Echo Safety & Escalation Rules

1. What normally happens to your information

In normal operation:

• Echo check-ins are used to give you personal reflections and nudges.
• Echo gives your employer aggregated and/or anonymised insights at team, location or business-unit level (for example, “fatigue risk has increased in this depot over the last 4 weeks”).
• Managers and executives do not routinely receive:
  • your call recordings
  • full transcripts
  • your name attached to what you said.

We call this principle “named by exception”:

Your identity is kept out of management reports except in clearly defined, rare situations described below, or where you explicitly ask us to share your details so someone can follow up with you.

2. When Echo may share information that identifies you

Echo may use or share information that identifies you only if one or more of the following apply:

2.1 Immediate risk of serious harm

We reasonably believe there is an immediate or imminent risk of serious harm to you or another person, for example:

• threats of self-harm or suicide
• threats of violence against others
• clear signs or statements that someone is in danger right now
• a serious safety hazard that could cause death or serious injury if not addressed quickly.

In these cases, Echo may share information that identifies you (and/or others involved) with:

• designated contacts at your employer (for example WHS/HSR, HR, site manager, critical incident contact), and/or
• emergency services, health services or other appropriate external responders.

We will share only what is necessary to manage the immediate risk.

2.2 Serious unlawful or reportable conduct

We reasonably believe your Echo check-in contains information about serious unlawful or reportable conduct, for example:

• serious physical or sexual assault
• serious harassment, discrimination or abuse
• threats or acts of violence at work
• significant property damage or serious sabotage
• serious fraud or corruption
• other conduct your employer is legally required to respond to or report.

In these cases, Echo may share relevant information (including names if needed) with:

• designated senior contacts at your employer (for example WHS, HR, legal, integrity or whistleblowing channels), and/or
• regulators or law enforcement where we are required or clearly authorised by law to do so, or where a permitted general situation under privacy law applies (for example a serious threat to life, health or safety or clearly defined law-enforcement grounds).

We aim to share only the minimum necessary information and to use existing internal channels wherever possible (for example, referring to a whistleblowing or complaints team rather than frontline managers).

Where your employer has a formal whistleblower policy (for example under the Corporations Act), we will use or support that channel where appropriate.

2.3 Legal obligations and regulatory reporting

Echo or your employer may be legally required to use or disclose information, including your identity, when:

• complying with work health and safety, employment, privacy or other applicable laws
• responding to a lawful direction or request from a court, tribunal, regulator or law enforcement agency
• making a mandatory report (for example, a reportable incident to a safety regulator).

Where possible, we will push these requests through your employer’s normal legal / compliance processes so that they, not Echo, are the primary decision-maker.

2.4 You ask us to

We may also share your identity if:

• you explicitly ask us to (for example, “please have HR call me”, “I want to talk to my HSR about this”) and
• it is appropriate and safe to do so.

In these situations, we will confirm what you want shared and with whom, and we will keep a record of that consent.

3. How we decide whether to escalate

When Echo detects a potential issue, we consider factors such as:

• Severity – How serious is the potential harm or misconduct?
• Immediacy – Is there an immediate risk, or can this wait for normal processes?
• Clarity – How clear is the information? Are there obvious misunderstandings or ambiguities?
• Necessity – Can the risk be managed using anonymous or aggregated information, or is naming an individual genuinely necessary?
• Proportionality – Are we sharing no more information, with no more people, than reasonably required?

Where there is time and it is safe to do so, Echo may:

• attempt to clarify what you meant (for example, asking follow-up questions),
• ask how you would like the issue to be handled (for example, whether you want to be contacted), and
• suggest existing internal channels (manager, HSR, HR, EAP, whistleblower line) where they are better suited.

4. What happens if we escalate

Where Echo decides it is necessary to escalate in a way that may identify you, we will:

1. Select the right channel
   Use the employer-approved escalation path (for example, WHS lead, HR, site leader, critical-incident contact, whistleblowing channel, or emergency services).

2. Share only what’s needed
   Provide a concise summary focusing on:

   • the nature of the risk or incident
   • who may be affected
   • the urgency
   • what we think needs to happen next (for example “contact this worker directly,” “inspect this site,” “engage specialist support”).

3. Inform you where safe to do so
   Where it is safe and lawful, we will:

   • tell you that an escalation is being made and why
   • explain who will (or may) contact you
   • encourage you to use existing internal processes as well.

   In some extreme cases (for example, where there is a serious risk of retaliation or further harm), telling you in advance may not be appropriate. In those cases, we may delay informing you until it is safer to do so or rely on your employer’s judgment.

4. Hand over to your employer
   Once we have escalated, your employer becomes responsible for:

   • investigating
   • taking action
   • communicating outcomes in line with their own policies, legal obligations and industrial instruments.

Echo does not run investigations or disciplinary processes and does not decide disciplinary or employment outcomes.

5. How escalations are recorded and reviewed

For every escalation where we share identifying information, Echo will record:

• the date and time
• the type of issue (for example “immediate self-harm risk”, “serious harassment allegation”)
• who the information was shared with (organisation/role, not necessarily names of every recipient)
• what information was shared
• why it was necessary (which rule in this document applied).

We use these records to:

• audit our own decisions
• ensure we are following these rules consistently
• improve our safeguards and training
• provide evidence to regulators or partners if needed.

Your employer may also keep their own records as part of their WHS and incident management obligations.

6. Protections for workers who speak up

Echo is designed to support, not punish, workers who raise genuine concerns. The following principles apply:

• No retaliation for good-faith reports
  Your employer should not subject you to adverse treatment for raising a safety, psychosocial or conduct concern in good faith, whether through Echo or any other channel.
• Confidentiality as far as possible
  We aim to keep your identity limited to those who need to know to manage the issue. In some cases (for example, formal investigations or legal proceedings), your identity or evidence may need to be disclosed more widely, but this should be done under proper processes.
• Choice where possible
  Where the situation is not time-critical, you will usually be able to decide:
  • whether you want your name attached
  • whether you prefer an anonymous or de-identified escalation
  • whether you want follow-up contact.
• Echo is not your only option
  You always have the option to use:
  • your manager
  • Health and Safety Representatives (HSRs)
  • union representatives
  • HR or WHS teams
  • formal grievance or whistleblowing channels (including any formal whistleblower policy your employer has in place)
  • Employee Assistance Programs (EAP) or external support.
  Echo does not replace these channels and is not your employer’s only way of managing WHS and conduct issues.

7. What Echo will not do

Echo will not:

• secretly record conversations outside the Echo service
• share your name or individual comments with managers for routine performance management or “spying”
• make automated employment decisions (for example hiring, firing, promotion, discipline) based solely on Echo data
• act as an emergency hotline or clinical service (we can help you get to the right place, but we are not that place).

If anyone tells you Echo is being used in a way that seems inconsistent with this document, you should raise it with:

• your employer’s WHS / HR / privacy contact, and/or
• Echo via the contact details in the Participant Information & Privacy Notice.

8. Changes to these rules

We may update these rules over time, for example if:

• legal or regulatory requirements change
• we refine our escalation processes
• we receive feedback from workers, HSRs, unions, employers or regulators.

When we make material changes, we will:

• update the “Last updated” date at the top, and
• take reasonable steps to let participants know (for example through your employer, via email/SMS, or on our website).

If changes materially affect how and when we might identify or escalate information about you, we will highlight those changes clearly and may ask you to review and reconfirm your participation in the pilot.

This document is intended to make our safety and escalation approach clear and predictable. It does not limit or remove any rights you have under work health and safety, privacy, employment or other applicable laws.