Privacy policy

1. Scope and responsibility

This policy applies to Plume’s public website and editorial contact channels operated from Jakarta, Indonesia. It explains the categories of information we may receive, why we use them, how long we retain them, and the choices available to readers. Plume is an informational publication rather than a healthcare provider. We do not intentionally collect health records through the website.

This policy should be read together with the Cookies policy, the Terms of use, and the Health disclaimer, which describe related commitments. It covers every public page of this website, the contact form at contact.php, and correspondence sent to the postal address or telephone number published here. It does not cover external websites that Plume links to; those services apply their own notices, and readers are encouraged to read them before sharing information. For readers in Indonesia, the relevant framework includes Law No. 27 of 2022 on Personal Data Protection, and the Plume editorial desk decides why and how contact information received through these channels is used.

• (a) A reader who only browses articles is not asked to provide any personal information.
• (b) A reader who writes to the editorial desk is treated as having chosen to share the details contained in that message.
• (c) Contributors, experts, and suppliers who correspond with Plume are covered in the same way as readers.

2. Information collected

We may receive a name, email address, telephone number, and message when a reader chooses to contact the editorial desk. Technical information such as browser type, approximate region, device category, referral page, and request time may be recorded in server logs for security and reliability. We do not ask for sensitive health details and ask readers not to submit diagnoses, medical records, or emergency information through ordinary forms.

In practice, the contact form asks for a name, an email address, an optional telephone number, a subject, and a free-text message. Only the email address and the message are needed to receive a reply, and a reader may use a first name or initials instead of a full name. Server logs normally record an IP address, the page requested, the response status, and a user-agent string, which are used to detect abuse and diagnose faults rather than to profile individual readers. If a message contains information that was not requested, such as a diagnosis or a medication list, the editorial desk may delete that part of the message and will tell the sender when it has done so.

• (a) Information a reader provides: name, email address, telephone number, subject, and message text.
• (b) Information generated by visiting: IP address, browser and device category, referral page, and timestamp.
• (c) Information stored by the browser: the cookieChoice preference described in the Cookies policy.

3. Legal basis and purpose

We use contact information to respond to a message, correct content, assess accessibility reports, and maintain editorial correspondence. The relevant basis may be consent when a person voluntarily submits a form, or legitimate interest when processing is necessary to secure and operate a public information service. We do not sell personal information or use submitted messages to make advertising decisions.

Consent applies where a reader voluntarily submits a form, and a reader can withdraw it at any time by writing to the editorial desk, although withdrawal does not affect handling that took place beforehand. Legitimate interest applies to server logs and basic security monitoring, where Plume considers that the interest in keeping a public site reliable is proportionate and has limited effect on a reader’s privacy. Where Indonesian law requires another basis, such as compliance with a lawful request from an authority, Plume will rely on that basis and limit the information provided to what is requested. Plume does not use automated decision-making that produces legal or similarly significant effects on a reader.

• (a) Replying to a message: consent.
• (b) Investigating a correction or accessibility report: consent, and legitimate interest in keeping the publication accurate.
• (c) Security logs and abuse prevention: legitimate interest.
• (d) Responding to a lawful request from a competent authority: legal obligation.

4. Retention periods

Routine contact messages are normally retained for up to 24 months after the last meaningful exchange. Security logs may be retained for up to 90 days, unless a longer period is reasonably required to investigate abuse or comply with a lawful request. Aggregated, non-identifying statistics may be retained longer because they do not reasonably identify a reader. We periodically review stored correspondence and remove material no longer needed.

Retention is counted from the date of the last meaningful exchange, not from the date of the first message, so an active conversation does not expire halfway through. A single enquiry that receives a reply and no further contact is therefore usually deleted about 24 months after that reply. Messages that report a factual error are kept for the same period, together with a short note of the correction made, so that the editorial desk can show how a decision was reached. Deleted correspondence is removed from the active mailbox immediately and from routine backups on the next backup rotation, which normally takes no more than 35 days.

• (a) Contact messages and replies: up to 24 months after the last exchange.
• (b) Server and security logs: up to 90 days, unless an investigation requires longer.
• (c) Cookie preference record: up to 13 months, held in the reader’s own browser.
• (d) Aggregated statistics without personal identifiers: kept for as long as they remain useful for editorial planning.

5. Cookies and similar tools

Our cookie banner records a preference named cookieChoice in the browser and keeps it until the reader clears site data or the preference is replaced. Essential session mechanisms, if used by the hosting environment, generally expire when the session ends. Limited analytics may use an anonymous event identifier with a lifespan of up to 13 months only when consent is available. Details appear in the Cookies policy.

The cookieChoice entry is stored in the reader’s browser rather than on a Plume server, and it contains only the word Accept or Reject together with the date of the choice. Essential session mechanisms, where the hosting environment issues one, are commonly named PHPSESSID or similar and expire when the browser is closed. Analytics identifiers are random strings that carry no name, email address, or telephone number, and they are not created when a reader selects Reject. A reader can change a choice at any time by clearing site data in the browser, after which the banner is shown again.

6. Service providers

Hosting, security, email delivery, and analytics providers may process limited information on our behalf. Providers receive only what is needed for the stated service and are expected to maintain confidentiality and appropriate safeguards. Plume does not authorise processors to sell correspondence or use it to build unrelated advertising profiles. A current provider description can be requested from the editorial desk.

Named third parties and services

The following services are involved in delivering the pages at the time of this update:

• Google Fonts (Google LLC and Google Ireland Limited): delivers the Lora and Open Sans typefaces. When a page loads, the font service receives the reader's IP address, browser type and the requested font files. Plume sets no advertising or tracking identifiers through this service.
• Web hosting and content delivery provider: serves the pages and stores contact messages on server storage. The provider's legal name, data-centre region and data processing terms are supplied in writing on request, within 20 working days.
• Telephone network operators: carry calls to the editorial desk line. Plume keeps no call recordings and notes only the details a caller chooses to share.

No third-party analytics script, advertising network, social media pixel or embedded video player is loaded by Plume pages at the time of this update. If one is introduced, it will be named in this list and reflected in the cookie banner before it is activated.

Data protection contact

Plume has designated its editorial desk as the data protection contact under Indonesia's Personal Data Protection Law (Law No. 27 of 2022). Requests to access, correct, delete or restrict personal data, and any privacy complaint, can be sent to:

Data Protection Contact, Plume editorial desk
Jalan Melati 15, RT.002/RW.005, Cilandak Barat, Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12430, Indonesia
Phone: +62 812 5558 7643

Readers can also use the contact form and begin the message with the words "Privacy request". Each request is acknowledged within 2 working days and answered within 20 working days.

Plume uses providers in four functional categories: web hosting, email delivery for replies to readers, security and traffic filtering, and limited analytics. Hosting is provided from data centres in Indonesia or elsewhere in the Asia-Pacific region, and email delivery is limited to sending and receiving the correspondence that a reader has started. Each provider is bound by written terms that restrict use of information to the contracted service, require confidentiality, and require prompt notice of a security incident. The editorial desk reviews these arrangements at least once each year and, on request, will describe the providers currently in use, the country in which each one operates, and the kind of information each one can access.

• (a) Hosting and content delivery: page requests and server logs.
• (b) Email service: sender address, message text, and delivery status.
• (c) Security filtering: IP address and request pattern.
• (d) Analytics, only with consent: anonymous event identifier and page path.

7. International transfers

Because website infrastructure can use regional or international data centres, information may be processed outside Indonesia. Where a transfer occurs, Plume seeks contractual, technical, and organisational safeguards appropriate to the nature of the information. Readers may request more detail about a particular transfer, subject to security and confidentiality limits. We avoid sending sensitive medical information through the site.

The most likely destinations for processing outside Indonesia are Singapore and other locations in the Asia-Pacific region, where several hosting and email providers operate data centres. Where information is transferred, Plume looks for written commitments on confidentiality and security, limits on onward disclosure, and a level of protection comparable to what Law No. 27 of 2022 expects. A reader who prefers that a message is not processed abroad can send a short letter to the Jakarta address instead, and the editorial desk will handle it on paper and through local email. Plume will not move correspondence to a new region without first reviewing the provider’s safeguards.

8. Reader rights

Depending on applicable law and circumstances, a reader may request access to personal information, correction of inaccurate details, deletion, restriction, or an explanation of processing. A request should identify the email address used and describe the action sought. We may need to verify identity before responding. We aim to respond within 30 days, or explain why additional time is reasonably required.

To exercise a right, a reader writes to the editorial desk from the email address that was used originally, or by post to the Jakarta address, and states which right is being exercised. We acknowledge a request within 5 working days and aim to give a full answer within 30 days. If a request is complex or involves several systems, the answer may take longer, and the reader will be told the reason and a new date. A request may be declined where it would expose another person’s information, conflict with a legal duty to keep a record, or is clearly repetitive, and the reason will be given in writing.

• (a) Access: a copy or summary of the personal information held about the reader.
• (b) Correction: amendment of details that are inaccurate or incomplete.
• (c) Deletion: removal of correspondence that Plume no longer needs.
• (d) Restriction or objection: a pause on, or an end to, particular uses such as analytics.
• (e) Withdrawal of consent: stopping future handling that depends on consent.

9. Children and vulnerable people

Plume is written for adults and is not directed at children. We do not knowingly request information from anyone under 18. If a parent, guardian, or reader believes a child has submitted personal information, contact the editorial desk so the material can be reviewed and deleted where appropriate. Urgent health or safety matters should be taken to local emergency services or qualified professionals.

Because Plume is written for adults, the contact form does not include an age field and the editorial desk does not seek out the age of correspondents. If a message appears to come from someone under 18, the desk replies in general terms, avoids requesting further personal details, and deletes the message once the reply has been sent. A parent or guardian may ask in writing for the removal of information about a child, and Plume will act on a reasonable request within 14 days. Readers who are in distress are encouraged to contact local emergency services, a hospital, or a qualified counsellor, since an editorial inbox cannot give personal support.

10. Security

We use access controls, transport encryption where supported, limited administrative permissions, and routine review of contact channels. No internet transmission can be promised completely secure. If we become aware of a material incident affecting personal information, we will assess its scope, take reasonable containment steps, and communicate where required by applicable obligations.

Access to the mailbox that receives contact messages is limited to named members of the editorial desk and uses individual credentials with a password policy and, where the provider supports it, two-step verification. Pages are delivered over HTTPS where supported, and administrative changes to the site are limited to a small group. Where a material incident affects personal information, Plume will inform affected readers and the competent authority within the period required by applicable law, which for written notice under Law No. 27 of 2022 is currently 3 x 24 hours. Readers can help by using a dedicated email address for correspondence and by reporting any suspicious message that appears to come from Plume.

11. Complaints and contact

Questions about this policy can be sent to Plume at Jalan Melati 15, RT.002/RW.005, Cilandak Barat, Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12430, Indonesia, or by phone at +62 812 5558 7643. Please explain the concern and include a safe way to respond. Readers may also contact the relevant Indonesian authority or another competent regulator if they believe their rights have not been respected.

The editorial desk acknowledges privacy enquiries within 5 working days and aims to give a full reply within 30 days. A complaint should describe what happened, the date, the page or channel involved, and the outcome the reader would like to see. If the first reply does not resolve the matter, the reader can ask for a second review by a different member of the editorial desk, which is normally completed within 21 days. Readers in Indonesia may also raise a concern with the Ministry of Communication and Digital Affairs (Komdigi) or another competent authority at any time, without waiting for Plume’s review.

• (a) By post: Plume editorial desk, at the Jakarta address above.
• (b) By telephone: +62 812 5558 7643, during Jakarta business hours on weekdays.
• (c) By form: contact.php, which shows a confirmation message after the message is sent.

12. Changes and history

This policy was published for the 2026 editorial year and last revised on 12 February 2026. Earlier revisions may have clarified retention periods, cookie descriptions, and contact procedures without changing the publication’s commitment not to sell personal information. Material changes will be dated on this page. Continuing to use the site after an update means only that the revised information is available to read; consent will still be requested where required.

Change history for this page, newest first:

• 12 February 2026: clarified retention periods for contact messages and security logs, expanded the description of the cookieChoice preference, and added the procedure and response times for reader requests.
• 5 January 2026: first publication of the privacy policy for the 2026 editorial year.

Where a change is material, such as a new category of provider, a new purpose, or a longer retention period, the page will show the date of the change and a plain description of it. Minor wording changes that do not affect a reader’s rights will be recorded in the same list.