Last updated: 10 November 2026 · Version 1.3
Genesis Flex Sdn. Bhd. (Company No. 1247193-X) ("G-Flex", "we", "us") operates the G-Flex healthcare benefits administration platform. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with the Malaysian Personal Data Protection Act 2010 ("PDPA").
By using the G-Flex platform, you consent to the practices described in this policy.
The data controller is Genesis Flex Sdn. Bhd., with its address at 26-01-02, FTTH Plaza Centro, No. 8, Jalan Batu Tiga Lama, 41300 Klang, Selangor, Malaysia. For privacy inquiries, contact our Data Protection Officer at privacy@gflex.com.my.
We collect the following categories of personal data:
Sensitive personal data: Health and medical data constitutes "sensitive personal data" under the PDPA and is processed only with your explicit consent or as otherwise permitted by law (including processing for medical purposes by or under the responsibility of a healthcare professional).
Children and dependants: Where you enrol dependants, including children below 18 years of age, you confirm that you are authorised (as parent, guardian or principal member) to provide their personal data and the necessary consent on their behalf.
We process personal data for the following purposes:
Malaysia's PDPA is consent-based. We process personal data on the following bases recognised under the PDPA:
We do not rely on a free-standing "legitimate interests" basis as understood under the EU GDPR. Fraud-prevention, security and service-improvement activities are carried out on the basis of your consent and our legal obligations.
We may share personal data with:
We do not sell personal data to third parties. We do not share data with advertisers.
Application data is hosted on Supabase-managed PostgreSQL servers in Singapore (ap-southeast-1), the nearest available managed data centre region to Malaysia. Our infrastructure providers (Supabase Inc. and Vercel Inc.) are incorporated outside Malaysia, and limited access by their personnel from other jurisdictions may occur for support, maintenance and security purposes. If you link a WhatsApp number, Meta Platforms, which operates the WhatsApp Business Platform we use, also handles those messages and may process them outside Malaysia (see section 12). Where any transfer of, or access to, personal data outside Malaysia takes place, we ensure it is subject to appropriate contractual safeguards and is carried out consistently with the PDPA.
Diagnosis code lookups may query a public medical-coding reference service (the U.S. NIH Clinical Tables ICD-10-CM API). Only the clinical search term entered by the user is sent to that service; no member name, NRIC, or identifiable health record is transmitted. All benefit calculations, QR code generation and claims processing occur within the platform.
We implement the following security measures:
In line with the Personal Data Protection (Amendment) Act 2024, we maintain procedures to detect, assess and respond to personal data breaches. Where a breach occurs that causes or is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner, and the affected data subjects, within the timeframes and in the manner required by the PDPA and its subsidiary regulations. We have appointed a Data Protection Officer and maintain an internal Security Incident Response Plan governing breach handling.
We retain personal data in accordance with the following schedule:
After the retention period, personal data is anonymised (PII replaced with non-reversible identifiers) while aggregate data is preserved for historical reporting.
As a data subject under the PDPA, you have the right to:
To exercise any of these rights, contact our Data Protection Officer at privacy@gflex.com.my. We will respond within 21 days as required by the PDPA.
Linking a WhatsApp number to your G-Flex account is optional. Everything in the app works without it. If you choose to link a number, this section applies in addition to the rest of this Policy.
What we collect. Your WhatsApp number and profile name; the messages you send to us and we send to you on WhatsApp (text, the type of message and any menu choice you make); delivery and read status with times; the record of your consent (time, version of the text you agreed to, a fingerprint of that text, your device and IP address); your choices (for example, when you send STOP); and, for conversations handled by our staff, which team the conversation was assigned to and which staff member replied.
How we use it. Only for what you agreed to when you linked your number: to send you updates about your account, such as claims, guarantee letters and benefits; to answer the requests you make through WhatsApp menus; and to keep your account secure. We do not use WhatsApp for marketing, and we do not sell or share these messages with advertisers. At present, automated replies use fixed, pre-approved wording; no artificial intelligence writes the replies. If that changes, we will update this Policy and ask for your agreement again.
Who can see your messages. Our authorised staff in the teams that deal with your request (for example Support, Claims, Finance and Operations) can read the conversation and may reply to help you. Staff see a masked form of your number. We record which staff member replied, and replies are included in our audit log. Access is limited by role.
Meta (WhatsApp). WhatsApp is operated by Meta Platforms. We use the WhatsApp Business Platform, which Meta hosts, so Meta handles and stores your messages in order to deliver them to and from us, and may process them outside Malaysia. Meta also applies its own terms and privacy policy to your use of WhatsApp. Section 7 describes how we protect personal data that leaves Malaysia.
What we never ask for on WhatsApp. We will not ask for, and our messages will not contain, your full identity card or passport number, card or bank details, passwords or health information. Our systems block messages that look like they contain these. Please do not send them to us; use the app for anything personal or medical. Messages that show the status of a claim are limited to what is needed to tell you the outcome.
When we message you. Update messages are not sent between 9 pm and 8 am Malaysia time and are limited to a few a day. Replies to a message you sent are not held back.
Your choices. You can stop at any time: send STOP (or BERHENTI) on WhatsApp, switch off WhatsApp messages in the app, or unlink your number (UNLINK or PADAM). Send START (or MULA) to resume, or link again. Stopping does not affect your use of the app, and it does not affect anything we did with your consent before you stopped. You also have the rights described in section 11, including access to and correction of the WhatsApp data we hold about you.
How long we keep it. WhatsApp message content is kept for 12 months, in line with notification history in section 10. Raw technical records received from Meta are deleted after 7 days. Your consent records are kept while your number is linked and afterwards for as long as needed to show when and how you agreed. Records of support conversations that form part of a claim or complaint are kept for as long as the claim or complaint record (section 10).
Children and dependants. Only the account holder can link a number. Updates may mention a dependant's claim; by linking, you confirm you are entitled to receive that information.
Questions. Write to our Data Protection Officer at privacy@gflex.com.my.
The G-Flex platform uses localStorage for session persistence (language preference, authentication tokens).
Our public website (www.gflex.com.my) uses Google Tag Manager and Google Analytics 4 to measure how visitors use the site, for example which pages are viewed, how visitors arrived, and whether a demo request was submitted. These tools set cookies and send usage data, including your IP address and browser details, to Google, which may process it outside Malaysia. Analytics is on from your first page view; the cookie notice on the site tells you so. We do not use advertising or remarketing cookies, and we do not send names, email addresses or other details you enter in forms to Google Analytics.
You can stop analytics at any time by clearing this site's cookies and data in your browser, by installing Google's Analytics opt-out browser add-on, or by writing to privacy@gflex.com.my.
Our demo request form on the public website collects the details you type into it (name, company, work email, phone number, role, company size, what you are interested in, how and in which language you prefer to be contacted, and any note) together with the page you were on, the site that referred you and any campaign tags in the link. We use them to arrange and follow up your demo request. If you tick the optional box on the form, we will also send you news and offers from G-Flex; you can unsubscribe at any time, and your demo request does not depend on it. To protect the form from automated abuse we use Cloudflare Turnstile, which loads from Cloudflare when you start the form and may process your IP address and browser details. Our database does not store your IP address; to limit repeated submissions we keep only a daily scrambled (hashed) code derived from it. Our hosting providers may keep routine server logs.
We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification. Continued use of the platform after notification constitutes acceptance of the revised policy. The version number and date at the top of this document indicate the latest revision.
Genesis Flex Sdn. Bhd.
Data Protection Officer
26-01-02, FTTH Plaza Centro, No. 8, Jalan Batu Tiga Lama, 41300 Klang, Selangor
Email: privacy@gflex.com.my
Website: www.gflex.com.my
We use Google Analytics to understand how visitors use this site. It sets cookies and shares usage data with Google. Privacy Policy