HSE On Demand

Privacy Policy

Draft – under legal review. This page is not yet in effect. Items in [square brackets] are still to be confirmed.

HSE On Demand is a business name of Sasha Liddell (ABN 42 400 850 443), based in Western Australia ("we", "us"). We set up and manage health, safety, environment and quality systems for businesses, through our online Portal and our consultants.

This policy explains how we handle personal information about our clients' contacts and staff, the people who use our Portal, and visitors to hseondemand.com.au. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) as good practice, whether or not the Act applies to us.

1. What we collect

Client contacts: name, role, business, email, phone and billing details.
People named in a client's system: names, roles, work emails, training and licence records, induction and toolbox attendance, task owners and due dates, and records of meetings, inspections and Take 5s.
Incident and injury records: where a client keeps these in the Portal, they may include health information about a worker. We only handle it as needed to manage the client's system.
Portal users: login email, name and what you do in the Portal (for example who completed a check and when).
Roma chats: questions typed to Roma and her answers.
Website enquiries: what you send us through the contact form or by email.

We do not ask for tax file numbers, government ID numbers or bank card numbers in the Portal.

2. How we collect it

Most personal information comes from our clients, who give us their existing documents and registers or enter records into the Portal. We also collect it directly from you when you use the Portal, talk to Roma, email us or attend a meeting or audit we run.

If you are a worker named in your employer's system, your employer is responsible for telling you that your details are shared with us. We are happy to answer your questions directly.

3. Why we use it

to set up, maintain and audit our clients' management systems
to send reminder emails to the person responsible for a due task
to run guided management reviews and weekly checks, and keep their minutes
to let Roma find the right record when asked
to invoice and manage our client accounts
to meet our legal obligations and deal with disputes

We do not sell personal information. We do not use clients' records for marketing, and we do not use them to train AI models.

4. Who we share it with

Service providers we use to run the business: Portal hosting, email (Microsoft 365), [accounting software] and the AI provider behind Roma. They may only use the information to provide their service to us.
Subcontracted auditors or consultants working on your account, who must keep it confidential.
Certification bodies and principal contractors, only when the client asks us to share records with them.
Regulators and authorities, where the law requires it.

Inside a client's Portal, users the client has approved can see that client's records. One client cannot see another client's information.

5. Overseas storage and Roma

Some of our service providers store or process data outside Australia, including in the United States. [Confirm the list: Portal hosting – region; Microsoft 365 – Australian data centres; AI provider – United States.] We choose providers with strong security and contractual privacy commitments.

Roma is an AI assistant powered by a third-party AI model (currently Anthropic's Claude). When you ask Roma a question, your question and the register details needed to answer it are sent to the AI provider to produce the reply. [Confirm: the provider does not use this data to train its models and keeps it for a limited period only.] Please do not type health details or other sensitive personal information into Roma.

6. Security, retention and deletion

We protect personal information with access controls, multi-factor sign-in on our own accounts, and by giving Portal access only to people the client approves.

We keep a client's records while we provide services to them. When the agreement ends, we give the client a copy and delete their data from the Portal within [60] days, unless the law requires us to keep it. Billing records are kept for 5 years as required by tax law.

If we become aware of a data breach that is likely to cause serious harm, we will tell the affected client promptly and, where required, notify the Office of the Australian Information Commissioner (OAIC) and the people affected.

7. Access, correction and complaints

You can ask to see or correct the personal information we hold about you. If it sits in your employer's system, we may involve your employer, because they control those records. We will reply within 30 days.

If you have a privacy complaint, email us first and we will respond within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au or on 1300 363 992.

Contact: HSE On Demand, hello@hseondemand.com.au

We may update this policy. The current version is always on our website.