ProSafe EHSLegal

Privacy Policy

Effective May 14, 2026

This Privacy Policy describes how Procaps Laboratories ("Procaps") collects, uses, and protects information when you use the ProSafe EHS Platform (the "Software"). The Software is an internal tool; we do not sell information to third parties.

1. Information We Collect

  • Account information: name, work email address, employee number, department, job title, roles.
  • Authentication metadata: sign-in times, IP address, and browser user-agent.
  • EHS records you submit: incident reports, hazard reports, BBS observations, audit findings, toolbox sign-offs, and similar safety data.
  • Compliance signatures: electronic signatures, document acknowledgments, with timestamp and cryptographic hash of the signed record (21 CFR Part 11).
  • Audit logs: every create / update / delete on tracked tables, with actor identity and timestamp.
  • Optional AI inputs: when you use AI-assisted features, the relevant text you submitted (e.g., an incident narrative) is sent to the AI provider for processing. We do not send personally identifying detail unless you put it in the prompt.
  • Anonymous QR / kiosk submissions: a hazard reported via a posted QR code is stored without a person identifier; only the token, area label, and IP address (for rate-limiting) are retained.

2. How We Use Information

  • To operate the Software and provide its features to authorized users.
  • To maintain compliance records required by OSHA 29 CFR 1904, 21 CFR Part 11, 21 CFR Part 111, and other applicable regulations.
  • To investigate incidents, manage corrective actions, and conduct internal audits.
  • To send notifications (email, Slack) about items that require your attention.
  • To detect and prevent abuse (rate limiting, suspicious access patterns).
  • To respond to lawful requests from auditors, regulators, or courts.

3. Sharing

We share information only with: (a) authorized employees, contractors, and auditors of Procaps Laboratories who need access to perform their roles; (b) regulatory authorities when legally required (OSHA, FDA, EPA); (c) sub-processors (Supabase, Railway, Resend, Slack, OpenAI) bound by their own data-protection terms.

4. Sub-Processors

  • Supabase, Inc. — database hosting, authentication, file storage. Data resides in their managed Postgres infrastructure.
  • Railway Corp. — application hosting.
  • Resend — outbound email notifications (when configured).
  • Slack Technologies — outbound Slack notifications (when configured).
  • OpenAI — AI-assisted classification and drafting (when API key configured and feature is used).

You should not enter sensitive personal data (SSN, financial info, individually identifying medical history) into AI prompts.

5. Retention

Compliance records are retained as required by applicable law and Procaps's record retention policy. OSHA-recordable incident records are kept for at least five (5) years from the end of the calendar year they cover (29 CFR 1904.33). Covered exposure records are retained for at least thirty (30) years, and covered medical records for employment plus thirty (30) years, subject to the exceptions in 29 CFR 1910.1020. Audit logs and electronic signatures are retained for the life of the underlying record.

6. Security

We use industry-standard security measures: TLS in transit, encryption at rest, row-level security for tenant isolation, role-based access control, Microsoft sign-in with organizational access policies, re-authentication for signature events, and append-only audit trails enforced at the database level. No system is perfectly secure; report suspected incidents immediately to the EHS administrator.

7. Your Choices

  • You may request a copy of data we hold about you. Contact your EHS administrator.
  • You may request correction of inaccurate personal data. Compliance records cannot be deleted but may be corrected with a documented change reason (Part 11).
  • If you object to AI processing, ask the EHS administrator to disable AI features for your account.

8. Children

The Software is not intended for use by individuals under 18 years of age.

9. International Transfers

Data is stored on U.S.-based infrastructure operated by our sub-processors. If you access the Software from outside the United States, your data will be transferred to and processed in the U.S.

10. Changes to This Policy

We may update this Privacy Policy. Material changes will trigger a re-acceptance prompt. The current effective date is shown at the top of this page.

11. Contact

Questions or requests: Procaps Laboratories EHS Department, Henderson, NV.