Editorial note: Parnon publishes general educational material. Consult a qualified health professional before changing exercise or nutrition routines.

LEGAL · UPDATED OCTOBER 5, 2026

Privacy policy

This policy explains how Parnon handles information when visitors read the publication, contact the editorial team, or interact with optional cookies. It applies to the website operated from Jalan Sudirman No. 12, Jakarta Pusat, DKI Jakarta 10220, Indonesia. It does not override a specific notice presented in a separate service. This document is intended to reflect the transparency expectations found in Indonesia's Personal Data Protection Law (Law No. 27 of 2022, commonly called the UU PDP) alongside general international good practice for an editorial website. For example, a reader who only browses articles without submitting a form generates far less information than a reader who writes in with a detailed question, and most visitors interact with Parnon at the level of ordinary, largely anonymous web traffic. A smaller group of visitors who choose to correspond with the editorial team share identifiable details voluntarily, and that correspondence is handled with additional care as described in Section 4. Where a dedicated notice exists for a specific future feature, such as a newsletter sign-up or a reader survey, that notice is read together with this policy and takes precedence on any point of conflict. This policy is published in English because Parnon publishes in English, and a visitor relying on machine translation should contact us if a translated version appears to create ambiguity.

1. Data controller and scope

Parnon is responsible for the editorial website and the contact channels identified on this page. We collect information necessary to operate a publication, respond to a message, protect the service, and understand broad usage when consent is provided. We do not sell personal information as a standalone data product. In practice this means the editorial team based at the Jakarta address above decides why and how information is processed, rather than an outside advertiser or distribution partner making that decision on our behalf. For example, if a reader submits a correction request, Parnon decides who reviews it, how long the message is kept, and when it is deleted, instead of delegating that choice to a vendor. The scope of this policy covers the public website, the contact form, and resulting email correspondence; it does not extend to a social platform's own privacy practices when a reader interacts with Parnon through that platform, such as a public comment left on a shared article link. Where Indonesian law or a comparable framework in a reader's home jurisdiction provides a stronger protection on a particular point, Parnon aims to apply the more protective standard rather than the minimum legally required.

a. The editorial team, not an advertiser or distribution partner, decides the purpose and means of the processing described on this page.
b. This policy covers the Parnon website and its contact channels; it does not cover a third-party platform's handling of an interaction that happens outside those channels.
c. A dedicated notice published for a specific feature controls on any point where it differs from this general policy.

2. Information collected

We may receive a name, email address, message content, and details voluntarily supplied through contact. Technical logs may include an IP address, browser type, device category, requested page, referral page, and timestamp. We try to avoid collecting sensitive information and ask visitors not to send medical records or unnecessary health details. A typical example is a reader writing to flag a factual error in an article about recovery protocols, which usually involves only a name, an email address, and a short message about the page in question. Technical logs are generated automatically by the hosting environment for essentially every visit, including one where no form is ever submitted, and are not cross-referenced with a name unless a security investigation makes that necessary. If a visitor nonetheless includes sensitive information, such as a specific diagnosis or medication list, in a free-text message, that information is handled with the same confidentiality as the rest of the message and is deleted on the same schedule described in Section 5. We do not knowingly collect precise geolocation, biometric identifiers, or payment card data through the current public website, since no payment or location feature exists on it today.

a. Form fields: name, email address, and the free-text message a visitor chooses to write.
b. Automatic technical data: IP address, browser and device category, requested URL, referring page, and timestamp, collected for essentially every visit.
c. Anything sensitive a visitor volunteers unprompted is minimized where possible and never requested by Parnon.

3. Legal bases

Processing may be based on responding to a request, operating and securing the website, pursuing legitimate editorial administration, or consent for optional analytics cookies. Where consent is the basis, a visitor can withdraw it by clearing the cookie choice or contacting us. Withdrawal does not make earlier processing unlawful. For a contact message, the basis is typically the visitor's own request for a reply, which creates a reasonable expectation that Parnon will process the message to answer it. For technical security logs, the basis is a legitimate interest in keeping the website available and resistant to abuse, balanced against the limited privacy impact of short-lived, non-targeted log data. For optional analytics, the basis is the consent captured through the cookie banner described in the Cookies Policy, and no analytics identifier is set before that consent is given. A practical edge case is a visitor who rejects analytics but still submits a contact form: that message is still processed under the request-response basis, independent of the cookie decision.

a. Contact and correction requests: processed under the basis of responding to the visitor's own request.
b. Security and reliability logs: processed under a legitimate interest, limited to what is needed to protect the service.
c. Optional analytics: processed only after affirmative consent through the cookie banner, and withdrawable at any time.

4. Contact messages

Messages are used to answer the request, investigate corrections, moderate abuse, or document an editorial decision. Access is limited to people who need it for those purposes. We do not use a contact message to create a marketing list without a separate lawful basis and clear notice. For example, an editor reviewing a correction request may consult the original article's fact-checking notes to verify the claim, but that editor does not forward the message to an advertising or sponsorship contact. Access to the shared inbox is limited to a small number of editorial staff, and each person with access is expected to treat message content as confidential, consistent with the Editorial Policy's conflict-of-interest provisions. If a message is abusive, threatening, or clearly unrelated to the publication, it may be retained longer than the standard period described in Section 5 solely to document the incident and support a decision to restrict further contact. Parnon does not forward a reader's message to a third party for that party's own marketing purposes.

5. Retention

Routine contact correspondence is normally retained for 24 months after the last meaningful exchange. Security logs are normally retained for up to 90 days, unless a longer period is necessary to investigate abuse or comply with law. Published correction records may be retained for the life of the relevant article so that the editorial history remains accountable. For example, a reader's one-off question that is answered and not followed up on would normally be deleted around 24 months after that final reply, while an active back-and-forth correspondence resets that period with each new message. Security logs tied to a specific incident, such as an attempted intrusion, may be kept beyond 90 days for as long as the investigation or a related legal obligation remains open, after which they are deleted in the ordinary course. A correction record is kept separately from the underlying contact message and typically consists only of a short, dated note describing what was changed and why, without retaining the reader's full personal details indefinitely.

a. Ordinary contact messages: approximately 24 months from the last reply, then deleted.
b. Security and access logs: approximately 90 days, extended only for an active investigation or legal requirement.
c. Editorial correction notes: kept for the life of the article, but stripped of unnecessary personal detail.

6. Cookies

The cookieChoice preference may remain for 12 months and records accept or reject. Essential session mechanisms, if used by hosting infrastructure, expire when the session ends. Optional analytics identifiers, if enabled after consent, are configured for a maximum lifespan of 13 months and are reviewed during 2026. Details appear in Cookies. For example, a returning visitor who accepted optional analytics in January 2026 would have that consent remembered until the cookieChoice preference itself expires around January 2027, after which the banner reappears and consent is requested again. No optional cookie is set on first load of the page; the banner must be actively accepted before any non-essential identifier is created. A visitor who clears their browser storage effectively resets both the consent record and any analytics identifier, which is treated the same as a first-time visit.

7. Processors and disclosure

Hosting, security, email delivery, and analytics providers may process limited information on our instructions. Specifically, the website is hosted and delivered through infrastructure operated by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, United States), which also provides the standard network-level security and DDoS protection described in Section 1. Correspondence sent through the Contact page is relayed through a transactional email delivery provider used solely to route that message to the editorial inbox, and is not used by that provider for advertising purposes. Where optional analytics are enabled under Section 3 of the Cookies Policy, aggregate usage data is processed through a privacy-oriented analytics tool configured not to set cross-site advertising identifiers. Each of these processors is contractually limited to acting on Parnon's instructions and is not permitted to use the information for its own independent marketing purposes. We may disclose information where required by Indonesian law, a valid legal process, or an urgent security investigation. Providers are expected to apply access controls and confidentiality appropriate to their role. For example, a hosting provider processes technical logs to keep the website online but has no independent right to use that data for its own marketing. An email delivery provider used to route a reply to a contact message sees only the fields necessary to send that reply and is contractually limited to that purpose. We do not disclose a reader's message content to an advertiser, sponsor, or unrelated third party as a matter of routine business; disclosure outside the categories above happens only in the narrow circumstances described, such as a lawful request from an Indonesian authority or a credible threat to the security of the service.

a. Infrastructure processors: hosting, content delivery, and email providers acting strictly on Parnon's instructions.
b. Legal disclosure: only where required by Indonesian law, a valid legal process, or to address an urgent security matter.
c. No routine disclosure to advertisers or sponsors of a reader's personal message content.

8. International transfers

Some infrastructure providers may process data in countries outside Indonesia. Before selecting a provider, Parnon considers contractual safeguards, security practices, and the provider's stated transfer mechanisms. Visitors may contact us for general information about the categories of recipient involved. For example, a content delivery or email routing provider may operate data centers in more than one country as part of normal redundancy, which can mean a technical log is briefly processed outside Indonesia even though the website itself is operated from Jakarta. Where this occurs, Parnon expects the provider to maintain contractual confidentiality and security commitments consistent with the provider's published data processing terms. This section does not create a right to receive a full list of every sub-processor, but a visitor may ask general questions about the type of infrastructure used and the regions involved.

9. Rights and requests

Subject to applicable law, a person may ask about access, correction, deletion, restriction, or withdrawal of consent. Send a request through contact with the email address used for correspondence and a clear description of the request. We may need to verify identity proportionately before disclosing or changing information. For example, a person asking what information Parnon holds about them should include the email address they previously used to contact us, since searching by name alone may not reliably locate the correct record. A request to delete a message that is part of an active, unresolved correction investigation may be delayed until that investigation concludes, consistent with the legitimate interest described in Section 3. Parnon aims to acknowledge a rights request within a reasonable period and typically responds substantively within 30 calendar days, extended where a request is unusually complex and the visitor is told about the extension.

a. Access and correction: ask what is held and request that inaccurate details be fixed.
b. Deletion and restriction: ask for a message or record to be deleted or its use limited, subject to legitimate retention needs described above.
c. Consent withdrawal: ask that optional analytics stop being applied to future visits.

10. Complaints

We prefer to resolve questions directly. Contact Parnon at Jalan Sudirman No. 12, Jakarta Pusat, DKI Jakarta 10220, Indonesia or +62 813 6789 2541. Privacy-specific inquiries, including a request to exercise the rights described above, can be directed in writing to the attention of the Data Protection Officer at the same postal address, or by phone, and will be routed internally to the person responsible for privacy compliance. Parnon does not sell personal information to third parties for monetary or other valuable consideration, and does not share personal information with third parties for cross-context behavioral advertising. A visitor who nonetheless wishes to submit a Do Not Sell or Do Not Share My Personal Information request, or a comparable opt-out request recognized under applicable regional law, may do so using the same contact details above, and the request will be acknowledged within 10 business days consistent with the response times described elsewhere in this policy. A person may also contact the competent Indonesian authority or another regulator with jurisdiction if they believe applicable privacy law has been breached. For example, a visitor who is not satisfied with Parnon's response to a rights request described in Section 9 may escalate the matter to the Indonesian Ministry of Communication and Digital Affairs or the personal data protection authority established under the UU PDP, depending on which body has jurisdiction over the complaint at the time it is raised. Parnon aims to respond to an initial complaint sent to the contact details above within 10 business days to confirm receipt, with a substantive response following as the matter is reviewed. Keeping a direct channel open with Parnon first is encouraged because it is typically the fastest way to correct a straightforward error.

11. Children

Parnon is written for adults and does not knowingly request personal information from children. If a parent or guardian believes a child submitted information, contact us with enough detail to locate the record. We will review the request and remove information where required. For example, if a parent identifies a specific message by date and the email address used, Parnon will locate that message, assess whether it appears to have been submitted by a minor, and delete it where appropriate rather than retaining it for the standard period described in Section 5. The website does not include a feature directed at children, and no content on the site is designed to appeal specifically to a person under the age of majority in their jurisdiction.

12. Changes

This policy was reviewed on October 5, 2026. Material changes will be dated on this page and described in plain language. Earlier versions may be retained for governance, but the current version governs future processing from its effective date. A change log is kept internally so that a reader comparing an older printed or saved copy of this page with the live version can ask the editorial team what changed and why. The October 5, 2026 review confirmed the retention periods in Section 5, the cookie lifespans in Section 6, and the contact details throughout this page, and no prior version of this policy remains in force for new processing after that date.