Privacy policy

vCosh is operated by VCOSH Operations, a Saudi-registered company (the “Company”, “we”, “us”). vCosh is a NIOSH-supervised, NCOSH-certified Occupational Safety & Health platform sold to enterprises operating in the Kingdom of Saudi Arabia.

For data-protection inquiries the Company’s Data Protection Officer can be reached at privacy@vcosh.sa.

We process three categories of personal data:

• Account data — name, work email, employer (tenant), role, language preference, and password hash (never the password itself).
• Engagement data — content viewed, paths completed, assessment responses, points earned, activity-tracking data (when you connect a wearable), community posts, and AI assistant conversations.
• Health-adjacent data — answers to the real-age assessment and any health-related text you type into the AI assistant. This data is treated with elevated confidentiality and is never disclosed to your employer at an individual level.

We use the data above only for the following purposes:

• To deliver the training, assessments, consults, and rewards you and your employer have purchased.
• To produce aggregate, de-identified analytics for your employer’s HR Console — for example, the share of employees who completed a mandatory safety module.
• To send you transactional notifications (assignment reminders, consult confirmations, etc.) on the channels you have not opted out of.
• To improve the quality of our content and detect platform abuse.
• To comply with NCOSH and PDPL obligations, including audit-log retention and breach notification.

We do not sell your data to advertisers. We do not run advertising on vCosh.

Our lawful bases for processing your data are:

• Performance of a contract — your employment contract and your employer’s service agreement with us.
• Compliance with a legal obligation — NCOSH-mandated occupational-safety training records.
• Your explicit consent — for sensitive health-adjacent processing (real-age assessment, wearable sync, AI assistant). You may withdraw consent in your Profile at any time.

Your data is partitioned by tenant. People at one employer cannot see data from another employer.

Within your tenant, the visibility rules are:

• Your employer’s HR/L&D administrators see your name, role, training completion, mandatory-assignment status, and aggregate health-risk distributions — never your individual assessment answers, AI assistant transcripts, or specialist-consult notes.
• Specialists you book see only the patient brief and notes from sessions they conducted. Specialists cannot see notes written by other specialists about you.
• vCosh staff have role-based access. Customer Success staff can see your tenant’s aggregate metrics but not your individual data. Engineering staff can access individual data only through audit-logged impersonation, which is restricted to incident response and always disclosed.

vCosh operates from data centres in me-central-1 (Riyadh, KSA). Personal data of KSA-resident users is processed and stored exclusively in Saudi Arabia.

A small set of supporting services (transcoding for video, transactional email delivery) may transiently process content outside the Kingdom under PDPL-aligned data-transfer agreements. We disclose the current list of sub-processors in our PDPL notice.

• Account & engagement data — for the duration of your employer’s contract with vCosh, then up to 90 days while the account is being decommissioned.
• Training records — 7 years, per NCOSH retention guidance.
• Audit logs — 7 years, per PDPL §32 obligations.
• Health-adjacent data — until you withdraw consent in Profile, after which it is deleted within 30 days.
• AI assistant transcripts — 12 months for safety review, then deleted.

Under PDPL you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data, subject to the retention obligations above.
• Export a copy of your data in a portable format.
• Withdraw consent for sensitive processing.
• Complain to the Saudi Data & AI Authority (SDAIA) at any time.

To exercise any of these rights, use the controls in your Profile or email privacy@vcosh.sa. We will respond within 30 days.

We protect your data with: encryption at rest and in transit, multi-factor authentication, role-based access control, append-only Merkle-rooted audit logs, automatic vulnerability patching, and continuous security monitoring. Our infrastructure is ISO 27001 aligned.

We test our recovery procedures quarterly and verify our backups are restorable. In the event of a personal-data breach we notify affected users and SDAIA within 72 hours, as required by PDPL §22.

vCosh is intended for adult workforce members and is not directed at anyone under 18. We do not knowingly collect personal data from minors.

We may revise this policy as the platform evolves or law changes. Material revisions will be announced to you in vCosh and, where required, by email. The current version is always available at this URL.