1. Purpose of this notice
This notice sets out how CipherQHSE, operated by Cipher Proactive Solutions, protects the confidentiality of information entrusted to us by customers, users, prospective customers and partners.
It applies alongside our Privacy notice and our subscription terms. Where a signed confidentiality or data processing agreement is in place with your organization, that agreement takes precedence for the information it covers.
2. Information treated as confidential
- Organization records held in your workspace, including incidents, investigations, risk assessments, audit findings, corrective actions, inspection results, permits and management reviews.
- Personal data of employees, contractors and visitors, including occupational health and injury information.
- Commercial information: pricing agreed with you, contract terms, renewal dates and billing correspondence.
- Security information: credentials, access tokens, configuration details and vulnerability reports.
- Any information marked confidential, or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.
3. Our obligations
- Access is granted strictly on a need-to-know basis and only to personnel who require it to deliver, secure or support the service.
- We do not disclose your information to third parties for their own purposes, and we never sell it.
- Where processors are engaged, they are bound by written confidentiality and data protection obligations no less protective than these.
- We apply role-based permissions, organization-level data isolation, encryption in transit and at rest, and audit logging of sensitive actions.
- Personnel are bound by confidentiality undertakings that continue after their engagement ends and receive regular security and data protection training.
4. Permitted disclosures
We may disclose information only where one of the following applies:
- You or your authorized administrator has instructed or approved the disclosure.
- Disclosure is required by law, regulation, court order or a competent supervisory authority — in which case we will, unless legally prohibited, notify the affected organization first.
- Disclosure is necessary to protect someone's vital interests, for example where an incident presents an imminent risk to life or health.
- The information is already lawfully in the public domain through no breach on our part.
5. Handling of health, safety and incident data
Incident and occupational health records can be sensitive. We limit their visibility to the roles your organization designates, support anonymous or restricted reporting where enabled, and do not mine this content for our own commercial purposes. Access by our own support staff requires a specific customer request or an approved support case, and is logged.
6. International operations
Where information is processed across borders, we apply the transfer safeguards described in our Privacy notice — including the UK International Data Transfer Addendum and the European Commission Standard Contractual Clauses — and require equivalent confidentiality obligations from every processor, regardless of location.
7. Reporting a concern or a suspected breach
Suspected confidentiality breaches or unauthorized access should be reported immediately to your organization administrator and to us.
Contact info@cipherproactive.com with a description of what happened. We investigate promptly, contain the issue, notify affected organizations without undue delay where personal data is involved, and cooperate with any regulatory notification obligation. Reports made in good faith will not be penalized.
8. Return and destruction of information
On termination of a subscription, administrators may export their organization data during the agreed wind-down period. After that period, information is deleted or irreversibly anonymized, except where retention is required by law — for example financial records. Backups are cycled out on a rolling basis under the same controls.
9. Duration
Confidentiality obligations apply during your subscription and continue for as long as the information remains confidential, including after the service ends.
10. Contact
Confidentiality and security enquiries: info@cipherproactive.com. Postal address: 128 City Road, London, EC1V 2NX, United Kingdom. Business hours: Mon – Fri, 9AM – 5PM.