Privacy Policy
Effective from [TO FILL: date]
Draft — this text is still under review and may change.
This policy explains what personal data SoulMed (Solo Medical & Wellness Tourism) collects through the SoulMed app and the soulmed.id website, what it is used for, who it is shared with, how long it is kept, and what your rights are. It is written with reference to Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
1. Who we are
SoulMed is operated by [TO FILL: legal entity], of [TO FILL: address] ("we"). For privacy questions, contact [TO FILL: privacy email].
2. Data we collect
| Data | Source | When |
|---|---|---|
| Name, email address, profile photo | Your Google account | When you sign in with Google |
| Phone number | You enter it | On your first order, or in Profile |
| Language | You choose it | When you change it in Profile |
| Orders: package, add-ons, head count, total, payment status | Your orders | When you order and pay |
| Payment data: method, Virtual Account number, status | AiYO Bills (payment provider) | When you pay |
We do not receive your Google password, and we do not store your card or bank account details. We do not use your data for advertising, and there are no advertising trackers in the app or on the website.
You can browse the directory (hotels, attractions, food, health, transport, news, packages) without signing in. We only ask you to sign in to order or to see your order history.
3. What the data is used for
- Creating and managing your account.
- Processing your orders and payments.
- Sending confirmation emails and service vouchers.
- Contacting you to arrange your travel and service schedule.
- Meeting legal obligations, including financial and tax records.
4. Who the data is shared with
- Service partners (for example a hotel or a therapy provider) who deliver the add-ons in your order. Partners receive your name, email, phone number and order details, and only for paid orders.
- AiYO Bills, the payment provider, to create and process your invoice.
- Google, only for signing in with Google.
- Our infrastructure providers (servers, file storage and email), who process data on our behalf.
- Competent authorities, where the law requires it.
5. How long data is kept
- Account data is kept while your account is active.
- If you delete your account, your name, email, photo, phone number and Google sign-in link are erased.
- Paid orders are kept, with the contact details recorded on them, for [TO FILL: 10 years, as tax record-keeping requires], for financial, tax and dispute purposes. Only our internal team can access them.
6. Your rights
You have the right to access, correct and ask for the deletion of your personal data, and to withdraw consent. You can change your phone number and language yourself in Profile. To delete your account, see Delete Account. For anything else, contact [TO FILL: privacy email]. We respond within [TO FILL: period, for example 3 × 24 hours under the PDP Law].
7. Security
- Data travels over encrypted connections (HTTPS).
- In the app, your session is kept in the device's secure storage (Keychain on iOS, Keystore on Android).
- Access to order data in our systems is limited by role.
8. Children
SoulMed's ordering service is for users aged [TO FILL: minimum age, for example 18] and over.
9. Changes to this policy
If this policy changes, we update its effective date on this page. For significant changes, we also tell you in the app or by email.