This Privacy Policy explains what personal data we collect when you use bekerja.id, what we use it for, who we share it with, and how you can exercise your rights under Indonesian Law No. 27 of 2022 on Personal Data Protection (the PDP Law). The Indonesian version of this policy prevails if there is any difference in interpretation.
1. Who we are
PT Bekerja Berinovasi Bertalenta ("bekerja", "we") operates bekerja.id, including the patient dashboard, the nurse portal and the teleconsultation service. For the personal data you provide to us, we act as the Personal Data Controller under the PDP Law.
2. Data we collect
- Identity & contact details: name, gender, mobile/WhatsApp number, email, and your Google account name and profile photo if you sign in with Google.
- Address: home or service location (province down to village, plus address details).
- Patient health data — including specific personal data under the PDP Law: name, age, gender, weight and height, medical condition, medical history, assistive devices, patient photo, care plan, vital signs, daily reports, incident reports, and the content of consultations with doctors or psychologists.
- Family data: name and contact number of family members/guarantors and the family members you register.
- Transactions: order details, invoices, the chosen payment method and photos of transfer receipts. We do not store credit/debit card numbers.
- Partner applicant data (nurses, doctors, psychologists): identity, national ID number (NIK) and ID card photo, photo, address, education and diplomas, STR/SIP licences, work experience, emergency contact and electronic signature.
- Communications: chat messages with our team or the AI assistant, and messages you send us via WhatsApp or email.
- Technical data: IP address, device and browser type, access times, security logs (e.g. sign-in attempts) and the cookies needed for the site to work.
3. How we use your data
- To create and manage accounts, verify email addresses and keep accounts secure.
- To process home care and teleconsultation orders: matching nurses or health professionals, scheduling, care plans, daily reports and incident handling.
- To process manual payments, issue invoices and check transfer receipts.
- To screen and verify partner applicants.
- To answer questions via chat, WhatsApp and email, including automatic replies from the AI assistant.
- To run the voucher, loyalty and affiliate programmes you join.
- To prevent fraud and abuse, comply with legal obligations and resolve disputes.
- To improve our services using statistics that do not identify you.
We do not sell your personal data and we do not use health data for advertising.
4. Legal basis
We process personal data on the basis of:
- your explicit consent, given when you register, when you first sign in with Google, when you place an order and when you apply as a partner. Patient health data is only processed with that consent;
- performance of the service agreement between you and us;
- compliance with legal obligations, such as transaction and tax records;
- legitimate interests in system security and fraud prevention.
If you order a service for someone else (for example a parent or child), you confirm that you are authorised to provide that patient's data and have informed them and obtained the consent of the patient or their guardian.
5. Who may receive your data
Data is only shared to the extent necessary:
- Partner nurses, doctors and psychologists who care for you — only the patient data and address relevant to their task.
- bekerja staff with access limited to their role; access is restricted per module and data changes are recorded in an activity log.
- Third-party service providers that process data on our behalf:
- Google — Google sign-in (name, email, profile photo) and website fonts;
- Cloudflare — DNS, network protection and "human verification" (Turnstile);
- Hostinger — sending email (account activation, password reset, notifications);
- Anthropic — AI models for automatic chat replies, health risk checks and page translation. We only send the data needed to produce a response;
- our server (VPS) provider, where the application and database run;
- video call platforms (e.g. Jitsi Meet or Zoom) for video consultations or visits;
- WhatsApp (Meta) if you contact us via WhatsApp.
- Competent authorities where required by law.
Some of these providers may process data outside Indonesia. In that case we ensure an equivalent or adequate level of data protection as required by the PDP Law.
6. Storage & retention
- Account data is kept while your account is active.
- Order, care and transaction records are kept for as long as needed to provide the service and to meet legal obligations (such as keeping financial records).
- Data of partner applicants who are not accepted is deleted no later than 12 months after the selection decision.
- Security and activity logs are kept for no longer than 12 months.
- Account registrations that are not activated are deleted automatically after 24 hours.
When the retention period ends, data is deleted or anonymised.
7. Data security
- All connections to bekerja.id are encrypted (HTTPS).
- Passwords are stored as hashes, and staff accounts are protected by two-step verification.
- Sensitive files (ID cards, transfer receipts, patient photos, partner documents) are kept in private storage that only the owner and authorised staff can open.
- Staff access is restricted per module and every data change is logged.
- The database is backed up regularly.
No system is completely immune. If a personal data protection failure occurs, we will notify you and the competent authority within 3×24 hours as required by the PDP Law.
8. Your rights
Under the PDP Law you have the right to:
- obtain information about how your personal data is processed;
- access and obtain a copy of your personal data;
- correct or update inaccurate data — some of it can be changed directly in Edit Profile;
- request the deletion or destruction of your personal data;
- withdraw your consent to processing;
- request that processing be postponed or restricted, and object to decisions based solely on automated processing;
- file a complaint in accordance with the law.
How to make a request: sign in → Account → Privacy & Data → Submit a request (delete data or request a copy), or email halo@bekerja.id. We will verify your identity and respond within 3×24 hours.
Withdrawing consent or deleting data may mean the service cannot continue. We keep certain data where the law requires it (for example transaction records).
9. Children
bekerja accounts are intended for users aged 18 and over. Children's data (for example for babysitter services or child patients) may only be provided by a parent or legal guardian.
10. Cookies
We only use cookies that are needed for the site to work: sign-in session, "Remember me", form security token and language preference. We do not use third-party advertising cookies.
11. Changes to this policy
We may update this Privacy Policy from time to time. If there are important changes, you will be asked to read and accept the new version when you open the dashboard. The date of the version in force is shown at the top of this page.
12. Contact us
For questions or requests about personal data:
- PT Bekerja Berinovasi Bertalenta
- Address: Klumpukan, Seloboro, Salam, Magelang 56484
- Email: halo@bekerja.id
- WhatsApp: +628992991777