Privacy Policy

1. Overview

Thank you for using AccordPath, an AI-powered workplace psychological safety support tool designed to help organisations identify and respond to psychosocial hazard concerns, support their teams, and maintain appropriate records of actions taken. AccordPath is operated by ACCORDPATH PTY LTD (ACN 693 542 504, ABN 16 693 542 504) (also referred to in this Policy as “AccordPath”, “we”, “us” or “our”).

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and any other applicable privacy laws.

This Policy explains how we collect, use, disclose, store and otherwise handle personal information in connection with AccordPath, our website, related communications, and any support or onboarding activities. It also explains how you may access or correct your personal information, and how you may make a privacy complaint.

Please read this Policy carefully and contact us using the details in section 15 if you have any questions.

2. Basis for collection and consent

We collect personal information where it is reasonably necessary for one or more of our functions or activities, in accordance with APP 3.3 of the Privacy Act 1988 (Cth). Because AccordPath is a workplace tool provided by subscribing organisations, we recognise that employees and other workplace participants may not be in a position to freely withhold consent to the collection of their personal information through the Platform. Accordingly, we do not rely on individual consent as the primary basis for collecting personal information through the Platform.

Where collection of particular categories of information is genuinely optional and not necessary for the core operation of the Platform, we will seek separate, informed consent. This includes:

• enabling audio recording or transcript features, where consent of all parties is required; and
• collection of sensitive information that is not reasonably necessary for the functions described in this Policy.

3. What kinds of personal information do we collect and hold?

3.1 Information about users of AccordPath

If you are a user of AccordPath, we may collect personal information such as:

• your name;
• your work email address, phone number and other contact details;
• your employer or organisation name;
• your role and access level within your organisation, and your relationship to a workplace matter;
• your login credentials, account status and authentication-related data;
• your preferred language and communication preferences;
• profile information or images you upload;
• device, browser, session and usage information, including IP address, device identifiers, page views, timestamps, browser type, operating system, cookies and similar analytics data;
• information about how you use the Platform and its features; and
• information contained in communications with us, including support enquiries, onboarding correspondence and feedback.

3.2 Workplace and incident information

Because AccordPath is used to manage workplace psychological safety and people-management matters, we may collect information that users enter into the platform in connection with a workplace matter, including:

• names and work details of individuals involved in a workplace concern;
• descriptions, observations, timelines, locations and supporting context relating to a workplace matter;
• meeting-related information and records of actions taken;
• uploaded documents, attachments and user-entered free-text notes; and
• records relating to the handling, progress and outcome of a workplace matter.

3.3 Sensitive information

Some information processed through AccordPath may be sensitive information under the Privacy Act 1988 (Cth). The categories of sensitive information we may collect through the Platform include:

• health information, including information about a person’s physical or mental health or wellbeing;
• information about a person’s psychological state, including psychological distress, injury or condition;
• information about a person’s disability; and
• information disclosed by individuals in the context of workplace safety matters, workplace incidents or psychosocial hazard concerns.

We will only collect sensitive information where:

• the individual has consented; or
• collection is reasonably necessary for our functions or activities and is otherwise permitted or required by law.

If optional recording functionality is enabled, we may also collect audio recordings or transcripts where participants have been appropriately notified and, where required, have provided consent.

3.4 Information about non-user individuals

We may collect personal information about people who do not hold a direct AccordPath login, where that information is entered into AccordPath by an authorised user or provided to us during onboarding, support, or the handling of a workplace matter. This may include:

• employees, team members, witnesses or other individuals involved in a workplace matter;
• designated contact persons nominated by an organisation;
• job applicants, contractors or former employees where relevant to a workplace matter; and
• contact persons provided by a client organisation for implementation, billing, legal or support purposes.

3.5 Website and marketing information

If you visit our website, contact us, download materials, request a demo, join a waitlist, or otherwise interact with us outside the product, we may collect:

• your name and business contact details;
• organisation and role information;
• information you provide in forms, emails or calls;
• website usage and analytics information; and
• cookie and similar tracking data.

3.6 Recruitment and contractor information

If you apply to work with us or provide services to us, we may collect:

• your name, address and contact details;
• resume, work history, qualifications and reference information;
• billing, tax or business registration details; and
• information provided during recruitment, contracting or onboarding.

3.7 If you choose not to provide information

If you do not provide personal information requested by us, we may not be able to provide you with access to AccordPath, respond to your enquiry, onboard your organisation, or deliver relevant services and support.

3.8 Unsolicited personal information

If we receive personal information we did not request, we will determine whether we could have collected that information under this Policy and applicable law. If not, and if lawful and reasonable to do so, we will destroy or de-identify the information as soon as practicable.

4. Support conversations

When you use the in-app Help & Support chat inside the AccordPath application, we collect and process the messages you type, any screenshots or files you choose to attach, and technical page context captured when you open the chat (such as the page you were viewing, application version, browser type, interface state indicators, and recent technical error information).

This information is used to provide you with support, diagnose issues, and improve the product. Support conversations are handled by an AI assistant and are visible to the AccordPath team, and may be processed by the third-party AI service providers described elsewhere in this Policy.

Support conversations may result in an issue record being created in our internal issue-tracking systems, which will include your name, work email address, organisation, and the content you submitted.

No records from your organisation’s AccordPath workspace, such as case records or notes, are automatically shared through this channel. The chat only transmits what you type, what you attach, and the technical context described above.

Support conversation records are retained while your organisation’s account remains active, and are deleted on verified request or on organisation offboarding.

5. Why do we collect your personal information?

We collect, hold, use and disclose personal information for purposes including:

• providing, operating, maintaining and improving AccordPath;
• creating and managing user accounts, organisations and access levels;
• providing the Platform’s features and supporting users in managing and recording workplace matters;
• generating AI-assisted and other supporting content, notifications and records;
• supporting organisation onboarding, implementation, billing and account administration;
• responding to enquiries, requests, feedback and support issues;
• monitoring usage, performance, security and service reliability;
• training, quality assurance, product development and service improvement, including by using de-identified or aggregated data where appropriate;
• complying with legal, regulatory and contractual obligations;
• protecting our legal rights and investigating misuse, suspected unlawful conduct or security incidents; and
• sending service-related communications and, where permitted, marketing communications.

To understand how organisations are adopting AccordPath, we keep daily counts, for each subscribing organisation, of page views in the Platform and of how often the recording of a new workplace matter is completed, discarded or left unfinished. These organisation-level counts contain no names, email addresses or other identifiers of any person, and we keep them for 12 months.

AccordPath staff can also see, for each subscribing organisation and each user account, counts of how the Platform is used, such as the number of workplace matters opened and pages visited. We use these counts to operate and improve AccordPath and to provide support. These counts do not include the content of workplace matters, notes or conversations, and AccordPath staff cannot read that content through them.

We do not use identifiable User Content or workplace data to train artificial intelligence or machine learning models.

Based on the information entered into the Platform, AccordPath uses software rules and AI models to flag workplace matters that may need the user’s immediate attention, to draft suggestions and other content, and to show guidance to the user. These outputs are suggestions and prompts only: a person reviews them and decides whether and how to act on them. AccordPath does not, by automated means, make any decision about an individual that would significantly affect their rights or interests. We store AI-generated content in the Platform with the information it relates to.

AccordPath is designed to help organisations support better workplace responses. It does not replace legal advice, HR judgment, or employer decision-making responsibilities.

6. How do we collect personal information?

We may collect personal information:

• directly from you when you create an account, use AccordPath, contact us, request support, attend onboarding, respond to emails, submit forms, or otherwise interact with us;
• from your employer or organisation, for example when your organisation sets up your account, assigns your role, provides implementation data, or enters information relevant to a workplace matter;
• from authorised users of AccordPath who input information relating to other individuals;
• through our website, platform logs, cookies, analytics tools and related technologies;
• from service providers, contractors, advisers or integration partners supporting the operation of AccordPath; and
• from publicly available sources or other third parties where lawful and reasonable to do so.

We will take reasonable steps to ensure that personal information collected is relevant to our functions and activities.

7. Disclosing your personal information

We may disclose personal information to:

• your employer or organisation, and its authorised administrators or representatives;
• users within your organisation, where disclosure is necessary for the operation of AccordPath and the handling of workplace matters;
• our related bodies corporate, contractors, professional advisers and service providers;
• cloud hosting, storage, infrastructure, analytics, communications, identity, payment and support service providers;
• implementation, customer support, security, product development and operational partners acting on our behalf;
• regulators, courts, law enforcement agencies or other government bodies where required or authorised by law;
• third parties involved in an actual or proposed business transaction involving all or part of our business; and
• any other person or entity authorised by you or your organisation.

7.1 Service provider locations

Our service providers, including our cloud hosting and infrastructure providers, may store or process personal information in countries outside Australia, including the United States and other countries in which our service providers operate. Where personal information is handled by a service provider in a jurisdiction outside Australia, we take reasonable steps to ensure that the information is handled consistently with the APPs, including through contractual arrangements, due diligence and ongoing oversight.

The AI models that generate suggestions and other content in the Platform run on Amazon Web Services (Amazon Bedrock) in Australia. Amazon Web Services does not use the information sent to these models for model training, and the developers of the models do not receive it.

We send notification emails through a third-party email service, which may process recipients’ contact details outside Australia. Notification emails do not contain the content of any workplace matter. The one exception is a case report that you choose to email to yourself, which is sent through the same service.

7.2 Processing on behalf of organisations

AccordPath processes workplace data on behalf of subscribing organisations. The scope and terms of that processing are governed by the applicable service arrangement, pilot agreement or commercial agreement between AccordPath and the subscribing organisation. This Policy describes how AccordPath handles personal information in the course of providing its services, including in its capacity as a processor of data on behalf of client organisations.

7.3 Connected AI agents

A user may connect their own AI assistant or agent, such as one provided through your organisation’s Microsoft 365, to AccordPath. A connected agent acts as that user: it can read and do exactly what that user can in the Platform, and nothing more.

Information that a connected agent reads from AccordPath, and content the agent produces, is held in your organisation’s own systems and is subject to your organisation’s retention and discovery settings. For example, Microsoft 365 Copilot stores prompts and responses in the user’s mailbox. AccordPath does not control that information once it is held in your organisation’s systems and is not responsible for how it is kept, used or disclosed there. Your organisation is responsible for that information.

The person who connected an agent can disconnect it at any time, and your organisation ends an agent’s access by deactivating that person’s account.

8. Direct marketing

We may use your personal information to send you information about AccordPath, updates, events, insights or related products and services where permitted by law.

You can opt out of receiving marketing communications at any time by using the unsubscribe function in the communication or by contacting us using the details in section 15.

We may still send you non-promotional communications that are necessary for providing our services, such as account, billing, security or product notices.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

These steps may include access controls, audit logging, encryption, secure hosting, password protections, staff access controls, monitoring and other security safeguards appropriate to the nature of the information we hold.

However, no method of electronic transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of information transmitted over the internet.

You also play an important role in protecting personal information by maintaining the confidentiality of your login details and notifying us promptly of any suspected unauthorised access.

10. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). This includes:

• taking reasonable steps to contain the breach and assess whether it is likely to result in serious harm;
• notifying the Office of the Australian Information Commissioner (OAIC) as required by law; and
• notifying affected individuals, and where applicable, the subscribing organisation, as soon as practicable.

We maintain internal procedures for identifying, assessing and responding to data breaches.

11. Accessing or correcting your personal information

You may request access to the personal information we hold about you, or request that we correct it if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, please contact us using the details in section 15.

In some circumstances, we may refuse access or correction where permitted by law. If we do so, we will provide written reasons where required.

12. Retention, destruction and de-identification

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide services to our client organisations, maintain appropriate records, resolve disputes, enforce agreements, and comply with legal obligations.

When we no longer need personal information for those purposes, and are not otherwise required or authorised to retain it, we will take reasonable steps to destroy or de-identify it.

Because AccordPath is used to maintain records of workplace matters, some information may need to be retained for longer periods than ordinary account data.

13. Making a complaint

If you believe we have breached applicable privacy law, or you wish to make a complaint about how we have handled your personal information, please contact us using the details in section 15.

We will acknowledge your complaint within a reasonable time and investigate it. We will aim to respond within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices, services, legal obligations or business operations.

The updated version will be made available through our website or platform, and will take effect from the date of publication unless stated otherwise.

15. Contact us

If you have questions, requests or complaints about this Policy, please contact:

AccordPath Privacy Contact
Email: [email protected]