Privacy policy
TRM Safety app and website · Last updated 1 November 2026
This policy explains what personal information the TRM Safety app collects, why, who it is shared with, how long it is kept, and your rights. It covers the iPhone app, the web app at trmsafety.app (also reachable at trm-safety.pages.dev) and the site sign-in page that opens when you scan a site QR poster.
1. Who we are
TRM Safety is provided by Teesside Risk Management Ltd (registered in England & Wales, company no. 16232241; teessideriskmanagement.co.uk). We are the controller of the personal information described here. This means we decide how it is used and we are responsible for protecting it.
For any privacy question or request, email [email protected].
2. What we collect
If you have an account
- Account details: your name, your email address, your role (administrator, manager, issuer / supervisor or worker) and which organisation you belong to. Your password is handled by our sign-in provider and is stored only in scrambled (hashed) form; we never see it.
- Safety records you create or sign: permits to work, risk assessments and method statements (RAMS), sign-ons, toolbox talks and inductions, inspections and plant checks, observations, actions, gas readings and notes. These include the names of the people involved and when they did things.
- Signatures: the signature you draw on the screen when you sign a record.
- Photos: photos you take or choose to add to a record. The camera and photo library are only used when you choose to add a photo, or, in the iPhone app, when you tap “Scan site QR” to read a site sign-in poster (only the link in the QR code is read; no picture is kept or sent). Photos are normally resized on your phone, which also removes hidden details stored in the photo, such as where it was taken. If a phone cannot resize a photo, the original file is uploaded instead and it may still contain any details your camera saved with it.
- Uploaded documents: RAMS that an administrator, manager or supervisor uploads as a PDF, such as a contractor’s own RAMS. They are kept with the organisation’s records.
- Site plans: a plan or drawing of a site that an administrator, manager or supervisor uploads, with the fields, no-work areas and hazards (such as overhead lines or buried services) drawn on it, and which fields each permit covers. When a permit warns about a hazard on the plan, the app records who acknowledged the warning and when. Site plans are about places, not people, but they are kept with the organisation’s records and shown only to its members.
- Audit trail: a record of who created, changed, signed, acknowledged or deleted what, and when. This is how the app shows that records have not been altered.
If you start a company in the app
- The company name, the first site’s name if you add one, your name and email address, and the dates of the company’s free trial.
- A one-way code made from the email address you started the company with, and one made from the internet (IP) address you used. They cannot be turned back into the address. They are used to allow one free trial per email address and to limit how many companies can be started from one connection in a day.
If you use the help assistant
- The question you type is sent to Cloudflare Workers AI, which runs Meta’s Llama 3.1 model, to write an answer from the app’s help guide. Email addresses and long numbers are taken out of the question first. Your name, organisation and records are not sent. We do not store your questions or the answers.
- To apply the limits (20 questions an hour, 100 a day), the app records your account and the time of each question, for about two days.
- When the help guide does not cover a question, we count it against the nearest section of the guide, per day. This count does not include the question or who asked it.
If you use Messages (group messages)
Administrators, managers and issuers / supervisors of your organisation can set up message groups, for example for a site or a team, and add people to them. If you are in a group, we store:
- the messages you send in it: the text, the time on your phone when you sent it, the time it reached our server, and your name as it was when you sent it;
- photos you send in it, with an optional caption. Photos are made smaller and re-saved on your phone before they are sent; location and other camera details (EXIF) are not kept;
- each earlier version of a message you edit (see below);
- who is in each group, who added or removed them and when, and when you last read the group (for the read ticks and the unread count);
- the groups’ names, and the site a group is for, if any;
- if you report a message: which message, your name, the reason you give (if any) and when; and, when an administrator or manager resolves the report, their name, the time and their note;
- the people you block in Messages, if any. Only you can see who you have blocked.
Messages are only for work at your organisation. Please do not send health or other sensitive personal information in them.
If you sign in to a site using a QR poster
- Your name and company, the site, the times you signed in and out, and how you signed out (on your phone, by the site team, or automatically at the site’s end-of-day time if you did not sign out – the register then shows “Didn’t sign out”). At a site sign-in tablet, also whether you said you have had the site induction. You do not need an account or the app for this.
- If the site has switched on “Only allow sign-in on site”: when you tap Sign in, your phone’s location is read once to check you are on site. We keep only how far you were from the site and how accurate the reading was (for example “35 m”), not where you were. The same applies when you sign in on a site sign-in tablet (the tablet’s location) or in the app. The reading is sent to our server once, with the sign-in; the server works out the distance and does not store the reading itself. If you sign in in the app without a signal, the reading is kept on your phone only until the sign-in is sent (or refused), then removed. Your location is never needed to sign out.
- An administrator can set a site’s location by tapping “Use my current location” while standing on site. That reads the administrator’s phone location once and saves it as the site’s location (with who set it and when); it is not a record of where that person was at other times.
- The check uses the location the phone reports. It stops casual sign-ins from somewhere else (for example from a photo of the QR poster, or from home), but someone using tools that fake a phone’s location could get round it, so it is not proof that a person was on site. It is also not meant to keep a site’s location secret.
- Your phone remembers your name, company and current visit so it can sign you out later, and the site’s name and emergency information so the page still opens without signal. This stays on your phone.
Technical information
- Our hosting and sign-in providers keep short-term technical logs, such as IP address, browser or device type and the time of each request. These are used to keep the service running and secure.
What we do not collect
- The app does not track your location: it is read only at the moment you sign in to a site that checks it (or when an administrator sets a site’s location), never in the background (automatic sign-out at the end of the day uses the time, not where you are). It does not ask for your phone number, and it does not use advertising or analytics tools.
Records sometimes mention people other than the person writing them, for example a name in an observation or a person signed on to a talk. If a record includes details about someone’s health, such as an injury, it is used only to meet health and safety duties at work.
3. Why we use it and our lawful basis
| What we do | Lawful basis under UK GDPR |
|---|---|
| Create and run your account, sign you in, send account emails (confirm your email address, reset your password) | Contract: we need it to provide the app you or your organisation asked for. Legitimate interests: running a secure service. |
| Keep permits, RAMS, inspections, talks, inductions, observations, actions and the audit trail, with names and signatures | Legal obligation, where health and safety law requires records to be made or kept. Legitimate interests: keeping people safe at work and being able to show what was checked, agreed and signed, and by whom. |
| Start a company and its free trial, and limit sign-ups (one free trial per email address, a limit per connection) | Contract: setting up the account you asked for. Legitimate interests: preventing misuse of free trials. |
| Make a company read-only when its free trial ends, email its administrators reminders, and, after a retention period (currently 90 days after the trial), delete its records | Contract: the terms of the free trial. Legitimate interests: not keeping personal information longer than needed, and giving the company time to export its records. |
| Answer questions in the help assistant, and apply its limits | Legitimate interests: helping you use the app, and keeping the service available for everyone. |
| Site sign-in and sign-out | Legitimate interests and legal obligation: knowing who is on site (for example in an emergency) and that they have been inducted. |
| Checking you are on site when you sign in, where the site has switched this on | Legitimate interests: an accurate record of who is really on site, because the QR poster is a link that could be used from anywhere. |
| Run your organisation’s message groups, keep the record of them and deal with reported messages | Legitimate interests: safe and organised work on site, and a reliable record of instructions given. |
| Technical logs and security | Legitimate interests: protecting the service and your information from misuse. |
Where we rely on legitimate interests, we have weighed them against your rights. Signed safety records protect everyone on site, including the people named in them. We do not sell personal information. We do not use it for marketing or to make automated decisions about you.
5. How long we keep it
- Your account (sign-in, email address and team membership) is kept while you use the app. It is removed when you delete your account, or when your organisation asks us to remove you.
- Signed and issued safety records, including the names and signatures on them, are kept as evidence for as long as they are needed for legal, insurance and safety reasons. Some records must be kept for set periods by law. The app does not delete records automatically, except those of a company started in the app whose free trial has ended (below). Your organisation reviews what it keeps.
- A company started in the app (free trial): when the free trial ends, the company’s account becomes read-only – everyone in it can still view records and download PDFs, and administrators, managers and supervisors can export them, but nothing new can be added. Unless the account has been continued, the company’s records, photos and uploaded files, and the sign-ins of the people in it, may then be deleted after a retention period (currently 90 days after the trial ends). Nothing is deleted before its administrators have been emailed the date, well ahead (currently 30 days before) and again shortly before (currently 7 days and 1 day before); the date is also shown in the app. They are also emailed before the trial ends and when it ends. Photos and uploaded files are removed from storage separately, some days after the records are deleted; until then nobody can open them in the app. We keep a record that the deletion happened (dates and counts only, no names or email addresses), and the record of which reminders were sent (counts only). Organisations set up by TRM are not affected.
- Site sign-in records are kept with the site’s records on the same basis.
- Messages, message photos, group membership and reports of messages are kept for the life of your organisation’s account on TRM Safety. Nobody can delete or hide a message, including the sender and administrators, so that the record of what was said on site cannot be changed afterwards. You can edit your own message for 15 minutes after sending it; the original text is kept and the message shows “edited”. They are deleted only when the whole organisation’s account is deleted (for a company started in the app, also after its free trial ends, as described above; message photos are then removed from storage separately, some days later). The list of people you have blocked is kept until you unblock them or your account is deleted. If your organisation’s administrators switch Messages off, nothing is deleted: the messages, photos, group membership and reports already there are kept as part of the organisation’s records, its administrators can still read and export them, and its administrators and managers can still deal with reported messages; switching Messages back on shows everything again.
- Help assistant: questions and answers are not stored. The record of when you asked a question is kept for about two days. The daily counts of questions the guide did not cover are kept for 180 days.
- Sign-up record of a company started in the app (the one-way codes of the email and internet address, and when): kept so that the free-trial and sign-up limits work, also after the company or account is deleted.
- Backups and technical logs held by our providers are kept for a short period and then deleted or overwritten.
6. Deleting your account
You can delete your account in the app at any time: More › Account & privacy › Delete my account. You will be asked to type DELETE to confirm.
- This removes your sign-in, your email address and your team membership straight away, and clears the app’s data on that phone. You are taken out of any message groups (the group shows that you left because your account was deleted), and the list of people you blocked is removed.
- Signed and issued safety records stay as evidence, including your name and signatures on them. This is because they record what was agreed and checked on site, which other people may rely on.
- Messages you sent stay in their groups, with your name, as part of your organisation’s record of what was said on site, and so do the photos you sent, the record of which groups you were in, and any reports of messages you made. A single message cannot be removed: messages are kept until your organisation’s account is deleted, and are removed then.
- An entry is added to the audit trail to show that the account was deleted.
- If you are the only administrator of your organisation and other people still use it, you must first make someone else an administrator. This ensures the organisation is still managed.
- If you are the only person in your company on TRM Safety, you can delete your account together with the company: More › Account & privacy › Delete my account and the company, and type the company name to confirm. This permanently deletes the company and all its records (permits, RAMS, toolbox talks, inspections, observations, actions, site sign-ins, site plans, settings, invitations and the audit trail). Its photos and uploaded files can no longer be opened by anyone, and are removed from storage separately, some days later. Export a backup first if you may need the records.
You can also ask us to delete your account by emailing [email protected] from the email address on the account.
7. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete information. We may need to keep signed safety records and messages where the law requires it, or to deal with legal claims; if so, we will explain;
- ask us to limit how we use your information, or object to how we use it;
- ask for information you gave us in a format you can take elsewhere.
To use any of these rights, email [email protected]. We will reply within one month. There is normally no charge.
If you are unhappy with how we have used your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint.
8. Cookies and storage on your device
The app does not use cookies for advertising or tracking. It also has no analytics. It does store some information on your phone or computer so that it works, including offline:
- your sign-in session, so you stay signed in;
- a copy of your organisation’s records, photos, uploaded RAMS PDFs, site plans and any changes not yet sent, so you can work without a signal;
- the app’s files, so it opens quickly and works offline;
- settings for this device, such as a site kiosk lock, whether reminders are on, and that you have read the help assistant notice;
- a message (and its photo) that you send while offline: it is kept on the phone only until it has been sent. If you sign out before then, it stays on the phone and is sent the next time you sign in on it. Deleting your account in the app, or clearing the app’s data, removes it. Messages you have opened are not stored on the phone for offline use;
- in the iPhone app, if you turn reminders on: reminders scheduled on your phone (a permit you issued or received expiring in 30 minutes, a fire watch ending, a permit waiting for you to accept or close out – after 30 minutes and again after 2 hours – an extension waiting for you to confirm – after 10 minutes and again after 30 minutes – and signing out before the automatic sign-out time). They are worked out on your phone from its own copy of the records and shown by iOS; nothing is sent to us or to a notification service. Reminders can appear on your lock screen and include the permit reference, its location or description, the site name and, for sign-out reminders, your name, so anyone who can see your phone can read them. To hide them, turn reminders off in the app, or set Show Previews to “When Unlocked” for TRM Safety in iPhone Settings → Notifications;
- in the iPhone app, if you turn on Face ID or Touch ID unlock: your sign-in to the app (a sign-in token that renews itself – never your password) kept in the iPhone Keychain, which iOS only opens after Face ID or Touch ID. Face ID or Touch ID unlock is a screen lock for the app: the app also stays signed in on the phone in the usual way, as it does without it. Face ID and Touch ID are handled by iOS: the app and we never see or receive your face or fingerprint data. Signing out, or turning the switch off in Account & privacy, deletes it;
- on the site sign-in page: your name, company and current visit, so you can sign out later, and a random code for this phone (we store only a scrambled copy with your sign-in), so that only the phone you signed in with can sign you out.
This storage is strictly necessary for the service you asked for, so we do not ask for consent. Signing out stops the app using your session. Deleting your account, or clearing the website data in your browser settings, removes this storage.
9. Keeping it safe
Information is encrypted while it travels over the internet. Each organisation can only see its own records. Photos and uploaded documents are stored privately, and the database checks who is allowed to see and change each record. Sign-in uses email and password. Please keep your password private and sign out of shared devices.
10. Children
TRM Safety is a tool for use at work. It is not intended for children, and we do not knowingly collect information about children.
11. Changes to this policy
If we change this policy, we will update this page and the date at the top.