Privacy Policy

How Haznote collects, uses, stores, and discloses personal information, including sensitive health information in safety reports.

Version: 1.2
Effective: 2026-11-01
Status: Published

0When this policy applies

This policy explains how Haznote handles personal information. It applies from the effective date above and should be read together with any collection notice shown when information is provided.

Haznote ("Haznote", "we", "us") provides a workplace safety reporting service to Australian businesses. This policy explains how we handle personal information, and it applies to the Haznote worker application, on mobile devices and at app.haznote.com, the web application at dashboard.haznote.com, and our website.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Safety reporting necessarily involves information about injuries, health, and sometimes distressing interpersonal conduct. We have written this policy to be specific about that rather than general, because vague privacy language is of no use to a worker deciding whether to report something.

2What we collect

Account information, for administrators, managers, and appointed representatives:

Name, email address, role, and the sites you are assigned to.
A hashed password, only if you choose to set one. You can sign in with a one-time code sent to your email address instead, and we never store a password in a readable form.
For a representative, the professional accreditation and business number they supply about themselves.

Worker information, which the employer provides rather than the worker:

Name and email address, used to sign the worker in with one-time email codes and to attribute reports, and a mobile phone number if the employer provides one.
Site and zone assignments, and whether the account is active.
A device token, if the worker enables push notifications.

Report content, which is the substance of the service:

Voice recordings made by the worker, and the text transcript produced from them.
Photographs of the hazard, incident, or scene.
Precise device location (latitude and longitude), captured at the moment of recording or of taking a photo, when the worker allows it.
The site, zone, and any typed note the worker adds, and whether the worker chose to report anonymously.
Anything the worker chooses to say or photograph, which may include the names of other people, descriptions of injuries, and accounts of workplace conduct.

Technical information, collected automatically:

Application version, device type, and operating system.
IP address, request logs, and error diagnostics, retained for security and troubleshooting.
Access records: who viewed a confidential report and when, and who changed company access, which we are required to keep as an audit trail.

We do not request medical records, diagnoses, insurance or Medicare numbers, and we do not integrate with any external health record system. What we hold comes only from the report itself. Because a report is free-form speech and photographs, a worker can include more than is needed — please do not include medical information that the report does not require.

3Sensitive information

Some of what we hold is sensitive information under the Privacy Act. In practice this means:

Health information, where a report describes an injury, an illness, or the physical effect of an incident on a person.
Information about psychosocial matters, such as reports of bullying, harassment, or sexual harassment, which may reveal health information and allegations about identified people.

We collect this information because a worker submits it for the purpose of workplace safety, and because their employer needs it to meet its work health and safety obligations. The product is designed for that purpose and asks for nothing beyond it. A voice report is free-form, so we cannot guarantee that a given recording contains nothing further; we do not use anything it contains for any other purpose.

Psychosocial reports are held in a separate confidential stream. They are visible only to the company administrator and any representative the company has appointed, never to site managers. Every time such a report is opened, we record who opened it and when. Where the Service cannot produce a classification at all — for example when transcription or classification fails — the report is routed to this confidential stream rather than to a manager. This is a failure path, not a confidence judgement: the Service does not withhold a report from a manager because a suggested classification looked uncertain.

A psychosocial report is an allegation that has not been tested. It is not a finding. It should be handled accordingly by anyone who receives it.

4How we use it, and our role

We use personal information to:

Receive reports, transcribe and classify them, and deliver them to the right person in your organisation.
Send notifications about incidents and account changes, and the emails that let you use your account: one-time sign-in codes and sign-in links, invitations, a link and a code that confirm a change of email address, a security notice when a password is set, and a notice telling a worker they have been added to a site of another company.
Generate the WHS documents and registers your organisation asks for.
Keep the audit and access records that regulatory and breach obligations require.
Secure the service, investigate misuse, and provide support when you ask for it.
Understand how the web application is used, so we can improve its reliability. The usage events we send carry an account identifier, not a name or an email address, and never carry report content — clause 13 explains this in full.

We do not sell personal information, and we do not use report content for advertising or for any purpose unrelated to running the service for your organisation.

Your employer decides what is collected. Where Haznote is used by your employer, your employer determines why and how information about you is collected, and we handle that information on their instructions. If you want to know why your employer uses Haznote, or to raise something about their handling of your information, contact them first. You can also contact us using clause 15.

5Automated processing and artificial intelligence

This is the part of our processing that is least obvious, so we describe it in full.

When a worker submits a voice report, the audio file is sent to a speech-to-text provider, which returns a written transcript.
The transcript, or the typed note for a report with no audio, is sent to a language model provider, which suggests a category, a priority, whether the report looks like it may be notifiable, and whether it appears to be a psychosocial matter.
Those suggestions determine where the report is routed. A suspected psychosocial report goes to the confidential stream; other reports go to the assigned managers.
A person then reviews the report. Any classification that carries legal weight must be confirmed or corrected by a person before an official document is produced.

The automated output is advisory. It is stored unchanged next to any human correction, so the record always shows what the system suggested and what a person decided. Automated transcription and classification can be wrong, and no legal determination is made automatically.

If the Service cannot process or classify a report at all — for example when transcription or classification fails — it fails towards confidentiality: the report goes to the confidential stream rather than to a manager. This is a failure path, not a confidence judgement: the Service does not withhold a report from a manager because a suggested classification looked uncertain. This can mean a report is seen by fewer people than expected, never by more.

Transcription and classification are both performed by OpenAI, in the United States. Report audio and the transcripts made from it are therefore disclosed overseas — clause 8 describes that disclosure and what we do about it. We configure this provider not to use report content to train general-purpose models. We may use other providers for testing only with synthetic or de-identified data, never live customer reports. We intend to move this processing to an Australian region; this policy will say so when that is done, and not before.

6Anonymous reports and their limits

Where a site permits it, a worker can submit a report anonymously. When they do, we do not attach their name to the report, the report is not shown in their own list of submissions, and managers see it without an author.

Anonymous does not mean unidentifiable. A voice recording carries the voice of the person who made it, and a colleague may recognise it. What a report describes, and where and when it was made, can also point to its author on a small site. Anyone who needs to be certain they cannot be identified should not use a voice recording.

We remove camera and location metadata from photographs attached to anonymous reports before storing them. We cannot remove identifying characteristics from a recording of a person speaking.

We do not attempt to identify the author of an anonymous report, and the Terms of Service prohibit our customers from doing so other than through a lawful investigation process.

7Where your information is stored, and how it is protected

Our deployment target for customer records, recordings, photographs and generated documents is Sydney, Australia (AWS ap-southeast-2). AI processing is a separate matter and is not in Australia today — see clause 5 and clause 8.

Connections between your browser or the mobile app and Haznote use HTTPS.

We use provider-managed encryption at rest and HTTPS in transit, private storage, role-based access and short-lived media links. These measures reduce risk but no online service can promise absolute security.

Recordings and photographs are held in private storage and are reachable only through short-lived links issued to a person who has permission to see that specific record.
Access is scoped by role and by site. Managers cannot reach the confidential psychosocial stream, cannot see reports for sites they are not assigned to, and cannot see a report before it has been routed.
Access to confidential reports is logged, as are changes to who has access to a company.

No system is perfectly secure. Clause 11 describes what we do if something goes wrong.

8Service providers and overseas processing

Report audio and transcripts are sent outside Australia for transcription and classification, as clause 5 describes. Our application server, background workers and the proxy that carries requests between your browser and that server necessarily process report content as it passes through them — this is how the service runs, and it is separate from the AI processing above. Push notifications and product analytics receive only account, device or network information. Email delivery additionally carries the content of the messages we send, and that includes an in-app support request: what you write in it, and any screenshot you choose to attach, travel to our email provider with the message. We never send stored report audio, transcripts or photographs to any of these services — but a screenshot is a file you attach yourself, so please do not attach one showing report content, and quote the incident reference instead.

We select established providers, limit the information they receive to what is needed for their function, and use contractual and technical controls appropriate to the information involved. Overseas locations may include the European Union and the United States, depending on the supporting service and the recipient’s infrastructure.

A current list of material service providers and their functions is available from privacy@haznote.com. We update the list when the production architecture changes.

Where Australian privacy law applies to an overseas disclosure, we take reasonable steps appropriate to the circumstances before making that disclosure. We remain accountable for our own handling of the information.

9Who we share information with

Within your organisation, information is shared according to role: managers see reports for their assigned sites, administrators see company-level information, and appointed representatives see the confidential reports assigned to them.

Outside your organisation, we disclose personal information only to the service providers we use to run Haznote, and where the law requires it, such as in response to a court order or a lawful request from a regulator.

Supabase for Australian database and private object storage.
OpenAI for transcription and language-model classification, in the United States.
Infrastructure providers for application hosting and web delivery.
Email, SMS and push-notification providers for account and safety communications. Sign-in codes are sent by email; SMS sign-in is switched off by default.
PostHog for limited web product analytics; report content is excluded.

This list changes as the service changes. We will keep this policy current, and clause 14 explains how we tell you about updates.

We do not disclose report content to a regulator on your behalf. Notifying a regulator is your organisation’s decision and obligation.

10How long we keep it

We retain information for the period reasonably needed to provide the Service, preserve the integrity of workplace safety records, meet the Customer’s documented recordkeeping needs, resolve disputes and comply with law. Records of notifiable incidents are retained for at least five years from the date the regulator is notified. A legal hold may require longer retention of relevant records.

Incident records and audit history are protected from ordinary deletion so later edits do not erase the original safety record.
A report captured on a device but never sent stays on that device until it is sent or deleted there.
Authentication, diagnostic and security records are retained only for operational, fraud-prevention and security purposes, then deleted or de-identified when no longer reasonably needed.

Where appropriate, we remove or replace account identifiers while retaining a safety record. This reduces identification risk, but narrative, voice, photographs or surrounding circumstances may still identify a person. We do not describe this as guaranteed anonymity.

11Data breaches

We maintain a data breach response plan. If we suspect a breach involving personal information, we contain it, assess it, and where it is an eligible data breach under the Notifiable Data Breaches scheme, we notify.

We take all reasonable steps to complete our assessment within 30 calendar days of becoming aware of the grounds for suspicion, and sooner where we can.
Where we form a reasonable belief that an eligible data breach has occurred, we notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals as soon as practicable.
Where a breach affects a customer’s data, we tell that customer so they can meet their own notification obligations.
Our record of who accessed confidential reports exists specifically so that the scope of any breach can be established.

12Accessing and correcting your information

You can ask us what personal information we hold about you, and ask us to correct it if it is wrong. We will respond within a reasonable period, and we do not charge for making a request.

If you are a worker, the fastest route is usually your employer, who controls your account and can correct your name, phone number, and site assignments directly.
We may need to verify your identity before we release information.
We may decline a request where the law permits, for example where releasing information would reveal the identity of a person who reported anonymously, would compromise an investigation, or would disclose another person’s personal information. If we decline, we will tell you why.
A worker cannot see the transcript of their own submitted report through the application. This is a deliberate design decision about how reports are handled once submitted, and it does not affect your right to make an access request under this clause.

13Email, cookies, and analytics

Service and safety messages are kept focused on operating the account and responding to incidents. Commercial messages are sent only where permitted, identify Haznote and include a working unsubscribe option. Unsubscribing from marketing does not stop essential security or safety notifications.

The web application uses cookies that are necessary to keep you signed in and to protect the session. We do not use advertising or cross-site tracking cookies.

The web application sends a small number of usage events — currently only that a register CSV was exported and that a PDF was generated — to PostHog, our analytics provider, so we can see which parts of the product are used. Each event carries an account identifier, a short description of the action, and the network information any web request carries, including your IP address. The action description can include your role and whether a filter was applied. Events never carry report content, a worker’s name, or a transcript. PostHog processes these events in the European Union. The mobile application sends no analytics events.

When you create an account, we store with your company record where you came from: the website that sent you (its domain only), the kind of source it was (for example a search engine or an AI assistant), the page you landed on, which link or button you used, the campaign tags in the link (source, medium and campaign), and your answer to “How did you hear about us?” if you give one. We use it only to see which channels bring customers. It is not sent to PostHog or any other analytics service, and it is not shown to other users. We do not collect the website, the kind of source, the page, the link or button, or the campaign tags when your browser sends a Global Privacy Control or Do Not Track signal; only your own answer to “How did you hear about us?”, if you give one, is kept.

14Changes to this policy

We update this policy when our handling of personal information changes, including when we add or remove a service provider. Each version carries a version number and an effective date, shown at the top of this page. Where a change is material, we will tell affected customers directly.

15Contact and complaints

To make a privacy enquiry, access or correction request, or complaint, contact Haznote at privacy@haznote.com.

We will acknowledge your complaint, investigate it, and respond in writing. We aim to respond within 30 days.

If you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner (OAIC), on 1300 363 992 or at oaic.gov.au.