Who we are
HSEQ ConsultHub is operated by HSEQ ConsultHub Ltd (“we”, “us”). The product website is https://hseqconsulthub.co.uk. The Android and iOS apps use the same production API.
Privacy enquiries: info@sinclairsafetysolutions.co.uk. We will add a Companies House number, registered office, and ICO registration number to this page when they are confirmed. Until then, use the email above.
What this notice covers
- The public site (home, about, find a consultant, contact, this policy).
- Account sign-in, invitations, password reset, and workspace use of the SaaS.
- Report-only PIN / QR field reporting.
- The HSEQ ConsultHub mobile app (PIN login and Hazard Stage 1 in the current release).
- Verification invitations, registration, evidence review and award status sharing with the originating provider.
- Billing and support emails we send about the platform.
Consultant firms that use the platform may also have their own privacy notices for their clients. This notice does not replace those.
This notice does not appoint HSEQ ConsultHub Ltd as a competent person or professional adviser. Completing a workflow or signing an agreement does not certify legal compliance. The customer organisation remains the duty holder.
Who is responsible for your data
HSEQ ConsultHub Ltd is the controller for platform accounts, authentication, product operations, public enquiries, and platform billing records we hold to provide HSEQ ConsultHub.
Tenant organisations (consultants and their client workspaces) are controllers of the workplace HSEQ records they enter or assign — for example hazards, inspections, documents, health-check evidence, verification files, and workforce records. We process that tenant-owned content as a processor on their instructions, with access limited by tenant isolation and role permissions. Our processor commitments are in the Data Processing Agreement. The other terms that apply are listed on Terms of Service.
Platform owner accounts are not designed to browse consultant or client workspace content. There are two exceptions today. Owner accounts can open Health Check records. An administrator can also sign in as a client user for up to 15 minutes to give support; this needs a written reason and is recorded in the audit log.
What we collect
- Identity and account data: name, work email, company, role, workspace membership, invitation status, and password hashes (not the password itself).
- Authentication data: session cookies, device Bearer tokens, report-only PIN session tokens, optional MFA state, and password-reset tokens. We do not put session secrets in organisation-export or subject-access packages.
- Workplace records you or your organisation enter: safety reports, documents, actions, inspections, training, assets, health-check and verification evidence, and similar module content. These may include names, job titles, site details, and files.
- Report-only submissions: PIN or QR identity metadata and the report content submitted for a site. PIN hashes and QR secrets are not treated as portable records.
- Public enquiries: the contact form (name, email, company, location, message, optional consultant).
- Find a consultant listing: consultant display name and service area only on the public directory. Logos are not published as public URLs.
- Billing contacts: names, emails, and invoice metadata needed to bill consultant capacity. We do not invent unpublished prices.
- Technical logs: application errors and health checks. We do not intend to log passwords, full payment cards, or session cookies.
We do not currently operate an Occupational Health product module. Do not upload clinical health records unless a later Founder-approved module says otherwise.
Why we use it
- Contract: to create accounts, run the workspace, send operational email, and provide the modules your organisation has assigned.
- Legitimate interests: to secure the service, prevent abuse, keep tenant isolation, and improve reliability. You can object; some security processing is still required to provide the service.
- Legal obligation: to keep records we must keep, and to respond to valid legal requests.
- Consent: where you send a public enquiry, or where a form asks you to accept this notice (for example Verification registration).
Health and injury information
HSEQ ConsultHub is not intended to collect unnecessary sensitive personal data. Incident and other safety records may still include information about health or injury when users enter it. Consultancy firms and client organisations should only enter information that is necessary, relevant and proportionate for the safety activity being managed. Where special category data is processed, the organisation that controls the record needs an additional legal condition under data protection law.
Marketing emails
We may contact business representatives about platform updates, pilot opportunities, demonstrations, service announcements or relevant commercial information. You can opt out of non-essential marketing emails at any time using the unsubscribe link in the email. Service, security and account emails may still be sent where they are needed to provide the service.
Mobile app
The HSEQ ConsultHub app talks to https://hseqconsulthub.co.uk. The current release supports PIN login and Hazard Stage 1 reporting. It uses the same server-side permission checks as the website. Preview (sideload) builds may still point at staging for testing.
Package / bundle identifier: uk.co.hseqconsulthub.mobile.
International transfers
Hosting and subprocessors may process data in the United Kingdom, the European Economic Area, or other countries. Where a transfer outside the UK / EEA is needed, we rely on the subprocessor’s appropriate safeguards (such as standard contractual clauses) rather than claiming a single UK-only residency. A written residency programme has not been published yet.
How long we keep data
Account and tenant records are kept while the organisation uses the service and for any extra period UK or other applicable law requires. The written programme is published at Retention and Deletion.
- When a client workspace is archived, access stops immediately. Client-owned files and that client’s operational records become due for permanent deletion 12 months after archive, unless a legal hold or other lawful retention applies.
- Consultant papers created for that client stay on HSEQ ConsultHub for five years from archive and are not included in a client hop.
- Documents in a consultant’s demonstration sandbox client become due for deletion 3 days after upload and are removed by a scheduled clean-up.
- Organisation export download packages expire.
- Deleting a named user removes that person’s login and membership. It does not delete consultant or client operational records they created or were assigned.
Public contact enquiries are kept long enough to answer them and follow up.
Your rights
Under UK GDPR and the Data Protection Act 2018 you can ask to access, correct, erase, or restrict personal data we hold as controller, to object to certain processing, and to receive a portable copy where the law gives that right. You can also withdraw consent where we rely on it (this does not affect processing already done).
If your data sits in a client or consultant workspace, start with that organisation’s administrator. They control those records. We will help where we are the controller or where a valid request must go through us.
Subject access and organisation export
HSEQ ConsultHub keeps two separate workflows that may share an export engine:
- Subject access requests (SAR) — disclosure about an identifiable person, with credentials and session material excluded.
- Organisation Migration — a tenant moving their organisation records. This is not a substitute for a SAR.
Authorised tenant users use the in-app SAR and migration surfaces. Other people should email info@sinclairsafetysolutions.co.uk.
Children
HSEQ ConsultHub is a workplace compliance product. It is not directed at children under 16, and we do not knowingly create accounts for them. If you believe a child has used the service, contact us and we will delete the account where we can.
Security
We use password hashing, HTTPS, tenant-scoped permissions, same-origin checks on browser login, and a Bearer device-session route that refuses browser Origin. Field and file storage goes through the platform storage adapter. This is not a claim of ISO 27001 certification or that the platform is enterprise-ready. The standalone Security note repeats these controls.
Contact and complaints
Email info@sinclairsafetysolutions.co.uk or use the contact form.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
Changes to this notice
We will update this page when the product or our subprocessors change in a way that affects privacy. The date at the top is the latest version. Continued use after an update means the new notice applies to later processing.