PraxysEHSHuman factors incident analysis

Data Processing Addendum

Effective date: October 14, 2026

This addendum is part of the PraxysEHS Terms of Service between PraxysEHS LLC ("PraxysEHS," "we," "us") and the customer ("Customer," "you"). It covers personal information in Customer Data, which we handle on your behalf. Words defined in the Terms mean the same here. Where this addendum and the Terms disagree about personal information in Customer Data, this addendum controls.

1. Our roles

For personal information in Customer Data, you decide why and how it's used, and we handle it for you. Under the California Consumer Privacy Act, as amended, we are your service provider. Under other state privacy laws, such as those of Virginia, Colorado, Connecticut, Texas and Oregon, we are your processor. You are the business or controller.

2. What we handle, and why

  • Purpose: to provide, secure and support the Service for you, as the Terms describe, and as you direct (for example, when you share a case or make a download link).
  • Kinds of personal information: names, job roles and contact details of your Users and of people named in your investigations; what people said in interviews; injury and health details; photos, documents and recordings; and, if you use OSHA recordkeeping, the details OSHA's forms ask for about an injured or ill employee.
  • Whose: your employees, contractors, visitors and others named in your investigations, and your Users.
  • For how long: while you use the Service, and then as the Terms and our Privacy Policy describe for deletion after a plan ends.

3. What we promise

  • We do not sell personal information. Full stop. We also don't share it for cross-context behavioral advertising.
  • Your instructions only. We handle it only to provide the Service to you, as described in section 2. We don't retain, use or disclose it for any other purpose, including any commercial purpose of our own, or outside our direct business relationship with you.
  • No combining. We don't combine it with personal information we get from anyone else, or from our own dealings with other customers, except where the law allows it to provide the Service.
  • Confidentiality. Everyone at PraxysEHS who can access it is bound to keep it confidential.
  • The law. We comply with the state privacy laws that apply to us as your service provider or processor, and give personal information the same protection they require of you. If we decide we can no longer meet these obligations, we'll tell you promptly.
  • Your right to step in. If you reasonably believe we're using personal information in a way this addendum doesn't allow, you may tell us, and we'll work with you to stop and fix it.
  • De-identified information. If we use information that can no longer identify anyone, such as counts of how many cases reach findings, we keep it that way, don't try to re-identify it, and require the same of anyone we share it with.

4. Security

We protect personal information with reasonable technical and organizational measures suited to its nature, including encryption of connections and stored data, hashed passwords, separation of each organization's data, role-based access, limits on sign-in attempts, and tested backups. Our Privacy Policy describes these in more detail.

5. Helping with requests

When someone asks to know, access, correct or delete their personal information, or exercises another right under state privacy law, and the request is about Customer Data:

  • If they ask us directly, we'll tell them to contact you, and let you know.
  • We'll help you respond, mostly through the Service itself: administrators can find, correct, download and delete what's in your account. Where you need more, we'll help as reasonably needed.
  • We'll also give you information you reasonably need for a data protection assessment the law requires of you.

6. Others who handle it for us

We use a small number of other service providers (subprocessors) to run the Service. Each is bound by a written contract with protections at least as strong as this addendum. Today, for Customer Data:

  • Cloudflare, Inc.: hosting, database, file storage, backups, security and email delivery. Data stored in eastern North America.
  • Microsoft Corporation: our support inbox, only for what you choose to send us at support@praxysehs.com. United States.

We'll give your account administrators at least 30 days' notice before adding or replacing a subprocessor for Customer Data. If you object on reasonable privacy grounds, we'll try to address it; if we can't, you may end your plan and receive a refund of prepaid fees for the unused time, as your only remedy for the objection.

7. If something goes wrong

If we confirm a security breach that affects personal information in Customer Data, we'll notify your account administrators without undue delay, tell you what we know about it, and give you the information you reasonably need to meet your own obligations. We'll take reasonable steps to contain it and prevent it from happening again.

8. Showing we keep our word

On your reasonable written request, no more than once a year, we'll give you the information you reasonably need to show we meet this addendum, such as answers to a security questionnaire. If the law requires an audit beyond that, we'll agree on its scope, timing and confidentiality in advance, at your expense.

9. When it ends

When your plan ends, we delete personal information in Customer Data as the Terms and Privacy Policy describe, unless the law requires us to keep it, and it ages out of our backups within 90 days. You can download everything before then. This addendum continues to apply to anything we still hold.

10. Our certification

We understand the restrictions in this addendum and will comply with them.

Contact

PraxysEHS LLC · support@praxysehs.com