Skip to main content
Her Form

Privacy Policy

Last updated: February 2026

Draft Notice: This privacy policy is subject to formal legal review and may be updated. Please check back for the finalised version.

1. Who We Are

This policy applies to PT Form Life Bali ("we", "us", "our"), an Indonesian-registered company operating two health optimisation brands:

We provide at-home blood testing packages, AI-powered health coaching, personalised lab report analysis, supplement recommendations, and consultation booking for customers in Indonesia and Australia.

Contact: hello@getherform.com

2. What Data We Collect

2.1 Personal Information

  • Name, email address, phone number
  • Telegram and/or WhatsApp ID
  • Shipping address

2.2 Health & Biomarker Data

  • Blood test lab reports (PDF)
  • Extracted biomarker values (e.g. testosterone, estrogen, thyroid, liver, kidney, vitamins)
  • Health questionnaire responses
  • AI coaching conversation history
  • Lifestyle data you share with us (exercise, sleep, diet, supplements, goals, menstrual cycle information)

2.3 Order & Transaction Data

  • Purchase history and order details via Shopify
  • We do not store credit card numbers — payment processing is handled by Shopify's payment providers

2.4 Usage Data

  • Website analytics collected via PostHog (page views, interactions, device info)
  • Email engagement data (opens, clicks) via Klaviyo/Resend

3. How We Use Your Data

We use your data for the following purposes:

  • Health analysis: Analysing your blood test results to generate personalised reports and recommendations
  • AI coaching: Powering your personalised coaching experience via our Telegram/WhatsApp bots
  • Report generation: Creating and delivering your personalised lab reports
  • Customer support: Responding to your questions and providing assistance
  • Order fulfilment: Processing and shipping your testing kits
  • Marketing (with consent): Sending you relevant health tips, promotions, and product updates — you can unsubscribe at any time

4. AI Processing Disclosure

We use artificial intelligence to enhance our services. Here's how:

  • Lab report analysis: Your biomarker data is sent to Anthropic's Claude AI via API for analysis and report generation. Data is processed according to Anthropic's data processing terms and is not used to train their models.
  • AI coaching bots: "Mia" (Her Form) and "Marcus" (His Form) are AI coaching assistants that provide personalised guidance via Telegram and WhatsApp. Conversation history is stored to maintain context and improve your coaching experience.

Important: No automated decision-making without human review.

All lab reports generated by AI are reviewed by our team before delivery to you. AI coaching is educational and for wellness optimisation only — it is not a substitute for medical advice.

5. Data Sharing

We never sell your data. We share data only with trusted third-party service providers ("processors") who help us deliver our services:

  • Google Cloud Platform (GCP) — data storage and infrastructure (Sydney, Australia region)
  • Anthropic — AI analysis and coaching (Claude API)
  • Resend — transactional email delivery
  • Shopify — e-commerce and order management
  • Calendly — consultation booking
  • Meta (WhatsApp, Instagram, Facebook Messenger) — customer communication channels
  • Chatwoot — customer support platform (self-hosted)

Each processor is contractually required to protect your data and use it only for the purposes we specify.

6. Data Storage & Security

  • Primary storage: Google Cloud Platform, Sydney (Australia) region
  • Database: Cloud SQL (PostgreSQL), encrypted at rest
  • File storage: Google Drive (shared team drive) for lab report PDFs
  • Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
  • Access controls: Role-based access, limited to authorised team members only
  • CRM: Twenty CRM (self-hosted on GCP Sydney) for internal team workflow — not shared externally

7. Data Retention

  • Health & biomarker data: 2 years from date of collection
  • AI coaching conversation history: 2 years from last interaction
  • Order & transaction data: 7 years (tax and regulatory compliance)

You can request deletion of your data at any time (see Your Rights below). We will delete your data within 30 days of a verified request, unless we are legally required to retain it.

8. Your Rights

Regardless of where you are located, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Correction — ask us to correct inaccurate or incomplete data
  • Deletion — request that we delete your data (subject to legal retention requirements)
  • Portability — receive your data in a structured, commonly used format
  • Withdraw consent — withdraw your consent for data processing at any time
  • Lodge a complaint — file a complaint with the relevant data protection authority (see section 15)

To exercise any of these rights, email us at hello@getherform.com. We will respond within 30 days.

9. Cookies & Analytics

We use the following analytics and tracking tools:

  • PostHog — website analytics (page views, user interactions, feature usage)
  • Shopify Analytics — e-commerce performance tracking
  • Meta Pixel — advertising performance measurement

These tools may use cookies or similar technologies. You can manage cookie preferences through your browser settings.

10. Children

Our services are not intended for individuals under 18 years of age. We do not knowingly collect data from children. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Cross-Border Transfers

Your data is primarily stored in Australia (GCP Sydney region). However, some processing may involve data being transmitted to servers in the United States — specifically when using Anthropic's Claude AI API for biomarker analysis and coaching.

We ensure all cross-border transfers comply with applicable data protection laws in both Indonesia and Australia, and that receiving parties maintain equivalent or higher standards of data protection.

12. Indonesian Law — UU PDP No. 27/2022

Under Indonesia's Personal Data Protection Law (Undang-Undang Perlindungan Data Pribadi), your health data is classified as "specific personal data" (data spesifik) and receives heightened protection.

Legal Basis for Processing

We process your specific personal data based on your explicit consent, which you provide when you purchase our services and complete the health questionnaire.

Data Controller Obligations

  • We maintain records of all data processing activities
  • We implement appropriate technical and organisational security measures
  • We conduct data protection impact assessments for high-risk processing

Breach Notification

In the event of a personal data breach, we will notify affected individuals and the relevant authority within 3 × 24 hours as required by UU PDP.

Your Rights Under UU PDP

In addition to the general rights listed in section 8, Indonesian residents have the right to:

  • Receive information about the clarity of identity, legal basis, purpose, and use of personal data processing
  • Withdraw consent at any time and request cessation of data processing
  • Delay or restrict processing in accordance with the purpose of data disclosure
  • Sue and receive compensation for violations of personal data processing

13. Australian Law — Privacy Act 1988

Under Australia's Privacy Act, your health data is classified as "sensitive information" under Australian Privacy Principle (APP) 3 and requires your explicit consent before collection.

Key APPs We Comply With

  • APP 1 (Open & transparent management): This policy fulfils our obligation to manage personal information openly
  • APP 3 (Collection): We only collect sensitive information with your explicit consent
  • APP 5 (Notification): We notify you at or before the time of collection about how data will be used
  • APP 6 (Use & disclosure): We use data only for the purposes stated in this policy
  • APP 8 (Cross-border disclosure): We take reasonable steps to ensure overseas recipients comply with the APPs — our primary data storage is in Australia (Sydney), though AI processing may route through US-based services
  • APP 11 (Security): We take reasonable steps to protect personal information from misuse, interference, and loss
  • APP 12 & 13 (Access & correction): You can request access to and correction of your personal information at any time

Complaints

If you are unsatisfied with our handling of your data, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

14. Disclaimers

  • Not a medical provider: PT Form Life Bali is not a medical clinic, hospital, or healthcare provider. Our services are for health optimisation, education, and wellness purposes only.
  • AI is not medical advice: Recommendations generated by our AI tools (including Mia and Marcus coaching bots) are educational in nature. Always consult a qualified healthcare professional for medical advice, diagnosis, or treatment.
  • Human review gate: All AI-generated lab reports are reviewed by our team before delivery to you. No fully automated health decisions are made without human oversight.

15. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or a prominent notice on our website. The "Last updated" date at the top of this page indicates when the most recent changes were made.

16. Contact & Complaints

For any questions, concerns, or requests regarding this privacy policy or your personal data:

  • Email: hello@getherform.com
  • WhatsApp: +62 853-3807-3380

Regulatory Bodies

Indonesia:

  • Ministry of Communication and Informatics (Kementerian Kominfo) — www.kominfo.go.id

Australia:

  • Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au