What the workspace may contain
RettHMS workflows may contain internal users' names, email addresses, company membership, responsibilities and HSE or quality records. An SJA may contain external participants' self-reported names and companies.
Job documentation may include check responses, incidents, actions, photos and attachments. The final notice must describe what is actually collected and what is necessary for each purpose. Do not place health information or personnel-case details in ordinary shared descriptions.
Purposes and responsibilities must be clear
The completed notice must distinguish the public website, accounts and customer relationships, the business's own HSE records, support enquiries and any use of AI.
For each activity, it must identify who is responsible, what the data is used for, the basis relied on, who has access and how questions about personal data are handled. This draft does not establish those roles or bases.
AI, providers and processing locations
The prepared AI setup covers short text tasks. This does not establish file-analysis capabilities or Europe-only processing of all data.
A final register must identify providers actually in use, the information they receive, where processing takes place and any transfer arrangements. Choosing a technology or passing a local test does not establish these facts.
Quarantined files and backups
Unchecked user files remain private in quarantine. File scanning and external backups have been deferred and must not be described as active, verified safeguards.
The final notice must match actual file processing, logging, access and any backups. This document does not promise an operational external recovery copy.
Retention, ending access and deletion
Cancelling a subscription, deactivating a member and deleting data are different events. A completed retention plan must explain what happens to accounts, work records, invoices, logs, attachments and any backups.
This draft does not establish general statutory periods or promise immediate deletion. The product's agreed account-ending process must be aligned with actual processing and the final agreement and privacy wording.
Questions about your information
Contact post@retthms.no with questions about information in RettHMS. Briefly describe the matter without sending passwords, sign-in links or sensitive case details.
The process for secure identity checks, directing requests to the right recipient and handling them must be described before the notice is completed.