Data Processing Agreement

The clinic identified in the service order is the Personal Data Controller. CV. SENTRA ARTIFICIAL INTELLIGENCE INDONESIA, the business operating Lumina as identified by its owner, is the Personal Data Processor. Its registered business address and designated privacy contact must be completed in Annex A before publication. ‘Lumina Clinic Software’ is a product name, not a substitute for the contracting entity.

This Indonesia-specific agreement supplements the service order. Mandatory Indonesian data-protection, health, electronic-system and language laws prevail over inconsistent terms. It does not certify compliance or replace a separate assessment for Malaysia or other jurisdictions. Both language versions form one agreement; Bahasa Indonesia prevails for Indonesian services if interpretation differs, subject to mandatory law.

The clinic determines the purposes and lawful grounds for processing. Lumina shall process only on documented instructions for scheduling, clinical records, care plans, inventory, billing, staff administration, support, approved exports and reporting. Instructions must identify the purpose, data, recipients, locations and retention. Lumina shall notify the clinic if an instruction appears unlawful and suspend that instruction pending resolution; legal demands shall be disclosed unless prohibited.

Data subjects include patients (including children and persons with disabilities), guardians, clinic personnel and payers. Data may include identity/contact details, health and medical records, appointments, documents, financial/payment information and staff records. Health data is specific personal data. Operations include collection, storage, organisation, retrieval, correction, authorised disclosure, export, restriction and deletion. Processing lasts for the service term and the lawful transition/retention period in clause 9.

The clinic shall document an applicable lawful ground for each purpose, give accessible privacy information and obtain and retain valid consent where required, including applicable rules for children and persons with disabilities. Accepting this DPA is not patient consent and does not authorise unrelated secondary uses.

Lumina shall promptly forward rights requests to the clinic, verify and minimise disclosures under its instructions, preserve relevant evidence and assist with access, correction, restriction, withdrawal, deletion, portability and objections to consequential automated decisions. Requests subject to a 3 × 24-hour statutory deadline must be prioritised; Lumina shall acknowledge and begin assistance within 24 hours and supply available information in time for the clinic’s deadline. The bulk export approval process does not pause statutory deadlines or restrict lawful clinical access. Mandatory medical retention and lawful exceptions must be evaluated rather than promising unconditional erasure.

Lumina shall maintain access controls with least privilege, clinic-level separation, secure transport, protected stored data, controlled administrative access, audit trails, vulnerability and patch management, backup/recovery procedures and an incident-response process appropriate to health data. The clinic shall manage its users, devices, access reviews and exported copies. Staff and contractors with access shall be bound by confidentiality and receive appropriate training.

Annex A must record verified technical measures, backup locations, restoration tests and retention settings. This agreement does not assert an unverified encryption algorithm, security certification or complete audit coverage. Lumina shall not sell clinic/patient data, use it for advertising or train general-purpose models on it. Any separately instructed processing requires a lawful basis and the safeguards in this agreement.

Before engaging another processor with access to clinic personal data, Lumina shall obtain the clinic’s written approval under Article 51(5) of Law 27/2022. Annex A shall identify each approved legal entity, service, data categories, processing/support locations, retention and onward processors. Generic references to ‘cloud providers’ are insufficient approval.

Lumina shall give advance notice of changes, obtain the required written approval before new processing and offer a lawful alternative or orderly exit if agreement cannot be reached. Written sub-processor terms shall impose appropriate instructions, confidentiality, security, assistance, incident reporting, transfer, return and deletion obligations. Lumina remains responsible for its own duties and shall monitor contracted safeguards.

Applicable health-sector requirements take precedence over general cloud-hosting flexibility. For the electronic medical-record storage cooperation described in Article 22 of Minister of Health Regulation 24/2022, domestic data storage facilities and the prescribed Ministry recommendation are required. Relevant certification, backup, access and interoperability requirements must be verified before using a deployment as the clinic’s regulated electronic medical-record system.

For any otherwise lawful overseas processing, backup or support access, the parties shall document the destination, recipient, purpose, data and applicable Article 56 transfer mechanism in sequence: equivalent or higher protection; if unavailable, adequate and binding protection; if neither is available, the legally required data-subject consent. A foreign cloud contract or this DPA alone is not proof of adequacy and does not override domestic medical-record requirements. New destinations require review before transfer. The parties shall assess transfer necessity and risk, document the effectiveness of safeguards and onward transfers, provide required information to data subjects, and periodically reassess the arrangement.

Lumina shall notify the clinic without undue delay and no later than 24 hours after becoming aware of a personal-data protection failure affecting the clinic, using the clinic’s designated incident contact. This is a contractual early-notice commitment, not a replacement for the statutory deadline. Initial notice shall not wait for a complete investigation; updates shall follow as facts are established.

The notice shall describe affected data and people as known, when and how exposure occurred, containment/recovery actions, likely effects and an incident contact. Lumina shall preserve evidence and assist investigation and remediation. The clinic remains responsible for required written notices to data subjects and the competent institution within the applicable 3 × 24-hour period under Article 46, and public notice where required; the parties shall coordinate without delaying notices or limiting the Processor’s own legal duties.

An active clinic admin may submit an official export request in Settings. A notification is sent to bsean@buildmomentum.xyz for verification and approval. The export is scoped to that clinic; the resulting ZIP contains structured records and retrievable attached files, excluding live access/invite secrets and platform-wide data. Only active clinic admins can view request activity and obtain a short-lived private download link. Each approval and link issuance is recorded.

Generated download copies are available for 7 days and then removed by the retention process; this does not delete source medical records. Large or unsuccessful exports require assisted secure delivery. The parties shall arrange timely alternative access if approval, size limits or service interruption would impede a statutory right, continuity of care or the clinic’s lawful access. An export is a data copy, not a certified backup or a waiver of patient rights.

The clinic shall set and document a lawful retention schedule. Electronic medical records subject to Article 39 of Minister of Health Regulation 24/2022 must be retained for at least 25 years from the patient’s last visit, with lawful further retention where applicable. Subscription cancellation, an expired download or a patient request does not automatically override this requirement.

On termination, the parties shall agree a secure return/migration plan, verify the receiving copy and continuity of legally required retention, and document responsibilities before deletion. Lumina shall delete service copies on the clinic’s lawful written instruction after handover, except data legally required to be retained. Retained data shall be restricted to the retention purpose. Active copies, backups, deletion dates and any legal holds shall be recorded in the exit plan, with written confirmation of completed deletion. There is no unconditional 90-day purge of medical records.

The clinic remains responsible for professional recordkeeping, accuracy, authorised corrections, confidentiality, patient access and disclosure. Medical-record documents belong to the healthcare facility and their contents belong to the patient as provided by the medical-record rules. The parties shall preserve that distinction; Lumina obtains no independent ownership right in those records.

The clinic and Lumina shall document their respective responsibilities for the applicable Indonesian electronic-system registration, domestic storage, security certification, Ministry recommendation and Ministry health-data interoperability requirements, including SATUSEHAT where applicable. A DPA, an export feature or a clinic account is not evidence that these technical/regulatory requirements have been met.

Optional AI processing requires documented clinic instructions, necessary notices/lawful grounds, minimisation and approval of the gateway and actual model provider, including their locations, retention and onward processing. Identifiable medical records shall not be sent to an AI service until those conditions and applicable transfer/health rules are satisfied. Outputs require human review and must not be the sole basis for clinical or other legally significant decisions.

Annex A must distinguish application hosting/database providers from AI and email providers. Export approval emails shall contain request metadata, not patient records or ZIP attachments. Staff who copy a patient summary into email or WhatsApp must verify the recipient and lawful disclosure, minimise content and use an approved channel. A copied draft is not evidence that the patient received or consented to it.

Each party shall assess and document high-risk processing, including specific health data, large-scale processing, new technologies and consequential automated decisions, and perform a data protection impact assessment where required. Lumina shall provide information and assistance relevant to its processing.

Each party shall assess the obligation to appoint a personal-data protection officer under Articles 53–54 of Law 27/2022, taking account of Constitutional Court decision 151/PUU-XXII/2024: the criteria are alternative/cumulative (‘and/or’), not a requirement that all criteria be met. Contact details, responsibilities, processing records and risk decisions shall be maintained and made available as required.

Lumina shall provide reasonably necessary compliance evidence and permit proportionate audits under confidentiality safeguards, without exposing other clinics’ data. Routine audit arrangements shall not delay incident investigation or lawful regulator access. The parties shall cooperate with competent authorities, maintain processing records and document corrective actions.

Government or third-party requests shall be verified, limited to legally required data and communicated to the clinic unless prohibited. Nothing in this agreement excludes statutory accountability, data-subject remedies or the obligations imposed directly on either party.

Acceptance must identify the actual text version, language presented, authorised signer and timestamp. Both English and Bahasa Indonesia texts must be available before acceptance. A preview, a query-string date or printing this page is not proof of signature. Existing acceptance records shall remain tied to their original text; a revision requires new acceptance and must not relabel an old agreement.

This revision is a draft until Annex A is completed, operational commitments are verified and it is formally published. Publication is not retroactive. PP 33/2026 takes effect on 16 January 2027 under Article 225; before that date the parties shall complete a readiness review, including incident procedures (Articles 114–117), Processor duties (Articles 139–141), officer criteria (Article 142) and overseas transfers (Articles 160–174). These future provisions do not postpone duties already applicable under Law 27/2022. If law or verified deployment facts change, the parties shall review and amend the agreement and instructions before affected processing.

Processor business name supplied by the owner: CV. SENTRA ARTIFICIAL INTELLIGENCE INDONESIA. Registered business address: awaiting confirmation. Privacy/incident contact and clinic escalation contact: to be designated. Official export-request recipient: bsean@buildmomentum.xyz.

Services identified in the code: Supabase (authentication, database, file storage and export processing); Vercel (application hosting and optional AI Gateway); the configured model provider (currently Anthropic by default, configurable); Spacemail (official request email). For each, confirm the contracting legal entity, purpose, personal-data categories, country/region including backups and support, retention, transfer basis and clinic written approval. The owner reports that the Supabase project is located in Mumbai, India. Database/storage configuration, backups and support locations have not been independently verified. Indonesian PSE registration and any required Ministry of Health recommendation remain unverified. Mumbai hosting must not be described as satisfying Indonesian domestic medical-record storage requirements; resolve the deployment suitability in clause 6 before representing this service as a compliant regulated EMR. This inventory is not an approved or exhaustive sub-processor schedule.

Verify before publication: Indonesian storage suitability and any Ministry recommendation; electronic-system registration and health-data interoperability; encryption and administrative controls; backup/restore tests and deletion cycle; incident staffing and 24-hour response; deployment of the export function, private storage, email credentials and scheduled deletion. Unverified matters must not be represented as completed controls.