SafePlan

Privacy policy

First published July 12, 2026 · Applies to SafePlan's website and the SafePlan service for client companies and their crews

SafePlan runs health-and-safety compliance paperwork for construction companies. Doing that work means holding some personal information about our clients' people. This page says plainly what we collect, why, where it lives, who can see it, and how to get it back or have it removed. We follow the principles of PIPEDA, Canada's federal private-sector privacy law.

What we collect

• Worker information — names, roles, spoken language, hire dates, and training/certification records (for example a Working at Heights card and its dates), supplied by the client's office or by the worker photographing their own card through a secure link we send.
• Site records — weekly site-check forms, site photos, toolbox-talk logs, and incident details the client's supervisors file, which can name the people involved.
• Contact details — phone numbers and email addresses used to send secure submission links and reminders.
• Business contact information — if you email us from this website, we receive whatever you send and use it only to respond.

The website itself sets no tracking cookies and runs no analytics or advertising scripts.

Why we collect it

One reason: to administer the client company's occupational health-and-safety compliance paperwork — tracking training expiries, filing weekly site checks, keeping incident records with their legal notice deadlines, and keeping the client's records binder ready to produce. We do not sell personal information, use it for advertising, or share it with anyone outside that work.

Whose data it is

Where it lives and who can see it

• Records are stored with Google Firebase (Firestore and Cloud Storage) in the Montréal, Canada region — the data stays in Canada.
• Each client company has its own isolated workspace. Access rules are written and tested so that one client's people can never see another client's records, and those rules are re-tested automatically whenever the system changes.
• Within a client's workspace, access follows roles: owners and their coordinator see their company's records; a worker's secure link accepts only that worker's own submission and works once.
• On SafePlan's side, access is limited to the people doing the administrative work — today that is the founder and the service's operator tooling. Every filed record keeps a history of who did what, when.
• Data is encrypted in transit and at rest by the storage provider (this is standard Google Cloud infrastructure encryption — we state it because it is real, and we claim nothing beyond it).
• Uploaded files are checked server-side before they are accepted (file type verified from the file's actual content, not its name).

How long we keep it

For as long as we administer the client's program, because the point of the service is an always-current record set. Health-and-safety records often have their own legal retention periods that belong to the employer — so when a contract ends, we export everything to the client first, then delete the workspace on the client's written instruction. We don't keep copies of a former client's records beyond what the wind-down requires.

When we would disclose

Only three cases: to the client whose records they are; to a person the client directs us to provide them to (for example an auditor the client engages); or where the law compels disclosure. Nothing else.

Questions, corrections, complaints

Email hello@safeplan.ca. If a record we hold about you is wrong, we will correct it with the client's confirmation. If you are unsatisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we change what we collect or how we handle it, this page changes first and the date at the top moves. We won't quietly expand what we do with your information.