Privacy notice
Safety OS is a health & safety management tool used by your organisation. Your organisation is the data controller for the information held here; Safety OS processes it on their behalf. This notice explains, in plain terms, what is collected and the rights you have under UK GDPR.
What we collect
Account details (name, work email, role) for people who sign in; and the safety records the organisation keeps: incidents and near-misses, investigations, corrective actions, risk assessments, observations, site plans and any files or photos attached to them.
When you use the public report form, we collect what you enter and, optionally, a photo and your contact details so we can follow up.
Anonymous reporting
If you tick “report anonymously” on the report form, we do not record your name, your contact details, or your IP address against the report. It cannot be traced back to you. The only thing kept is what you chose to describe.
Why we use it, and for how long
The information is used solely to run the organisation's health & safety management system: recording what happened, investigating it, deciding statutory reportability, and tracking that issues get fixed. It is not sold, and it is not used for advertising.
Records are kept for as long as the organisation needs them to meet its legal and safety obligations, then deleted. Your organisation sets the specific retention periods.
Your rights
Under UK GDPR you can ask to access the data held about you, to have it corrected, or to have it erased. An owner or admin can export the organisation's data and can erase an individual's personal data from the system on request.
To exercise any of these rights, contact your organisation's health & safety or data protection contact.
How it is protected
Data is encrypted in transit, access is controlled by role, and each organisation's data is isolated from every other's. Occupational-health records are held separately with tighter access. Statutory reports are never filed on your behalf; a competent person always reviews and decides.
This is a general notice for the demonstration system. A live deployment should tailor it to the organisation's lawful basis, retention schedule and data-protection contact.