1. Introduction
Insivio ("we," "our," or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you interact with our website, platforms, and services.
Insivio is headquartered in Jakarta, Indonesia, with a regional presence in Singapore. This policy applies to users in all jurisdictions and is designed to comply with:
- Indonesia — Undang-Undang Pelindungan Data Pribadi No. 27 Tahun 2022 (UU PDP)
- Singapore — Personal Data Protection Act 2012 (PDPA), as amended 2021
- European Union — General Data Protection Regulation 2016/679 (GDPR), for EU/EEA users
Where applicable law provides stronger protections than this policy, that law prevails.
2. Data Controller
Insivio acts as the Data Controller (Pengendali Data Pribadi under UU PDP) for personal data collected through our website and services.
Data Protection Contact (DPO):
For all data protection enquiries, requests, and complaints:
Email: hello@insivio.ai — Subject line: "Data Privacy Request"
3. Nature of Our Services — Not a Medical Device
Insivio operates two platforms, neither of which is classified as a medical device or Software as a Medical Device (SaMD) under applicable Indonesian, Singaporean, or international regulatory frameworks (including IMDRF guidelines):
- LongeviTwin — a wellness and health education platform providing general health information and longevity insights. It does not diagnose, treat, cure, or prevent any disease or medical condition. All outputs are for personal educational use only.
- Drug Discovery Platform — a computational research tool for scientific researchers. All predictions and outputs require experimental validation. The platform is not intended for clinical decision-making.
Neither platform is regulated as a medical device by Kemenkes (Indonesia), HSA (Singapore), the FDA (United States), or the EMA (European Union).
4. Personal Data We Collect
We collect only what is necessary to provide our services:
- Account data: name, email address, organisation name
- Usage data: pages visited, features used, session duration (anonymised analytics)
- Communications: messages you send us via contact forms or email
- Enquiry form data: investor type, organisation, and message content submitted via our contact form
Health data (LongeviTwin): Health-related inputs provided within LongeviTwin are classified as Data Pribadi yang Bersifat Spesifik (specific personal data) under UU PDP and as sensitive personal data under PDPA. Such data is processed locally on your device where technically possible. We apply heightened security obligations to this category and will not process it without your explicit consent.
5. Legal Basis for Processing
- Indonesia (UU PDP): We process personal data based on your explicit consent (Pasal 20 UU PDP), contractual necessity, and our legitimate interests in operating and improving our services.
- Singapore (PDPA): We collect, use, and disclose personal data based on your consent or as permitted under the PDPA (including business improvement and research exceptions where applicable).
- EU/EEA (GDPR): Our lawful bases are consent (Article 6(1)(a)), contract performance (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)).
6. How We Use Your Data
- To provide and improve our services
- To respond to your enquiries and communications
- To send relevant updates (with your consent)
- To ensure security and prevent fraud
- To meet legal and regulatory obligations
We do not sell, rent, or trade your personal data to third parties.
7. Data Storage and Cross-Border Transfers
Your data may be stored on servers located in Indonesia, Singapore, or other countries where our infrastructure providers operate. Where data is transferred outside Indonesia, we ensure that adequate protections are in place consistent with UU PDP requirements on cross-border data transfers. Where data is transferred outside Singapore, we ensure compliance with PDPA's data transfer obligations.
Health-related data processed within LongeviTwin is processed locally on your device where technically feasible and is not transmitted to external servers in identifiable form.
8. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
- Right to access — request a copy of your personal data we hold
- Right to correction — request correction of inaccurate data
- Right to deletion / erasure — request deletion of your data (subject to legal retention obligations)
- Right to data portability — request your data in a portable format
- Right to withdraw consent — withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing. Withdrawal may limit your ability to use certain features.
- Right to object — object to processing based on legitimate interests
To exercise any right, contact us at hello@insivio.ai with the subject "Data Privacy Request." We will respond within 14 business days.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure, including encryption in transit and at rest, access controls, and regular security reviews.
10. Data Breach Notification
In the event of a personal data breach that is likely to cause harm:
- Indonesia: We will notify the relevant supervisory authority and affected individuals within 14 calendar days of becoming aware of the breach, as required under UU PDP.
- Singapore: We will notify the Personal Data Protection Commission (PDPC) within 3 business days of assessing that a breach is notifiable, and affected individuals without undue delay, as required under the PDPA (2021 amendment).
11. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. Account data is retained for the duration of your account and deleted within 30 days of account closure upon request.
12. Cookies and Analytics
Our website may use cookies and analytics tools to understand usage patterns. These tools process data in anonymised or aggregated form. You may disable cookies in your browser settings, though this may affect certain website functionality.
13. Children's Data
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, contact us immediately.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website. Continued use of our services following notification constitutes acceptance of the updated policy.
15. Contact Us
For any questions about this Privacy Policy or to exercise your data rights, contact us at hello@insivio.ai.