Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Name, email address, phone number, job title, employer name, MSHA mine ID, and role within your organization.
• Profile Information: MSHA training certifications, Part 46 or Part 48 training records, qualifications, and competency designations.
• Safety Records: Inspection reports, hazard observations, incident reports, near-miss reports, workplace examination records, pre-operational inspection data, and vehicle inspection records.
• Photos and Media: Images uploaded in connection with hazard reports, incident documentation, inspections, and workplace examinations.
• Company Documents: Documents your company's administrators choose to upload, such as MSHA registration paperwork, quarterly Form 7000-2 filings and the hours entered with them, certificates of insurance and similar business paperwork.
• Communications: Information you provide when contacting our support team, submitting feedback, or participating in surveys.

1.2 Information Collected Automatically

• GPS Location Data: We record your device's position at specific moments, such as when you check in to or out of a site, answer an emergency alert, or submit a safety record that captures a position. Section 1.4 lists every such moment and who can see each position. The Platform does not continuously track your location.
• Device Information: Device type, operating system, browser type, screen resolution, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, time stamps, click patterns, and interaction data to improve Platform performance.
• Log Data: IP address, access times, referring URLs, and error logs for system administration and security monitoring.

1.3 Information From Third Parties

• Employer-Provided Data: Your employer (the mining company) may provide your name, contact information, job role, and training status when setting up your account.
• Weather Data: We obtain weather information from third-party providers to support on-site safety decisions. To show local weather, the Platform uses your device's position: the web dashboard sends it to our server, which rounds it to about 1 km before requesting the weather, and the mobile app requests the weather for your position directly from the U.S. National Weather Service. We do not save these positions in our database.

1.4 Location Data

We record your device's position (latitude and longitude, and usually the accuracy the device reports) at these moments:

• When you check in to or out of a site: by scanning a site QR code, in the mobile app, or in the web dashboard. If your browser allows location access, the web dashboard also checks you in or out automatically when you open it, using the boundaries of your sites that have automatic check-in turned on. The iPhone app does this only if you turn on Auto Check-In and allow “Always” location access.
• When you complete a site's hazard training, or check in at a site as a visitor.
• When you answer an emergency alert (SAFE or I NEED HELP) or ask for assistance, including from a link in an emergency text message.
• When you start a lone-worker session, and each time you check in during it.
• When you submit an inspection, workplace examination, hazard or incident report, or safety form that captures a position.

When you open the mobile app, it reads your position to suggest a check-in or check-out, and saves that reading only if you accept. Earlier versions of the mobile app also recorded a position when a phone entered or left a zone of a site; those records are kept. You can also choose to use your current position to set a site's location.

Who can see a recorded position

• Check-in and check-out positions are not shown to anyone in the Platform, including supervisors. The check-in itself (the site and the times) is shown, while you are checked in, to people who can see that site's on-site list, which can include people from other companies assigned to the site; after you check out, it is shown to supervisors and administrators of the company that operates the site.
• Safety records you submit (inspections, examinations, reports and forms): you, and supervisors and administrators of your employer.
• Hazard-training and visitor check-in records: supervisors and administrators of the company that operates the site.
• Emergency answers: the position and note on your answer are shown to you, to supervisors and administrators of the company that operates the site, and to supervisors and administrators of the company that raised the emergency when you are one of its people or visitors. While the emergency is active, if you answer I NEED HELP, your name, position and note are also shown to people assigned to that site, whichever company they work for; to people checked in there since the emergency began who work for the site's company or for a contractor company it has listed at that site; and to supervisors and administrators of the company that raised the emergency when the site's company has given them one of those relationships to the site.
• Working alone: during a lone-worker session, supervisors and administrators of your employer can see your session, including the location you typed and your last recorded position. If you miss a check-in and the alert escalates, your emergency contact, supervisors and administrators assigned to the site, and supervisors and administrators of the company that operates the site can also see it (and, at the last level and only where that site has turned it on, people checked in there whom the site's company has given a relationship to the site). The escalated alert text messages include a Google Maps link to your last recorded position.
• VeriField platform administrators can also see the positions above, except check-in and check-out positions.

Copies of some of these records, including their positions, are kept in our audit log. A position is kept as long as the record it belongs to; we do not delete records or their positions automatically.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the Platform, including check-in/check-out services, inspection management, training tracking, incident reporting, and emergency management features.
• Safety Compliance: To assist your employer in meeting MSHA regulatory requirements, including maintenance of training records per 30 CFR Part 46 and Part 48, inspection documentation, and safety reporting.
• Emergency Response: To facilitate muster operations, lone worker monitoring, and emergency action plan coordination when initiated by authorized personnel.
• Analytics and Improvement: To analyze usage patterns, diagnose technical issues, and improve Platform functionality, performance, and user experience.
• Communications: To send service-related notifications, safety alerts, training reminders, and compliance deadline notices.
• Security: To detect, prevent, and address fraud, unauthorized access, and other illegal or harmful activities.
• Legal Obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. SMS & Emergency Alerts

VeriField Pro uses SMS (text messaging) exclusively for safety-critical communications at the mine sites where you work or visit. We do not send marketing or promotional messages.

How we collect your consent

You provide your phone number and consent to receive safety SMS at one of these points:

• When an administrator at your employer creates your VeriField Pro user account and enters your mobile number.
• When you update your phone number on your own profile under My Profile.
• When you check in as a visitor or contractor at a mine site using the VeriField Pro QR check-in form, which collects your phone number for the duration of your visit.

Consent language is shown alongside every phone-number field so it is visible at the time of collection.

Message content

• Emergency events: muster orders, site evacuation, shelter-in-place, and panic alerts triggered by an authorized administrator at your site.
• Assistance requests: direct alerts to site supervisors when a worker requests help during an active or potential emergency.
• Account confirmations: occasional service messages (e.g. initial welcome message with sign-in instructions).

Frequency

Message frequency varies. In normal operation, recipients typically receive zero to a few messages per month. During an active emergency, frequency will be higher as updates are sent.

Opt-out and help

• Reply STOP to any message to unsubscribe from all future SMS from VeriField Pro.
• Reply HELP to any message for support contact information.
• You can also remove your phone number from your profile at any time under My Profile → Phone.

Message and data rates may apply depending on your mobile carrier plan. Carriers are not liable for delayed or undelivered messages.

Your phone number is shared only with our SMS delivery vendor (Telnyx) for the sole purpose of delivering your messages. We do not sell, rent, or share your phone number with third parties for marketing purposes.

4. How We Share Your Information

We do not sell your personal information to third parties. We never have and never will.

We may share your information only in the following limited circumstances:

• With Your Employer: Your employer's authorized administrators can access your check-in records, training status, inspection data, and other safety-related information created or stored on the Platform. This access is essential to the employer's MSHA compliance obligations.
• With the Company That Operates a Site: When you work at or visit a site operated by a company other than your employer, that company's supervisors and administrators can see your check-ins there, your hazard-training and visitor check-in records for that site, and your answers to emergencies there, including the positions described in Section 1.4. During an active emergency, a request for help is also shown to others at that site as described in Section 1.4.
• Service Providers: We engage trusted third-party service providers that perform services on our behalf, including cloud hosting (Supabase/AWS), edge delivery (Vercel), email delivery (Resend), and communications (Telnyx). These providers are contractually obligated to protect your data and use it only for the services they provide to us.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, subpoena, court order, or governmental request, including requests from MSHA inspectors or other regulatory authorities with lawful authority.
• Safety Emergencies: We may share location and identity information with emergency responders during active emergency situations initiated through the Platform's emergency management features.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users of any change in ownership or control of personal information.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Certain categories of data are subject to mandatory federal retention requirements:

• Training Records: Per 30 CFR 46.9(h), training certificates and records must be retained for the duration of each miner's employment (records and certificates of annual refresher training under 30 CFR 46.8 must be kept for two years) and for at least 60 calendar days after a miner terminates employment. We retain these records accordingly.
• Inspection Records: Pre-operational inspection and workplace examination records are retained consistent with the recordkeeping requirements under 30 CFR Part 56/57.
• Incident and Accident Records: Records related to reportable incidents under 30 CFR Part 50 are retained for a minimum of 5 years.
• Check-in/Check-out Records: Retained for a minimum of 1 year or longer if required by your employer's policies.
• Account Data: When a client subscription ends, the client's data is not deleted: records are kept as MSHA recordkeeping requirements and the client's own record-retention rules require, and we provide the client an export of its data on request. Closing a user account ends that person's sign-in but keeps the records MSHA requires, with the person's name on them. We do not delete records, or the positions stored with them, automatically.

6. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS (version 1.2 or higher) and at rest using AES-256.
• Row-level security (RLS) separating each company's records, with the exceptions described in section 1.4.
• Multi-factor authentication for supervisor and administrator accounts (set-up required for administrators on the web dashboard and optional for supervisors; for now the web code prompt offers a skip for the browser session, for a lost phone, and the mobile app and the database do not check the code).
• Database security advisor checks; no third-party penetration testing at present.
• Production access restricted to named company personnel.
• All data stored on servers located within the United States.

While we take data security seriously and employ robust safeguards, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your information.

7. Cookies and Similar Technologies

We use first-party cookies only: cookies that keep you signed in or make a specific feature of the Platform work, and three that remember preferences in the dashboard (two for the display, one for your time zone). We do not use marketing, advertising, or third-party tracking cookies.

For the full list of cookies we set, please see our Cookie Policy.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to any legal or regulatory retention requirements. Note that MSHA-mandated records cannot be deleted before the end of applicable retention periods.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Opt-Out of Communications: You may opt out of non-essential communications at any time. Safety-critical alerts and regulatory notifications cannot be opted out of while your account is active.

To exercise any of these rights, contact us at legal@verifieldpro.com. We will respond to your request within 30 days. Note that because we act as a data processor on behalf of your employer, we may need to direct your request to your employer (the data controller) for certain actions.

9. California and State-Specific Rights

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information).
• The right to delete personal information, subject to regulatory retention requirements.
• The right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• The right to non-discrimination for exercising your privacy rights.
• The right to correct inaccurate personal information.
• The right to limit the use and disclosure of sensitive personal information.

8.2 Other State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy legislation may have similar rights. We honor these rights as applicable under your state's law. Contact us at legal@verifieldpro.com to exercise your rights.

10. Our Role as a Data Processor

VeriField Pro operates as a data processor on behalf of our clients (mining companies and safety consultancies), who are the data controllers. This means:

• Your employer determines the purposes and means of processing your personal data through the Platform.
• We process personal data only in accordance with our clients' instructions and our contractual obligations.
• Requests to access, correct, or delete data that your employer has submitted to the Platform should be directed to your employer. We will assist your employer in fulfilling such requests.
• Our Data Processing Agreement governs the relationship between VeriField Pro and our clients with respect to personal data processing. See our Data Processing Agreement for details.

11. Children's Privacy

The Platform is designed for use by adult mine workers, safety professionals, and authorized personnel. The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected personal information from a person under 18, we will promptly delete that information. If you believe that a person under 18 has provided personal information to us, please contact us at legal@verifieldpro.com.

12. International Data Transfers

The Platform is operated in the United States and is intended for use within the United States. All data is stored on servers located within the United States. We do not transfer personal data outside of the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to and processed in the United States.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page and updating the “Last updated” date. For material changes, we will also provide notice through the Platform or via email. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: