Your medical file never reaches a phone.

What is collected

Almost all of it is typed by the worker during one orientation, or by the office beforehand so the worker does not have to. Nothing is gathered in the background: there is no location tracking, no analytics, no advertising identifier and no third-party tracker on any screen.

• Who you areName, work email, phone, employer and trade. Email and phone can be left blank.
• Date of birthOnly to decide whether the young & new worker rules apply. It leaves the administration console for nobody: rosters and person cards get the badge and the reason, never the date.
• Emergency contactWho to ring. Encrypted at rest, and readable on a safety officer's phone, because ringing next of kin is done standing over somebody.
• Medical declarationConditions, allergies and medication you choose to declare. Encrypted at rest and reachable only from the administration console. A phone is told whether a file exists and never what is in it.
• SignaturesThe strokes you drew and an image of them. Stored outside the public area; serving one requires an administrator.
• Ticket photographsPictures of tickets and certificates you upload. Also private, and a photograph counts for nothing until a person confirms it.
• Your answersWhat you answered in an orientation, an assessment, a permit or a checklist, your score, and which questions you were stuck on.
• Your device's clockThe time your phone believed it was, stored beside the server's own time. It is what an investigation asks about — a signature at 23:50 local is a different fact from 06:50 UTC.
• Sign-in, for staff onlyA password, stored only as a slow one-way hash, plus the sessions you are signed in on and a count of failed attempts. Workers never get an account.
• NotificationsIf you turn them on — staff from their notifications, a worker from his own page — the subscription your browser issues. The alert itself carries nothing: your phone asks us what it is about, so nothing about you passes through the phone maker's push service. Turning alerts off, or a phone losing your site pass, deletes it.

Photographs taken on a site walk are of the work, not of people. A red observation names the trade responsible, not an individual, unless a finding is assigned to a person by name.

Added since this page was first written, and true as of 8 September 2026: which documents you opened (the first time, the last time and how many times, so an office can tell "handed to him" from "he read it"); a crash report if a screen fails on your phone — the fault, the page it happened on and who was signed in, never what was on the screen; your booking and the link that made it, until you are erased; and counts for the office's statistics, which are totals per trade and never a list of what any one man did.

Where the sensitive things are kept

Medical declarations and emergency contacts are encrypted with AES-256-GCM before they are written down, and each one is bound to whose it is. A blob copied from one person's row onto another's fails to decrypt rather than quietly reporting the wrong man's allergies to a paramedic.

The same value is encrypted in every place it lands — the person's record, the answer as given, and the frozen copy inside the signed document. If the encryption key is missing the system refuses to store the answer at all rather than falling back to writing it in the clear.

Nothing that comes back from the system is ever stored on your device. Not a roster, not a record, not a medical file. A phone that is lent to a mate, left on a bench or lost gives up the app's shell and nothing in it.

Who can see what

Three levels, and every request is checked against the job you are on rather than merely against being signed in.

Your tickets follow you across every site your employer runs and stop at that employer's boundary. An orientation is never portable: every site requires its own.

Who else the data touches

Hosting, the database and file storage are Cloudflare. Email — orientation invitations, confirmations and reminders — goes through Resend, and only where an address was given. A photograph of your ticket is read inside the Cloudflare account that holds it: three models there read the same picture and only agree a field when two of them read it the same way. It does not leave for anybody else unless your employer deliberately switches to an outside reader (Anthropic), which is a setting, not the default. A model only ever proposes; nothing it reads counts until a person confirms it. Translating content is done the same way. The typefaces on this page and the home page are served by Google Fonts.

Nothing is sold, and nothing is shared for advertising.

How long it is kept

A submitted document is a safety record and is kept as a safety record: it is frozen when it is signed, and a later correction is a new entry against it rather than a quiet rewrite. There is no automatic deletion timer, and this page will not invent one — records are removed when somebody asks for them to be removed.

Asking for your data to be removed

Ask your employer's safety administrator, or write to us and we will tell you who that is. An administrator can erase a person from the console, and that erasure removes: your name, email, phone, trade, photograph and date of birth; your emergency contact; your medical declaration, in every place it was stored; your ticket photographs, from the database and from storage; your saved sessions and your site pass; your name and address on any orientation booking; any booking link still outstanding, with the address it was sent to; every notification to you or about you; and your name from any crash report, which keeps the fault and loses the man.