1. About this Privacy Policy

This Privacy Policy, on behalf of Flabee Sdn Bhd, explains how and what type of data related to you as a natural person (“Personal Data”) is collected, why it is collected, and to whom it is shared or disclosed. It also contains information about your rights related to your Personal Data.

Please read this Privacy Policy carefully.

This Privacy Policy applies when you:

• Visit Flabee Sdn Bhd website, social media pages, or physical office premises.

• Visit any of our stores for the purchase of baby food.

• Access or use any of our platform’s products and services, including Flabee AI Insights.

• Register and/or attend any virtual or in-person events hosted or attended by us.

• Contact our customer support or completing a webform.

• Participate in our user research activities.

• Otherwise interact or communicate with us.

These criteria are hereinafter collectively referred to as Flabee Sdn Bhd “Services”.

On our websites, we also collect cookies information, for details please refer to the section below.

2. About Us

When we refer to “Flabee” (“we”, “us”) in this Privacy Policy, we mean Flabee Sdn Bhd with company registration number 202101015272 (1415572-M) and registered address at No 19-2 & 21-3, Jalan Taming Permai 1, Kawasan Perniagaan Taming Permai, 43300 Balakong, Selangor and/or our licensee that is responsible for the processing of your Personal Data.

Flabee has appointed a Data Protection Officer (“DPO”) to oversee our compliance with Malaysia’s Personal Data Protection Act 2010 (as amended). You may contact our DPO at [email protected] (Subject: “Attn: DPO”). Where required, we will notify/ register the DPO appointment with the Personal Data Protection Commissioner in the prescribed manner. For clarity, in this Privacy Policy, “Flabee” acts as a data controller for Personal Data processed for our Services, and we may engage data processors to process Personal Data on our behalf under written contractual safeguards.

3. What types of Personal Data do we collect?

We collect and process the following types of Personal Data:

(a) Contact Information Data

Contact Information Data includes, but are not limited to, full name, email address, NRIC/ identity number and phone number.

(b) Communication and Interaction Data

Communication data refers to the data resulting from your interaction with us, e.g. emails, chat messages, webinars visited, files downloaded, user research activities and product interest information. We may also collect registration information related to your attendance at one of our events, including scheduling information, food preferences or allergies, and accessibility requests. When attending our event, Flabee and its agents may photograph and record the event and activities related to the event in visual or audio media. For property under Flabee responsibility, we may process video surveillance (CCTV) information.

(c) Application-related Usage Data

We may automatically gather and analyze information on how and whether specific features of our Services are used.

(d) Device and Browser Data

When you as a user visit one of our websites and/or product applications, data from your computer or mobile devices may be collected, such as device type, basic location, information about the browser type and version, the operating system and version, the internet service provider or mobile carrier, the IP Address (or proxy server) as well as geographic areas derived from your IP address, time and date of access. Duration of access, referring URL (if any), and identifiers that help us to recognize your device and validate that you are a licensed user.

(e) Websites Cookies

We use cookies and similar technologies to operate our website, remember preferences, understand usage, and (where enabled) measure marketing performance. Cookies may be: (i) Strictly necessary (required for core functions), (ii) Analytics (to understand visits and improve user experience), and (iii) Marketing (to measure and improve advertising effectiveness). Some cookies may be set by third-party providers we use for analytics/marketing. You can manage cookies via your browser settings and, where available, our cookie banner/settings. If you disable certain cookies, some features may not function properly. Where we enable third-party analytics or marketing cookies, those third parties may collect or receive information about your device and use of our website in accordance with their own privacy practices. You can manage your preferences at any time via your browser settings and, where available, our cookie banner/settings. Where required by applicable law or regulator guidance, we will not place or activate non-essential cookies (including analytics and marketing cookies, especially those provided by third parties) unless and until you have provided your consent via our cookie banner/settings. You may change your preferences at any time.

(f) Sensitive Personal Data

Some information we process may be sensitive personal data, including health-related information you provide (e.g., pregnancy-related health entries, wellness notes) and any other data classified as sensitive under applicable law. We process sensitive personal data with your explicit consent (where required) and apply heightened access controls, confidentiality obligations, and security safeguards. You may withdraw your consent as described in Section 10, but doing so may limit our ability to provide certain features (e.g., AI insights based on health entries).

Please note that certain personal data is necessary to access or use our core Services — for example, contact details are required to create an account or schedule a consultation. If you choose not to provide mandatory information (such as contact details required for account creation or appointment scheduling), we may be unable to create your account, confirm your booking, or deliver the requested Service. Other types of data, such as entries in your mood diary or baby kick log, are optional and may be skipped without affecting your core access. However, omitting this optional information may limit your ability to receive personalized insights or benefit from related app features. We will also provide, where appropriate, clear in-app notices at the point of collection to indicate whether a data field is obligatory or voluntary, and the consequences if it is not provided.

4. How do we collect and process your Personal Data?

You provide Personal Data directly to us by accessing one of our websites or applications, attending one of our events, coming for a consultation appointment, registering and/or using one of the Services, and participating in activities with us (e.g. user research activities). We may also obtain Personal Data in the context of providing the Services or obtain information about you from third party sources, such as public databases and social media platforms.

5. Why do we process your Personal Data?

We may process your Personal Data for one or more of the following purposes:

(a) Provide the requested Services

To provide the requested Services and to make sure that we fulfill contractual obligations with you. This includes but is not limited to:

• Specific pregnancy health data includes expected due date, weight, blood pressure, and any other relevant health information necessary for providing accurate scanning reports and scheduling appointments. This data is used to generate detailed pregnancy scanning reports, track fetal development, and provide personalized recommendations for maternal health.

• Transaction behavior data collected includes purchase history and browsing behavior within the website and mobile app to understand user preferences and recommend relevant products or services. This data may also be used for targeted advertising and marketing initiatives to improve the overall user experience.

• Responding to your requests for assistance, payment processing, billing, data storage and responding to any request you may send us through our website, email or any other way.

We use two types of automated tools in our service delivery: Flabee AI Insights and internal image verification processes.

Flabee AI Insights is a branded feature powered by secure third-party artificial intelligence (AI) services. It analyzes user-submitted health entries — such as mood logs, baby kick counters, ovulation tracking, and wellness notes — to generate helpful summaries shown within the app. These summaries are informational only and are not reviewed by clinical staff. They are not intended to diagnose, treat, or replace professional medical advice. Flabee AI Insights is generated automatically by third-party AI service providers acting as data processors on our behalf. For this purpose, we may share (i) your wellness entries you submit (e.g., logs and notes), and (ii) limited app context such as language preference, country, age range and pregnancy stage where applicable. We do not send your account contact details (such as full name, NRIC/identity number, email address, or phone number) for this feature unless such information is already included by you within the content you submit. Flabee AI Insights is provided to support your understanding of your own entries. We do not use Flabee AI Insights to make automated decisions that produce legal effects or similarly significant impacts on you (e.g., eligibility decisions). You may choose not to use optional features that rely on AI insights.

Separately, for internal safety and quality assurance, we use automated tools (including third-party AI services) to extract visible text (such as the patient’s name) from ultrasound images or videos to reduce the risk of misassignment. Where the extracted text does not match the intended user account, our system will display a prompt for staff to double-check before completing the upload. The image or video (which may contain the patient’s name as shown on the scan) is processed only for real-time text extraction and matching. No permanent storage of your file occurs on the AI platform. All processing logs and any temporary content are governed by strict confidentiality and security controls enforced by our service providers, and will be deleted after a defined period in accordance with their policy.

(b) Improve and enhance our Services

To improve our operations, systems, products, processes in order to enhance your experience, we need to understand your preferences, analyze aggregated, anonymized or statistical usage data and crash information as well as conduct surveys with regards to our Services.

(c) Enable security and compliance

To maintain the security and compliance of our Services with the objective to protect against, investigate and deter fraudulent, unauthorized, or illegal activity and to avoid and detect attacks on our applications or misuse of our Services. To ensure appropriate security of our office premises and comply with any legal and regulatory obligations.

(d) Perform sales, marketing and events related activities

To communicate news about upcoming events, products, services and for direct advertising; To inform you about our Services; To manage your registration to our events and to make visual and audio media related to the event available to you. We may use limited personal data (such as purchase history or broad usage patterns) to tailor marketing content where permitted by law. You can object to or opt out of direct marketing at any time using the unsubscribe option (where available) or by emailing [email protected] (Attn: DPO).

6. When will we process your Personal Data?

We process Personal Data in accordance with Malaysia’s PDPA (as amended). Where we rely on consent, we will obtain your consent through clear notice and an affirmative action (for example, via in-app prompts, forms, or settings). Where permitted by applicable law, we may also process Personal Data without consent, including where processing is necessary to provide the Services you request, to comply with legal obligations, or to protect legitimate interests in security and fraud prevention. Where we rely on consent, you may withdraw it as described in Section 10, subject to lawful exceptions and necessary service operations.

We take reasonable steps to ensure that the Personal Data we hold is accurate, complete, not misleading and kept up to date, having regard to the purpose for which it is collected and further processed. If any of your details change, please notify us so that we can update our records.

Where required by applicable law, if you do not have legal capacity to provide consent on your own, we may require consent from a parent, guardian, or other authorised representative before processing certain Personal Data (especially Sensitive Personal Data).

7. Who will have access to your Personal Data?

Depending on the purpose and the necessity, we may disclose your Personal Data to the following categories of recipients:

• To internal personnel of Flabee on a “need-to-know” basis.

• To agencies, auditors, or other advisors under professional obligations of confidentiality in connection with corporate functions.

• When you sign up to one of our events where a third party is appointed by Flabee to host, sponsor or present (including webinars and trainings), we may share relevant Personal Data with that third party to administer the event and, where you have consented or where permitted by law, for related marketing. Such third parties may act as independent data controllers for their own processing; their privacy practices will apply to their use of your Personal Data.

• To government, law enforcement and regulatory bodies to meet applicable legal or regulatory obligations.

In delivering our Services, we work with selected third-party providers that support key functions, including:
– Cloud infrastructure providers to securely store and manage your data
– Analytics and AI service providers to help interpret wellness data you submit (e.g., mood diary and baby kick logs) and return relevant insights
– Communications and notification platforms to send service alerts and reminders

– Automated processing service providers (including AI/OCR providers) to generate Flabee AI Insights and to perform internal upload verification checks

Where these providers process Personal Data on our behalf, we require contractual safeguards and confidentiality obligations, and we take reasonable steps to ensure appropriate technical and organizational security measures are in place. Where we appoint data processors, we require them to implement appropriate technical and organisational security measures and to process Personal Data only on our documented instructions. We also require processors to promptly notify us of suspected or actual personal data breaches and to cooperate with investigations, remediation, and (where applicable) regulatory and user notifications.

Some of the third-party providers may process Personal Data outside Malaysia (e.g., in regional data centres). Where we transfer Personal Data across borders, we will take reasonable steps to ensure appropriate safeguards are in place and that the transfer is made in accordance with the PDPA (as amended) and any requirements or guidance issued by the Personal Data Protection Commissioner, including relying on lawful transfer mechanisms or exceptions where applicable.

8. How long do we store your Personal Data?

Subject to applicable law, we retain your Personal Data only as long as necessary for the purposes described in this Privacy Policy, and for legal, regulatory, tax, accounting, or claims purposes where applicable. You may request deletion or anonymisation of certain Personal Data, and we will assess and comply where required or appropriate, subject to lawful exceptions.

AI-generated summaries (such as Flabee AI Insights) may be stored within your account to allow you to view your history and track trends. We retain such information only as long as necessary for the purposes described in this Privacy Policy, or as required by applicable laws. For internal upload verification, any temporary processing logs are retained only for the period defined by our service providers’ policy and then deleted.

Where Personal Data is no longer needed for the purpose for which it was collected and we are not required to retain it for legal or business reasons, we will take reasonable steps to destroy or permanently delete it. If you wish to withdraw consent (where processing is based on consent) or submit a retention/deletion request, please contact us at [email protected] (Attn: DPO).

9. How do we protect your Personal Data?

To protect your Personal Data against accidental or unlawful destruction, loss, use, or alteration and against unauthorized disclosure or access, we use adequate physical, technical, and organizational security measures. In particular:

• Encryption of data at rest and in transit

• Regular security audits and penetration testing

• Access controls that restrict access to Personal Data on a need-to-know basis

• Data backup and disaster recovery procedures

While we strive to ensure the security of your Personal Data, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure.

If we have reason to believe that a personal data breach has occurred, we will assess the incident and take prompt steps to contain and remediate it. Where required by law, we will notify the Personal Data Protection Commissioner as soon as practicable. If the breach causes or is likely to cause significant harm to affected individuals, we will also notify affected individuals without unnecessary delay, including (as appropriate): a description of what happened, the type of data involved, likely consequences, steps we have taken, recommended steps you can take, and how to contact our DPO for more information. Where required by law or applicable guidance, notification to the Commissioner and/or affected individuals will be made as soon as practicable and within the timeframe prescribed by applicable requirements.

10. What are your rights regarding your Personal Data?

We are committed to transparency regarding the collection and use of your Personal Data. Subject to applicable law, you may request the following in relation to your Personal Data:

(a) Access and correction of your Personal Data;

(b) Withdraw consent (where processing is based on consent);

(c) Opt-out / cease processing for direct marketing; and

(d) Data portability (where applicable and where introduced/in force under applicable law, and technically feasible), i.e., requesting that certain Personal Data be transmitted to another data controller.

We may need to verify your identity before processing requests. Where permitted by law, we may refuse or limit requests (for example, to protect the rights of others or where legal exemptions apply).

How to submit a request: Please email [email protected] (Attn: DPO) with details of your request. We may request additional information to verify your identity and to locate the relevant data. We will respond within the timeframe required by applicable law. Where applicable, we aim to respond within twenty-one (21) days from receiving a complete request and may extend where permitted by law. We may also charge a fee where allowed by law and will inform you in advance if a fee applies.

You may choose to limit certain processing by

(i) opting out of direct marketing communications at any time through the unsubscribe option (where available) or by emailing [email protected] (Attn: DPO), and/or

(ii) choosing not to use optional features such as wellness logs or Flabee AI Insights. Please note that limiting certain processing may reduce feature availability or personalization.

You may withdraw your consent to our processing of your Personal Data by notice in writing (including by email). Where applicable, upon receiving such notice we will cease the relevant processing, subject to situations where processing is necessary for service delivery, legal compliance, or the establishment, exercise, or defence of legal claims. You may also require us to cease processing your Personal Data for direct marketing purposes by notice in writing.

If you are not satisfied with our response, you may also lodge a complaint with the Personal Data Protection Commissioner / Jabatan Perlindungan Data Peribadi (JPDP), in accordance with applicable law.

11. Updates

We actively monitor changes in applicable data protection regulations, including amendments to Malaysia’s Personal Data Protection Act (PDPA). When required, we will update our practices and documentation — including this Privacy Policy — to reflect new obligations or operational enhancements. We will notify you of any significant changes by posting the new Privacy Policy on our website and, if applicable, through other communication channels. We also maintain internal records of consent, data flows, and third-party data handling in line with these evolving requirements.

Last Updated on 20 December 2025