Website Privacy Policy
Japan Clinic Irodori — https://japan-clinic-irodori.com
Version 1.0 · Effective 2 October 2026 · Last updated 2 October 2026
This Privacy Policy explains what personal data we process when you open our website or contact us through WhatsApp to make a reservation, what we use it for, who it may be disclosed to, how long we keep it, and your rights over that data. We have prepared it in accordance with Law Number 27 of 2022 on Personal Data Protection (the "PDP Law").
1. Who we are
Your personal data is managed by:
Personal Data Controller (Pengendali Data Pribadi): PT IRODORI JAYA INDONESIA, which operates the Japan Clinic Irodori brand
Registered address: Indonesia Stock Exchange Tower 1 Level 3, Unit 304, Jl. Jendral Sudirman Kav 52-53, Kelurahan Senayan, Kecamatan Kebayoran Baru, Kota Administrasi Jakarta Selatan, Provinsi DKI Jakarta 12190
Personal data protection contact: admin@japan-clinic-irodori.com
In this policy, "we" means the personal data controller above, and "you" means a visitor to the website or a person who contacts us through WhatsApp.
2. Scope of this policy
This policy applies to:
The website japan-clinic-irodori.com; and
Reservations and communications through WhatsApp that you start from our website.
The website has no forms, and we do not ask you to enter personal data on the site. Reservations are made through the WhatsApp button. Even so, when you open the site, some technical data is processed automatically. Section 3 explains this.
Our website contains links to third-party services, for example Google Maps, WhatsApp, Instagram, TikTok, and LinkedIn. Data that you provide directly to those services is governed by the privacy policy of each service. Data that we receive from those services remains governed by this policy.
3. Personal data we process
We process only the data we need for the purposes listed in Section 4.
Serving the website (automatic every time a page is opened): your IP address and the technical data of the request needed to serve the page and fonts; basic visit statistics from our website hosting provider (the page opened and its full address including parameters, the referring page, time zone, language settings, screen pixel ratio, and performance and connection data at the time the page loads). Type of data: general.
Website usage statistics with Google Analytics (automatic when the page is opened; see Section 5): your activity on the site (for example, the pages you open), device and browser data, and a random identifier stored in a cookie. Type of data: general (identifying when combined with other data).
Reservations through WhatsApp: your name, WhatsApp/telephone number, the branch and visit time you choose, and the content of your messages. We receive this data on WhatsApp, not on the website. Type of data: general. Where it relates to a health service or to your health condition, we treat it as health data.
For a reservation, we only need your name, telephone number, branch, and visit time. You do not need to write your complaints or medical history in the chat. You can tell the therapist directly during your visit. If you write them anyway, we treat them as specific health data (Article 4 of the PDP Law) and use them only to respond to your message.
4. What we use your data for
Answering your messages and arranging your reservation. Data: name, contact details, branch and visit time, message content. Basis for processing: fulfilling your request at the time of entering into an agreement with us, namely a service reservation (Article 20(2)(b) of the PDP Law).
Serving the website and understanding its basic performance. Data: website serving data and basic visit statistics (Section 3). Basis for processing: other legitimate interests in serving the website, with regard to the purpose, the necessity, and the balance between our interests and your rights (Article 20(2)(f)).
Understanding how the website is used so that we can improve it (statistics with Google Analytics). Data: website visit data and cookie identifiers. Basis for processing: other legitimate interests in improving the website, with regard to the purpose, the necessity, and the balance between our interests and your rights (Article 20(2)(f)). You can stop it in the ways described in Section 5.
Meeting legal obligations, including a court order or judgment, or a decision of a state administrative official under legislation. Data: data lawfully requested. Basis for processing: fulfilling a legal obligation (Article 20(2)(c)).
We do not sell your personal data. We do not send you promotional messages unless you separately agree to them. We do not make decisions that affect you based solely on automated processing.
If we want to use your data for a new purpose that differs from those above, we will inform you and, where required, ask for your consent before doing so.
5. Cookies and Google Analytics
Our website uses Google Analytics to learn how visitors use the site. Google Analytics sets and reads cookies to recognize the same user across several visits, and collects device and browser data and your activity on the site. Your IP address is involved when data is collected, but according to Google's documentation, Google Analytics does not log or store IP addresses.
Google Analytics runs from the moment you open the site. The site currently does not display a banner asking for cookie consent.
You can stop data collection by Google Analytics by installing the Google Analytics Opt-out Browser Add-on from Google (https://tools.google.com/dlpage/gaoptout). You can still use the site fully.
You can also disable or delete cookies in your browser settings.
You can also ask us to end or restrict the processing of your data (Section 10).
We do not send the content of your reservation conversations to Google Analytics.
Besides Google Analytics, serving the site involves two other services: our website hosting provider (hosting and basic visit statistics) and Google (the font service, because the site's fonts are loaded from Google's servers). Both receive your IP address as a technical consequence of the internet connection when the page loads. We use them only to serve the site and understand its basic performance, and we limit the data as described in Section 3.
6. Who your data may be disclosed to
We disclose your personal data only to the following parties, and only to the extent necessary:
Google (Google Analytics): website usage statistics. Data: website visit data and cookie identifiers.
Google (font service): displaying text on the site. Data: IP address and the technical data of the request when fonts are loaded.
Our website hosting provider: serving the website and basic visit statistics. Data: serving data and basic visit statistics (Section 3).
WhatsApp (WhatsApp LLC, part of the Meta group of companies): the reservation and communication channel you choose. Data: data you send through WhatsApp.
Competent government authorities, where legislation requires: meeting legal obligations. Data: to the extent required.
We keep your personal data confidential and supervise the parties involved in processing data under our control.
7. Transfer of data abroad
Some of the services we use are operated by companies outside the territory of Indonesia (for example Google, our website hosting provider, and WhatsApp of the Meta group of companies). Your data may therefore be processed outside Indonesia.
Purpose of transfer: running website statistics, serving the website (including fonts), and providing the WhatsApp communication channel.
Rules we follow: Article 56 of the PDP Law requires a personal data controller to ensure that the receiving country has a level of personal data protection equal to or higher than the PDP Law; if that is not met, to ensure that adequate and binding protection exists; and if neither is met, to obtain the consent of the data subject. We carry out transfers with reference to these provisions.
Safeguards: we will update this section with information on the data protection safeguards that apply to each provider (for example data processing agreements or contract clauses).
Risks and how we reduce them: transferred data may be subject to the laws of another country. To reduce the risk, we limit the data sent to overseas services (Google Analytics does not receive the content of reservation conversations; the font service and hosting receive only the technical data needed to serve the site), and we encourage you not to write your medical history in the chat.
Your rights: you can still exercise your rights (Section 10) over transferred data by contacting us.
8. How long we keep data
We keep personal data only as long as necessary for the purposes in Section 4 or as long as required by legislation. After that, the data is deleted or destroyed in accordance with legislation. The processing period runs from the time the data is collected until the end of the following retention periods.
Reservation data and WhatsApp conversations: 12 months from your last conversation with us through WhatsApp.
Website statistics data (Google Analytics): event data for 2 months, except key event data, which follows the user-level data retention period; user-level data for 14 months from your last activity on the site. Data past this period is deleted automatically through a monthly deletion process. Aggregated statistical reports are not affected by this setting.
Website serving data and basic visit statistics (our website hosting provider, font service): this data is sent directly from your browser to our website hosting provider and to Google; we do not download or store it ourselves. The hosting provider processes it as a Personal Data Processor on our behalf for as long as our service agreement with that provider is in effect, and does not set a more detailed retention period for this data. Google processes it to serve fonts and for security purposes, and does not state a retention period. According to Google, the font service does not set cookies, and the data it collects is not used to build user profiles or for targeted advertising.
You can ask for earlier deletion of your data (Section 10). We may still keep data where legislation requires it or where it is needed to resolve legal proceedings.
9. Data security
We protect your personal data from unauthorized access, disclosure, alteration, and misuse with technical and operational measures appropriate to the nature and risk of the data. We limit access to our reservation WhatsApp conversations to the staff who need it to serve you.
If a personal data protection failure (Kegagalan Pelindungan Data Pribadi) occurs, we will notify you and the institution that administers personal data protection in writing no later than 3 x 24 hours, in accordance with Article 46 of the PDP Law. The notice states the data that was disclosed, when and how it was disclosed, and the handling and recovery efforts we have made.
10. Your rights
Under the PDP Law, you have the right to:
Obtain information (Article 5): Information about the clarity of our identity, the basis of our legal interest, the purpose of requesting and using your data, and the accountability of the party requesting your data.
Complete and correct (Article 6): Updating or correcting data that is wrong or inaccurate. We do this no later than 3 x 24 hours after we receive your request, and we tell you the result.
Access and obtain a copy (Article 7): Access to your data that we process. We provide access no later than 3 x 24 hours after we receive your request. A copy is provided free of charge, except in certain circumstances that do require a fee.
End processing, delete, or destroy (Article 8): Stopping the processing and deleting or destroying your data, in accordance with legislation.
Withdraw consent (Article 9): Withdrawal of consent at any time. We stop processing based on that consent no later than 3 x 24 hours after we receive your request.
Object to automated decisions (Article 10): An objection to a decision based solely on automated processing, including profiling, that produces legal consequences or significantly affects you. We do not make such decisions.
Postpone or restrict processing (Article 11): Postponement or restriction of processing, proportionate to its purpose. We do this no later than 3 x 24 hours after we receive your request, except in cases excluded by Article 41(2) of the PDP Law.
Sue and receive compensation (Article 12): A lawsuit or compensation for a violation in the processing of your personal data.
Obtain data in a structured format (Article 13): Your data in a commonly used format or one that electronic systems can read. Once Government Regulation No. 33 of 2026 on the Implementing Regulation of the PDP Law ("PP 33/2026") takes effect, this right applies where the processing is based on consent, or on performing a contractual obligation or fulfilling your request at the time of entering into an agreement, and is carried out automatically.
How to make a request. Send a recorded request to admin@japan-clinic-irodori.com or to our address in Section 1. Requests we receive are recorded. Please include:
your identity, together with proof of identity so that we can verify that the request comes from you;
the right you want to exercise; and
a description of your request regarding the data we process.
A request may be made by you, by your parent or guardian if you are a child, by your guardian if you are a person with a disability, or by a person you have authorized. We notify you of the follow-up through the same communication channel you used or another channel that is easy for you to access.
In certain cases, the law requires us to refuse access to or changes of personal data, for example where granting the request would endanger your safety, physical health, or mental health or those of another person, or would result in the disclosure of another person's personal data (Article 33 of the PDP Law). If that happens, we will explain the reason to you.
For processing based on other legitimate interests (Section 4), you can ask for an explanation of the use of that basis, and we will provide it.
If you believe we have not carried out our obligations on your request, you can report it to the institution that administers personal data protection in accordance with legislation.
11. Children's data
Our website is intended for adults. Processing a child's personal data requires the consent of a parent or guardian (Article 25 of the PDP Law). In this policy, a child is a person under 18 years of age who is not married (following PP 33/2026 Article 1 point 21). If you are under 18 and not married, please ask your parent or guardian to contact us before you provide any data. If we learn that we are processing a child's data without the consent of a parent or guardian, we will delete it.
12. Changes to this policy
If we change the information in this policy, we will notify you before the change takes effect, through this page and, where necessary, through the communication channels we use with you. For changes that require new consent, we will ask for your consent again. The date at the top of the page shows the latest version.
Version 1.0 (2 October 2026): First version. Scope: the website and reservations through WhatsApp.
13. Contact us
For questions about this policy or to exercise your rights:
Address: Indonesia Stock Exchange Tower 1 Level 3, Unit 304, Jl. Jendral Sudirman Kav 52-53, Kelurahan Senayan, Kecamatan Kebayoran Baru, Kota Administrasi Jakarta Selatan, Provinsi DKI Jakarta 12190
Brand name: Japan Clinic Irodori