How Jentra OSH uses your details

This notice covers the Jentra OSH app. It is for the staff of an occupational health service provider that uses Jentra OSH. It is also for the employer staff who use the employer portal. You agree to this notice when you join Jentra OSH. It is written in English and Malay as the Personal Data Protection Act 2010 asks.

1. 01

   Who is responsible

   Jentra Labs Sdn. Bhd. (202601044573 (1706668-M)) runs Jentra OSH. "Jentra" and "we" in this notice mean Jentra Labs Sdn. Bhd. Our address is No 20, Jalan Bunga Raya Satu, Kampung Baru, 68100 Batu Caves, Selangor.

   • Your provider decides what goes into the app about workers, tests and reports. Your provider is the data controller for that data. Jentra is its data processor. We process that data only to run the app for your provider.
   • Jentra is the data controller for your sign-in account. Jentra is also the data controller for the subscription and its payments.
   • Your provider chooses who gets an account and what role each person has.
2. 02

   Workers' health records

   • Jentra OSH holds the health records of workers. These include audiometry results, medical surveillance findings and the reports that the Department of Occupational Safety and Health (DOSH) asks for.
   • Health data is sensitive personal data under the Personal Data Protection Act 2010.
   • Your provider is the data controller for these records. Your provider gives each worker its own privacy notice before the assessment. Jentra gives providers a template for that notice.
   • Our terms require your provider to have each worker's consent.
   • Your acceptance of this notice covers your own account. It does not cover the workers' records.
   • A worker who wants to see or correct a record should contact the provider. We pass any worker request that reaches Jentra to the provider.
3. 03

   What we collect

   • Your account: your name, your email address and your role. An employer portal account also holds the name of the employer company.
   • Worker records that your provider enters: name, IC number, employer, job, test results, the doctor's findings and the reports.
   • For owners: the plan, the worker count, the invoices and the payment records.
   • Technical records of sign-ins: the time and the internet address. We keep them to keep the app secure.
4. 04

   Why we use it

   • We use it to run the app for your provider: worker records, tests, results, reports and the employer portal.
   • We use it to sign you in and keep the app secure.
   • We use it to answer your support requests.
   • We use it to count the workers tested for the plan. Jentra counts workers only and does not open their records for the count.
   • We use it to bill the subscription and keep the records the law asks for.
   • We use it to draft AI text for the doctor when your provider turns AI on. A qualified person checks each draft before anyone relies on it.

   We never sell your details. We do not use them to train AI.

5. 05

   Where the data comes from

   • You give us data when you use the app.
   • Your provider gives us data when its staff create your account or enter worker records.
   • Worker data comes from the workers and their tests. Your provider enters it in the app.
   • Jentra copies in your provider's earlier records when your provider asks for it.
6. 06

   What you must give

   • A name and an email address are required for an account. The account cannot be created without them.
   • Your provider decides which worker details a test or report needs.
   • A bank receipt is required to confirm a bank transfer. Jentra cannot confirm the payment without it.
7. 07

   Who receives it

   • Staff of your provider see the data that their role allows.
   • Employer clients of your provider use the employer portal. An employer sees only what your provider shares with that employer. An employer never sees a worker's full record.
   • Only your staff and the employers you share reports with see your workers' records. Jentra staff open them only to give the support you ask for, or to fix a fault that stops the app working.
   • Google runs the app for us. Firebase Authentication handles sign-in. Google Cloud stores the data and runs the app's functions. Firebase Hosting serves the app's files.
   • Google Cloud Vertex AI runs Gemini for the AI drafts. It receives requests only when your provider turns AI on.
   • ZH Healthcare Sdn. Bhd. (1469895-W) collects subscription payments for Jentra until Jentra's bank account opens. It receives your provider's bank transfer.
   • Cloudflare runs Jentra's internal console. The console holds customer, invoice and payment records.
   • Google stores the emails you send us. Brevo delivers the emails we send from hello@jentra.my. Anthropic runs the AI assistant that helps us sort emails and draft replies.
   • A government body or a court receives data when the law requires it.
8. 08

   Where it is stored

   • Google Cloud stores the app data in Singapore (the asia-southeast1 region). Each provider's data is in its own Google Cloud project.
   • Vertex AI processes the AI requests in Singapore.
   • Firebase Authentication processes sign-in data only in the United States. Google states this on its Firebase privacy page.
   • Firebase Hosting serves the app's files from Google's global network. Those files hold none of your data.
   • Cloudflare, Brevo and Anthropic may process data outside Malaysia.

   Singapore and the United States are outside Malaysia. We tell you about these transfers here because the Commissioner's guideline on cross-border transfer asks for it.

9. 09

   How we protect it

   • Each provider's data is in its own Google Cloud project. No other provider can see it. This includes Jentra's OSH partner.
   • You sign in with an email address and a password. Database rules check each request against your role.
   • AI stays off until your provider agrees to it in the data processing agreement.
   • The app removes the worker's name and IC number before it sends a request to Vertex AI. The app's server function also removes text that looks like an IC number.
   • Only your staff and the employers you share reports with see your workers' records. Jentra staff open them only to give the support you ask for, or to fix a fault that stops the app working.
10. 10

    How long we keep it

    • We keep the data while your provider subscribes.
    • The app becomes read-only for 14 days when a trial or paid period ends without payment. The account then locks.
    • Jentra sends the owner a full export within 14 days after an account locks or a subscription ends.
    • We keep the data for 90 days after we send that export. We tell the owner in writing before we delete it. Any backup copies expire within a further 14 weeks.
    • The law may require your provider to keep workers' health records for many years after a test. Your provider keeps the export for that time.
    • We keep payment receipts and invoices for 7 years as Malaysian tax and company law requires.
11. 11

    Your rights

    • You may ask to see the personal data we hold about you. You may also ask for a copy.
    • You may ask us to correct data that is wrong, incomplete, misleading or out of date.
    • You may withdraw your consent by writing to us. We then stop processing your data. We cannot keep your account open without your consent.
    • You may ask us to send your data to another service you choose. We do this when it is technically possible and the data format fits.
    • The owner may ask for an export at any time. Jentra sends the data as CSV files and PDF reports within 14 days of a written request.

    Email hello@jentra.my from the address you sign in with to use a right. Say what you are asking for. We reply within 21 days. Your provider decides on worker records and the other data it entered. We pass your request to your provider and help it reply.

12. 12

    Questions and complaints

    Email hello@jentra.my about anything in this notice. You may also complain in writing to the Personal Data Protection Commissioner. The Commissioner's email address is aduan@pdp.gov.my.

13. 13

    Data protection officer

    Jentra has not appointed a data protection officer. The Commissioner's guideline requires one above 20,000 people. The limit is 10,000 people for sensitive data. Jentra is below both numbers. Send privacy questions and requests to hello@jentra.my.

14. 14

    Data breaches

    • A data breach means personal data is lost, misused or opened without permission.
    • Jentra tells your provider within 24 hours of becoming aware of a breach of worker records or other provider data. Your provider then tells the Commissioner. Your provider also tells the people affected when the law requires it. We help your provider do so.
    • Jentra tells the Personal Data Protection Commissioner about a breach of account or billing data within 72 hours. We tell you within 7 days after that when the breach is likely to cause you significant harm.
15. 15

    Changes to this notice

    A changed notice gets a new version number and a new effective date. Both appear at the top of this page. The app records the version you accepted. We tell you about a new version by email and by a message in the app. You accept the notice again only when a change is material.