Privacy notice

Account details (name, work email, role) for people who sign in, and a log of significant actions, such as who approved a document and when. An owner, admin or health & safety manager can also record an emergency contact (name, phone number and relationship) for a team member.

The safety records the organisation keeps: incidents and near-misses (including injury details, and the name and contact details of whoever reported them), investigations, corrective actions, risk assessments, inspections, observations, site plans, emergency contacts, contractor and training records, and any files, photos or voice notes attached to them. Any signed-in member of the organisation can read its incident reports.

Where the organisation uses these features: lone-worker check-ins, working-hours (fatigue) logs, and answers to wellbeing surveys.

Health-related information: injury detail in incident reports, occupational-health records, sickness absence, working-hours (fatigue) data and wellbeing answers can all reveal something about a person's health, so we treat them as health-related. Health data is special-category data under UK GDPR. Occupational-health records are kept in separate tables with separate access, which only occupational-health and HR roles can open. Absence records are limited to owners, admins and health & safety managers.

When you use the public report form, we collect what you enter and, optionally, a photo or voice note and your contact details so we can follow up.

If you tick “report anonymously” on the report form, we do not store your name, your contact details or your IP address with the report. The only things kept with it are what you chose to send: the category, site, description and any photo or voice note. A photo or voice note is stored as sent, with its original file name. An attached photo or voice note may identify you. Our web server keeps security logs of every request, which include IP addresses; they are kept apart from reports and used only for security.

The information is used solely to run the organisation's health & safety management system: recording what happened, investigating it, deciding statutory reportability, and tracking that issues get fixed. It is not sold, and it is not used for advertising.

Records are kept while your organisation uses SafetrexIQ. Some, such as incident records, cannot be deleted from inside the app, because safety law often requires them to be kept. When your organisation stops using SafetrexIQ, Clarion Safety Group deletes its data on request.

Deleted data can remain in backups: nightly copies on our server for 15 days, and an encrypted copy on a separate server (Contabo GmbH, France) for 31 days.

Some features use AI: drafting the management system (this runs automatically when the company profile is saved), risk-assessment drafts, investigation write-ups, safety recommendations, and the Ask Trex assistant. Every AI text request passes through a privacy gateway on our servers before it can go anywhere else; fixed instructions, including your organisation's name, are sent as written. Search indexing runs on our own servers and is never sent to OpenAI.

The gateway looks for health and other special-category information, such as injuries, illness, mental health, religion, trade-union membership and criminal records. It does this automatically, using term lists, rules for injuries and body parts, and your organisation's list of known people. If it finds any, the whole request is processed only by our own AI model, which runs in France. Detection uses word lists and rules, so it can miss wording they do not cover. It is a safeguard, not a guarantee. An organisation that cannot accept that risk should choose Sovereign mode or Off mode.

Before anything leaves our servers, the gateway replaces these with placeholders: the names of everyone recorded in the workspace (team members, incident and observation reporters, people in absence, working-hours and lone-worker records, contractors, team members' emergency contacts, the organisation's responsible person, the assessors, approvers and data owners named on assessments and documents, and wellbeing-survey respondents who leave their name), names with a title such as Mr, Mrs or Dr, email addresses, UK and international phone numbers, UK postcodes and National Insurance numbers. Other names typed into free text may not be recognised.

The application never puts passwords, sign-in codes or tokens into a request. Text that looks like a password, PIN, door or alarm code, API key, access token or private key is blocked from every model.

Each organisation has one of four AI modes. An owner, admin or health & safety manager sets it under Company profile.

• Off: AI drafting and the assistant are switched off for the organisation. Search still indexes records with our own on-server model; nothing is sent to OpenAI. Everything else keeps working.
• Sovereign: nothing is sent to OpenAI. All AI runs on our own model in France. On current hardware this is slow: Ask Trex still answers, more slowly, but document drafting (management system, risk assessments, investigation write-ups, site recommendations) does not complete and must be written by hand.
• Restricted: only anonymous totals and trends may be sent to OpenAI. No current feature sends totals, so today it behaves like Sovereign.
• Standard (the default for new organisations): requests may be processed by OpenAI (OpenAI OpCo, LLC), which may process them outside the UK and EU, including in the United States. Recognised names and contact details are replaced first, and detected health information stays on our own model.

OpenAI does not use requests sent through its API to train its models. It keeps them in abuse-monitoring logs for up to 30 days, unless the law requires it to keep them longer or it needs to investigate abuse.

AI output is a draft. Generated documents become approved only when a named person signs them off. Every AI request writes a record to your organisation's audit trail: the date, the feature, where it was processed (our servers or OpenAI) and the outcome. The record never contains what was in the request.

No decision about a person is made solely by AI. The RIDDOR reportability verdict comes from a fixed set of rules, not from AI, and a competent person confirms it. Statutory reports are never filed on your behalf.

Clarion Safety Group uses these providers to run SafetrexIQ: Contabo GmbH hosts the application, database, uploaded files and our own AI model on servers in France; GoDaddy delivers emails such as sign-in codes and alerts; and OpenAI (OpenAI OpCo, LLC) processes AI requests where an organisation's AI mode allows it, as described above. Nightly backups are also kept on a second Contabo server in France, encrypted with a key that server does not hold.

Our public website pages (not the app itself) load typefaces from Google Fonts, so your browser connects to Google's servers when you visit them.

A small number of SafetrexIQ staff have a platform-admin role. It lets them see which organisations and accounts exist and how large they are, read audit entries across organisations, suspend an organisation and change a member's role. Staff can also create accounts, assign any role, including HR or occupational health, and deactivate or delete accounts. When a sign-in email does not arrive, they can issue a one-time sign-in code to that person. The code works once, expires within minutes and lets its holder sign in as that person. Every use of the role is logged. Actions aimed at one organisation, such as suspending it or changing a member's role, also appear in that organisation's audit trail. Account-level actions (updating or deactivating an account, issuing a sign-in code, resending or confirming verification, and deleting an account) carry no organisation, so they appear only in the staff log. The staff console itself does not display the contents of your records, and nothing in it reads occupational-health or sickness-absence content.

Your organisation's records are stored in France; the UK recognises the EU as giving an adequate level of data protection.

Where your organisation's AI mode allows it, AI requests may be processed by OpenAI (OpenAI OpCo, LLC), including in the United States. These transfers rely on OpenAI's Data Processing Addendum, which uses the 2021 EU Standard Contractual Clauses with the UK Addendum. Content that OpenAI flags for abuse review can reach its moderation sub-processors, which may be outside the EU.

Email delivery by GoDaddy may take place outside the UK and EU, under GoDaddy's data processing terms.

Under UK GDPR you can ask to access the data held about you, to have it corrected or erased, to restrict or object to how it is used, and to receive it in a portable form. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Erasure: an owner or admin can remove a person's access, delete their notifications and occupational-health records, and anonymise their login if they belong to no other organisation. Their name can remain in records that others created or that the law may require us to keep: incident reports, sickness absence, working-hours and lone-worker entries, audit entries, uploaded files, wellbeing follow-up names, and names typed onto assessments and documents as assessor, approver or data owner. The organisation's responsible-person name and email, and the copy of incident text in the search index, also stay. We remove or anonymise these on request.

To exercise any of these rights, contact info@clarionsafetygroup.com or your organisation's health & safety or data protection contact.

Your data stays yours. Owners and admins can download a ZIP of the organisation's records, uploaded files and generated documents at any time from the Team page, in the Data & privacy card. The ZIP does not include occupational-health records, sickness absence, working-hours (fatigue) records or notifications. We provide those on request.

Data is encrypted in transit, access is controlled by role, and each organisation's data is isolated from every other's. Occupational-health records are kept in separate tables with separate, tighter access.