ACN: 701 938 221

Version [1.0] | Effective 9 October 2026

Privacy Policy

1. About this policy

This policy explains how SOV Systems Pty Ltd ("SOV Systems", "we", "us") collects, uses, stores and protects personal information through the SOV·32 platform and our website, sovsystems.com.au.

It applies to:

workers who use SOV·32 through their employer
supervisors, managers and other staff of our client organisations
people who contact us or visit our website

We have chosen to comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) in full, and to handle wellbeing information to the standard required for sensitive information.

2. Nature of our services

Our programs provide workplace wellbeing, safety education, behavioural skills training and performance support. We do not provide medical, psychological, therapeutic or diagnostic services.

SOV·32 is not a crisis line and is not a substitute for professional medical or psychological care or emergency services. If you are in immediate danger, call 000.

3. How SOV·32 works: our role and your employer's role

Your employer chooses to use SOV·32 and decides how it is used in your workplace, including whether check-ins are part of its WHS procedures and who in the organisation can see your information.

SOV Systems provides and operates the platform. Your employer is responsible for its own policies on worker participation and for how its staff use the information they can see. Questions about your employer's policies should be directed to your employer.

4. What information we collect

Workers

Your name, role, site and employer. Your employer enters these details, not SOV Systems.
A unique code that identifies you within the platform.
Your answers to daily check-ins. These cover energy, focus, engagement, workload, control and support, plus two questions about each day's toolbox training.
An engagement score calculated from your check-ins, including whether each check-in was completed.
Flags you raise, or that are raised about you, including context notes and any changes in status (for example, resolved, withdrawn or escalated).
Corrections you submit to past check-ins.
Your GPS location and the time, captured only at the moment you complete a check-in or raise a flag. SOV·32 never tracks your location in the background.
A record of your consent, including the date, time and version of the notice you agreed to.
A device identifier used only to send you app notifications.
Name, organisation, role and contact details.
Any information you send us through our Book a Demo, contact or enquiry forms, email or phone.
Information about how you use our website, such as the pages you visit, your device and browser type, and your approximate location. We collect this through Google Analytics, which uses cookies. You can block or delete cookies in your browser settings.

Safe Support
We record only the total number of times Safe Support is used. We do not record who used it.

Client staff and website visitors

Name, organisation, role and contact details.
Any information you send us through our website, email or phone.

5. Health information

Some program modules involve topics such as fatigue, stress, mental load, physical conditioning and general wellbeing. As a result, we may collect or process information that is considered "health information" under the Privacy Act 1988 (Cth). This information is treated as sensitive information and protected with additional safeguards.

We do not provide health services, medical advice, psychological counselling or treatment. Any wellbeing content is educational in nature and is not a substitute for professional medical or psychological care.

6. Your consent

Before your first check-in, SOV·32 shows you a short notice explaining how your information is used, and asks for your consent. We keep a record of the date, time and version of the notice you agreed to. If we change the notice, we will ask for your consent again.

You can withdraw your consent at any time through Settings › Privacy in the SOV·32 app, or by contacting us.

If you do not give consent, or you withdraw it, you will not be able to complete check-ins in SOV·32. Safe Support and the flag system remain available to you. Your employer decides its own policy on participation, so please speak with your employer about what applies in your workplace.

7. How we use your information

We use your information to:

operate SOV·32 for your employer
create your employer's WHS and wellbeing compliance records
send you check-in reminders
protect the security and integrity of the platform and its records
respond to requests and complaints
meet our legal obligations

Your records may be used as evidence in a WHS investigation, a workers compensation claim or legal proceedings involving your workplace.

We do not sell personal information. We do not use workers' check-in or flag information for marketing. Any filming for promotional purposes uses demonstration data only, and anyone who appears on camera signs a separate release.

8. Who can see your information

Your employer
Supervisors and managers in your organisation see your name, your check-in answers, your engagement score and your flags, at the access level your employer has set. Your check-ins are not anonymous to your employer.

For Safe Support, your employer sees only a monthly total, with no names or details.

SOV Systems
SOV Systems staff see only coded identifiers, not names. Workers' names are encrypted, and our administrator access cannot decrypt them.

For clients whose records we store long-term (see section 10), information can only be retrieved through a restricted "break glass" process. This is used only when your employer authorises it for its own records, or when the records are required by law, such as a request from SafeWork or a court order.

Our service providers
We use the following providers to run SOV·32:

Supabase: database hosting, in Sydney, Australia
Vercel: application hosting, in Sydney, Australia
Amazon Web Services: secure record storage, in Australian regions
Google Firebase: app notifications (device identifier only)
Wix: website hosting and website form submissions
Google Analytics: website usage statistics

Where required by law
We may disclose information where an Australian law, court or tribunal order requires or authorises it.

9. Overseas disclosure

Your check-in answers, flags and location data are stored and processed in Australia.

Google Firebase, which we use only to deliver app notifications, may process your device identifier outside Australia, including in the United States and other countries where Google operates. No check-in answers, flags, names or location data are sent through Firebase.

Information you submit through our website forms is stored by Wix, and website usage information is processed by Google Analytics. Both may store or process that information outside Australia, including in the United States.

10. How long we keep your information

How long we hold your information depends on the plan your employer uses.

Tier 1 (SaaS)
We host your information temporarily in our Australian database, for up to about two months. Each month, it is automatically transferred to storage your employer nominates. Once the transfer is confirmed, we delete it from our systems, including backups. After that, your employer holds the records and is responsible for how long they are kept and for responding to access or correction requests about them.

Tier 2 (The Shield)
Each month, records are transferred to secure, locked storage in Australia. We keep them for 10 years from the date they enter storage. This is SOV Systems' decision to keep records for longer than current minimum requirements, so that a complete record is available if it is ever needed. At the end of 10 years, records are automatically deleted.

To link corrections to original records, we keep a small index for the same period. It holds only record identifiers, dates, check-in times, coded worker identifiers and security codes, and contains no names or answers.

Client staff and website visitors
We keep contact information for as long as we need it to deal with you, and then delete or de-identify it.

11. How we protect your records

Each record is time-stamped, location-stamped and secured with a unique security code (hash) when it is created, and linked to the records before it. This makes it possible to detect any attempt to change a record, which is what makes SOV·32 records reliable as evidence.

We also protect information by:

encrypting workers' names
showing SOV Systems staff coded identifiers only
limiting access according to each person's role
hosting data in Australia
monitoring security alerts from our service providers

No system can be guaranteed to be completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

12. Access and correction

Correcting your records
Once a record is created, it cannot be changed or deleted. This protects everyone, including you. If something in a check-in is wrong, you can use "Correct a past check-in" in the app to submit a correction. Your correction is permanently attached to the original record, and anyone who views that record sees both.

Seeing your information
You can ask to see the information held about you. For Tier 1, please ask your employer. For Tier 2, contact your employer or us, and we will work with your employer to respond.

We will respond to requests within 30 days. If we cannot give you access or make a correction, we will explain why in writing and tell you how to complain.

13. Data breaches

If we become aware of a data breach involving your information, we will:

notify your employer within 72 hours
assess whether the breach is likely to cause serious harm
where it is, notify the Office of the Australian Information Commissioner (OAIC), and ensure affected people are notified, as the Notifiable Data Breaches scheme requires

Your employer will usually contact affected workers directly.

14. Complaints

If you have a concern about how your information has been handled, please contact us first. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the OAIC at www.oaic.gov.au or on 1300 363 992.

15. Changes to this policy

We may update this policy from time to time. The current version is always available at sovsystems.com.au. If a change affects how worker information is used, we will update the in-app notice and ask for consent again.

16. Contact us

Privacy Officer, SOV Systems Pty Ltd
Level 1, 53 Victoria St, Grafton NSW 2460
contact@sovsystems.com.au