Privacy Policy

FairTest Pty Ltd (“FairTest”, “we”, “us”, “our”)

Last updated: 14 March 2026

1. Introduction

FairTest provides a drug and alcohol testing management platform (“Platform”) via our web application at app.fairtest.com.au and our mobile application (collectively, the “Services”). We are committed to protecting the privacy of personal information, including sensitive health information, in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information.

2. Information We Collect

2.1 Account Information

• Full name, email address, phone number, and password
• Organisation name, role, and contact details
• Billing and payment information (processed by Stripe)

2.2 Employee Information

Organisations using FairTest may upload or enter employee data, including:

• Full name, employee ID, email address, and phone number
• Department, location, job classification, and pay type
• Manager and reporting relationships
• Labels and groupings

2.3 Sensitive Health Information

FairTest processes drug and alcohol testing data on behalf of organisations. This may include:

• Test type, date, result, and outcome
• Substances tested and detected
• Photographs and signatures captured during testing
• Random selection event participation and history
• Non-compliance records

This information is classified as sensitive information under the Privacy Act and is collected and handled with additional safeguards as described in this policy.

2.4 Usage and Technical Data

• Device information, browser type, and operating system
• IP address and approximate location
• Log data, session activity, and feature usage
• Biometric authentication preferences (Face ID / fingerprint — stored on-device only)

2.5 Communication Data

• AI chat conversations with our built-in assistant
• SMS and email notification records
• Support and feedback communications

3. How We Collect Information

We collect personal information:

• Directly from you — when you create an account, configure your organisation, or use the Services
• From your organisation — when an employer or testing provider enters employee data or test results into the Platform
• From integrated systems — when your organisation connects third-party HR systems (e.g., UKG Ready) to sync employee rosters
• Automatically — through cookies, server logs, and similar technologies when you use the Services

4. Purpose of Collection

We collect and use personal information for the following purposes:

• Providing and operating the Platform and Services
• Managing user accounts, authentication, and access control
• Processing and recording drug and alcohol test results on behalf of organisations
• Running random and targeted employee selection events
• Generating compliance reports and analytics
• Processing payments and managing subscriptions
• Sending transactional emails and SMS notifications (e.g., selection alerts, test reminders, positive result notifications)
• Providing AI-assisted querying of testing data
• Improving and maintaining the security of our Services
• Complying with legal obligations

We will not use sensitive health information for any purpose other than the provision of our Services to your organisation, unless required by law or with explicit consent.

5. Consent

By using FairTest, you consent to the collection and use of your personal information as described in this policy.

For sensitive health information (drug and alcohol test results), collection and processing is carried out on behalf of your employing organisation. Your organisation is responsible for obtaining any required consent from employees in accordance with their own workplace policies and applicable legislation, including workplace health and safety laws.

6. Disclosure of Information

We may disclose personal information to:

6.1 Your Organisation

Test results, selection data, and employee records are accessible to authorised users within your organisation based on their assigned role (owner, admin, manager, or tester).

6.2 Testing Providers

Where an organisation engages a third-party testing provider through FairTest, relevant employee and test data may be shared with that provider to facilitate testing services.

6.3 Third-Party Service Providers

We use the following third-party services to operate the Platform:

Provider	Purpose	Data Shared	Location
Supabase	Database hosting, authentication	All platform data	Cloud-hosted
Stripe	Payment processing	Billing and payment details	United States
Resend	Transactional email delivery	Email addresses, notification content	United States
Twilio	SMS notifications	Phone numbers, message content	United States
Anthropic (Claude)	AI chat assistant	Chat queries and relevant test/employee data for query responses	United States
Expo (EAS)	Mobile app distribution and updates	Device tokens, app metadata	United States

These providers are bound by their own privacy policies and data processing agreements. We do not sell personal information to any third party.

6.4 Legal Requirements

We may disclose personal information where required or authorised by law, including in response to court orders, subpoenas, or regulatory requests.

7. Cross-Border Disclosure

Some of our third-party service providers are located outside Australia, primarily in the United States. Before disclosing personal information overseas, we take reasonable steps to ensure that the recipient handles your information in a manner consistent with the APPs.

8. Data Security

We implement a range of technical and organisational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security (RLS) ensuring strict multi-tenant data isolation — each organisation can only access its own data
• Role-based access control within organisations
• Secure authentication with support for multi-factor authentication (MFA)
• Biometric authentication on mobile devices (data stored locally on-device, never transmitted)
• Regular security monitoring and audit logging of data access

No method of electronic storage or transmission is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

9. Data Retention

We retain personal information for as long as your account or your organisation’s account remains active, or as needed to provide the Services. Specific retention practices include:

• Account data — retained until the account is deleted
• Test records and employee data — retained for the duration of the organisation’s subscription and in accordance with workplace health and safety record-keeping obligations
• Billing records — retained as required by tax and financial reporting laws
• AI chat conversations — retained per user and organisation for continuity of service
• SMS and email records — retained for a reasonable period for delivery confirmation and troubleshooting

Upon termination of an organisation’s account, we will delete or de-identify personal information within a reasonable period, unless retention is required by law.

10. Access and Correction

Under the APPs, you have the right to:

• Access the personal information we hold about you
• Request correction of any information that is inaccurate, incomplete, or out of date

To make a request, contact us at privacy@fairtest.com.au. We will respond within 30 days.

For employee data held within an organisation’s account, please contact your employer or the relevant organisation administrator in the first instance.

11. Notifiable Data Breaches

In the event of an eligible data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. This includes notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

12. Cookies, Tracking, and SMS

FairTest uses cookies for:

• Authentication — maintaining your logged-in session
• Preferences — storing your selected organisation and theme preferences

We do not use third-party advertising or analytics tracking cookies.

We also send SMS notifications via Twilio. Your mobile phone number is shared with Twilio solely for the purpose of delivering these messages. Standard message and data rates may apply.

13. Children’s Privacy

FairTest is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on our website and updating the “Last updated” date above. Continued use of the Services after changes constitutes acceptance of the updated policy.

15. Complaints

If you believe we have breached the APPs or wish to make a complaint about our handling of your personal information, please contact us at privacy@fairtest.com.au. We will investigate and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

16. Contact Us

For any questions or requests regarding this Privacy Policy or your personal information:

FairTest Pty Ltd
Email: privacy@fairtest.com.au