Terms and policies

How the subscription works, what we promise, what we do not, and how either side ends it.

• SUBSCRIPTION. You subscribe per organisation. Worker seats are included in your band and are unlimited in number of people; the band sets the size of workforce the price covers. If your register grows past the band ceiling we tell you inside the product and the price moves to the next band from your next renewal, never retrospectively.
• SEATS AND DOWNGRADE. You may move down a band at any time; the change takes effect at the next renewal, not mid-period, and we do not refund part of a paid period. If your register is larger than the band you have chosen, the product keeps every record and keeps working, and asks you either to archive leavers or to pick the band that fits. We do not delete people to make you fit a smaller band.
• FREE TRIAL. The trial runs for seven days from sign-up. Payment card details are required to start it and are held by our payment provider, not by us. Nothing is charged during the seven days. At the end of day seven the subscription starts automatically at the price quoted to you at sign-up, including any discount agreed, unless you cancel first. Cancelling is one click inside the product at any time before the trial ends, it takes no notice and nothing is charged. If a first payment fails, our normal payment reminders apply and the workspace locks until it is paid: nothing is deleted, you can still export everything. Locked or cancelled trial data is kept for thirty days and then erased. You never have to contact anybody to cancel.
• RENEWAL AND CANCELLATION. Paid subscriptions renew automatically, monthly or annually according to what you chose, at the price shown on your billing page. You can cancel from inside the product at any time before the renewal date and you will not be charged again. Cancelling stops the next payment; it does not refund the period you are in.
• PRICE CHANGES. We give at least thirty days' notice in the product and by email before a price change takes effect at your next renewal. Where you hold an agreed fixed-term price, that price is held for the term and a published price change does not override it.
• DISCOUNTS AND FREE MONTHS. A discount or a free month applies only to the periods stated when it was granted, is recorded against your account, and is not a permanent change to your price. Unless we have said otherwise in writing, the subscription returns to the standard price for your band at the first renewal after the concession ends.
• LATE PAYMENT AND SUSPENSION. If a payment fails we tell you and allow a grace period before anything changes. If fees remain unpaid after we have given you notice and the grace period has passed, we may suspend access to the workspace. Suspension is not deletion: your records remain, the export path stays available to you, and access is restored when the account is settled.
• AVAILABILITY. We work hard to keep the service up and we publish incidents rather than hide them, but we do not promise that it will be uninterrupted or error free. Maintenance, faults, and failures in networks, devices or third party platforms outside our control can interrupt it. Where we have agreed a specific availability target with you in writing, that written target is what applies.
• YOUR RECORDS ARE YOURS. Your safety records belong to you. You can export everything, at any time, from inside the product, including while locked, suspended or leaving. We do not hold records back to win an argument about money.
• LEAVING. When a subscription ends, the export remains available to you for thirty days. After that window the workspace data is erased within a further sixty days, except where the law requires us to keep something, and backups age out on their normal rolling cycle. We can delete sooner if you ask us in writing.
• ACCURACY OF YOUR RECORDS. You decide what goes into the workspace and you are responsible for whether it is true, current and complete. Oberon stores, organises, prompts and reminds. It does not verify that a check really happened, that a certificate is genuine or that a reading was taken correctly.
• YOU REMAIN THE DUTY HOLDER. Oberon is a record-keeping and prompting tool. It is not a safety management system in the legal sense and it does not take on any of your duties. Duties under the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and every other safety law that applies to your business stay with you. You appoint the competent person. You decide what is safe. We are not liable for a decision you take using the product, for a duty you do not meet, or for an enforcement action, claim or penalty arising from your work activities.
• LIMITS ON WHAT WE OWE. Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Subject to that, neither side is liable for loss of profit, loss of contracts, loss of anticipated savings, business interruption or any indirect or consequential loss, and our total liability for all claims in any twelve month period is limited to the fees you paid us in the twelve months before the event that caused the claim.
• WHEN YOU COVER US. You cover us for claims brought by a third party that arise from records you put into the workspace which you had no right to hold, from your breach of the acceptable use policy, or from your own breach of safety or data protection law. We will tell you promptly about any such claim and let you run the defence.
• USAGE DATA. We measure how the product is used so we can run, secure and improve it, and we publish and reuse that measurement only in aggregate form that identifies neither you nor any individual. Your records themselves are never sold, never shared with other customers, and never used to train a general model.
• LAW. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Use it for your own health and safety records, and not to store other people's data unlawfully.

• Only upload records you are entitled to hold, and only about people you employ, engage or admit to your sites.
• Do not use the workspace to harass, to monitor covertly, or to store special-category data you have no lawful basis for. Photographs taken as evidence on a task or a check must show the work, not be used to keep an eye on a person.
• The company library is for your own documents. Do not upload anything unlawful, infringing, malicious or obscene. We may remove or quarantine a file where we reasonably believe it breaks this policy or the law, and we will tell you what we removed and why unless the law stops us.
• Storage allowances apply per workspace and are shown on your library page. When you reach the allowance, uploads stop until you remove something or ask for more. We do not delete your files to make room.
• Do not attempt to reach another customer's workspace, probe the service for weaknesses without our written agreement, or run automated traffic that degrades it for others.
• Do not resell or share access outside your organisation unless you are a partner under a separate partner agreement.
• We may suspend an account that puts other customers, other people's data or our platform at risk, and we will tell you why.

You are the controller of your workers' and visitors' data. We are your processor.

• You decide what personal data goes into the workspace and why. You are the data controller. We process it only on your documented instructions, which are the ordinary operation of the product.
• SIGNATURES AND LOCATION. Signatures are recorded with the signer, the version signed and the time. Where the signer's device allows it, an approximate location, coarse to about a kilometre, is recorded with the signature so it can be shown to have been given on site. A signer may refuse and the signature still stands; the record then reads that location was not available. Location is captured at the moment of a sign-on and at no other time. There is no live map, no location history and no tracking between signatures, and the lawful basis for it is your legitimate interest in showing that a briefing was given where the work was.
• WORK RECORDS. We hold the work records your people create: checks, incidents, actions and tasks, training, inductions, permits, asset records, and hand-arm vibration or noise entries. We also hold engagement timing, meaning whether a document issued to a worker has been opened and signed and how long a briefing was open. Engagement timing is visible to managers only and is there to spot who needs support, not to rank anybody.
• PHOTOGRAPHS. Where a manager requires photo evidence on a task or a check, the photograph and who took it are stored with that record and appear in the record's drawer and in evidence packs. People may appear in those photographs. Telling your workforce that photo evidence is collected, and why, is your duty as controller. Photographs are kept for as long as the record they belong to, and deleting the record deletes them.
• HEALTH-ADJACENT RECORDS. Hand-arm vibration and noise exposure entries, and health information a worker or manager records after an accident, are special-category data. You decide the lawful basis and the condition for processing them, which will usually be your obligations under health and safety law. In the product a worker sees twelve months of their own exposure record and a manager keeps the full history, because health surveillance duties run for many years after the exposure. We do not delete exposure or health surveillance records on a rolling schedule; they stay until you delete them or the workspace is erased, so that you can meet the long retention periods those duties carry.
• VISITORS AND CONTRACTORS AT THE GATE. The kiosk collects names, company, times in and out, briefing acknowledgements and, where entry was allowed by exception, the name of the person who authorised it. That data is collected by us on your behalf and you are its controller, exactly as you are for your own staff. Showing a visitor a privacy notice at the point of sign-in is your responsibility as the occupier, and we give you wording you can use.
• OFFLINE DEVICES. Where there is no signal, entries and photographs are held on the device that captured them until it reconnects, then sent and removed from the device queue. On a personal device this means workspace data sits on that phone in the meantime. Telling your people this, and having a rule about lost or personal devices, is part of your controller duty. We hold nothing extra on the device beyond what is waiting to be sent.
• AI FEATURES. Where you use the drafting features or ask Chief a question, the text of the request is sent to our AI provider to produce the answer. We do not send your worker records wholesale, the provider does not use the content to train its general models, and drafts come back into your workspace as your document.
• WORKER NOTICES AND REQUESTS. Telling your workers all of this is your duty as controller, and how you do it is your decision. Oberon does not show workers a monitoring notice in their app: we give you an editable worker privacy notice template to hand out or to give an employee who asks, and a one-step per-person export for a subject access request.
• SUBPROCESSORS. Processing happens in the UK and the EEA. We keep a named list of subprocessors, give you at least thirty days' notice before adding or replacing one, and you may object on reasonable data protection grounds. Each is bound by terms no weaker than these.
• SECURITY AND SUPPORT ACCESS. We restrict staff access, log every support access to your account, and show that log to you.
• HELPING YOU. On request we will help with subject access requests, deletion, impact assessments and consultations with the regulator, using the same one-click export the product already provides.
• BREACHES. We will tell you without undue delay if there is a personal data breach affecting your workspace.
• DEMONSTRATION WORKSPACES. Our demonstration and presentation environments contain invented records only. Real customer data is never copied into them, and demonstration tenants are excluded from our reporting, billing and exports.
• RETURN AND DELETION. You can export everything at any time. After the agreement ends, the export stays available for thirty days, then the data is erased within a further sixty days, except where the law requires us to keep it, with backups ageing out on their normal cycle.

The tools support your own competent judgement. They do not replace it.

• Oberon is software. It is not a health and safety consultancy, and nobody here has visited or assessed your business.
• Everything the AI produces is a starting point: drafted policies and risk assessments, suggested hazards, converted documents brought in from your own files, written guides, Ask Chief answers, RIDDOR triage and the F10 check. AI output can be wrong, out of date or wrong for your site. It is not advice on your specific circumstances and we give no warranty as to its accuracy or completeness.
• Nothing the AI drafts is published, issued or acted on until a person in your organisation reads it and approves it. That review is the control, and it is yours.
• You remain the duty holder. Duties under the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and the rest stay with you. You appoint the competent person, you decide what is safe, and you are responsible for the decisions you take, whether or not the product prompted them.
• Where a matter is serious, novel or legally contested, take advice from a qualified adviser. The product will say so when it can tell.