Privacy Policy

1.Who we are and what this covers

WHSComply is a service of Briesa Pty Ltd (“we”, “us”, “our”). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It covers two groups of people: those who use WHSComply or contact us, such as a company's staff, auditors a company invites and people who request a demo; and the people whose details companies keep in WHSComply, such as subcontractors, their workers and site visitors.

2.Companies are responsible for their records

When a company puts details of its workers, subcontractors or visitors into WHSComply, or asks them to sign in to its sites, the company decides what is collected and why, and is responsible for it under the privacy law that applies to it. We hold and process that information on the company's behalf, only to provide WHSComply.

If you work on or visit a company's site, its own privacy policy explains how it uses your information, and you should contact the company first to see, correct or complain about it. If you contact us instead, we will pass your request to the company and help it respond.

3.What we collect

About the people who use WHSComply:

• name, email address and password, which is stored only in hashed form; if you sign in with Google or X, the name and email address that provider shares
• your company, role and teams, and the inductions, policy acknowledgements and training the company records for you
• what you do in WHSComply: each change is recorded in the audit log with your name, email address and the time
• your conversations with the assistant, and support requests you send from the Help page
• billing details for the company: its name, ABN, address and billing email. Card details are entered with Stripe, and we never see or store full card numbers
• if you request a demo: your name, work email, company, how many people it has, the plan you are interested in and anything you tell us

4.What companies keep about workers and visitors

Depending on how the company uses WHSComply, this can include:

• names, contact details, employer or subcontractor, trade and emergency contacts
• White Card, high risk work licence, trade licence and first aid details, their numbers and expiry dates, and copies of the cards uploaded
• site sign-in and sign-out times, the project, and the inductions, SWMS, permits and toolbox talks a person signed on to
• incident, injury and near miss reports, which can include health information about the people involved
• subcontractors' business details, insurances and certificates of currency
• photos, inspection records and other documents the company uploads

5.Health information

Injury and illness details in an incident report are health information, which the Privacy Act treats as sensitive. Companies should record only what the incident record, the regulator or a workers compensation claim needs, and give access to incident details only to the people who need it.

6.How we use it

We use personal information to provide WHSComply: signing you in, keeping the company's records, running site sign-in, sending invitations, sign-in codes, expiry alerts, reminders and the daily digest, and answering assistant questions. We also use it to bill the company, support you when you ask, keep WHSComply secure, investigate errors and misuse, arrange demos and meet our legal obligations.

We don't sell personal information, use it for advertising or use company records to train AI models. We only send marketing email with your consent, and every marketing email lets you unsubscribe.

You can browse this website without telling us who you are. Using WHSComply needs your real name, because a site's safety records must show who was there and who did what.

7.Where it is stored

The company's records, documents and their backups are stored in Australia, in the Sydney region of our database provider, Supabase.

To run WHSComply, some information passes through or is handled by the service providers below, some of them outside Australia, mainly in the United States. We choose providers that protect personal information and give it to them only for the service they provide to us.

• Supabase: the database, sign-in and file storage, in Sydney
• Vercel: hosts the website and the app. Every page and request, including what you type into WHSComply, passes through its servers, which may be in the United States or other countries
• Stripe: takes payments and issues invoices, using the company's billing details and the email of the person who checks out, in the United States and other countries
• Resend: sends WHSComply's email, including sign-in codes, invitations, the daily digest and alerts. It handles each email's recipient and content, which can include names from the company's records, in the United States
• Anthropic, through Vercel's AI Gateway: answers assistant questions. Only when someone asks a question, it receives the question, the earlier messages in that conversation, and a summary of the company's WHS status: the company's name, the asker's name and role, open gaps and items needing attention, and calendar events for the next 14 days with their project addresses. Anthropic processes these outside Australia, including in the United States
• OpenStreetMap: your browser loads WHSComply's maps from OpenStreetMap's servers, which see your IP address and the area shown. Where map pins are on, a project's address is sent to a geocoding service to find its position
• Google and X: only if you choose to sign in with them

8.Who else sees it

Within a company, people see records according to the role and teams the company gives them. Subcontractors and workers see their own details and what the company shares with them about the projects they work on.

Our own team accesses a company's records only when needed to provide, support or secure WHSComply. We disclose personal information to others only where the law requires or allows it, such as to a regulator or under a court order, or to a business that takes over WHSComply, which must protect it as this policy does.

9.Cookies and local storage

WHSComply uses only the cookies it needs to work. There are no analytics, advertising or tracking cookies.

• sign-in cookies set by Supabase keep you signed in. If you untick “Keep me logged in”, they last only until you close the browser
• whscomply-remember records that choice, for up to 400 days
• sidebar_state remembers whether the app's sidebar is open, for 7 days
• your browser's local storage keeps your light or dark theme and whether you hid the overview's recommendations, on your device only

10.Security

Every record is tied to its company, and the database itself checks each request against the person's company and role. Connections to WHSComply are encrypted, passwords must be at least 10 characters with upper- and lower-case letters and a number, and every change is written to an audit log that can't be edited. Site sign-in links, guest links and calendar feeds can be turned off at any time, and stop working at once.

No system is perfectly secure. If you think something is wrong, tell us at support@briesa.com.

11.Data breaches

If we suspect a data breach, we act straight away to contain it and assess whether it is likely to cause serious harm. If it is, it is an eligible data breach under the Notifiable Data Breaches scheme, and it is notified to the Office of the Australian Information Commissioner (OAIC) and to the people affected as soon as practicable.

If a breach involves a company's records, we tell the company without delay and work with it, since the company is usually the one who must notify its workers and subcontractors.

12.How long we keep it

We keep a company's records while it uses WHSComply. Some can't be deleted while they must be kept: for example, the WHS laws require a record of each notifiable incident to be kept for at least five years, and SWMS and WHS management plans for set periods after the work or an incident.

The audit log is never edited or deleted. Each document is kept for at least seven years from upload, which the company can lengthen but not shorten, and only then can an owner or admin delete it. Subcontractors and workers the company no longer engages are archived, not deleted, so their history on past projects stays.

When a company closes, its workspace locks on the closing date and we keep its records for seven years after that, then delete or de-identify them.

Assistant conversations are kept until the person who started them deletes them, which they can do at any time. Demo requests are kept only as long as we need them to follow up.

13.Seeing and correcting your information

You can update most of your own details in WHSComply. You can also ask us at support@briesa.com for a copy of the personal information we hold about you, or to correct it. We will respond within 30 days and won't charge you. If we refuse, we will tell you why in writing and how to complain.

If a company holds your information, ask the company first, as section 2 explains.

A correction updates the record. The audit log keeps the earlier value as part of the record's history, but the record itself shows the corrected information.

To stop using WHSComply, ask the company's owner or an admin to remove you, or email us. Your name stays against the changes you made and the sites you signed in to, because the company's safety records depend on it.

14.Complaints

If you have a privacy complaint, email us at support@briesa.com. We will acknowledge it promptly and aim to resolve it within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

15.Changes and contact

We will publish any update to this policy here with a new date, and email company owners about significant changes.

Questions about privacy? Contact Briesa Pty Ltd at support@briesa.com.