Privacy Policy

Last updated: 7 November 2026 · Version 1.2

1. Introduction

Genesis Flex Sdn. Bhd. (Company No. 1247193-X) ("G-Flex", "we", "us") operates the G-Flex healthcare benefits administration platform. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with the Malaysian Personal Data Protection Act 2010 ("PDPA").

By using the G-Flex platform, you consent to the practices described in this policy.

2. Data Controller

The data controller is Genesis Flex Sdn. Bhd., with its address at 26-01-02, FTTH Plaza Centro, No. 8, Jalan Batu Tiga Lama, 41300 Klang, Selangor, Malaysia. For privacy inquiries, contact our Data Protection Officer at privacy@gflex.com.my.

3. Personal Data We Collect

We collect the following categories of personal data:

• Identity Data: Full name, NRIC/passport number, date of birth, gender, nationality, photograph
• Contact Data: Email address, phone number, residential and work address
• Employment Data: Employee ID, corporate affiliation, job title, department, employment start/end dates
• Health & Medical Data: Diagnosis codes (ICD-10), prescriptions, medical certificates, treatment records, guarantee letters, medical bills and claims history
• Financial Data: Bank account details (for reimbursement), invoice records, benefit utilisation amounts
• Technical Data: IP address, browser type, login timestamps, session identifiers, audit trail records
• Dependant Data: Names, NRIC, date of birth, and relationship of enrolled dependants

Sensitive personal data: Health and medical data constitutes "sensitive personal data" under the PDPA and is processed only with your explicit consent or as otherwise permitted by law (including processing for medical purposes by or under the responsibility of a healthcare professional).

Children and dependants: Where you enrol dependants, including children below 18 years of age, you confirm that you are authorised (as parent, guardian or principal member) to provide their personal data and the necessary consent on their behalf.

4. How We Use Your Data

We process personal data for the following purposes:

• Administering healthcare benefit plans and eligibility verification
• Processing medical claims, guarantee letters, and reimbursements
• Managing provider networks and panel clinic operations
• Generating invoices, e-invoices (LHDN), and financial reports
• Fraud detection, watchlist monitoring, claims audit, and related automated analysis (profiling) of claims and visit patterns to identify irregular or potentially fraudulent activity
• Providing customer support and resolving disputes
• Compliance with legal and regulatory obligations
• System security, performance monitoring, and audit logging

5. Legal Basis for Processing

Malaysia's PDPA is consent-based. We process personal data on the following bases recognised under the PDPA:

• Consent: The consent you provide at registration or first login. For sensitive personal data (including health and medical data) we rely on your explicit consent as required by Section 40 of the PDPA, or on the medical-purposes ground where processing is undertaken by or under the responsibility of a healthcare professional.
• Performance of a contract: Where processing is necessary for the performance of the benefits administration arrangement to which you or your employer are a party, or to take steps at your request before entering into it.
• Legal obligation: Where processing is necessary for compliance with a legal obligation to which we are subject, such as Malaysian tax law (LHDN e-invoicing) and record-keeping requirements.
• Vital interests: Where processing is necessary to protect your vital interests, for example in a medical emergency.

We do not rely on a free-standing "legitimate interests" basis as understood under the EU GDPR. Fraud-prevention, security and service-improvement activities are carried out on the basis of your consent and our legal obligations.

6. Disclosure of Personal Data

We may share personal data with:

• Your Employer (Corporate): Benefit utilisation summaries, claims status, and aggregate reports — only data relevant to administering your corporate benefits programme
• Panel Clinics & Merchants: Member eligibility verification, guarantee letter details, and benefit entitlements required for cashless treatment
• Infrastructure Providers: Supabase Inc. (database hosting, Singapore region) and Vercel Inc. (application hosting) as data processors under contractual obligations
• Regulatory Authorities: LHDN (e-invoicing), where required by Malaysian law

We do not sell personal data to third parties. We do not share data with advertisers.

7. Data Hosting & Cross-Border Transfers

Application data is hosted on Supabase-managed PostgreSQL servers in Singapore (ap-southeast-1), the nearest available managed data centre region to Malaysia. Our infrastructure providers (Supabase Inc. and Vercel Inc.) are incorporated outside Malaysia, and limited access by their personnel from other jurisdictions may occur for support, maintenance and security purposes. Where any transfer of, or access to, personal data outside Malaysia takes place, we ensure it is subject to appropriate contractual safeguards and is carried out consistently with the PDPA.

Diagnosis code lookups may query a public medical-coding reference service (the U.S. NIH Clinical Tables ICD-10-CM API). Only the clinical search term entered by the user is sent to that service; no member name, NRIC, or identifiable health record is transmitted. All benefit calculations, QR code generation and claims processing occur within the platform.

8. Data Security

We implement the following security measures:

• Encryption in Transit: All data transmitted via TLS 1.2+ (HTTPS enforced). SSL certificates provisioned via Let's Encrypt with automatic renewal.
• Encryption at Rest: AES-256 disk encryption on all database storage (Supabase managed infrastructure).
• Access Control: Role-based access control (RBAC) with 4 distinct roles. 115+ database-level Row Level Security (RLS) policies enforce multi-tenant data isolation.
• Authentication: Passwords stored using bcrypt with salt. Session management via secure JWT tokens.
• Audit Trail: Comprehensive audit logging of all data access, modifications, and administrative actions with before/after value tracking.
• Backups: Automated daily database backups with point-in-time recovery capability.

9. Data Breach Notification

In line with the Personal Data Protection (Amendment) Act 2024, we maintain procedures to detect, assess and respond to personal data breaches. Where a breach occurs that causes or is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner, and the affected data subjects, within the timeframes and in the manner required by the PDPA and its subsidiary regulations. We have appointed a Data Protection Officer and maintain an internal Security Incident Response Plan governing breach handling.

10. Data Retention

We retain personal data in accordance with the following schedule:

• Medical claims and billing records: 7 years from creation date
• Financial records (invoices, e-invoices): 7 years
• Member records: Duration of employment plus 2 years
• Audit logs: 7 years
• Session and authentication data: 90 days
• Notification history: 1 year

After the retention period, personal data is anonymised (PII replaced with non-reversible identifiers) while aggregate data is preserved for historical reporting.

11. Your Rights Under PDPA

As a data subject under the PDPA, you have the right to:

• Access: Request a copy of your personal data held by us
• Correction: Request correction of inaccurate or incomplete data
• Withdrawal of Consent: Withdraw consent for data processing (note: this may affect your ability to use certain platform features)
• Data Portability: Request your data in a structured, machine-readable format
• Complaint: Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, contact our Data Protection Officer at privacy@gflex.com.my. We will respond within 21 days as required by the PDPA.

12. Cookies & Analytics

The G-Flex platform uses localStorage for session persistence (language preference, authentication tokens).

Our public website (www.gflex.com.my) uses Google Tag Manager and Google Analytics 4 to measure how visitors use the site, for example which pages are viewed, how visitors arrived, and whether a demo request was submitted. These tools set cookies and send usage data, including your IP address and browser details, to Google, which may process it outside Malaysia. Analytics is on from your first page view; the cookie notice on the site tells you so. We do not use advertising or remarketing cookies, and we do not send names, email addresses or other details you enter in forms to Google Analytics.

You can stop analytics at any time by clearing this site's cookies and data in your browser, by installing Google's Analytics opt-out browser add-on, or by writing to privacy@gflex.com.my.

Our demo request form on the public website collects the details you type into it (name, company, work email, phone number, role, company size, what you are interested in, how and in which language you prefer to be contacted, and any note) together with the page you were on, the site that referred you and any campaign tags in the link. We use them to arrange and follow up your demo request. If you tick the optional box on the form, we will also send you news and offers from G-Flex; you can unsubscribe at any time, and your demo request does not depend on it. To protect the form from automated abuse we use Cloudflare Turnstile, which loads from Cloudflare when you start the form and may process your IP address and browser details. Our database does not store your IP address; to limit repeated submissions we keep only a daily scrambled (hashed) code derived from it. Our hosting providers may keep routine server logs.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification. Continued use of the platform after notification constitutes acceptance of the revised policy. The version number and date at the top of this document indicate the latest revision.

14. Contact Us

Genesis Flex Sdn. Bhd.
Data Protection Officer
26-01-02, FTTH Plaza Centro, No. 8, Jalan Batu Tiga Lama, 41300 Klang, Selangor
Email: privacy@gflex.com.my
Website: www.gflex.com.my