Skip to content

Updated 30 August 2026

JejakSiKecil Privacy Policy

JejakSiKecil stores children’s health data. We treat that as a serious responsibility. This policy explains what data we collect, why, how we protect it and what rights you have. It is written to comply with Indonesian Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”).

1. Summary

  • We collect only the data needed to run the service.
  • Children’s records are shared with your family members; pregnancy and postpartum records are not.
  • We do not sell data, and there are no third-party analytics on any screen that shows clinical values.
  • You can export and delete your own data at any time.

2. Data we collect

Account data. Name, e-mail address, password (stored only as an Argon2id hash, never in clear text), language, time zone, unit and display preferences, an optional profile photo, and the version and time of your consent to the Terms of Service and this Privacy Policy.

Child data. First name, sex, date and time of birth, due date (for adjusted age), birth measurements, parental heights (for the mid-parental height estimate), optional photos and logging settings.

Activity records. Every record you or a caregiver create: time, type, amounts, durations, notes, photos and who recorded it. This includes health records (temperature, medication, immunisations) and growth measurements together with the z-scores and percentiles we compute from them.

Pregnancy and postpartum data. If you enable it, these records are stored with a private flag and are accessible only from your account.

Technical data. IP address, browser type, device identifiers you register for notifications, sign-in times and error logs. We also write every access to a private record and every change of caregiver permissions to an audit log.

Payment data. If you subscribe to Plus, the payment provider processes your payment details; we receive only the subscription status and a transaction identifier.

We process data to: run the service you asked for (performance of a contract); show charts, schedules and reminders (legitimate interest for core features, your consent for notifications); keep the service secure and prevent abuse (legitimate interest); and meet legal obligations. Children’s health data is processed on the basis of the explicit consent you give as a parent or guardian when you create a child profile. You can withdraw that consent at any time by deleting the profile or your account.

4. Children’s data

The data we process about children is entered by parents or legal guardians, or by caregivers they invite. We never contact children directly and we do not build marketing profiles from children’s data.

5. Sharing within a family

Family members (owner and caregivers) can see and edit every child record in that family, including photos and health records. Every record shows who created it. Pregnancy and postpartum records are the exception: only their author can see them. If you leave a family or are removed from it, you lose access to that family’s records.

6. Third-party service providers

We use infrastructure providers for server and database hosting, file storage for photos and export files, an e-mail delivery service for verification codes, password-reset links and caregiver invitations, and Google for Sign in with Google if you choose it. These providers process data only on our instructions and under confidentiality agreements. We do not sell personal data and we place no third-party analytics or advertising on any screen that shows clinical values.

7. Security

  • Data is encrypted in transit (TLS) and at rest.
  • Passwords are hashed with Argon2id. Session tokens are short-lived and rotated; reusing a spent token revokes every related session.
  • Photo and export links are signed and expire within 24 hours; no storage bucket is publicly listable.
  • Private-record restrictions are enforced on the server and every access is written to the audit log.

No system is completely secure. If a data breach affects you, we will notify you as the PDP Law requires.

8. Storage and retention

  • Data is kept for as long as your account is active.
  • Records you delete can be restored for 30 days, then they are erased permanently.
  • When you delete your account it is deactivated immediately, every session is revoked, and all data is permanently erased after 30 days. Audit logs required for security may be kept longer in a form no longer linked to your account.
  • Export files expire and are removed automatically.

9. Your rights

Under the PDP Law you have the right to: access and obtain a copy of your data (the Export Data menu); correct inaccurate data (every record is editable); erase data (per record, per child profile, or the whole account); withdraw consent; object to specific processing, including turning off each kind of notification; and lodge a complaint with the competent personal-data-protection authority. For requests that cannot be made from inside the app, contact us at the address in section 14; we respond within the statutory period.

10. Notifications and e-mail

We send transactional e-mail (verification codes, password resets, invitations). Push notifications, including immunisation reminders and caregiver activity, are sent only after you grant permission in your browser and can be switched off per kind in settings. We do not send marketing e-mail without separate consent.

11. Cookies and local storage

The app keeps session tokens, preferences and the offline record queue in your browser’s local storage (including IndexedDB) so that it works without a connection. That data lives on your device and is cleared when you sign out. We do not use cross-site tracking cookies.

12. International transfers

Our servers are located in South-East Asia. Where our providers process data outside Indonesia, we ensure equivalent protection as the PDP Law requires.

13. Changes to this policy

This policy carries a version number. Material changes will be presented for renewed consent inside the app; the version you accepted and the time of acceptance are stored on your account.

14. Contact

Questions and requests about personal data: support@jejaksikecil.com.

To delete your account and all data, see also Hapus Akun or email support@jejaksikecil.com from your registered address with the subject Hapus Akun.