Privacy Policy

Effective date: [date]

This policy explains what personal information PraxysEHS LLC ("PraxysEHS," "we," "us") collects through PraxysEHS CM, how we use it, and the choices you have. Contractors and their workers also have a shorter notice written for them: Privacy for Contractors and Workers.

Two roles, depending on the information.

For our own records (customer accounts, billing, and how the website and Service are used), we decide how information is used. This policy describes that.
For what customers collect through the Service (contractor and visitor sign-ins, inductions, training cards, escorts and headcounts at their sites), we handle it on the customer's behalf and follow its instructions. If you signed in at a customer's site, that customer controls the record. Contact them with questions; we'll help them respond.

What we collect

Your account: your name, work email, role and sites. Sign-in is by password, stored only in scrambled (hashed) form, or by an email link.
Billing: your organization's name, billing email, plan and payment history. Card and bank details are kept by Stripe, never by us.
Contractors, through customers: company details and insurance certificate end dates; each worker's name, cell phone, language and training cards; and their records at the customer's sites.
Visitors, through customers: name, company, who they're visiting, the type of visit, their acknowledgment of the safety notice, sign-in and sign-out times, and escort records.
Sign-out answers: whether anything happened that day, which can include that someone was hurt.
Badge photos, only where a customer turns them on: a plain photo for the badge, never used to recognize faces, and deleted after 30 or 90 days.
Lobby tablets: each tablet's name, site, and when it last connected.
Public record check: information from government records about contractor companies, such as OSHA inspections and state license status. We don't run background checks on people.
Security and technical information: session details, limited sign-in records, and short-lived request logs kept by our hosting provider.

Cookies: only one, which keeps you signed in. No advertising or analytics cookies.

How we use it

To provide the Service: signing people in and out, running inductions, tracking training cards, sending alerts and reminders, and running headcounts.
To keep it secure, bill customers, contact you about your account, and meet legal obligations.
To improve the Service, using counts that don't identify any person or company.

We don't sell personal information, share it for advertising, keep a searchable directory of contractors, or use photos to recognize faces.

Who we share it with

Service providers under contracts that limit their use of it: Cloudflare (hosting, storage, backups, security and email), Stripe (payments), Microsoft (our support inbox), and Google Fonts (loads our typefaces).
Teams or Slack, if a customer connects a channel. Lobby alerts post into that customer's own workspace.
The customer and contractor involved. A customer sees records from its own sites and what contractors share with it. A contractor company sees what relates to its own people.
Legal requirements, when required by law, subpoena or court order. For customer records, we refer requests to the customer where we can.
Business changes, under protections at least as strong as these.

How long we keep it

Customer records: while the account is active. Sign-ins, inductions, briefings and training card checks are kept at least five years.
After a plan ends: read-only for 12 months, then deleted with at least 60 days' notice. Sign-ins, inductions, briefings and training card checks are kept read-only for five years after the plan ends, then deleted.
Badge photos: 30 or 90 days, as the customer sets.
Billing records: as tax and accounting law requires, generally seven years.
Backups: up to 90 days after deletion.

Where it's stored and how we protect it

Our database and files are stored with Cloudflare in eastern North America. Connections are encrypted, providers encrypt stored data, each organization's data is kept separate, access follows each person's role, and lost tablets can be disconnected. No system is perfectly secure; if a breach affects your information, we'll notify affected customers and people as the law requires.

Your choices and rights

Access, correction and deletion. Contact us at support@praxysehs.com. If the information is part of a customer's records, we'll direct your request to that customer.
Emails. Reminder emails have a way to turn reminders off.
State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete or opt out. We'll honor requests as your state's law requires, and won't treat you differently for making one.

Children

PraxysEHS CM is for businesses and isn't directed at children under 16. [Confirm handling of visitors and workers under 18.]

Changes and contact

We'll post updates here with a new effective date, and tell account administrators before material changes. PraxysEHS LLC · support@praxysehs.com