Privacy Policy

HazProof is a product of Opynbox LLC ("Opynbox," "HazProof," "we," "us," or "our"), a Texas limited liability company, Austin, Texas, USA. HazProof is construction safety-management software. It includes the web app at hazproof.com and field apps for iOS and Android (Android coming soon), used for JHAs, meetings, inspections, observations, incident reports, and OSHA recordkeeping. HazProof is sold to businesses, and every user is invited by an organization.

• Your employer controls its workplace records. The organization that uses HazProof (the "Customer") decides what is recorded and how it's used. We process those records on the Customer's behalf under our Master Subscription Agreement and Data Processing Addendum. For those records we act as a service provider or processor.
• We control a smaller set of data: account and login data, security and audit logs, website, demo-request, and sales-contact data, and our own business communications.

If your information is in an employer's workspace, contact your employer first. You can also contact us (§13).

Medical records. HazProof is not a medical records system. We are not a HIPAA covered entity or business associate. HazProof stores only the injury and illness details needed for OSHA Forms 300, 300A, and 301. Within an employer's workspace, those details are visible only to Safety Managers and the injured employee. Customers agree not to upload employee medical records (for example physicals, drug or alcohol test results, audiograms, exposure monitoring, medical surveillance, or doctors' notes) and to keep them in their own HR or occupational-health systems.

Biometrics. If you turn on Face ID or fingerprint unlock, it stays on your device (iOS Keychain or Android Keystore). We never receive or store biometric data.

Offline copies. The app may keep catalogs and unsynced records on your device until they can be sent. Signing out removes them.

We use information to provide, operate, secure, and support HazProof. That includes signing you in, enforcing roles, storing and displaying records, running AI features the Customer has turned on, syncing offline records, delivering app updates, preventing abuse, responding to demo and support requests, invoicing, meeting legal obligations, and enforcing our agreements. We may create de-identified, aggregated statistics that don't identify any person, Customer, or jobsite. We don't attempt to re-identify them.

We use Customer workplace data only to provide HazProof to that Customer, as it instructs. We don't use workplace data, AI inputs, or AI outputs to train AI models, and we don't use them for advertising.

We don't sell personal information, and we haven't sold any in the past 12 months. We don't "share" personal information for cross-context behavioral (targeted) advertising, and we haven't done so in the past 12 months. We don't knowingly collect sensitive data for the purpose of inferring characteristics about anyone. We don't use automated decision-making that produces legal or similarly significant effects.

Some optional features use AI provided by Anthropic to draft suggestions, such as JHA hazards, incident summaries, or recordkeeping prompts. When you use one, we send only the content needed for the request. Under its commercial terms, Anthropic doesn't train its models on this content and keeps it only for a limited period for trust and safety. AI output is a draft. A qualified person must review it. It isn't legal or medical advice and doesn't decide whether a case is OSHA-recordable. You don't need to include names or medical details for AI features to work.

Service providers (subprocessors). Each is bound by contract to protect the data and use it only to serve us. The current list, also maintained at hazproof.com/subprocessors:

Anthropic, listed above, is the live AI processor. OpenAI is present in the product for embeddings only and is not live, so it does not receive customer data and is not an active subprocessor.

We give Customers notice before adding a new subprocessor.
Your organization. Administrators and authorized users can see their organization's records according to their roles.
Legal and safety. We may disclose information to comply with law or valid legal process (we redirect requests for Customer records to the Customer where we can), to enforce our terms, or to protect anyone's rights, property, or safety. We don't send records to OSHA or other agencies unless the Customer tells us to.
Business transfers. Information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this Policy, with notice where required.

We keep personal information only as long as needed for the purposes above, our contracts, and the law.
- Workplace records are kept for the Customer while its subscription is active. HazProof doesn't hard-delete them in the app. Removed records are archived, and records are erased only through a controlled process where the law requires it or the Customer instructs it. Employers must keep OSHA injury and illness records for five years after the end of the year they cover (29 CFR 1904.33). HazProof doesn't store employee medical or exposure records, so the 30-year rule in 29 CFR 1910.1020 doesn't apply to data in HazProof by design.
- After a subscription ends: Customer data is available to export for 90 days, then deleted within 30 days, except where the law or a legal hold requires us to keep it.
- Backups roll off within 35 days. Account, log, demo, and billing data: see the table in §2.
- See also our retention schedule.

Every record is scoped to one organization and protected by database row-level security and role permissions. Injury and illness details are further limited by role. Data is encrypted in transit and at rest. More detail: hazproof.com/security. If we confirm a security breach affecting Customer data, we'll notify affected Customers without undue delay, aiming for within 72 hours of confirmation, and help them meet their own notification duties.

Under 29 CFR 1904.35, employees, former employees, and their personal representatives can get copies of the OSHA 300 Log and their own Form 301 from their employer. Employees can download these in the app. Employers may not retaliate against workers for reporting injuries.

Workplace records. Your employer controls these. Ask your HazProof administrator, or use hazproof.com/privacy-requests and we'll route your request to your employer and help it respond. Because employers must keep some records by law, we act on deletion requests for workplace records only when your employer instructs us to.

Data we control (U.S. state privacy rights). Depending on where you live (for example Texas, California, Colorado, Virginia, Connecticut, and other states with privacy laws), you may have the right to:
- know or confirm what personal information we process, and access it;
- correct it;
- delete it;
- get a portable copy;
- opt out of sale, targeted advertising, or profiling (we don't do any of these);
- limit the use of sensitive information.
California residents may also ask what categories we've collected and disclosed in the past 12 months. We disclose the categories in §2 to the service providers in §6 for business purposes only.
- How to ask: use hazproof.com/privacy-requests or email privacy@hazproof.com. We'll verify your identity using information we already hold. An authorized agent may submit a request with your signed permission, and we may verify with you directly.
- Timing: we respond within 45 days. We'll tell you if we need up to 45 more days.
- Appeals: if we deny your request, reply to our decision or email privacy@hazproof.com with "Appeal" in the subject within 60 days. We'll respond in writing within 60 days. If we deny the appeal, you can contact your state attorney general (in Texas: texasattorneygeneral.gov).
- No discrimination: we won't treat you differently for exercising your rights.

On your phone. You can sign out, turn off biometric unlock, and deny camera, photos, location, or notification permissions in your device settings. You can ask for your account to be deleted. Records your employer must keep remain in its workspace.

We don't use advertising or cross-site tracking cookies, and our apps contain no advertising SDKs. We honor Global Privacy Control (GPC) signals as an opt-out of sale or sharing. Because we don't sell or share, a GPC signal requires no change in how we process data. We don't respond differently to other "Do Not Track" signals. If we add non-essential cookies, we'll update this table first and ask for consent where the law requires it.

HazProof is a workplace product and isn't directed to children. You must be 18 or older to hold an account. Employers may record information about workers aged 16 or 17 in their workspace (for example on a training record), and the employer is responsible for that information. We don't knowingly collect personal information from children under 13. If you believe we have, email privacy@hazproof.com and we'll delete it.

HazProof is intended for organizations in the United States. Opynbox operates from the United States, and our primary hosting is in the United States. Some service providers may process data in other countries under contractual protections. If you access HazProof from outside the U.S., your information will be transferred to and processed in the U.S. If we begin serving customers in the EU, UK, or Switzerland, we'll update this Policy and offer appropriate transfer mechanisms (such as Standard Contractual Clauses).

We'll post changes here and update the dates. For material changes, we'll notify Customer administrators at least 30 days in advance. We won't apply a materially less protective practice to data we already hold without the consent the law requires.

Opynbox LLC (HazProof), Attn: Privacy, Austin, Texas, USA
Email: privacy@hazproof.com · Requests: hazproof.com/privacy-requests · Support: support@hazproof.com
Terms: hazproof.com/terms · DPA: hazproof.com/dpa · Security: hazproof.com/security