Privacy Policy — workplace safety monitoring

Version v3 — 5 July 2026 · Bluework Employee Management System

The short version: workplace-safety audio monitoring operates under the Workplace Monitoring & Systems Use Agreement you accept before using this system, and is activated and deactivated by your employer's administrators. Statutory notice periods (for example NSW's) are always honoured before capture begins. Stored data is held in Australia and kept only for a defined period, every hazard decision and export is recorded on a tamper-evident record, and you can raise an objection or complaint at any time.

1. What we collect and why

Where monitoring is active for your account, audio near your device is recorded in the background during your work session. The sole purpose is to help meet work health and safety duties by detecting psychosocial hazards such as bullying, harassment, aggression, and work overload, consistent with the Commonwealth Managing Psychosocial Hazards at Work Code of Practice 2024. Recordings are not used for performance management, and no automated decision is acted on without human review.

2. The lawful basis, honestly stated

Monitoring operates under the Workplace Agreement: a versioned, dated document you are asked to read and accept before first use. Your acceptance — including its date, version, and your site's jurisdiction — is retained as the record of notice and express agreement.
Use of this system, including monitoring, is a condition of your engagement as set out in your employment contract or engagement terms. That is disclosed plainly here and in the Agreement, not hidden.
Monitoring is administered by your employer: activation and deactivation are controlled by administrators, not from worker accounts.
Where your state requires a written notice with a waiting period (for example NSW's 14 days), capture does not begin until that period has passed — accepting the Agreement never shortens it.
You may object at any time: raise it with your administrator or your employer's privacy contact, or complain to the OAIC or your state's privacy or industrial body. Raising a concern is a workplace right and must not result in adverse action.

3. How recordings are handled

Audio is uploaded over an encrypted connection and transcribed by a third-party speech-to-text provider (AssemblyAI) with personal-information redaction applied to the transcript.
Transcription is performed by that provider and may be processed outside Australia. Your employer's stored copies of recordings and transcripts are held in Australia (region ap-southeast-2).
Potential hazards are screened in two stages — a keyword trigger, then an AI verification against the Safe Work Australia hazard taxonomy — and are always reviewed by a person before any report or action.
Every detection, review decision, status change, and export is written to a tamper-evident, hash-chained audit trail. (This trail records actions taken on a record; it is not a log of every time a file is viewed.)

4. The Aegis AI assistant

The optional in-app Aegis assistant answers your questions by sending a limited slice of operational context — your name, upcoming roster shifts, open tasks, active form names and fields, chat rooms you belong to, and leave status (leave dates and approval status only; the specific reason for medical or sick leave is not sent) — together with your message to a third-party AI language-model (LLM) provider that generates the reply.
When needed to assign a task, address a chat, or find cover for your shift, that context can also include the display names of coworkers in your business unit who are valid choices. It does not include their contact details, private chat contents, leave reasons, or availability notes.
This context is sent only when you use the assistant, is restricted by your logged-in access and business-unit scope, and is not used for advertising or sold. The LLM provider processes it to produce a response and may process it outside Australia.
The assistant only ever proposes actions (such as creating a task, submitting a built form, sending a chat message, requesting leave, updating a task, or requesting shift cover); nothing happens until you confirm, and every confirmed action is re-checked against current records and your access before it runs. Shift-cover requests still require the replacement worker to accept and a manager to approve before the roster changes.

5. Retention and storage

Raw per-session audio chunks are combined into a daily recording and the chunks are then deleted (within 30 days at the latest).
The combined daily recording and its transcript are kept for up to 24 months to satisfy WHS record-keeping duties, then permanently deleted.
Stored data is held in Australia (region ap-southeast-2). Audio sent for transcription may be processed outside Australia (see section 3).

6. Who can see it

Access is role-based. Only authorised supervisors and administrators with the hazards permission can review detections, and every export of an evidence record is itself recorded on the audit trail. Data is not sold or shared for marketing. Third-party processors (speech-to-text, the Aegis AI language-model provider, and secure storage) act only on our instructions.

7. Your rights

Request access to, or correction of, information held about you, including transcripts of recordings in which you appear.
Raise an objection to monitoring with your administrator or your employer's privacy contact at any time; objections are recorded and responded to. Deactivation is actioned by administrators.
Raise a complaint with your employer, or with the Office of the Australian Information Commissioner (oaic.gov.au), or your state's privacy or industrial body. Doing so is a workplace right and must not result in adverse action.

8. Contact

Privacy questions and access or correction requests: contact your administrator through the admin panel, or your employer's nominated privacy officer.