1. Who we are and how this policy applies
Veris EHS provides software for environmental, health and safety (EHS), environmental, social and governance (ESG), and risk management. This policy explains how personal information is handled through our platform and website.
For information entered into a client’s platform environment, the client organisation is the data controller: it decides what information is collected, why it is needed and who may access it. Veris EHS acts as a data processor, handling that information on the client’s behalf and under its documented instructions.
For enquiries submitted directly to Veris EHS through this website or by email, Veris EHS is responsible for handling the information needed to respond to the enquiry. Questions about this policy can be sent to contact@verisehs.ai.
2. Information handled by the platform
Clients and their authorised users introduce information into Veris EHS for operational workflows. Standard workforce information includes:
- Full name, used to identify people in observations, incident reports, assignments, approvals and audit records.
- Corporate email address, used for authentication, task routing and system notifications.
- Job title or designation, used for role-based access, approvals and escalations.
- Department or organisational unit, used to scope workflows, inspections and reporting.
- Supervisory relationships, used for reporting lines, investigation assignments and notification chains.
- Operational records and attachments submitted by users, which may identify employees, contractors or other personnel.
- System-generated audit trails, notification records, session information and access logs, used for accountability, security and troubleshooting.
3. Sensitive information and client configuration
The standard workforce profile is not intended to collect salary information, financial account details, national identification numbers, passport details, biometric identifiers or medical records unrelated to occupational safety reporting.
Clients must limit the information entered into configurable forms, reports, attachments and any enabled AI or computer vision features to what is necessary and lawful. Where a deployment involves sensitive information, images or other additional categories of personal data, the client must establish the appropriate lawful basis, notices, safeguards and agreed processing scope before enabling that use.
4. Website enquiries and demo requests
When you request a demo, a pilot or contact us, we handle the information you provide, such as your name, work email, company, role, telephone number, preferred meeting details and message. We use it to respond, arrange the requested conversation and manage related correspondence.
Information may be passed to service providers that deliver the enquiry or confirmation email on our behalf. Please do not include confidential operational records or sensitive personal information in a website enquiry.
We retain enquiry information for as long as needed to manage the conversation and meet applicable legal obligations. You can ask about access, correction or deletion by emailing contact@verisehs.ai.
5. How platform information is used
Veris EHS does not sell client personal data, use it for advertising or unrelated profiling, or create personal-data analytics products for sale. Processing for client workflows is limited to the client’s documented instructions and agreed service scope.
- Provide access to the platform and enforce the client’s configured permissions.
- Operate assignments, corrective actions, inspections, audits, approvals, notifications and reporting.
- Record who performed an action and when, and maintain a reliable audit trail.
- Maintain service availability, investigate technical issues and protect the platform.
- Provide authorised support and comply with applicable legal obligations.
6. Access and sharing
Within a client organisation, access is controlled by the permissions configured by its administrators. Veris EHS personnel may access client information only where authorised and necessary for support, maintenance or security. Such access is restricted, logged and subject to confidentiality obligations.
For hosted deployments, infrastructure providers may process information as sub-processors. They are required to protect the information and process it only for the agreed services. Clients can request the applicable sub-processor list. We provide at least 30 days’ advance notice of intended changes affecting client personal data.
We do not give a client’s parent companies, affiliates, investors or other associated entities access to client data without the client’s written instruction and a lawful basis. Information may be disclosed when required by law, a court order or a competent authority; where legally permitted, the client is notified before disclosure.
7. Hosting and international transfers
The hosting region and responsibilities are agreed for each deployment. Veris EHS supports SaaS/hosted, private-cloud, public-cloud and on-premises/local arrangements. In client-managed environments, the client’s infrastructure settings and agreement determine storage location, access and operational responsibilities.
A client may request a change of hosting region through the agreed change process, normally with at least 30 days’ notice. The client must assess applicable localisation and cross-border transfer requirements. Veris EHS protects transfers within its responsibilities and supports the client’s compliance assessment.
Replication across availability zones within the same geographic region does not itself constitute a cross-border transfer. Applicable protection requirements are determined by the local regulatory environment, not by a fixed list of countries.
8. Retention and deletion
During the subscription, client administrators control record-level retention, subject to legal and regulatory requirements. Leaving an organisation or having an account deactivated does not automatically erase records that the organisation is required to keep.
For data held in environments managed by Veris EHS, the client has at least 30 days after termination to export its data. Personal data is deleted from production systems within 90 days after the export period ends, unless applicable law requires longer retention. Written confirmation of deletion is available on request.
Backup and disaster recovery copies may remain for a limited additional period under the applicable rotation schedule. They remain protected until overwritten. For client-managed or on-premises deployments, deletion and backup responsibilities follow the deployment agreement.
9. Security and incidents
Controls within Veris EHS’s managed service responsibilities include encryption in transit and at rest, role-based access, client environment separation, monitoring, access logging, patch management and security reviews. Deployment-specific responsibilities are documented with the client.
For a confirmed personal data breach affecting client data under our responsibility, we notify the client without undue delay and no later than 72 hours after confirmation. A preliminary notification is provided within 24 hours where a breach is reasonably suspected but not yet confirmed. We provide further information as the investigation progresses.
The client is responsible for any required notifications to its employees or relevant authorities, with reasonable assistance from Veris EHS.
10. Your privacy rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing of your information, or receive it in a machine-readable format. These rights may be subject to legal exceptions, including required retention of safety and compliance records.
If you use the app and want to delete your account, open your profile and tap the “Delete account” button. This removes your account, sign-in details and personal settings. Records your organisation is required to keep are unaffected. See the Data Policy for the full account deletion terms.
Employees and contractors should contact their employer’s HR or data protection team first. The employer, as data controller, decides how the request is handled. Veris EHS provides technical assistance where needed and routes platform-related requests received directly to the relevant client.
For information supplied directly to Veris EHS through our website or correspondence, contact contact@verisehs.ai with the subject “Privacy / Data Request”. You may also raise concerns with the competent data protection authority under applicable law.
11. Changes, governing law and contact
This policy is effective from 1 July 2026 and is governed by the laws of the United Arab Emirates, without excluding mandatory data protection requirements applicable to a particular deployment or individual.
We may update this policy to reflect changes in our services, legal requirements or information handling. Enterprise clients receive at least 30 days’ written notice before material changes take effect. The effective date on this page will be updated accordingly.
Privacy and data enquiries: contact@verisehs.ai. Platform: Veris EHS. Website: verisehs.ai.