Privacy Policy

1. Our Commitment

ReFresh Pty Ltd ("the Company," "we," "us," or "our") (Level 5, 100 Market Street, Sydney NSW 2000, Australia) handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

ReFresh is an AI-assisted workplace psychosocial-hazard compliance platform built specifically for Australian HR directors and workplace safety managers. The Company uses personal information to help organisations operating under Australian WHS law identify, assess, document and review psychosocial hazards, draft compliant policy documents, and maintain an evidence trail for WHS investigations.

This Privacy Policy explains how the Company collects, uses, discloses, stores and manages personal information in connection with refreshtech.org and the ReFresh platform.

2. Personal Information We Collect

The Company collects and processes the following categories of personal information and workplace information through the ReFresh platform:

• Organisation profile data: state or territory, industry sector, headcount, number of sites, and existing policy documents uploaded by the subscribing organisation.
• Workplace policy documents: AI-drafted policies and policy amendments authored, reviewed and approved within the platform. These documents may describe specific workplace hazards and control measures.
• Psychosocial hazard register entries: hazard category, severity rating, control measures in place, accountable persons and review dates. These entries may describe workplace conditions affecting specific employee groups.
• User account data: name, work email address, job title and organisation name for people who use the ReFresh platform.
• HRIS-imported organisational structure data: on Professional and Enterprise plans, headcount and organisational structure data imported from the subscribing organisation's HRIS to prepopulate compliance profiles. The Company does not import payroll or personal salary data through this HRIS integration.
• Usage and session data: pages visited, features used, session duration, IP address and browser type. The Company collects this data to operate, secure and improve ReFresh.
• Contact and inquiry data: name, email address and message content submitted through the contact form or demo-request form.

Psychosocial hazard register entries may describe workplace conditions affecting identifiable employee groups, such as a specific team experiencing high workload or a site with a documented bullying complaint. The Company treats these entries as sensitive workplace information and does not use them for any purpose other than operating ReFresh for the subscribing organisation.

3. Purposes (APP 3, 6)

The Company collects organisation profile data, workplace policy documents and psychosocial hazard register entries because ReFresh is designed to support psychosocial hazard compliance under Australian WHS law. This information enables subscribing organisations to identify, assess, document and review workplace hazards, prepare policy documents and maintain evidence for WHS investigations.

The Company uses user account data to create and administer access to ReFresh, associate authorised users with their organisation, provide platform communications and support account security.

On Professional and Enterprise plans, the Company uses HRIS-imported organisational structure data to prepopulate ReFresh compliance profiles with headcount and organisational structure information. The HRIS import does not include payroll or personal salary data.

The Company uses usage and session data to operate, secure and improve ReFresh, including understanding how HR directors and workplace safety managers use compliance features. The Company uses contact and inquiry data to respond to requests, demo enquiries and support communications.

Customer-submitted policy content and psychosocial hazard register entries are not used to train, fine-tune or evaluate AI models without the explicit written consent of the subscribing organisation.

The Company retains account and organisational data for the duration of the subscription and for 90 days after cancellation. After that period, the Company deletes or anonymises that data. Anonymised usage analytics may be retained for longer for product improvement.

4. Disclosure (APP 6, 8)

The Company may disclose the personal information used by ReFresh to service providers that support the platform, including cloud infrastructure providers for hosting and storage, self-hosted analytics tools with session-level anonymisation applied, and email delivery services for system notifications. These sub-processors are bound by data processing agreements and are not permitted to use customer data for their own purposes.

The Company may disclose organisation profile data, workplace policy documents, psychosocial hazard register entries, user account data and HRIS-imported organisational structure data to those sub-processors only as necessary to operate ReFresh for the subscribing organisation. The Company does not disclose psychosocial hazard register entries for unrelated purposes.

The cloud infrastructure used by ReFresh may be located outside Australia. Where personal information is disclosed overseas, the Company puts in place reasonable contractual safeguards consistent with APP 8.

The Company may also disclose personal information where required or authorised by law, including where disclosure is necessary to comply with a legal obligation relating to Australian WHS law or another applicable legal process.

5. Your APP Rights

Subject to the Privacy Act 1988 (Cth), individuals may have rights concerning personal information held by the Company, including the following:

• APP 12 - Right to access your personal information;
• APP 13 - Right to request correction;
• Right to opt out of direct marketing (APP 7);
• Right to deal with us anonymously where lawful and practicable (APP 2).

Requests relating to personal information in a ReFresh account, organisation profile, workplace policy document, psychosocial hazard register entry or HRIS import should be directed to the Company using the contact details in Section 9. The Company may need to verify the requester's identity and may need to coordinate with the subscribing organisation where the information is controlled or supplied by that organisation.

Email [email protected] to make a request. We respond within 30 days.

6. Complaints

The Company encourages individuals to contact it first about concerns involving ReFresh user account data, workplace policy documents, psychosocial hazard register entries, HRIS-imported organisational structure data or other personal information handled through the platform.

If you believe we have not complied with the APPs, contact us first. If unresolved, you may lodge a complaint with the Office of the Australian Information Commissioner ("OAIC") at oaic.gov.au.

7. Notifiable Data Breaches

The Company maintains procedures for responding to incidents involving personal information processed by ReFresh, including user account data, organisation profile data, HRIS-imported organisational structure data, usage and session data, and contact and inquiry data.

If a data breach is likely to result in serious harm, we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme.

8. Cookies

Information about cookies and similar technologies used in connection with refreshtech.org and ReFresh is provided in the Cookie Policy.

9. Contact

For privacy questions, access or correction requests, complaints, or enquiries about personal information processed through ReFresh, contact the Company: