Privacy Policy

Policy version 2026-08-16

This Policy describes the personal information we collect through the Software, what it is used for, where it is held, how long it is kept, and what a person can do about their own information. It applies to everyone whose personal information the Software holds, including people who have never used the Software themselves.

Definitions

• neatforms means the developer of the Software, referred to as “Developer” in the End-User License Agreement and in our agreement with Client. “We”, “us” and “our” refer to neatforms, which is accountable for the personal information described in this Policy.
• Client means the organization that has licensed the Software, decided which features to turn on, and decided what its own forms ask for.
• Worker means a person who uses the Software in the course of their employment or engagement with Client.
• the Software means the neatforms worker application, the administrative dashboard, and the services that support them.

Client decides what the Software collects about its own people. We supply the Software and hold that information on Client’s behalf.

1. Information We Collect

1.1 Records submitted through forms. When a Worker completes and submits a form, the Software collects:

• (a) the Worker’s name;
• (b) the job site and supervisor entered at the time of submission;
• (c) the tasks, hazards, risk levels and controls selected;
• (d) the acknowledgment and sign-off names of the Workers involved in the task;
• (e) the date and time of submission, and whether the submission replaces an earlier one;
• (f) where Client has included a photo section in a form, the photographs the Worker attaches to the submission;
• (g) where Client has turned on the incident report form, what the Worker records about a workplace incident: when and where it happened, the kind of incident and how serious it was, what the person was doing at the time, what caused the harm, any injuries and the areas of the body affected, and the corrective actions taken;
• (h) the names of other people the Worker enters into a form, including the people involved in an incident, anyone who witnessed it, and the crew members who signed off on a hazard assessment; and
• (i) whatever any other form Client has built asks for. Client can create its own forms and decide what they collect, so a form may ask for information beyond what is listed above. We do not make those choices.

Where an administrator files a record on a Worker’s behalf, because it reached them on paper or by email, the Software also records which administrator filed it.

1.2 Certification and ticket records. Where Client uses the certification-tracking feature, the Software collects the name and expiry date of a Worker’s certifications, tickets and qualifications, entered by a Client administrator, together with any supporting document the administrator attaches to the record. A supporting document is typically a scan or photograph of the certificate itself, limited to three files per record, each no larger than 5 MB, in PDF, JPEG or PNG format.

1.3 Time records. Where Client uses the time-clock feature, the Software collects, for each Worker:

• (a) the time at which the Worker starts and stops work, recorded by our servers rather than taken from the Worker’s device;
• (b) the time zone reported by the device used to make the entry;
• (c) whether the entry was made by the Worker or by an administrator; and
• (d) where an administrator adds, changes or removes a time record, the change made, the administrator who made it, the time of the change, and any reason they gave for it.

1.4 Account information. For each Worker and administrator with an account, the Software collects a name, a username, the role held, and the email address described in 1.5. It also stores the account credential in a hashed form that cannot be read or reversed back into the credential itself, a record of which version of this Policy and of the End-User License Agreement the person agreed to and when, and the count and timing of failed sign-in attempts, which the Software uses to lock an account temporarily after repeated failures.

1.5 Email addresses. The Software collects the email address of each Worker and administrator only after the individual has been shown what it will be used for and has consented. For a Worker, the address is used to send account setup and credential-reset messages, and to notify the Worker when their email address or credential changes. For an administrator, it is used for those purposes and also to deliver completed PDF records and, where the administrator has opted in, certification-expiry reminders.

1.6 Information held on the Worker’s own device. So that a Worker can fill in a form without a signal and submit it later, the Software stores on the device itself any form in progress, any completed submission waiting to be sent, and any photographs attached to them. The Software also sets a session cookie, which keeps the Worker signed in and is required for the Software to function. This information stays on the device. It reaches us only when the submission is sent, and signing out clears it.

1.7 Technical records. Our hosting provider keeps a standard record of each request made to the Software, which includes the network address of the device that made it. We record application events for troubleshooting, and we remove credentials, session tokens and similar values before those events are written.

2. Sensitive Records

Certification documents under 1.2 are personal information about the individual Worker, and may show what is printed on the certificate, including the Worker’s name, the issuing body, and certificate or licence numbers. A Client administrator supplies them rather than the Worker, and we store them because Client has chosen to record them.

An incident report records that a named person was hurt at work and how. We treat that as health information about the person named and handle it as sensitive. The people named under 1.1(h) are often people who have never used the Software, such as a witness who does not work for Client. A Worker completing a form should enter what the form asks for and nothing further. We do not read incident reports to form any view about a Worker.

3. How Information Is Used

3.1 We use submitted form data to generate a PDF record of the completed assessment, to deliver that record to Client’s designated coordinator, to make the record available to Client’s administrators and to the Worker who submitted it, and to operate the Software.

3.2 We use email addresses only for the purposes disclosed to and consented to by the individual at the time of collection, as set out in 1.5, and for no other purpose without further consent. We do not use them for marketing and we do not sell them.

3.3 We use certification records and their attached documents to let Client track when a Worker’s certifications expire and to display the recorded certificate back to Client’s administrators. Where an administrator opts a record in to expiry reminders, we send that Client’s opted-in administrators an email listing the certification name, the Worker’s name and the expiry date of each certification approaching expiry. We never include attached documents in those reminders.

3.4 We use time records to show a Worker their own hours, to let Client’s administrators review and correct the hours worked by their people, and to total those hours over Client’s pay period.

3.5 We handle an incident report the same way as any other submission: it becomes a PDF, and that PDF goes to Client. We do not investigate what a report says, act on it, or pass it to anyone beyond the delivery described in Section 7.

3.6 We do not use any information described in this Policy to profile a Worker, to make an automated decision about a Worker, or to train any machine learning or artificial intelligence system.

4. Consent

4.1 We collect a Worker’s email address only with that Worker’s consent, given after the purpose has been shown to them. We record which version of this Policy the Worker agreed to and when, so that a later change can be measured against what the Worker actually accepted.

4.2 Where we make a substantive change to this Policy, we ask each Worker and administrator to review and accept the amended Policy the next time they sign in.

4.3 A Worker may decline to provide an email address, or withdraw consent later, under Section 8. Client’s own collection of information a Worker enters into a form is a matter between the Worker and Client, and rests on Client’s authority as employer rather than on consent given to us.

5. Where Information Is Stored and Processed

5.1 We use service providers to operate the Software. Each is engaged for a single defined function, and none is authorized to use personal information for any purpose beyond it:

• (a) cloud hosting, which runs the Software and serves it to Workers and administrators;
• (b) database hosting, which stores the records described in Section 1; and
• (c) email delivery, which sends the messages described in 1.5 and 3.3.

5.2 These providers store and process personal information on servers located in the United States. Personal information held in the United States is subject to the laws of that country, and may be accessible to United States courts, law enforcement agencies and national security authorities under those laws, without notice to us or to the individual concerned.

5.3 We engage these providers under contracts that require them to protect the information, to use it only to provide the service, and to keep it confidential. We remain accountable for personal information we transfer to them. Questions about this arrangement, including the policies and practices that apply to information held outside Canada, may be directed to the contact in Section 14.

5.4 We will identify the service provider performing any function listed in 5.1, by name, to any Worker, individual or Client who asks. Requests may be directed to the contact in Section 14.

6. Retention and Deletion

6.1 We retain a record of a completed form, the PDF generated from it, and any photographs attached to it, for as long as Client’s account remains active, so that Client holds the record of the work. We delete those records at Client’s written request, and on closure of Client’s account, in each case within 30 days.

6.2 Where occupational health and safety law requires an employer to keep a record for a minimum period, and Client relies on the Software to hold that record, the record is kept until that period ends, whatever 6.1 would otherwise require. This applies most often to incident reports, which an employer must generally keep for a minimum period after the incident. Client determines what that period is.

6.3 We retain a certification record and its attached documents until a Client administrator deletes the record. Deleting a certification record deletes its attached documents at the same time. A certification record cannot be edited once created, and a renewed certification is entered as a new record, so a correction is made by deleting the record and entering it again.

6.4 We retain time records for as long as Client’s account remains active, and delete them on the same terms as 6.1. Employment standards legislation requires an employer to keep records of hours worked for a minimum period, and where Client relies on the Software to hold them, 6.2 applies to those records as well.

6.5 We retain an email address for as long as the associated account remains active, and delete it within 30 days of the account being deleted or of the individual withdrawing consent, subject to any recordkeeping obligation under applicable law. We keep a record of an address that has permanently failed or been reported as spam, so that we do not keep sending to it.

6.6 A PDF held temporarily while a Worker completes a submission is deleted automatically within hours of being created, whether or not the submission is completed.

6.7 We keep the record of a person’s agreement to this Policy and to the End-User License Agreement, described in 1.4, for as long as it may be needed to demonstrate that the agreement was given.

6.8 Where an account is deleted, the records that account submitted remain available to Client, because they are records of work performed rather than records about the account. The username is not reissued to anyone else.

7. Disclosure to Others

We do not sell personal information, and we do not disclose it to third parties, except:

• 7.1 as necessary to deliver the completed PDF to Client’s designated coordinator email address;
• 7.2 as necessary to deliver certification-expiry reminder emails to Client’s opted-in administrator email addresses, which identify the Worker by name alongside the expiring certification;
• 7.3 to the service providers described in 5.1, which support the technical operation of the Software and are bound by the obligations described in 5.3; or
• 7.4 where required by law, including in response to a court order, warrant or other lawful demand.

7.5 Records, certification documents and time records are visible only to administrators of the Client organization that holds them. Every retrieval is restricted to that organization at the database query level, so one Client cannot reach another Client’s information.

7.6 Where a Worker names other people in a form, those names form part of the completed record and appear in the PDF delivered under 7.1. A person reporting an incident should expect Client to read the names they enter and what they wrote about those people.

8. Rights of Individuals

8.1 A Worker may ask their employer, or us, for access to their personal information, for a correction to it, or for its deletion, and may withdraw consent to the collection and use of their email address at any time. We respond to a request within 30 days. Where a Worker declines or withdraws email consent, a site administrator can carry out credential resets instead.

8.2 These rights are subject to Client’s recordkeeping obligations under applicable occupational health and safety and employment standards law. Where the law requires Client to keep a record, we cannot delete it at the request of the individual it names, and we will say so in our response.

8.3 Anyone named in an incident report may make the same requests, whether or not they have ever used the Software. One limit applies to incident reports in particular: a filed report is the record of what was reported at the time, and is not rewritten afterwards. A person who believes a report about them is wrong may ask for a correction to be recorded alongside it, and should raise it with Client, who holds the record.

8.4 Where a request concerns information Client entered or controls, we may direct the request to Client, and we will tell the individual that we have done so.

9. Security

9.1 We use reasonable technical and organizational measures to protect personal information against unauthorized access, loss and misuse, consistent with our obligations under our agreement with Client. Those measures include encrypting traffic in transit, storing account credentials only as an unreadable hash, restricting every database query to a single Client organization, locking an account after repeated failed sign-in attempts, and limiting administrative access to what a role requires.

9.2 No safeguard is complete, and we do not represent that the Software is immune from every attack.

10. Breach of Security Safeguards

Where personal information under our control is lost, accessed without authorization or disclosed without authorization, and a reasonable person would consider that this creates a real risk of significant harm to an individual, we will report the incident to the Office of the Information and Privacy Commissioner of Alberta and notify the affected individuals and Client without unreasonable delay. We keep a record of these incidents.

11. Cookies

The Software sets one cookie, which keeps a Worker or administrator signed in for the duration of their session. It is required for the Software to function and cannot be turned off while continuing to use it. We use no advertising cookies, no analytics cookies, and no third-party tracking of any kind, either in the Software or on the neatforms.ca website.

12. Change of Ownership

Where neatforms is involved in a merger, acquisition, financing, or sale of all or part of its business, personal information held under this Policy may be transferred to the party acquiring it as part of that transaction. We will require that party to continue handling the information under this Policy, or under a policy no less protective of it, and we will give notice on this page before any transfer takes effect.

13. Changes to This Policy

We may amend this Policy. The version date appears at the top of this page. Where a change is substantive, we ask each Worker and administrator to review and accept the amended Policy the next time they sign in, and we record that acceptance against the new version. The version a person accepted governs their information until they accept a later one.

14. Contact and Complaints

Antony Campbell is the individual accountable for our compliance with this Policy. Questions, requests under Section 8, and complaints may be directed to:

A person who is not satisfied with our response may complain to the Office of the Information and Privacy Commissioner of Alberta, or to the Office of the Privacy Commissioner of Canada.