Trust
Health data deserves a straight answer.
Security certifications, data residency and how each product handles personal and health information.
Assurance
Security and certification
HIPAA
HIPAA compliant since 2017.
ISO/IEC 27001:2022
Certified to ISO/IEC 27001:2022 and independently audited every year; first certified in 2018. Our information security program runs under a documented ISMS with monthly management review. Certificate available on request.
Request the certificateData residency
Client data is hosted in-region on Amazon Web Services: US clients on US infrastructure, Australian clients in Australian data centers.
Encryption
Data is encrypted at rest and in transit under TLS. Staff devices carry full-disk encryption.
Continuity
Business continuity and disaster recovery are tested every year, including restoration from encrypted automated backups.
What we don’t hold
We do not hold SOC 2 Type II; ISO 27001, independently audited annually, is the assurance we hold in its place. We do not sell client data or share it without prior consent.
For your security review
Security and privacy pack
Our ISO/IEC 27001:2022 certificate, data-residency statement and data processing agreement template, in one pack for your security and procurement teams.
Privacy approach
Confidentiality is not the same across the suite
Sleepfit promises each person their result is theirs alone. Fatiguefit4Duty shows its result to the team leader by design. Those are different positions, so we set them out separately.
| Product | Who sees the individual result | What the employer receives |
|---|---|---|
| Sleepfit | The individual only | Aggregate reporting only, by cohort and, where numbers permit, by location and craft |
| SleepWellBaby | The individual only | Aggregate reporting only, subject to a minimum cell size |
| Fatiguefit4Duty | The team leader or safety manager, by design | Individual risk indication at the point of duty, plus aggregate reporting by cohort, location and craft |
| Awareness eLearning | Completion is visible as a training record | Individual completion and aggregate knowledge-check reporting by cohort, location and craft |
| Was It Fatigue? | Your investigators | A structured, repeatable investigation record per event |
Consent
Each employee consents at enrollment, per product. Participation is voluntary, and not taking part carries no employment consequence. Referral letters are generated for the employee and released only by them.
Records
Assessment records are kept for a minimum of seven years. No statutory protection from legal discovery is claimed for any record: retention, access control and de-identification are the controls that apply.
See what sleep and fatigue mean for your workforce.
Tell us your industry and roughly how many people you employ. Your snapshot models how many are likely sleeping poorly and what it costs you. Then choose who you’d cover, and we’ll scope the right next step with you: a Fatiguefit Census where fatigue is a safety risk, or a proposal for a wellbeing program.
