Who we are and what this notice covers
Orvie is operated by DeepVertex Healthcare Technology, a healthcare technology company based in Jakarta, Indonesia. For the personal data described in this notice, DeepVertex Healthcare Technology acts as the controller (Pengendali Data Pribadi) under Law No. 27 of 2022 on Personal Data Protection (UU PDP).
Where a hospital or clinic uses the workspace under its own authority, that organisation may be a separate controller for the care it provides. Its own privacy notice then also applies, and we identify the organisation in your account, your appointment or our agreement with it.
This notice covers the website, the clinical workspace, device data ingestion and the emails we send about accounts and security. It does not cover third-party services we link to, including Google sign-in and Jitsi video rooms, which have their own notices.
We provide software, not emergency care. If you need urgent medical help, call 119 or 112, or go to the nearest emergency department.
Privacy contact: privacy@deepvertex.tech. Our data protection officer can be reached through the same address. Postal enquiries: DeepVertex Healthcare Technology, Jakarta, Indonesia.
Personal data we collect
We collect only the data needed to run a clinical workspace. Health data is specific personal data under Article 4 of the UU PDP and receives additional protection. The table below describes the categories, examples and sources.
| Category | Examples | Source |
|---|---|---|
| Account and authentication | Name, email address, password hash, email-verification status, role and account status, last sign-in, one-time code attempts, linked Google account identifier | You; our systems; Google if you choose Google sign-in |
| Profile and contact | Date of birth, gender, phone number, blood type, address and emergency contact. For doctors: licence number, specialty, hospital, experience and biography. For administrators: organisation and administrator tier | You; your clinic; administrators who create accounts |
| Clinical record | Appointment reason, severity and notes; consultation summary, diagnosis, treatment, examination findings, SOAP notes, laboratory results, imaging references, prescriptions and medication orders | You; treating doctors and nurses |
| Device and vital signs | Device identifier (MAC address), label, model and vendor; heart rate, blood pressure, oxygen saturation, temperature, glucose, weight, BMI, respiration, fetal heart rate, CTG and ECG waveforms, activity and sleep; reading time and raw payload | You; paired devices; clinic devices |
| Appointments and teleconsultation | Time, duration, status, meeting-room link and consultation status | You; your clinician |
| Questionnaires | Answers and calculated scores | You |
| Family and caregiver links | Name, email address, relationship and invitation status of a person you invite | You; the invited person |
| Correspondence | Emails and attachments you send to our privacy, security or support addresses | You |
| Audit and security logs | Actor, action, record or entity, IP address, user agent and timestamp | Our systems |
| Preferences | Language, theme and senior-mode setting | You, stored in your browser |
What we do not collect. We do not ask for your NIK, insurance membership number, payment-card details, biometric templates or genetic data. We do not use advertising identifiers, and the product contains no advertising or analytics trackers. If this changes, we will update this notice before the change takes effect.
Where the data comes from. Most of it comes from you, from the clinicians who record your care and from devices you or your clinic pair with the workspace. Clinic administrators may create an account for you; in that case the clinic is responsible for telling you that it has done so and for the accuracy of what it enters.
Why we process personal data
Article 20 of the UU PDP requires a lawful basis for every processing operation. We map each purpose to one or more of the bases in that article, and we do not use health data for advertising, marketing profiles or sale.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and verify your account, sign you in, reset your password and send one-time codes | Account and authentication | Contract, Article 20(2)(b); consent at registration, Article 20(2)(a) |
| Operate the clinical workspace: appointments, records, prescriptions, orders, laboratory results and questionnaires | Profile, clinical record, appointments | Explicit consent for health data, Article 20(2)(a); healthcare provision and vital interests, Article 20(2)(d); contract |
| Display and analyse device and vital-sign readings, including early-warning scores | Device and vital signs | Explicit consent; healthcare provision and vital interests |
| Host video consultations | Appointments and teleconsultation | Contract; healthcare provision |
| Let a family member or caregiver you invite read your record | Clinical record; family links | Your explicit consent; the caregiver’s own account data by contract |
| Verify clinicians and administrators, approve doctor accounts and manage hospital-scoped access | Profile, doctor licence data, account | Contract; legal obligation; legitimate interests in safe operation |
| Keep the service secure, prevent abuse and investigate incidents | Audit and security logs | Legal obligation, Articles 31 and 35–39; legitimate interests, Article 20(2)(f) |
| Keep medical records for the statutory period and respond to lawful requests | Clinical record; audit logs | Legal obligation, Article 20(2)(c), including Permenkes No. 24 of 2022 on medical records |
| Send service messages about security, changes and your account | Account | Contract; legal obligation |
Automated decisions. We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects. Early-warning scores are decision support: a clinician reviews the reading and makes every clinical decision. You may still object to automated decision-making under Article 10 of the UU PDP.
Marketing. We do not send marketing email today. If we introduce it, we will ask for separate consent first and will not bundle it with the consent you give for care.
Our legal bases
Indonesian law does not create a free-standing “healthcare” basis. Where care requires processing without consent, we rely on the protection of your vital interests under Article 20(2)(d) and on our legal obligations. Consent remains the primary basis for optional processing, and it must be explicit for health data.
- Consent. We ask separately for consent to process health data and to use the clinical workspace. We explain the purpose, the data, the retention period and your rights before you agree, as Articles 21 and 22 require. Consent is recorded with the document version, time and technical evidence, so we can show proof under Article 24. You may withdraw it at any time.
- Contract. We process account and service data to create your account, deliver the workspace and support you, as Article 20(2)(b) permits.
- Healthcare provision and vital interests. Clinicians need your record to treat you. Where consent is not the right basis, we limit processing to what is necessary to protect your health or another person’s vital interests.
- Legal obligation. Medical-records law, tax and accounting rules, and lawful requests from authorities require us to keep or disclose certain data. We disclose only what the request legally requires.
- Legitimate interests. We process security logs and account metadata to keep the service safe and reliable, weighing our interest against your rights. You may object to this processing.
If we need to use data for a new purpose, we tell you before the change and ask for consent where the law requires it. We do not sell personal data, and we do not use it to build advertising profiles.
Transfers outside Indonesia
Our primary application and database are operated on infrastructure we control in Indonesia. Some service providers may process data outside Indonesia: Google (Google LLC) if you use Google sign-in, Jitsi (8x8, Inc.) when you join a video consultation, and our email delivery provider.
Article 56 of the UU PDP allows a transfer only if the destination has an equivalent or higher level of protection, or if adequate and binding safeguards are in place, or — where neither applies — with your consent. Before relying on a transfer, we assess the provider, the data it receives and the safeguard available. We record the assessment in our transfer register.
A transfer does not change your rights under this notice. You can ask us which safeguard applies to a particular provider by writing to privacy@deepvertex.tech. Video consultation data is sent to Jitsi only when you choose to join a room; if you do not join, no consultation media leaves the workspace.
How long we keep personal data
We keep personal data only as long as we need it or as long as the law requires. Medical records must be kept for at least 25 years under Permenkes No. 24 of 2022 on medical records, which is longer than a patient account normally lives.
| Data | Retention | Why |
|---|---|---|
| Account, profile and preferences | While the account is active, then 30 days after closure | Operate the account; allow reversal of an accidental closure |
| Verification codes | Valid for 10 minutes; rows purged within 30 days | Sign-in and verification; security investigations |
| Clinical record, prescriptions, orders and laboratory results | At least 25 years from the last entry | Medical-records law; continuity of care; legal claims |
| Appointments and teleconsultation metadata | At least 25 years as part of the medical record | Care history; medical-records law |
| Device and vital-sign readings | At least 25 years; raw device payloads for 5 years | Clinical history; device troubleshooting and safety |
| Questionnaire responses | At least 25 years | Part of the clinical record |
| Audit logs | At least 25 years | Accountability, security and medical-records obligations |
| Consent records | At least 25 years after the last care | Proof of consent under Article 24 |
| Correspondence with privacy and security | 5 years | Resolve requests and demonstrate compliance |
| Backups | Up to 30 days, rolling | Recovery after an incident |
Retention starts from the last entry or the relevant event. When a period ends we delete or anonymise the data; where deletion from a backup is not technically possible, we isolate the backup and let it age out. A legal hold suspends deletion while a claim, investigation or regulatory request is open.
We do not delete records that medical-records law requires us to keep, even if you close your account. In that case we restrict access to the record and keep it only for the statutory purpose.
Your rights
The UU PDP gives you the following rights. They are free to exercise, and we will not treat you differently for using them.
- Access and a copy (Articles 7 and 32). You can ask what we hold about you and receive a copy. We respond within 3 x 24 hours of a verified request.
- Correction (Articles 6 and 30). You can correct inaccurate or incomplete data. Identity and contact data are corrected directly; clinical entries are corrected by an addendum that preserves the original record, as medical-records practice requires. We respond within 3 x 24 hours.
- Erasure (Articles 8 and 43). You can ask us to delete data we no longer need. We act within 14 days unless a legal retention duty or a legal hold applies. Where we cannot delete, we explain why and restrict processing instead.
- Restriction (Articles 11 and 41). You can ask us to pause or limit processing while a question about accuracy or lawfulness is resolved. We act within 3 x 24 hours.
- Portability (Article 13). You can receive your data in a structured, commonly used, machine-readable format and ask us to transmit it to another controller where technically feasible. We provide JSON and PDF within 30 days.
- Objection to automated decisions (Article 10). We do not make solely automated decisions with legal or similarly significant effects, but you may object to any automated processing used in your care. Early-warning scores are reviewed by a clinician.
- Withdrawal of consent (Articles 9 and 40). You can withdraw consent at any time. We stop the processing that relied on it within 3 x 24 hours, except where another legal basis or a retention duty applies. Withdrawal does not affect processing that happened before it, and it may mean we can no longer provide part of the service.
- Compensation and legal action (Article 12). You can seek compensation for unlawful processing and bring a claim before the competent court.
How to exercise a right. Email privacy@deepvertex.tech with the subject “Data rights request” and tell us which right you are exercising. We verify your identity before acting; for an authorised representative we ask for written authority, and for a minor we ask the parent or guardian to act. A request is recorded under Article 14, including what we received, when, and how we responded.
We may refuse a request where Article 33 allows it — for example where disclosure would endanger your health or safety or another person’s, reveal another person’s personal data, or conflict with national defence or security. If we refuse, we tell you why and how to complain. Portability and erasure may also be limited by the medical-records retention duty described above.
How we protect personal data
We protect personal data with technical and organisational measures appropriate to the risk, as Articles 35 to 39 require. The public Security Overview describes the controls in more detail. In summary:
- accounts are verified by email before they can sign in, and doctor accounts also need administrator approval;
- passwords are hashed with bcrypt at cost 12; one-time codes are stored only as a salted hash, expire after 10 minutes and allow five attempts;
- administrators must present a single-use code sent to the account email in addition to their password;
- role checks and record scoping run on the server, not only in the interface; doctors can open a patient chart only where they treat that patient;
- sign-ins, record changes and a doctor’s access to a patient chart are written to an audit log;
- production traffic is served over HTTPS, and session cookies are HttpOnly and Secure when HTTPS is used;
- the application sends security headers that block framing, MIME sniffing and third-party scripts.
No system is perfectly secure. If you suspect unauthorised access to your account, change your password and email security@deepvertex.tech.
Personal data breaches
A personal data breach is a failure of protection that leads to accidental or unlawful destruction, loss, alteration, disclosure or access. If one occurs, Article 46 of the UU PDP requires us to notify affected data subjects and the supervisory authority in writing within 3 x 24 hours.
Our notice will describe, at a minimum:
- the personal data that was exposed;
- when and how it was exposed;
- what we have done to contain the breach and recover from it;
- what you can do to reduce the risk, and how to reach us for questions.
Where the breach affects the public or a large group, we will also publish a notice through our usual channels. Processors must notify us without undue delay so we can meet the statutory deadline. We keep a breach register and test our incident runbook at least annually.
Children and minors
The workspace is intended for people aged 18 and over. We do not knowingly allow a minor to create an account. Article 25 of the UU PDP requires special protection for children’s data and the consent of a parent or guardian.
Some clinical data relates to pregnancy, fetal heart rate or a newborn. That data belongs to the patient, who must be an adult or have a guardian acting for her. If a minor receives care through the workspace, the guardian gives consent and exercises the rights in this notice on the minor’s behalf.
If you believe a minor has created an account without a guardian, contact privacy@deepvertex.tech. We will suspend the account and delete what we can, while keeping any clinical record we are legally required to retain. We do not direct marketing at children.
Changes, contact and complaints
Changes. This notice is version 1.0 and was last updated on 22 October 2026. If we make a material change, we will publish the new version, update the date and tell you by email or in the workspace at least 14 days before it takes effect. Earlier versions are available on request. Continuing to use the service after the effective date means you accept the updated notice; where the law requires consent, we will ask again.
Contact. Privacy and data-protection questions: privacy@deepvertex.tech. Security incidents: security@deepvertex.tech. Postal address: DeepVertex Healthcare Technology, Jakarta, Indonesia. We acknowledge privacy requests within 3 x 24 hours and other correspondence within five business days.
Complaints. If you are not satisfied with our response, you may complain to the Indonesian personal data protection supervisory authority, the Lembaga Pelindungan Data Pribadi. If the Lembaga is not yet receiving complaints, you may contact the Ministry of Communication and Digital Affairs (Komdigi) through its official channels. You can also bring a claim before the competent court. We ask that you contact us first so we have a chance to fix the problem, but doing so is not a condition of your right to complain.
This notice is published in English with a Bahasa Indonesia summary. A complete Indonesian translation will be published with the next revision; where Indonesian law requires an Indonesian version, that version will prevail.