Privacy Policy

Effective date: September 2026

This policy explains what personal information PraxysEHS LLC ("PraxysEHS," "we," "us") collects, how we use it, and the choices you have. It covers our website, the waitlist, and the PraxysEHS software (the "Service").

Two roles, depending on the information.

For our own records (your account, billing, the waitlist, and how the website and Service are used), we decide how information is used. This policy describes that.
For what customers put into the Service (their investigations, including the names of employees and details of incidents), we handle it on the customer's behalf and follow their instructions. If you're named in an investigation, or you use PraxysEHS through your employer, your employer controls that information. Please contact them with questions or requests; we'll help them respond.

What we collect

When you join the waitlist: your work email, what you do, and, if you choose to give them, your name, company, number of sites, the software you use now, and any note you send. We also keep the exact wording you agreed to when you joined.

When you create an account or are added to a team: your name, work email, role and home location, and your password, stored only in scrambled (hashed) form that can't be read back. An administrator may add you, in which case they give us your name and email.

What customers put into the Service: investigations and everything in them. That can include names and job roles of people involved, what they said in interviews, injury and health details, photos, documents and recordings, and the findings and fixes that follow.

Billing: your organization's name, billing email, plan and payment history, which we keep. The billing address, tax ID and payment details you enter on Stripe's pages are kept by Stripe; we never receive or store card or bank account numbers.

Security and technical information:

Sessions: the IP address and browser type of each signed-in session, used to protect accounts.
Rate limits: counters of recent requests by IP address, used to limit sign-in attempts and cleared within about an hour.
Failed sign-ins: recorded by the email address tried, with the IP address only as a scrambled code. Cleared within a day.
Waitlist: a scrambled code of the IP address, used to slow down automated sign-ups.
Activity records: who did what in an organization's account, such as creating a download link or changing a plan.
Request logs: short-lived logs kept by our hosting provider, Cloudflare.

Cookies: only one, which keeps you signed in. We don't use advertising or analytics cookies, and we don't track you across other sites.

How we use it

To provide the Service: running your investigations, your team and your account.
To keep it secure: protecting accounts, limiting sign-in attempts, preventing abuse, and investigating problems.
To bill you and keep financial records.
To contact you about your account, security, billing and changes to the Service.
To tell waitlist members when PraxysEHS opens and share occasional launch news. You can unsubscribe at any time.
To improve the Service, using counts and measurements that don't identify you, any person or any case.
To meet legal obligations and protect our rights.

We don't sell personal information, and we don't share it for advertising.

Who we share it with

Service providers who run parts of the Service for us, under contracts that limit their use of it:
- Cloudflare: hosting, database, file storage, backups, security, and sending our emails.
- Stripe: payments and invoices.
- Microsoft: our support inbox, for messages you send to support@praxysehs.com.
- Google Fonts: loads the typefaces on our pages, so Google receives your IP address and browser details when a page loads.
People your organization chooses. When someone in your organization shares a case with an outside collaborator or makes a download link, whoever receives it can see that case.
Legal requirements. When required by law, subpoena or court order. For customer investigations, we'll refer requests to the customer where we can, and tell them first unless we're prohibited (see our Terms of Service).
Business changes. If PraxysEHS is involved in a merger, acquisition or sale of assets. The information would stay covered by protections at least as strong as these.

How long we keep it

Investigations and account data: while the organization's account is active. After a plan ends, records stay read-only for 12 months and are then deleted, with at least 60 days' notice, unless a case is on legal hold. A customer can delete a case sooner themselves. We keep a short record that an organization's data was deleted, with counts but no personal details.
Backups: full backup copies are kept for 90 days, so deleted information remains in backups until they age out.
Billing records: as long as tax and accounting law requires, generally seven years.
Waitlist: until you unsubscribe or ask us to delete it, or until it's no longer needed for the launch.
Security records: failed sign-ins for one day; rate-limit counters for about an hour; session details until the session ends.

Where it's stored

Our database and files are stored with Cloudflare in eastern North America. Cloudflare's network may process requests in other locations to deliver the Service quickly and securely.

How we protect it

All connections are encrypted, and our providers encrypt stored data.
Passwords are hashed.
Each organization's data is kept separate, and access follows each person's role.
Sign-in attempts are limited.
Uploaded files can't run code in your browser.
Backups are tested to make sure they can be restored.

No system is perfectly secure. If we learn of a breach affecting your information, we'll notify affected customers and people as the law requires.

Your choices and rights

Access, correction and deletion. To ask for a copy of your personal information, or to have it corrected or deleted, contact us at support@praxysehs.com. Your organization's administrator can also update your name and role. If the information is part of your employer's account, we'll direct your request to them.
Unsubscribe. Every waitlist and marketing email includes an unsubscribe link. Account and security messages are part of the Service and can't be turned off while you have an account, but reminder emails can be turned off in the Service.
State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete or opt out of certain uses of your personal information. We'll honor requests as the law in your state requires. We won't treat you differently for making one.

Children

PraxysEHS is for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 16.

Changes to this policy

We'll post updates here with a new effective date. If a change is material, we'll let account administrators know in advance.

Contact

PraxysEHS LLC · support@praxysehs.com