UpdateStatus client privacy notice 

UpdateStatus allows any member of the public to find and book appointments for a range of health services in Indonesia. Booked appointments are shared with relevant service providers and client support staff who may assist clients to attend their appointments and document the health services provided to clients who had booked on UpdateStatus. 

UpdateStatus (available at www.UpdateStatus.id) uses the Online Reservation and Case Management App (ORA) software developed by FHI 360 with funding provided by USAID and PEPFAR.  UpdateStatus is operated by FHI 360 – an international nonprofit working to improve the health and well-being of people in the United States and around the world. FHI 360 and eligible local project partners of EpIC Indonesia are considered the “controllers” of UpdateStatus in Indonesia.

We are committed to protecting and respecting your privacy. We collect and process your Personal Information (PI) in accordance with the Personal Data Protection Law and Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems. We continually try to minimize the amount of private data that we collect. All clients who use UpdateStatus indicate that they have read, understand, and agree to the terms of this Privacy Notice, which explains what client data is collected through UpdateStatus, why we collect this information, and how it is processed securely.  

Contents: 

Key terms 

1. How do we collect your personal information? 
2. What kind of information do we collect and how do we use your information? 
3. How is your information shared? 
4. How do we protect and secure your information? 
5. What kind of communication will you receive from UpdateStatus? 
6. How can I edit my communication preferences and opt-out of UpdateStatus’s communications? 
7. How can you manage or delete your information on UpdateStatus? 
8. What is the minimum legal age to use UpdateStatus? 
9. How can you contact UpdateStatus/FHI 360 with questions? 

Key terms: 

• Personal Information (or “data”):  Any information regarding individuals who are identified or can be identified, either separately or in combination with other information, directly or indirectly.   Personal Information may also include Specific Personal Information, which is data that may have a bigger impact on a person, such as data regarding health or genetic data.  PI is also referred to as “your information” in this notice. Aggregate data or individual level data that cannot be linked to an individual are not considered PI. 
• Controller: the entity or entities which, alone or jointly with others, determines the objectives of the processing of personal information on UpdateStatus and exercise control over the processing of personal information. FHI 360 as the global administrator, along with relevant in country program partners, are the UpdateStatus controllers, and are referred to as “we” in this notice.  
• Clients: Any individual who uses UpdateStatus to book health services for themselves or for whom appointments are booked on their behalf by service providers or client support staff. Clients are also referred to as “you” in this document. 

• Service providers: Providers of health services registered on UpdateStatus, which may include clinicians, nurses, qualified community/lay providers, lab technicians, counselors, psychologists, pharmacy staff, and other individuals who are qualified to provide the health services clients request when they book appointments on UpdateStatus. Service providers have access to view appointments booked on UpdateStatus at the service provider’s clinic(s) to report when clients arrive for their appointment and report services provided to clients.  
• Client support staff: individuals who are assigned access to appointments booked on UpdateStatus and may include “outreach workers” who help reach new clients in the community and assist them to book services on UpdateStatus. This may also include “case managers” who usually manage a cohort of clients in longer term care and may have access to view the history of appointments their clients booked on UpdateStatus including clinical service delivery data reported by service providers.  

How do we collect your information? 

• You directly enter your information on UpdateStatus when you book an appointment on UpdateStatus, including your mobile phone number, date of birth, and name (or nickname). Service providers use this information to confirm your identify before providing virtual or in-person support. UpdateStatus will use your mobile number to send you appointment confirmation and reminders using WhatsApp.  
• UpdateStatus automatically collects limited information when you visit UpdateStatus, such as your IP address, general location (city and country), time of visit, and the type of device and operating system used to access UpdateStatus, which is used to understand site traffic. 

• You may request assistance from service providers or other client support staff to book your appointment on UpdateStatus on your behalf. In this case, you may have your information entered into UpdateStatus by service providers or client support staff after this information is confirmed by you. 
• You may refer other individuals for services on UpdateStatus using the client referral tool. Alternatively, you may be referred for services on UpdateStatus by someone else. Clients making the referral will enter the mobile phone number and name/nickname on UpdateStatus for each client they want to refer. 

What kind of information do we collect and how do we use your information? 

• Appointment information: Your name (or nickname), mobile phone number, date of birth, and the health services you want to receive are collected when you book an appointment on UpdateStatus. Additional information – like your national ID number – will also be collected if you request a facility queue number to secure your appointment time slot. This information is used to send you reminders for your upcoming appointments and allows UpdateStatus to share your appointment details with the service provider where your appointment was booked and your assigned client support staff. It helps service providers and client support staff find your appointment record on UpdateStatus and to confirm your identity and requested services. 
• Other demographic information: Additional demographic information may also be asked when you book an appointment on UpdateStatus, such as sex, gender identity, and membership in some populations, which allow us to ensure all populations are served equitably.   

• Sexual health information: You can complete a sexual health service assessment on UpdateStatus, which ask a series of questions to determine your HIV status and risk level for HIV and other STIs. Your responses to these questions allow UpdateStatus to recommend you specific health services that you can book on UpdateStatus. Your responses to individual questions on this assessment are kept confidential and are neither shared with service providers nor client support staff. 
• Health service access information: Your service provider and/or client support staff assigned to your appointment record may report the health services you accessed and diagnostic results based on the appointments booked through UpdateStatus, including ability for them to add custom notes. This information is collected to ensure clients are provided comprehensive and quality health services and to allow case managers to understand their client’s history of service uptake among providers on UpdateStatus. 
• Client feedback information: You may be offered the option to provide feedback on your appointment booked on UpdateStatus. This information is to understand your experience accessing services through UpdateStatus to improve the quality services. 
• Client referral information: UpdateStatus collects the phone number, sex, and specific health services that should be offered for each contact entered on the UpdateStatus client referral tool. This information is used to send an SMS message to each referral and to track details of referrals sent by UpdateStatus. This information is also shared with an assigned client support staff and service provider on UpdateStatus so they may manually follow-up with referred clients to support them to access services through UpdateStatus. 
• Location information: The internet browser you use to access UpdateStatus may ask your permission to share your current location with UpdateStatus. This information is not stored on UpdateStatus, but is used to personalize your experience using UpdateStatus, including to present service providers that are nearest to your current location.  

• Cookies and other tracking information: When you visit UpdateStatus, the site will automatically collect some information to help us understand our site traffic, including your IP address, general location (country/city), device type, and date and time of access. 
• We do not use client data for prospective and commercial uses.  

How is your information shared? 

• Your appointment requests are shared with the provider where you booked your appointment and the assigned client support staff. This service provider and assigned client support staff can reassign your appointment record to another service provider or client support staff based on your request and approval (for instance if you want to change your appointment to another clinic).  
• Clinical data, including details of the health services you accessed and diagnostic results based on your appointment book on UpdateStatus can only be viewed and edited by the provider where your appointment is booked. Your provider may also grant another provider or outreach workers or Case Managers on UpdateStatus to complete reporting of certain diagnostic or drug delivery for your appointment on UpdateStatus . 

• UpdateStatus does not share your personal information to any other database or national/government reporting system. Only aggregate and anonymized data (data that does not identify you at all) may be shared and reported to the national government and donors, upon request. Based on regulations established by the Ministry of Health, providers may be required to report data on their services delivered to the national government, but that would be handled by your provider and not on UpdateStatus. 
• Program staff may use aggregate appointment data (anonymized without identifying information) to help ensure all types of populations can access and receive services through UpdateStatus. 
• Clients agreeing to the UpdateStatus Privacy Notice provide their consent to having their information transferred outside of Indonesia to UpdateStatus’ secure cloud server where the UpdateStatus controllers have access to your information to provide management support to service providers and client support staff.  

How do we protect and secure your information? 

We take great care to protect your data. Technical measures are in place to prevent unauthorized or unlawful access to data and against accidental loss or destruction of or damage to data. Staff who are granted access to UpdateStatus data are trained to protect the data from any illegal or unauthorized access and usage. We protect and secure your data in the following ways: 

• Trained management, outreach, and counselling staff carefully support clients and handle their information securely. Our clinical partners are nationally accredited and follow health information guidelines set by the Ministry of Health. 
• UpdateStatus uses a range of security measures to protect clients and data including using Secure Sockets Layer (SSL) which encrypts your communication with UpdateStatus, secure high-capacity server hosting, offsite backup service with military grade encryption, and password-protected user logins. 
• Your phone number used to book appointments on UpdateStatus is protected on UpdateStatus. The phone number is encrypted on the server and hidden from view of providers and client support staff. A key is used by UpdateStatus decode the phone number each time it is required for use (to send clients WA (SMS) reminders or to present the phone number to the service provider or client support staff to contact you). UpdateStatus’ databases do not link your personal information with your phone number. [phone number encryption is part of UpdateStatus v4.2] 

What kind of communication will you receive from UpdateStatus? 

You may receive the following types of communications from UpdateStatus: 

• An appointment confirmation WhatsApp message is sent to the phone number included on the UpdateStatus appointment immediately after the appointment is saved on UpdateStatus. The message will not include the specific health services you requested for your appointment. 
• Reminder WhatsApp messages are sent to the phone number included on the UpdateStatus appointment. Reminder message(s) are sent 24 to 48 hours before the scheduled appointment. These messages will not include the specific health services you requested for your appointment.
• A WhatsApp message is sent to the phone number included on the UpdateStatus appointment when a change is made to the appointment’s date, time, provider, or assigned client support staff. 

• WhatsApp messages from UpdateStatus as part of planned WhatsApp campaigns relevant to health services you have accessed through UpdateStatus or to share updates for new or changed health services available through UpdateStatus.  

How can I edit my edit my communication preferences and opt-out of UpdateStatus’ communications? 

You can edit your communication preferences on UpdateStatus using the methods below: 

• Select “opt out of WhatsApp” when you book an appointment on UpdateStatus or request the provider or client support staff to select this option when they book an appointment on your behalf. Selecting this option will block UpdateStatus from sending you any automated WhatsApp messages for that specific appointment (will not affect other automated message sent for separate appointments).  
• Select “do not call” when you book an appointment on UpdateStatus or request the provider or client support staff to select this option when they book an appointment on your behalf. Selecting this option will notify the service provider and other client support staff to avoid contacting you on the phone number you provided and to take extreme precaution to confirm your identity if contacting you is necessary.  
• Contact your service provider or case manager to have your phone number updated on UpdateStatus or to provide them custom contact information (such as WhatsApp number or other contact information).  
• To stop receiving all WhatsApp from UpdateStatus, please contact us using the email or phone number at the bottom of this privacy notice. We can manually and permanently block all WhatsApp from UpdateStatus to your phone number. 
• When you receive a WhatsApp message from UpdateStatus, it will include a link to opt out of future communications.  

How can you manage or delete your information on UpdateStatus? 

We provide you with the ability to access, rectify, or delete your data. You can manage your date through the following ways: 

• Contact the phone number provided in your appointment booking confirmation WhatsApp from UpdateStatus to rectify or delete your data.  
• Start a chat with us on the home page and ask to speak to your assigned client support staff, who can help you access, rectify, or delete your data on UpdateStatus.

Requests to access, edit, or delete your personal data on UpdateStatus may only proceed after service providers or client support staff can confirm your identity. After your identity is confirmed, requests will be processed immediately or within 10 days. If you cannot submit your request to manage or delete your personal information in UpdateStatus with the options described above, send an email with your request to privacy@fhi360.org. 

What is the minimum age to use UpdateStatus? 

If you are 18 years or older, you may use UpdateStatus to book health services for yourself. If you are younger, you can ask your parent or legal guardian to book health services on your behalf.

How to contact UpdateStatus/FHI 360 with questions? 

If you have any questions about this notice, you can contact us as described below: 

FHI 360 Indonesia (Local UpdateStatus controller) 

• Contact us by email at: nhadi@fhi360.org
• Contact us by phone at: +62 813-2760-3594
• Our officers are located at: Generali Tower, 18th Floor, Gran Rubina Business Park, Rasuna Epicentrum, JL. HR. Rasuna Said Kav C-22, Kuningan, Jakarta, Indonesia 12940, O) +6221.22057175 (F) +6621.22057858

FHI 360 (Global UpdateStatus controller) 

• Requests to access, modify or delete client personal information, or any questions about this notice or how we handle your personal information, can be sent to privacy@fhi360.org  
• FHI 360’s office is located at: FHI 360 Headquarters, 359 Blackwell Street, Suite 200 Durham, NC 27701, US