Privacy Policy

Plus Ultra Innovations Pty Ltd
ABN: 23 686 310 850
Wellbeing Dashboard Platform

Effective Date: 29 January 2026
Last Updated: 9 October 2026
Version: 1.18

Changelog

9 Oct 2026 (v1.18): Section 4: a red shift check-in from a worker who is in no team now alerts the organisation's WHS lead, or the WHS leads its administrator chooses, who see the same as a team leader would. If no WHS lead can receive it, nobody is alerted and the worker is told so on screen. Administrators choose from the organisation's WHS leads only, and see how many people a red check-in from someone in no team would reach.
8 Oct 2026 (v1.17): Section 4: if a worker's team has no team leader, a red shift check-in alerts the organisation's WHS lead instead, who sees the same as a team leader would; if there is neither, nobody is alerted and the worker is told so on screen. Administrators see how many teams a red check-in could not reach, and how many people are in no team, as counts of how the organisation is set up.
8 Oct 2026 (v1.16): Sections 4 and 7: a team leader's note on a red check-in is deleted 90 days after it is written; the category they chose is kept with the record.
8 Oct 2026 (v1.15): Section 4: a red shift check-in alerts every team leader of the worker's own team, not one supervisor, and no other team. The leader who acts records what they did, as a category and a note; the records export counts the categories for a minimum group of 10 people and never includes the note.
8 Oct 2026 (v1.14): Section 5.2 states that joining with a join code counts claims against the IP address they came from, kept for about 2 hours, and that if the rate-limiting service cannot be reached, the sign-in limits are counted from our own record of sign-in attempts.
8 Oct 2026 (v1.13): Section 4 describes shift safety check-ins as they now work: the supervisor of a red check-in sees the worker's name, that it was red and which check made it red, never the answers or scores; administrators and owners see check-ins only as counts, and their export of check-in records holds counts by site, team and shift for a minimum group of 10 people, no longer individual rows.
8 Oct 2026 (v1.12): Section 12 describes the website exactly: the /station page keeps one entry in your browser's session storage, and the enquiry form has five fields, including what you are interested in. Section 5.2 states that the sign-in and password-reset limits count attempts against the email address and IP address used, kept for about 30 minutes, and that rate-limit analytics were switched off, and their records deleted, on 7 October 2026.
1 Oct 2026 (v1.11): Section 6.1: signing in with an emailed link now asks for the second factor too, from anyone who must use one.
30 Sep 2026 (v1.10): Section 7 states what is deleted when an organisation's engagement ends, and when. Sections 3.3, 4 and 5.1 name the two records about an individual that an employer can see, and when. Section 5.2 lists every service provider. Section 6.1 states who must use a second sign-in factor. Section 2.1 adds the World Health Organization's statement that it does not endorse any product. Section 12 describes in full what the website collects. Dashes used as separators replaced.
30 Sep 2026 (v1.9): Section 3.1 purpose heading "Clinical Risk Identification" renamed "Identifying psychosocial risk" (logged for the counsel review pack).
30 Sep 2026 (v1.8): Section 2.1 "Questionnaire Data" purpose rewritten: no longer "clinical risk identification"; now your own results and support options, and team-level psychosocial risk for groups of 10 or more (logged for the counsel review pack).
30 Sep 2026 (v1.7): Section 2.1 heading "Clinical Assessment Data" renamed "Questionnaire Data" (the platform does not perform clinical assessment; logged for the counsel review pack).
30 Sep 2026 (v1.6): private notes (My plan) added to Sections 2.1 and 7: stored encrypted, shown only to the person who wrote them, kept until they delete them, and deleted if their account is removed.
25 Sep 2026 (v1.5): the privacy contact email is now privacy@plusultrainnovations.com (Sections 8.2 and 14).
23 Sep 2026 (v1.4): removed statements not established in the platform — "job title" from Account Information; the Usage Data item (login times, features accessed, session duration); the hosting-providers certification statement in Section 6.1; the 12-month usage-log retention item in Section 7; and Section 6.2's reference to agreements this policy no longer describes.
22 Sep 2026 (v1.3): added "Website visitors and enquiries"; removed the statement that service providers are contractually bound and the equivalent safeguards list in Section 10 (no provider contract is established); Supabase hosting stated as Sydney, Australia; Singapore/PDPA references removed (one country per document — the Singapore text belongs in the Singapore jurisdiction pack, written when Singapore is onboarded); Resend stated once, sending region Tokyo, Japan; "personal information" (the Privacy Act's term) used throughout instead of the European term.
22 Sep 2026: removed statements that had not been established (data processing agreements, Data Protection Officer).
29 January 2026: v1.1.

1. Introduction

Plus Ultra Innovations Pty Ltd (ABN: 23 686 310 850) ("we", "us", "our", "Plus Ultra") is committed to protecting the privacy of individuals who use our workplace wellbeing platform ("Platform"). This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to all users of our Platform, including employees, administrators, and organisational clients.

2. Information We Collect

2.1 Information You Provide

Account Information
Name, email address, team membership: used for account creation and platform access.

Wellbeing Survey Responses
Stress levels, sleep quality, energy levels, job satisfaction: used for wellbeing assessment and insights.

Questionnaire Data
WHO-5 scores, BAT-23 burnout scores: used to show you your own results and support options, and, combined for teams of 10 or more, to identify psychosocial risks at work. The World Health Organization does not endorse any specific companies, products or services.

Productivity Data
Self-rated performance, days missed due to health: used for organisational productivity metrics.

Feedback
Free-text comments, suggestions: used for service improvement.

Private Notes
Notes you write for yourself in My plan. They are stored encrypted and shown only to you, never to your employer, managers or team, and they are not used for anything else.

2.2 Information Collected Automatically

Device Information
Browser type, operating system: used for technical support.

Log Data
IP addresses, access logs: used for security and troubleshooting.

2.3 Sensitive Information

We collect health-related information through our wellbeing assessments. This is classified as "sensitive information" under Australian privacy law. We only collect this information:

With your explicit consent
For the primary purpose of providing wellbeing insights
In accordance with applicable privacy laws

3. How We Use Your Information

3.1 Primary Purposes

Providing Wellbeing Insights: Generating personal wellbeing scores, trends, and recommendations
Identifying psychosocial risk: Identifying potential burnout or wellbeing concerns requiring support
Organisational Analytics: Providing de-identified, aggregated insights to your employer (subject to privacy thresholds)
Platform Operation: Account management, authentication, and technical support

3.2 Secondary Purposes

Service Improvement: Analysing usage patterns to enhance the Platform
Research: Conducting anonymised research to improve wellbeing science (with separate consent)
Communications: Sending Platform-related notifications and updates

3.3 What We Never Do

We do not sell your personal information to third parties
We do not share your individual questionnaire answers with your employer. Two records about an individual can reach an employer, and only where the organisation turns them on; they are described in Section 4
We do not use your data for advertising or marketing purposes
We do not make automated decisions that significantly affect you without human oversight

4. Privacy Thresholds & Anonymisation

To protect individual privacy, we enforce strict privacy thresholds before any data is shared with organisational administrators:

Every jurisdiction: a minimum group of 10 people for aggregate reporting. This threshold is fixed. It is never lowered, never configurable by an organisation, and has no jurisdiction exception.

What this means:

If your team has fewer members than the threshold, your data will NOT appear in team-level reports
Team reports are aggregated: a result is shown only for a minimum group of 10 people who responded, counted as distinct people
Your individual questionnaire answers are not shared with your employer

Shift safety check-ins, only where an organisation turns them on:

Your team leaders, when a check-in is red. A check-in marked red alerts every team leader of the worker's own team, and no one on another team. They can then see the worker's name, that the check-in was red, and which check made it red (for example, under 4 hours of sleep). They do not see the answers or scores. The alert itself does not name the worker.
Your organisation's WHS lead, if your team has no team leader or you are in no team. The WHS lead is alerted instead and sees the same, until you have a team leader again. If you are in no team, your organisation's administrator may choose which of its WHS leads receive it; they choose from WHS leads only. If nobody can be alerted, the screen tells you so and shows where to get support.
What the team leader did. The team leader who acts records what they did, by choosing a category (stood down, reassigned, fit to continue after review, sent home, or other) and writing a short note of what they did and the plan. The note can mention the worker. It is deleted 90 days after it is written, the category stays with the record of the red check-in, and the note is not included in any export.
Administrators see counts. The organisation's administrators and owners see shift check-ins as counts, never as individual check-ins. Their export of check-in records holds counts by site, team and shift, including how many times each category was recorded, each for a minimum group of 10 people; a smaller group is shown without numbers. They also see how many teams have no team leader and no WHS lead to alert, how many people are in no team, and how many people a red check-in from someone in no team would reach: counts of how the organisation is set up, never of anyone's check-ins.

5. Data Sharing & Disclosure

5.1 Organisational Clients

We share aggregated wellbeing results with your employer to help them understand workplace wellbeing trends. These results:

Are shown only for a minimum group of 10 people (see Section 4)
Do not identify any individual
Are used for workplace improvement

The two records about an individual described in Section 4 are the only exceptions.

5.2 Service Providers

We use the following service providers to operate the Platform and our website. The Service providers page (https://app.plusultrainnovations.com/legal/subprocessors) lists what each one handles.

Supabase: database hosting and sign-in, in Sydney, Australia. Handles all platform data.

Vercel: hosts the Platform and the website; server functions run in Sydney, Australia. Vercel Inc. is a United States company.

Resend: email delivery, sending region Tokyo, Japan. Handles email addresses and email content.

Upstash: rate limiting, in Sydney, Australia. Handles account identifiers, and website visitors' IP addresses for up to 121 seconds. The limits on signing in and on resetting a password count each attempt against the email address and the IP address it came from; these counters are kept for about 30 minutes. Joining with a join code counts claims against the IP address they came from; that counter is kept for about 2 hours. If Upstash cannot be reached, the sign-in limits are counted from our own record of sign-in attempts instead. Rate-limit analytics were switched off, and their records deleted, on 7 October 2026.

Stripe: billing. Handles the email address of the administrator who sets up billing, and the organisation's name. Location to be confirmed.

Slack, Microsoft and Google: only when an organisation connects its Slack, Microsoft Teams or Google Chat workspace, to deliver notifications. Handle a person's work email address and the notification message, which can include their name. Safety alerts do not name the worker. Locations to be confirmed.

Google (company email): holds our company inbox, which receives website enquiries and email sent to our privacy address. Location to be confirmed.

ImprovMX: forwards email sent to our privacy address to our company inbox. Location to be confirmed.

5.3 Legal Requirements

We may disclose personal information if required by law, court order, or government authority, or to protect the rights, property, or safety of Plus Ultra, our users, or the public.

6. Data Security

We implement industry-standard security measures to protect your information:

6.1 Technical Controls

Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
Access Control: Role-based access. Administrators and team leaders must use a second factor when they sign in with a password, enforced by the database since 30 September 2026, and an organisation can require the same of its workers. Anyone who must use a second factor and signs in with an emailed link is asked for it before their dashboard opens
Monitoring: Continuous provider-level availability and error monitoring; security events are recorded in a log readable only by platform administrators

6.2 Organisational Controls

Access: Production access is held solely by the founder. It is not shared, and no third party has been granted production access.
Recovery: Database restores follow a documented disaster-recovery runbook with post-restore verification.

7. Data Retention

Survey responses and personal information: kept for the duration of your organisation's engagement with the Platform.

When an engagement ends: When an organisation's engagement ends, we delete the personal information we hold about its workers and administrators, and verify the deletion, within 90 days. Before the end date the organisation can export its hazard register and team results. Backups that contain the information expire within 7 days of deletion. We keep a record that the deletion took place, which contains no personal information, and billing records as tax law requires.

De-identified aggregates: De-identified aggregates, always suppressed below the privacy floor, are retained for benchmarking. They are used for research only where your organisation has opted in.

Private notes: Kept until you delete them, and deleted if your account is removed.

A team leader's note on a red check-in: Deleted 90 days after it is written. The category the team leader chose is kept with the record of the check-in.

Upon request, we will delete your personal information sooner, unless retention is required by law.

8. Your Rights

8.1 Australian Users (Privacy Act 1988)

You have the right to:

Access your personal information
Correct inaccurate information
Request deletion (subject to legal retention requirements)
Complain to the Office of the Australian Information Commissioner (OAIC)

8.2 How to Exercise Your Rights

Contact our privacy contact:

Email: privacy@plusultrainnovations.com
Response Time: Within 30 days

9. Cookies & Tracking

Our Platform uses essential cookies for:

Authentication and session management
Security (CSRF protection)
User preferences

We do not use:

Advertising or tracking cookies
Third-party analytics that identify individuals
Cross-site tracking

10. International Data Transfers

Your data may be processed in countries outside your jurisdiction. The location of each service provider is stated in Section 5.2, and the locations used for website enquiries in Section 12.

11. Children's Privacy

Our Platform is designed for workplace use and is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Website Visitors and Enquiries

This section covers the public website at www.plusultrainnovations.com, which is separate from the Platform.

The enquiry form. The website has one form, the enquiry form at /contact. It asks what you are interested in (required: the platform, THE STATION, or something else), and for your name (optional, up to 100 characters), work email (required, up to 254 characters), organisation (optional, up to 200 characters) and message (required, 10 to 5,000 characters). A hidden anti-spam field is checked on our server and then discarded; it is never stored or sent on.

Where your enquiry goes. Your browser sends the form to our own server, which runs on Vercel in Sydney, Australia (Vercel Inc. is a United States company). Our server emails the five fields, and nothing else, to our company inbox. No IP address or device information is included. The email is sent by Resend from Tokyo, Japan, to the Company's Gmail inbox, where Google stores it; the storage location is to be confirmed. We use enquiries only to respond and follow up. Enquiries are deleted 12 months after the last contact, unless the enquirer becomes a client, in which case the enquiry is kept with that client's business records.

Your IP address. To limit abuse of the form to 5 submissions a minute, our server uses your IP address as a counter key in Upstash in Sydney, Australia. The key expires automatically after 121 seconds. The IP address is not hashed and is used for nothing else. Whether rate limiting is active on the live website is to be confirmed.

Server logs. If something goes wrong, our server records an error message. Form-validation errors record which field failed, not what you typed; email-delivery errors record the email provider's error. Vercel also keeps standard request logs (IP address, page requested, browser type); how long they are kept is to be confirmed.

No cookies, analytics or tracking. The website sets no cookies and runs no analytics or tracking pixels. The /station page keeps one entry in your browser's session storage (station-intro = 1) so its opening animation plays only once per tab. It holds no personal information and is cleared when the tab closes. The website loads content only from its own domain, and its fonts are self-hosted.

Email to our privacy address. Email sent to privacy@plusultrainnovations.com is forwarded to our company inbox by ImprovMX; its location is to be confirmed.

No AI. Nothing you send through the website is sent to any AI model.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Email notification to registered users
Prominent notice on the Platform
Updated "Last Updated" date

14. Contact Us

Privacy contact
Plus Ultra Innovations Pty Ltd
ABN: 23 686 310 850
Email: privacy@plusultrainnovations.com

For Australian Privacy Complaints:
Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992