1. Scope and who is responsible
This Privacy Policy applies to HSESteward, including the Android application, hsesteward.com, the Organization Admin portal and the Platform Owner portal. “HSESteward,” “we,” “us,” or “our” refers to the developer/operator of the HSESteward service.
For organization workspaces, the organization using HSESteward may determine why and how much of its workforce and project information is entered into the service. Depending on applicable law and the deployment arrangement, that organization may be an independent controller of workplace data, while HSESteward acts as a service provider/processor for that data.
2. Information we may collect
Account and identity information
- Name, email address, user ID, role, organization, project and crew assignments.
- Workforce information entered by an organization or authorized user, such as employee/token number, designation, company, RC/Civil ID reference, competency/authorization status and related work-readiness information.
Operational HSE information
- Toolbox talks, attendance, checklists, inspections, observations/NCRs, corrective actions, daily/weekly reports, ePTW records, hazards, controls, equipment records, controlled-document metadata and related comments or free-text entries.
- Safety Intelligence outputs generated from HSE records, including risk signals, hazard/control analysis, HIPO/SIMOPS indicators, evidence confidence, precursor patterns and recommended management actions.
Photos, documents and other evidence
- Photos captured or selected for field evidence, observations, report evidence, corrective-action closure or similar HSE workflows.
- Files and documents uploaded to controlled-document or other supported workflows, including file names and metadata.
Location information
When you use a feature that records field evidence or closure location, HSESteward may collect precise device location (for example GPS coordinates) if you grant location permission. Location is used for HSE evidence, traceability and location verification; it is not collected for advertising.
Technical and support information
- Authentication/session information and technical information needed to operate and secure the service.
- Information you send through support, demo, pilot or account-deletion requests.
- Server, security and diagnostic information generated by hosting, authentication, database or infrastructure providers as part of operating the service.
3. How we use information
- Authenticate users and enforce organization, project, crew and role-based access.
- Provide HSE workflows, reporting, ePTW, attendance, document control, equipment management and corrective-action tracking.
- Generate management dashboards and Safety Intelligence decision-support outputs.
- Maintain auditability, safety evidence, data integrity, fraud/security controls and service reliability.
- Respond to support, pilot, privacy and account-deletion requests.
- Improve the service, troubleshoot defects and evaluate feature performance using information lawfully available for those purposes.
Safety Intelligence and AI-assisted processing
Some HSESteward features may use automated or AI-assisted processing to structure safety information, identify possible hazards or control gaps, summarize patterns and generate recommendations. Selected safety content may be processed through contracted cloud/AI service providers where required to deliver these features. Automated outputs are advisory and must be reviewed by competent HSE personnel; they do not replace legal duties, risk assessment, permit authority, isolation authority, professional judgment or emergency procedures.
4. How information may be disclosed
We do not sell personal information and we do not use operational HSE data for third-party behavioral advertising.
Information may be disclosed to:
- Your organization and authorized users: Organization administrators, managers and other users can access information according to their assigned roles and workspace permissions.
- Service providers: Cloud hosting, authentication, database, storage, infrastructure, email/form delivery and AI-processing providers used to operate HSESteward. Current services may include Google Firebase/Google Cloud services, Cloudflare and communication/form providers.
- Legal and safety purposes: Where disclosure is required by law, lawful process, security needs, fraud prevention, or to protect rights, safety and integrity.
- Business continuity: If HSESteward is restructured, acquired or transferred, information may move with the service subject to appropriate privacy protections.
5. Data retention and deletion
We retain information for as long as reasonably necessary to provide the service, maintain security and auditability, comply with contractual or legal obligations, and support legitimate HSE recordkeeping requirements.
When an account-deletion request is approved, we will delete or de-identify account-associated personal data that we are not required to retain. Organization-owned HSE records may need to remain available for safety, legal, contractual, investigation, audit or compliance purposes. Where retention is necessary, we will limit the retained information to what is needed and de-identify personal fields where reasonably practicable.
Deletion requests are normally processed within 30 days after any identity/authority verification reasonably required to protect the account. Backups and security logs may persist for a limited additional period before routine deletion.
6. Your choices and privacy rights
Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, objection or a copy of certain personal information. Workplace data may also be subject to your employer/organization’s lawful recordkeeping obligations. Contact us using the details below and we will evaluate the request under applicable law and the relevant organization arrangement.
You can control camera and location permissions through Android settings. Disabling a permission may prevent features that require that permission from working.
7. Security
HSESteward uses authenticated access, tenant/project scoping, role-based permissions and cloud security controls designed to protect data. Data transmitted between supported clients and cloud services uses encrypted network connections where supported. No system can guarantee absolute security; users and organizations are responsible for safeguarding credentials and assigning appropriate access.
8. International processing
Cloud and service providers may process information in countries other than the country where you use HSESteward. Where required, we and our providers use appropriate contractual or legal safeguards for international processing.
9. Children
HSESteward is designed for professional/workplace use and is not directed to children. We do not knowingly market the service to children. Organizations should not submit children’s personal data unless they have a lawful basis and the use is appropriate under applicable law.
10. Changes to this policy
We may update this Privacy Policy as HSESteward changes. The current version and effective date will be posted on this page. Material changes may also be communicated through the app, website or organization administrators where appropriate.
11. Contact
Privacy questions and requests: kibunja@hsesteward.com.
Account deletion: hsesteward.com/delete-account/.