Privacy Policy

1. Who we are

SPARK (sparkmedical.id and teams.sparkmedical.id) is run by SPARK & Co studio, the controller of the personal data described here under Indonesia's Personal Data Protection Law (UU No. 27 of 2022). Contact: sparkbyhanami@gmail.com, or Contact Admin inside the app.

2. What we collect

Account: your name, email address, password (stored only as a secure hash by our authentication provider), your institution if you have one, and a student ID number if you give it at an institutional checkout.

Sign-in and security: when you sign in, a coarse device label (for example "Chrome · iOS"), the time, and whether a session was started, ended or replaced. We do not store your IP address; it is used only for a moment to stop form spam. Sign-in and registration use Cloudflare Turnstile, which checks that you are not a bot.

Subscriptions and payments: what you bought, when, its price and its status. Card and bank details are entered with our payment provider, Midtrans, and never reach SPARK.

What you write into SPARK: patient boards (Patient Format+, Shared Format, internal notes), SPARK Teams rosters and schedules (the names and emails a chief adds, duties, events, swaps), support chat messages, and feedback form answers.

Usage: page views counted in aggregate by Vercel Web Analytics, which uses no cookies and no personal identifiers.

3. Patient information

Patient Format+ stores the patient details you enter so your boards survive between devices. You decide what is entered, and you should enter only what your clinical duty needs. SPARK processes this information on your behalf, shows it only to you (or, on a Shared Format board, to the colleagues with access to that board), keeps an edit history for accountability, and deletes every patient row automatically after 14 days without an edit. It is never used for analytics, marketing or anything other than showing it back to the people entitled to see it.

4. Why we use it

To run your account and sign you in safely, including the one-device rule; to give you what you subscribed to and record payments; to keep shared boards and Teams schedules in sync between the people who use them; to answer support messages; to keep the service secure and fix problems; and to understand, in aggregate, which parts of SPARK are used. We rely on the contract between us (the Terms) and, where needed, your consent.

5. Who else processes it

We do not sell personal data and we do not share it for advertising. These providers process it for us, under their own security obligations: Supabase (database and authentication), Vercel (hosting and aggregate analytics), Midtrans (payments), and Cloudflare (bot protection). Their servers may be outside Indonesia; we use them because they apply recognised safeguards. We disclose data to authorities only when the law requires it.

6. How long we keep it

Patient rows and their edit history: 14 days after the last edit. Sign-in records: 90 days. Your account, subscriptions and SPARK Teams memberships: while your account exists. Payment and invoice records: as long as tax and accounting law requires. Support messages and feedback: until they are no longer needed to help you or improve SPARK.

7. Your rights

Under UU PDP you may ask to see the data we hold about you, to correct it, to have it deleted, to restrict or stop a processing, to withdraw a consent you gave, to object to a processing, and to receive your data in a usable form. Write to sparkbyhanami@gmail.com or use Contact Admin; we answer within the time limits the law sets. Deleting your account removes your profile, subscriptions and boards, except records the law requires us to keep.

8. Security

Data travels over encrypted connections. Access is limited by row-level security, so each person can reach only their own data and the boards they belong to. Passwords are never stored in readable form. If a breach affects your personal data, we will tell you and the authority within the time UU PDP requires (3 × 24 hours).

9. Cookies and local storage

SPARK uses no advertising or tracking cookies. Your browser keeps a few items for the app to work: your sign-in session, language, theme, and preferences such as pinned tools and unsaved calculator inputs. Clearing your browser data removes them.

10. Messages from us

We send only service messages: sign-in and password emails, messages about your payments, and announcements inside the app. We do not send marketing email unless you have opted in.

11. Who SPARK is for

SPARK is for medical students, doctors and other health professionals aged 18 or over. It is not intended for children.

12. Changes

If this policy changes in a way that matters, we will say so in the app before it takes effect. The date at the top shows the current version.