Privacy Policy

1 Introduction

2 Definitions

• Personal Data — data about an identified or identifiable individual, as defined under the PDP Law.
• Specific Personal Data — sensitive data; in the context of this App, your emotional health condition based on screening results.
• Research Data — data that has been separated from direct identifiers (using participant codes) and used for research analysis.
• You / Participant — the account owner using the App, either as a service user or a research respondent.

3 Information We Collect

3.1 Information you provide directly

3.2 Information collected automatically

• Location — approximate or precise location (only with your permission) used to calculate distance and sort the psychologist directory by proximity to your location. We do not store your location history.
• Technical data — device model, operating system, app version, IP address, access logs, and diagnostic data.
• Usage data — features used and app preferences. Some data is stored locally on your device (cache) to speed up the app.

3.3 Data from Google (Google Sign-In)

• If you sign in using Google Sign-In, we receive the name, email address, and profile photo associated with your Google Account.
• This data is used only for authentication and account creation in the ELMA App. We do not sell Google user data, do not use it for advertising, and do not transfer it to third parties except as necessary to operate this service (see Section 8).
• You can revoke ELMA's access to your Google Account at any time via myaccount.google.com/permissions, or by deleting your ELMA account (see Section 12).

4 Purposes of Processing and Legal Bases

5 Research Participation Consent and Right to Withdraw

The ELMA App is part of an academic research activity. Participation terms:

1. Voluntary — you participate of your own will, without coercion, and may stop using the App at any time without any sanction or consequence.
2. Research information — explanations of the purpose, procedures, benefits, and risks of the research are provided through this Privacy Policy and/or a separate research information document. This research is conducted in accordance with the research ethics guidelines and academic regulations of Universitas Negeri Jakarta.
3. Explicit consent — before taking a screening, you are asked to consent to the processing of your screening result data for service and research purposes.
4. Publication — research results may be published in journals, proceedings, theses/dissertations, or other scientific media, only in aggregate/anonymous form that does not allow participant identification.
5. Withdrawing from the research — you may request that your data no longer be used for research by contacting us at the details in Section 17. Data that has not been anonymized will be deleted; data already anonymized/aggregated and published cannot be retracted.

6 Protection and Separation of Participant Identity

To protect your identity:

• Data used for research analysis is separated from direct identifiers (name, email, phone number) and identified using participant codes.
• The mapping between participant codes and identities is stored separately with access limited to authorized research team members.
• Published data does not contain names, emails, phone numbers, photos, or combinations of data that could identify you.

7 Data Storage and Retention

• Data is primarily stored on servers located in Indonesia (Jakarta) — PT Dewaweb — and/or our cloud service providers.
• Account and identity data is stored while your account is active and during the research period; after a verified account deletion request, the data is deleted or anonymized within a maximum of 3×24 hours.
• Anonymized research data may be retained for up to 5 years after the research concludes for result verification, follow-up publications, and academic obligations, in accordance with research data management practices.
• Longer retention may apply where required by applicable laws or institutional regulations.

8 Sharing Data with Third Parties

We do not sell, rent, or use your Personal Data for commercial purposes. We may share data on a limited basis with:

1. Research team members and academic supervisors — for research analysis, under confidentiality obligations.
2. Infrastructure, media storage, and email delivery providers — PT Dewaweb (servers), Cloudinary (image storage), and Resend (email) — to store and process data according to our instructions.
3. Google — if you use Google Sign-In, subject to Google's privacy policy.
4. Groq, Inc. (AI model provider) — to process chatbot conversations and screening content automatically to generate responses.
5. Law enforcement or regulators — where required by applicable laws and regulations.

Scientific publications only contain anonymized/aggregated data. Screening data is not shared for advertising or marketing. Google user data is not sold or shared with third parties for any purpose beyond those described in this Privacy Policy.

9 International Data Transfers

Primary data is stored on servers in Indonesia (PT Dewaweb). Some service providers we use (e.g., Groq, Cloudinary, and Resend) may process data outside Indonesia. In such cases, we ensure a level of data protection equivalent to or higher than that required under the PDP Law.

10 Data Security

We apply reasonable technical and organizational measures, including:

• Encryption of data in transit (HTTPS/TLS) between the App and the server.
• Storage of authentication tokens in secure storage on the device.
• Separation of identity data and analysis data, and access limited to authorized personnel.
• Regular monitoring and system updates.

However, no method of transmission or storage is 100% secure. If you become aware of a suspected security incident, contact us at care@elma-app.tech.

11 Your Rights as a Data Subject

Under the PDP Law, you have the right to:

1. Access and obtain a copy of your Personal Data.
2. Correct inaccurate data (via the Profile menu in the App).
3. Delete your Personal Data (see Section 12).
4. Withdraw consent for data processing, including research participation consent.
5. Object to certain processing, including automated processing.
6. Obtain data portability in a commonly used format.
7. Lodge a complaint with us and/or the PDP supervisory authority.

Requests may be submitted via the Profile menu in the App or by email to care@elma-app.tech with the subject "Permintaan Data ELMA". We will respond within 14 business days.

If you signed in with Google, you can also revoke ELMA's access to your Google Account at any time via myaccount.google.com/permissions.

13 Children

The App is intended for users aged 18 years or older and/or those meeting the research sample criteria. We do not knowingly collect Personal Data from minors without parental/guardian consent. If we become aware that data from a minor has been collected without valid consent, we will delete such data.

14 Cookies and Local Storage

The mobile app uses local storage on your device (content cache, preferences, and authentication tokens) for service functionality. We do not use advertising cookies in the App. The ELMA website may use functional cookies necessary for site operation.

15 Not an Emergency Service

ELMA is not a medical, diagnostic, or emergency service. Screening results are indicative only, not a professional diagnosis, and do not replace consultation with a health professional. If you are in crisis or an emergency, contact 119 (extension 8) or your nearest emergency service.

16 Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including where there are changes to the research design or ethics approval. Material changes will be notified via the App or email at least 7 days before they take effect. The latest version is always available on this page.

17 Contact