Privacy Policy

VPI SafetyOS is operated by Vision Performance Inc. ("VPI," "we") as software provided to contractor organizations ("your organization," "you") for health and safety management. This policy describes what we collect through the platform, why, and how it's handled — for both the people your organization invites as users and anyone whose information appears in the records those users create (e.g. a contractor or visitor named in an inspection).

Through normal use of the platform, we hold:

• Account information: name, email, phone (optional), role, job title.
• Safety and compliance records: incident and near-miss reports, hazard assessments, inspections, audits, corrective actions, permits, training records, toolbox talk attendance, and any photos, documents, or signatures attached to them.
• Contractor/vendor records: prequalification documents you upload (e.g. WCB clearance, insurance certificates, COR certification) and their expiry dates.
• Device/request metadata: IP address and browser user-agent are captured automatically on actions that change a record, as part of the platform's audit trail (spec: every mutation is logged with who, what, and when, for regulatory defensibility).
• Passkey credentials, if you choose to set one up: a public key and a device label. We never receive or store an actual fingerprint, face scan, or other biometric — that stays on your device and is checked locally by your device's own operating system.
• Push notification subscriptions, if enabled, so time-sensitive alerts can reach your device.

If you use the "Request a demo" form on our public website, we collect the details you type into it: your name, work email, company, and optionally your role and a message. We use them only to reply to you and arrange a demo. The request is stored in our database and emailed to our team, and we do not sell or share it. Submitting it also records the date and time and, for security and abuse prevention, your IP address and browser details in our audit trail. To have a request deleted, write to privacy@visionperformanceinc.ca; the audit-trail entry holds no name or email.

To operate the platform your organization is using it for: recording and tracking safety information, running audits against the protocols your organization selects, sending required notifications (emergency alerts, overdue-item reminders, permit expiries), and maintaining the audit trail health-and-safety recordkeeping depends on. We don't use this data for advertising, and we don't sell it.

Data stays within your organization's account, visible only to the roles your organization's admins grant access to (see Role-Based Access Control below). To actually run the service, a small number of infrastructure providers process data on our behalf, under their own security commitments:

• Render — application hosting and the database.
• Cloudflare (R2) — file storage for uploaded photos, documents, and evidence.
• Resend — outbound transactional email.
• Twilio — outbound SMS and voice escalation calls.

None of these providers use platform data for their own purposes beyond delivering the service to us. We disclose data to a regulator or law-enforcement body only when legally compelled to.

This section needs legal confirmation before it can be treated as final. Several jurisdictions set specific minimum retention periods for safety and exposure records (for example, injury logs and exposure records are often subject to multi-year minimums). We have not yet confirmed the exact figures that apply to Alberta OHS/WCB recordkeeping against current statute text, so no specific retention period is promised here yet — records are currently kept for the life of your organization's account plus a standard operational buffer, and deleted or anonymized on request where we're not legally required to keep them longer.

Every organization's data is isolated from every other organization's at the database query layer, not just in the interface. Passwords are hashed (never stored in plain text), all traffic is encrypted in transit (HTTPS), and access to any given feature or record is enforced by role on the server, not just hidden in the menu. Every creation, edit, and deletion of a safety record is logged with who did it and when, and that log cannot be edited or overwritten after the fact.

• You can review and update your own account details from Settings → My Profile at any time.
• You can add or remove a passkey, or turn off push notifications, from the same page.
• To access, correct, or request deletion of personal information beyond what you can change yourself, contact your organization's admin or reach us directly (below) — we'll act on a verified request within a reasonable time.

VPI SafetyOS is a workplace tool and isn't directed at or knowingly used by children.

If this policy changes in a way that materially affects how your data is handled, we'll update the effective date above and, where the change is significant, notify organization admins directly.

Questions about this policy or a request regarding your data: privacy@visionperformanceinc.ca.