Privacy Policy

We collect information that you and your organisation submit to the Service, including:

• Account information: name, email address, job title, and role within your organisation.
• Health and safety records: incident reports, near miss reports, hazard identifications, corrective actions, site audits, toolbox talk records, training records, and permits to work.
• Personnel information: employee profiles including employment details, certifications, and emergency contact information.
• Uploaded documents: certificates, insurance documents, H&S policies, SDS documents, and other files uploaded to the platform.
• Usage data: login timestamps, form submission timestamps, and audit trail data required by health and safety governance obligations.

We do not collect payment information directly — payments are handled by our billing provider.

We use the information you provide to:

• Provide and operate the Safety Portal service
• Generate health and safety records, registers, and governance reports
• Send notifications relating to corrective actions, training expiry, and governance obligations
• Support AI-powered features including document analysis, JSA generation, and governance briefings
• Maintain the audit trail required under the Health and Safety at Work Act 2015
• Provide support and respond to enquiries

We do not use your data for marketing purposes or share it with third parties for their own commercial use.

Safety Portal stores your information using cloud-based infrastructure. Here is a summary of where your data lives and who handles it:

Data sovereignty: If your organisation requires data to be stored in New Zealand, please contact us to discuss options. We offer this on a case-by-case basis.

We take reasonable steps to protect your information. The specific technical controls in place include:

• Encryption at rest: all data is encrypted at the database and storage level using AES-256.
• Encryption in transit: all data transmitted between your browser and Safety Portal uses TLS 1.2 or higher (HTTPS).
• Access controls: data is isolated per organisation — your data is only accessible to authorised users within your organisation and HSCA administrators.
• Backups: automated database backups are taken daily and retained for a minimum of 7 days.

We retain your data for as long as your organisation has an active subscription with HSCA. Health and safety records (incidents, corrective actions, governance sign-offs) are retained in accordance with the record-keeping requirements of the Health and Safety at Work Act 2015.

On termination of your subscription, we will retain your data for 90 days to allow for export, after which it will be permanently deleted unless otherwise required by law.

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of any inaccurate information
• Request deletion of your personal information (subject to legal retention requirements)
• Ask how your information is being used

To exercise these rights, contact us at info@healthandsafetyconsultantsauckland.co.nz. We will respond within the timeframes required by the Privacy Act 2020.