Legal
Privacy Policy
Effective date: 27 June 2026 · Last updated: 27 June 2026
HSES Online is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what information we collect, why we collect it, and how we use and protect it.
1. About Us
HSES Online (“we”, “us”, “our”) operates the HSES Online platform (www.hses.app), a cloud-based work health, safety, and environment (WHS/HSE) management system designed for Australian organisations.
If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at support@hses.app.
2. Personal Information We Collect
We collect personal information that is reasonably necessary to provide our services. This includes:
2.1 Account and Profile Information
- Full name and email address
- Job title and role within your organisation
- Profile photograph (if provided)
- Account credentials (password stored in encrypted form only)
2.2 Organisation Information
- Organisation name, Australian Business Number (ABN), and logo
- Business locations and site addresses
- Billing and subscription details (payment processing is handled by our payment provider)
2.3 WHS and HSE Records
In the ordinary course of using the platform, you and your organisation will input WHS and HSE data which may include personal information about employees, contractors, and third parties, such as:
- Incident, near-miss, and hazard reports (including details of individuals involved)
- Injury, illness, or health information recorded in incident reports
- Risk assessments, corrective actions, and responsible person details
- Training records and competency information
- Document and form submissions
This data is entered by users of your organisation’s account. You are responsible for ensuring you have appropriate authority and consent to input personal information about third parties into the platform.
2.4 Usage and Technical Data
- Log data (IP address, browser type, pages visited, timestamps)
- Device and operating system information
- Feature usage patterns to improve the platform
2.5 Communications
- Emails and messages you send to our support team
- Feedback and survey responses
3. How We Collect Your Information
We collect personal information:
- Directly from you when you register, complete your profile, or contact support
- From your organisation when an administrator invites you to the platform. In this case, your email address and name are provided by your employer or representative
- Automatically when you use the platform, through server logs and standard web technologies
4. Why We Collect Personal Information
We collect and use personal information to:
- Create and manage your account and your organisation’s subscription
- Provide, operate, and improve the HSES Online platform
- Send transactional emails (invitations, password resets, notifications)
- Respond to support enquiries and provide customer assistance
- Maintain platform security and detect fraudulent or unauthorised activity
- Meet our legal and regulatory obligations
- Analyse aggregated, de-identified usage data to improve our product
We will not use your personal information for purposes other than those described above without your consent, unless permitted or required by law.
5. Sensitive Information
Incident and injury reports entered into the platform may contain sensitive information as defined by the Privacy Act, including health information about individuals. We handle all such sensitive information with a higher standard of care and will not use or disclose it except:
- To provide the platform services to your organisation
- Where the individual has consented
- Where required or authorised by Australian law
Your organisation, as the data controller for information entered by its users, is responsible for ensuring appropriate consent and authority exists before recording sensitive information in the platform.
6. Disclosure of Personal Information
We do not sell, rent, or trade your personal information. We may disclose personal information to the following categories of third parties:
6.1 Service Providers
We engage trusted third-party service providers who assist us in operating the platform. These providers are bound by confidentiality obligations and are only permitted to use your information for the specific purpose for which it was shared:
- Supabase: database hosting and authentication infrastructure (data hosted on Amazon Web Services infrastructure)
- Resend: transactional email delivery (invitations, notifications, password resets)
- Vercel: platform hosting and content delivery
6.2 Legal Requirements
We may disclose personal information if required to do so by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect the rights, property, or safety of HSES Online, our users, or others.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity. We will notify affected users of any such transfer and any material changes to how their information is handled.
7. Overseas Disclosure
Some of our service providers (including Supabase/AWS and Resend) may store or process personal information outside of Australia, including in the United States. Before disclosing personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles, in accordance with APP 8.
By using HSES Online, you acknowledge that your information may be transferred to and processed in countries outside Australia.
8. Security
We implement appropriate technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These measures include:
- Encryption of data in transit (TLS/HTTPS) and at rest
- Row-level security policies to enforce data access boundaries between organisations
- Access controls and role-based permissions within the platform
- Secure, hashed credential storage
You are responsible for maintaining the confidentiality of your login credentials and for all activity that occurs under your account. Please notify us immediately at support@hses.app if you suspect any unauthorised access.
9. Data Retention
We retain personal information for as long as your account is active or as needed to provide our services. We may also retain information as required by law or to resolve disputes, enforce agreements, or meet regulatory obligations.
When an organisation cancels its subscription, we will retain account data for 30 days to allow for data export, after which it will be securely deleted from our active systems. Backup copies may persist for a further limited period in accordance with standard data management practices.
10. Your Privacy Rights
10.1 Access
Under APP 12, you have the right to request access to personal information we hold about you. You can access and update most of your personal information directly through your account settings. For additional requests, contact us at support@hses.app.
10.2 Correction
Under APP 13, if you believe personal information we hold about you is incorrect, out of date, incomplete, or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree, note your request alongside the information.
10.3 Complaints
If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us first at support@hses.app. We will respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.
11. Direct Marketing
We may send you product updates, feature announcements, and other communications related to the HSES Online service. You may opt out of non-essential communications at any time by using the unsubscribe link in any email or by contacting us at support@hses.app. We comply with our obligations under the Spam Act 2003 (Cth).
12. Cookies and Analytics
The HSES Online platform uses session cookies and similar technologies to maintain your authenticated session and ensure the platform functions correctly. We do not use third-party advertising cookies or behavioural tracking cookies.
We may collect aggregated, non-identifiable analytics data to understand platform usage and improve our product.
13. Children’s Privacy
HSES Online is a business platform not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will notify you by email or by displaying a prominent notice within the platform. The revised policy will take effect from the date shown at the top of this page.
15. Contact Us
For any privacy-related questions, access or correction requests, or complaints, please contact us at: