law requires explicit consent for health data, we ask for it in writing or in a recorded form.
• Website analytics: our legitimate interest in understanding and improving the website (Art. 20(2)(f) PDP Law). You can opt out as described in section 3.

We do not sell your personal data. We do not send health data or medical records to analytics services.

6. Third parties

We share data only as needed with WhatsApp (Meta Platforms) for messaging, Google (Google Analytics and related Google tagging tools) for website analytics, our website hosting provider, our clinic-system and payment providers, and competent authorities where the law requires it.

7. Transfers outside Indonesia

Google and Meta (WhatsApp) process or store data on servers outside Indonesia, including in the United States. Under Article 56 of the PDP Law, we make sure the destination country offers equal or higher protection. If it does not, adequate and binding safeguards must be in place, such as data protection terms in the provider's agreement. If neither applies, we ask for your consent.

8. Storage and retention

We keep personal data for as long as necessary for the purposes of processing and in accordance with applicable laws and regulations, including the rules on retention of medical records. Analytics data is kept under the retention setting we configure in Google Analytics. Booking conversations are kept for as long as needed to manage your booking and questions. When data is no longer needed, it is destroyed or anonymised.

9. Security and data breaches

We apply reasonable technical and organisational measures to protect your data. Our medical staff must keep patient health information confidential. If a personal data protection failure occurs, we will notify you and the personal data protection authority in writing within 3 x 24 hours (Art. 46 PDP Law).

10. Your rights

Under the PDP Law you have the right to:

• information about how your data is processed;
• access and a copy of your data;
• correct your data;
• end processing, or delete or destroy your data, except data we must keep by law, such as medical records;
• withdraw consent;
• delay or restrict processing;
• transfer your data to another controller where technically feasible;
• sue and receive compensation for violations.

Make a request at [email protected], through the clinic's official WhatsApp, or in person at the clinic. We may ask you to verify your identity. We will respond within the timeframes set by the PDP Law.

11. Changes and contact

This interim notice will be replaced by our full Privacy Policy. Its effective date appears at the top. Send questions or complaints about personal data to [email protected], through the clinic's official WhatsApp, or by post to CV Tiga Pilar Mustika, Ruko Sentra Niaga Puri Indah Blok T6 No. 19, Kembangan Selatan, Kembangan, West Jakarta 11610.