1. Who is responsible for your data
Komite Akreditasi Kesehatan Pratama acts as the Personal Data Controller for data processed through this service. We determine the purposes and means of processing, and we are responsible for protecting it.
Secretariat address: Sahid Sudirman Center, Lantai II Suite A, Jl. Jenderal Sudirman 86, Karet Tengsin, Jakarta Pusat.
KAKP and KAKL are two institutionally separate bodies, although they are run by one team and share a single information system. Your accreditation and training records are stored separately by the institution you deal with. One account works at both; what is shared between them is your account identity only, not your activity records.
2. Personal data we collect
We collect only what is needed to operate the following services:
- Account data: full name with academic titles, email address, phone/WhatsApp number, and password (stored as a hash, never in its original form).
- National identity number (NIK): used solely as a unique identity marker, so that one person does not hold two accounts and so that the name on a certificate genuinely belongs to the same person.
- Training records: institution, position, region, registration history, attendance, and certificates issued.
- Payment data: invoice number, amount, payment channel, and the transfer proof you upload. We never store your card numbers or banking credentials.
- Accreditation submission data: healthcare facility identity, supporting documents, and process history, for users acting on behalf of a facility.
- Messages you send through the Contact Us form: name, email address, phone number if you provide one, subject, and the message itself.
- SIFASKES interest submissions: healthcare facility details (name, type, facility code, address, region) together with the contact person you name (name, position, phone number, email address) and the requirements you describe.
- Internal handling notes: brief remarks written by our staff while following up your message or submission. These are not sent to you, but they are part of the data you may request a copy of.
- Technical data: IP address, browser type, access time, and security activity logs. This is used to keep the system secure and to trace misuse.
3. Special treatment of the NIK
The NIK is classified as specific personal data. It is therefore treated differently from other data:
- Stored encrypted, never as plain text.
- Never displayed in full on any screen — only the first and last four digits.
- Never shown on the public certificate verification page.
- Never shared with third parties for marketing purposes.
4. Legal basis and purpose of processing
We process your personal data on the following bases:
- Your consent, given explicitly at registration and withdrawable at any time.
- Performance of a contract, when you register for an event or submit an accreditation survey request.
- Compliance with legal obligations and the discharge of our duties as an accreditation body under Ministry of Health rules.
- Legitimate interests, in particular keeping the system secure and preventing misuse.
5. Who your data is shared with
We do not sell your personal data. It is shared only as far as necessary with:
- The Ministry of Health and its designated official information systems, limited to data that must be reported in the conduct of accreditation.
- Payment service providers, limited to what is needed to process your transaction.
- Email delivery providers, limited to your address and the notification content.
- Law enforcement authorities, where required under applicable law.
- The SIFASKES team, as the operator of the electronic medical records application, limited to the contents of the interest submission you send — the facility details and the contact person you name — so that they can contact you. This transfer happens only if you yourself complete the SIFASKES interest form.
- Assigned surveyors and verifiers, limited to the facility documents covered by their assignment, with access recorded.
6. Data that is publicly visible
A small amount of data is deliberately public, because that is its purpose. The certificate verification page shows the serial number, certificate holder’s name, event name, CPD credits, issue date, and issuing institution — so that a third party can confirm a certificate really was issued by us.
That page never shows the NIK, address, phone number, or email address. Verification result pages are also excluded from search engine indexes, and the number of lookups is rate-limited to prevent bulk harvesting of the registry.
7. How long data is kept
Data is kept for as long as it is needed for the purpose it was collected for:
- Certificate records are kept permanently, because their authenticity must remain verifiable by third parties years later.
- Training registration and payment records are kept for the periods required by records-management and tax rules.
- Accreditation submission data is kept for the validity period of the accreditation status and the following re-accreditation cycle.
- Contact Us messages are kept for 2 years after they are resolved, then deleted automatically.
- SIFASKES interest submissions are kept for 2 years after they reach a final status (deal or cancelled), then deleted automatically.
- Technical security logs are kept short-term, only as long as needed for incident investigation.
Once the retention period ends, data is destroyed or anonymised so that it can no longer be linked to you.
8. How we secure your data
We apply reasonable technical and organisational safeguards, including encryption in transit and encryption of the NIK at rest, role-based access restrictions, mandatory two-factor authentication for administrative roles, audit logging of significant actions, and rate limiting on public endpoints.
No system is entirely immune. If a personal data breach occurs, we will notify you and the competent authority in accordance with the Personal Data Protection Law.
9. Your rights over your personal data
Under the Personal Data Protection Law, you have the right to:
- Be informed about the personal data we process about you and why.
- Access and obtain a copy of your personal data.
- Correct data that is inaccurate or misleading.
- End the processing of, delete, or destroy your personal data, so far as this does not conflict with our legal obligations.
- Withdraw consent you have previously given.
- Object to processing based on automated decision-making.
- Postpone or restrict the processing of your personal data.
- Claim compensation for unlawful processing of your personal data.
Requests may be submitted through the channels in the Contacting us section below. We respond within 14 working days of receiving a complete request. Please note that deleting some data may leave your account unusable, and it does not remove certificates already issued, whose authenticity must remain verifiable.
10. Cookies
We use only the cookies needed for the service to work — keeping you signed in, protecting forms against request forgery, and remembering your language choice. We set no advertising cookies and no third-party trackers. Full details are in the Cookie Policy.
11. This service is not for children
This service is intended for adult healthcare workers and facility managers. We do not knowingly collect children’s personal data. If you become aware that this has happened, please tell us so we can delete it.
12. Changes to this policy
This policy may be updated. Every substantive change comes with an increased version number and effective date shown at the top of the page. Where a change affects the basis of your consent, we will ask for your consent again before continuing to process your data.
13. Contacting us
Questions, requests to exercise your rights, or objections to processing may be sent by email to sekretaris@kakp.id or in writing to our secretariat at Sahid Sudirman Center, Lantai II Suite A, Jl. Jenderal Sudirman 86, Karet Tengsin, Jakarta Pusat.
If you consider our response inadequate, you have the right to lodge a complaint with the competent personal data protection authority.