PraxysEHSContractor management

Data Processing Addendum: PraxysEHS CM

Effective date: October 15, 2026

This addendum is part of the PraxysEHS CM Terms of Service between PraxysEHS LLC ("PraxysEHS," "we," "us") and the customer ("Customer," "you"). It covers personal information in Customer Data, which we handle on your behalf. Words defined in the Terms mean the same here. Where this addendum and the Terms disagree about personal information in Customer Data, this addendum controls.

1. Our roles

For personal information in Customer Data, you decide why and how it's used, and we handle it for you. Under the California Consumer Privacy Act, as amended, we are your service provider. Under other state privacy laws, such as those of Virginia, Colorado, Connecticut, Texas and Oregon, we are your processor. You are the business or controller.

For sites in Canada, we handle it as your service provider under Canada's Personal Information Protection and Electronic Documents Act and, where they apply, the private-sector privacy laws of Alberta and British Columbia. You remain accountable for it, and we handle it only as this addendum allows.

Contractor accounts. A contractor company's own account (its company details and crew list) is between that company and us, under our Contractor Terms. The copy of its workers and training cards it shares with you, and everything recorded at your sites, is Customer Data.

2. What we handle, and why

  • Purpose: to provide, secure and support the Service for you, as the Terms describe, and as you direct. That includes signing people in and out at your lobby tablets, running your site induction, checking training cards, sending the reminders and alerts you set up (by email, and to a Teams or Slack channel you connect), headcounts, and the public record check if you add it.
  • Whose: contractor workers, visitors, contractor company contacts, and your Users.
  • What we never do with it: use photos to recognize faces, run background checks on anyone, or keep a directory anyone can search.
  • For how long: while you use the Service, and then as the Terms describe for after a plan ends (section 9 below).

The kinds of personal information:

  • Names, cell phone numbers and email addresses of contractor workers, visitors and your Users, and the language a worker reads.
  • Sign-in and sign-out times, who they came to see, why they visited, and anything that held them at the tablet.
  • Induction results and quiz attempts.
  • Training card photos and their details, and who checked them.
  • Badge photos, where a tablet takes them.
  • Sign-out answers, including whether someone was hurt, and headcount results.
  • Documents a company uploads, such as certificates of insurance and contractor license cards, which can name people.

3. What we promise

  • We do not sell personal information. Full stop. We also don't share it for cross-context behavioral advertising.
  • Your instructions only. We handle it only to provide the Service to you, as described in section 2. We don't retain, use or disclose it for any other purpose, including any commercial purpose of our own, or outside our direct business relationship with you.
  • No combining. We don't combine it with personal information we get from anyone else, or from our own dealings with other customers, except where the law allows it to provide the Service. A worker who works for several of our customers has a separate record with each, and one customer never sees another's.
  • Confidentiality. Everyone at PraxysEHS who can access it is bound to keep it confidential.
  • The law. We comply with the privacy laws that apply to us as your service provider or processor, and give personal information the same protection they require of you. If we decide we can no longer meet these obligations, we'll tell you promptly.
  • Your right to step in. If you reasonably believe we're using personal information in a way this addendum doesn't allow, you may tell us, and we'll work with you to stop and fix it.
  • De-identified information. If we use information that can no longer identify anyone, such as counts of how many sign-ins a lobby handles, we keep it that way, don't try to re-identify it, and require the same of anyone we share it with.

4. Security

We protect personal information with reasonable technical and organizational measures suited to its nature, including encryption of connections and stored data, separation of each organization's data, role-based access, hashed passwords and one-time sign-in links, personal links stored only as one-way codes, lobby tablets that can be disconnected from anywhere, and nightly backups. Our Privacy Policy describes these in more detail.

5. Helping with requests

When someone asks to know, access, correct or delete their personal information, or exercises another right under privacy law, and the request is about Customer Data:

  • If they ask us directly, we'll tell them to contact you, and let you know.
  • You can answer most requests yourself in the Service. Administrators can see and download what's held about a person, and correct it.
  • Removing someone's details. Administrators can remove a worker's or visitor's details. Their phone number, email, personal link, training card photos and badge photos are deleted at once, and they can no longer sign in.
  • The five-year records. Their name stays on your sign-ins, inductions, briefings and training card checks, marked as removed at their request. The Terms keep these records for five years so you can show them if asked, which the law generally allows for records you need to meet a legal obligation or defend a claim.
  • Erasing those records early. If you decide a particular person's records must go sooner, an administrator can ask us in writing at support@praxysehs.com, and we'll erase them within 30 days.
  • Assessments. We'll help as reasonably needed beyond these tools, and give you information you reasonably need for a privacy assessment the law requires of you.

6. Others who handle it for us

We use a small number of other service providers (subprocessors) to run the Service. Each is bound by a written contract with protections at least as strong as this addendum. Today, for Customer Data:

  • Cloudflare, Inc.: hosting, database, file storage, backups, security and email delivery. United States.
  • Anthropic, PBC: reads a certificate of insurance or contractor license card when you or a contractor uploads one, so the dates and details can be filled in for you to check. Its terms bar using it to train AI models, and we don't keep the reading beyond what you save. United States.
  • Microsoft Corporation: our support inbox, only for what you choose to send us at support@praxysehs.com. United States.

A Teams or Slack channel you connect is yours, not ours: lobby alerts post there because you told them to.

We'll give your account administrators at least 30 days' notice before adding or replacing a subprocessor for Customer Data. If you object on reasonable privacy grounds, we'll try to address it; if we can't, you may end your plan and receive a refund of prepaid fees for the unused time, as your only remedy for the objection.

7. If something goes wrong

If we confirm a security breach that affects personal information in Customer Data, we'll notify your account administrators without undue delay, tell you what we know about it, and give you the information you reasonably need to meet your own obligations. We'll take reasonable steps to contain it and prevent it from happening again.

For sites in Canada, we'll tell you promptly, so you can report a breach that creates a real risk of significant harm and keep the record of it that Canadian law requires.

8. Showing we keep our word

On your reasonable written request, no more than once a year, we'll give you the information you reasonably need to show we meet this addendum, such as answers to a security questionnaire. If the law requires an audit beyond that, we'll agree on its scope, timing and confidentiality in advance, at your expense.

9. When it ends

When your plan ends, your account stays read-only for 12 months, then we delete personal information in Customer Data as the Terms describe, with at least 60 days' notice. The five-year records (sign-ins, inductions, briefings and training card checks) stay read-only until five years after your plan ends, then go. Deleted information ages out of our backups within 90 days. You can download everything at any time before then. This addendum continues to apply to anything we still hold.

10. Our certification

We understand the restrictions in this addendum and will comply with them.

Contact

PraxysEHS LLC · support@praxysehs.com