HazReady Corporation ("HazReady," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and related services.

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, job title, and agency or organization name. This information is necessary to provide our services and personalize your experience.

Usage Data. We collect information about how you interact with the platform, including pages visited, features used, documents generated, and session duration. This data helps us improve the platform and provide better service.

Agency Documents. Documents, policies, SOGs, and other files you upload are stored securely and used exclusively to provide AI-powered services to your agency. Your documents are never shared with other agencies or used to train AI models.

Physiological and Biometric Data. Where your agency enables responder monitoring, the platform processes physiological measurements such as heart rate and heart rate variability, together with the exertion, fatigue and recovery indicators derived from them. This is the most sensitive category of personal information the platform handles, and it is described separately in Section 3.

Cookies and Analytics. We use analytics and essential cookies to understand platform usage and improve our services. You can manage cookie preferences through your browser settings.

2. How We Use Your Information

To provide, maintain and improve the platform; generate AI-powered documents and reports tailored to your agency; support responder safety monitoring where your agency has enabled it, as described in Section 3; process registration and manage your subscription; send service notifications and important updates; respond to support requests; analyze usage patterns to improve features and performance; and comply with legal obligations.

3. Physiological and Biometric Data

Why this section is separate. Some HazReady features are designed to help agencies watch over responder safety using physiological measurements. We regard this as the most sensitive category of personal information the platform touches, so we describe it on its own rather than folding it into the general terms above.

What may be collected. Where an agency enables responder monitoring, the platform may process heart rate, heart rate variability, movement and activity signals, derived exertion, fatigue and recovery indicators, rest and rehabilitation status, and the time, session, assignment and incident context in which those readings were taken. Some jurisdictions treat measurements of this kind, and identifiers derived from them, as biometric or health information, and we handle them on that basis.

Where it comes from. These measurements originate from compatible wearable physiological sensors worn on duty and from the HazReady mobile applications used alongside them. HazReady does not draw this data from a responder's personal consumer health accounts, and we do not receive clinical records or diagnoses.

Why it is processed. Physiological data is processed for responder safety purposes: live accountability and situational awareness during an incident, recognition of exertion and fatigue risk, supporting rest and rehabilitation decisions, exposure and after-action records, and aggregated trends that help an agency review and improve its own safety practices. We do not sell physiological data, we do not use it for advertising, and we do not use it to train AI models. It is not intended to be used for employment discipline. HazReady is not a medical device and does not provide a diagnosis; physiological readings and any scores derived from them are decision-support information and are not a substitute for clinical assessment or professional judgement.

Consent and legal basis. Responder monitoring is configured and switched on by the agency, and is intended to operate on a knowledge-and-consent basis consistent with PIPEDA and with applicable provincial privacy and occupational health and safety legislation. In an employment setting the agency is the organization accountable for deciding whether monitoring is appropriate, for informing responders in advance, and for obtaining and recording any consent, collective agreement provision, or other authority required in its jurisdiction. A responder may decline or withdraw from monitoring in accordance with their agency's policy; withdrawal stops further collection, but does not by itself remove records the agency is required to retain.

Who can see it inside an agency. Access is limited within the customer agency by role-based access control and by the agency-level data isolation described in Section 4. As a general model, a responder can see their own readings; incident command and designated safety roles can see the operational status of responders assigned to an active incident; and agency administrators can see configuration and aggregated reporting. Other agencies on the platform never have access to your responders' data. HazReady personnel access identifiable physiological data only where necessary to operate, support, or secure the service, subject to confidentiality obligations and audit logging.

Retention. Physiological data is retained for the period your agency configures, for as long as it is needed for the safety, exposure and after-action purposes described above, and for longer where retention is required by law, regulation, or an applicable occupational health and safety or exposure-reporting obligation. Because those obligations differ by jurisdiction and by employer, retention periods for this category are agreed with each agency rather than fixed in this policy.

Your rights in this data. Subject to applicable law, a responder may ask to access the physiological data held about them, ask that inaccurate information be corrected, ask how it has been used or disclosed, withdraw consent to further monitoring as described above, and request deletion. Because the agency is the organization that collected the data, these requests are normally made to the agency's privacy contact, and HazReady will assist the agency in responding. You may also reach us using the details in Section 9.

4. Data Isolation and Security

HazReady implements strict agency-level data isolation — your agency's data is never accessible to other agencies on the platform. We employ row-level security (RLS) policies enforcing agency data boundaries, encryption in transit (TLS 1.2+) and at rest, role-based access control (RBAC) within your agency, immutable audit logging for legal defensibility, and regular security assessments and monitoring.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share information only in these limited circumstances: Service Providers — trusted third parties (cloud hosting, payment processing, email delivery) that process data on our behalf under strict contractual obligations; Legal Requirements — where required by law, court order, or governmental request; and Business Transfers — in the event of a merger, acquisition, or sale of assets.

6. PIPEDA Compliance

HazReady is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Canadian-hosted infrastructure is available. You have the right to access, correct, and request deletion of your personal information.

7. Data Retention

We retain your account information and generated documents for as long as your account is active. Upon account termination, we will delete your data within 90 days unless retention is required by law. Physiological and biometric data is retained as described in Section 3. You may request data export or deletion at any time by contacting us.

8. Your Rights

You have the right to access your personal information, correct inaccurate information, request deletion, and export your data. Additional rights that apply specifically to physiological and biometric data, including withdrawal of consent to monitoring, are described in Section 3. To exercise any of these rights, contact us.

9. Contact

Questions about this policy? Contact HazReady Corporation, Waterloo, Ontario, Canada — info@hazready.ai.