PraxysEHSEHS compliance calendar

Data Processing Addendum: PraxysEHS Compliance Calendar

Effective date: October 30, 2026

This addendum is part of the PraxysEHS Compliance Calendar Terms of Service between PraxysEHS LLC ("PraxysEHS," "we," "us") and the customer ("Customer," "you"). It covers personal information in Customer Data, which we handle on your behalf. Words defined in the Terms mean the same here. Where this addendum and the Terms disagree about personal information in Customer Data, this addendum controls.

1. Our roles

For personal information in Customer Data, you decide why and how it's used, and we handle it for you. Under the California Consumer Privacy Act, as amended, we are your service provider. Under other state privacy laws, such as those of Virginia, Colorado, Connecticut, Texas and Oregon, we are your processor. You are the business or controller.

Outside people you add. Consultants, auditors, contractors and others you give access to use the Service as part of your account, and what they put in is Customer Data.

2. What we handle, and why

  • Purpose: to provide, secure and support the Service for you, as the Terms describe, and as you direct. That includes sites and their profiles, the task calendar, the rule library, rule changes and yearly reviews, permits and permit reading, sampling, events and agency reports, the agency log, actions, site maps, files and photos, reports, audit packs and spreadsheets, bulk upload, and the emails and calendar invites the Service sends.
  • Whose: your Users (administrators, contributors and readers), and employees, contractors, agency staff, laboratory staff and others named in your records and files.
  • What we never do with it: sell it or use it for advertising. An artificial intelligence service reads it only when you choose to read a permit with AI (section 6).
  • For how long: while you use the Service, and then as the Terms describe for after a trial or plan ends (section 10 below).

The kinds of personal information:

  • Names, work email addresses, job titles, phone numbers, access levels and out-of-office dates of your Users.
  • Names of people who hold tasks or site roles, complete or check work, take samples, log events, record agency reports, meet agency inspectors, ask for or approve more time, or are named in notes, decisions and records.
  • Files and photos you upload, such as permits, inspection records, lab reports, training records, site plans and photos from the floor, which can show or name people. Photos keep any details the camera saved in them, such as where they were taken.
  • Permit documents read with AI, what was read from them, and who asked for each reading and decided on each item.
  • What your records say about injuries or illnesses, if they describe any, which can identify the people involved.
  • Sign-in records, activity records (who changed what, and when, including downloads), and a record of each email the Service sends.

3. What we promise

  • We do not sell personal information. Full stop. We also don't share it for cross-context behavioral advertising.
  • Your instructions only. We handle it only to provide the Service to you, as described in section 2. We don't retain, use or disclose it for any other purpose, including any commercial purpose of our own, or outside our direct business relationship with you.
  • No combining. We don't combine it with personal information we get from anyone else, or from our own dealings with other customers, except where the law allows it to provide the Service. A person who works with more than one of our customers signs in with one email address, but what they do in each customer's account stays there, and one customer never sees another's records.
  • Confidentiality. Everyone at PraxysEHS who can access it is bound to keep it confidential.
  • The law. We comply with the privacy laws that apply to us as your service provider or processor, and give personal information the same protection they require of you. If we decide we can no longer meet these obligations, we'll tell you promptly.
  • Your right to step in. If you reasonably believe we're using personal information in a way this addendum doesn't allow, you may tell us, and we'll work with you to stop and fix it.
  • De-identified information. If we use information that can no longer identify anyone, such as counts of how many tasks are done on time, we keep it that way, don't try to re-identify it, and require the same of anyone we share it with.

4. Security

We protect personal information with reasonable technical and organizational measures suited to its nature, including encryption of connections and stored data, separation of each customer's data, access by level, one-time sign-in links and session codes stored only as one-way codes, files that open only for signed-in people with access, an activity log of changes and downloads, and database copies kept no longer than 90 days. Our Privacy Policy describes these in more detail.

5. Helping with requests

When someone asks to know, access, correct or delete their personal information, or exercises another right under privacy law, and the request is about Customer Data:

  • If they ask us directly, we'll tell them to contact you, and let you know.
  • You can answer most requests yourself in the Service. Administrators can see everything in your account and download reports, audit packs, spreadsheets and files. Each User can change their own name, phone number and out-of-office dates.
  • Removing someone. An administrator can remove a person from your account, which ends their access. Their name stays on the tasks, decisions, reports and records they were part of, so the record stays complete.
  • Erasing a person's details. If you decide a particular person's name or details must be taken out of your records, an administrator can ask us in writing at support@praxysehs.com, and we'll erase or replace them within 30 days.
  • Assessments. We'll help as reasonably needed beyond these tools, and give you information you reasonably need for a privacy assessment the law requires of you.

6. Others who handle it for us

We use a small number of other service providers (subprocessors) to run the Service. Each is bound by a written contract with protections at least as strong as this addendum. Today, for Customer Data:

  • Cloudflare, Inc.: hosting, database, file storage, backups, security and email delivery. United States.
  • Anthropic, PBC: reads a permit document when an administrator or contributor chooses to read it with AI, so its dates, conditions and limits can be listed for your team to confirm. It receives the document and the permit's name, kind, number, agency and dates already on file. Its terms bar using it to train AI models, and nothing from a reading is added to your permits or calendar until a person on your team confirms it. Every reading and decision is logged in your account. When a customer brings in its own spreadsheet, Anthropic also receives the column names, up to three sample values from columns not matched by the Service, and the names of activities not matched, to suggest matches a person confirms; never the whole file. United States.
  • Microsoft Corporation: our support inbox, only for what you choose to send us at support@praxysehs.com. United States.

Stripe handles payments for us under its own terms. It receives billing information, not Customer Data.

When someone on your team asks for a public-record lookup, the Service sends only what the lookup needs to the government service that keeps the record: the site name searched for, with the site's state and city, to EPA's ECHO database, the street address entered to the US Census Bureau's address lookup, and a map area to the US Geological Survey. These are public services, not our subprocessors, and they receive no other Customer Data.

We'll give your administrators at least 30 days' notice before adding or replacing a subprocessor for Customer Data. If you object on reasonable privacy grounds, we'll try to address it; if we can't, you may end your plan and receive a refund of prepaid fees for the unused time, as your only remedy for the objection.

7. If something goes wrong

If we confirm a security breach that affects personal information in Customer Data, we'll notify your administrators without undue delay, tell you what we know about it, and give you the information you reasonably need to meet your own obligations. We'll take reasonable steps to contain it and prevent it from happening again.

8. Showing we keep our word

On your reasonable written request, no more than once a year, we'll give you the information you reasonably need to show we meet this addendum, such as answers to a security questionnaire. If the law requires an audit beyond that, we'll agree on its scope, timing and confidentiality in advance, at your expense.

9. Records you keep for regulators

Many environmental, health and safety records must be kept for a set number of years, often longer than the Service keeps them. The Service keeps your records while your trial or plan is active and for 12 months after it ends (section 10), but it isn't your official records archive, and we don't keep any of your records past that time for you. Download what you must keep before your data is deleted.

10. When it ends

When your trial or plan ends, your account stays read-only for 12 months, then we delete personal information in Customer Data as the Terms describe, with at least 60 days' notice to your administrators, by email at 60, 30 and 7 days. Deleted information ages out of our backups within 90 days. You can download your reports, audit packs, spreadsheets and files at any time before then. This addendum continues to apply to anything we still hold.

11. Our certification

We understand the restrictions in this addendum and will comply with them.

Contact

PraxysEHS LLC · support@praxysehs.com