ROLF

The ROLF system is based around a core group of data sets including

• account/Site
• SEG/Role
• applicant/Employee.

The primary module is the occupational health module includes:

• pre-employment medicals
• periodic medicals
• health monitoring
• injury management
• cases management
• recall management.

There are additional modules for Occupational Hygiene.

Key Stakeholder engagement 
The initial step for implementation will be to engage key stakeholders’ groups. This engagement will be in the form of workshops to demonstrate ROLF platform.

Security Roles and Profiles 
The security model for implementation will be discussed, documented and agreed. The security model will include who can access what data for what sort of records.

Establishment Data Collection and Bulk Upload
Key data will be required to commence using the system. This data includes:

• account/site information
• contact information
• role/SEG information
• current employee data (optional).

This can be supplied to Resile for bulk upload or can be entered by the client.

Training 
Standard implementations include access to training material for self-guided learning in the platform.

Reporting and Dashboard 
Part of the implementation will be standard reporting and dashboard implementation. Custom reports can be created on any data that is captured.

Resile’s platform is built on the world-class database platform Salesforce. Salesforce carefully considers privacy and security-related matters relating to customers worldwide, including those related to the protection of Customer Data, at every level and in every business function on an ongoing basis.

Multiple third parties have certified and audited the ROLF platform , our information technology provider and privacy measures and controls. Resile’s platform provider geographical recognition includes:

• EU/US and Swiss/US Safe Harbour self-certification; TRUSTe Privacy Program seal;
• Privacy mark certification by the Japan Information Processing Development Corporation (also known as “JIPDEC”) for the Company’s Japanese affiliate;
• Privacy mark certification by TÜV in Germany for the Company’s German affiliate.
• Australian Signals Directorate (ASD) Certified Cloud Service

Resile’s platform provider global audit compliance recognition includes ISO 27001 certification and SSAE 16 Security Organisation Control (SOC) Reports. Additionally, Resile’s platform providers internal audit and compliance functions regularly assess the privacy and security programs.

Resile’s platform provider implements internal privacy and security-related policies that reflect the contractual commitments to safeguard customer data and regulatory requirements, including requirements of Australian Privacy Laws. These policies include Resile’s Platform Provider Code of Conduct (which includes sections on confidentiality, privacy, and information security), information security and privacy policies regarding handling of Customer Data, and confidentiality agreements with all personnel.

Resile and its contractors regularly communicate with its employees about their obligation to safeguard confidential information.

Resile’s IT platform includes a comprehensive array of technical security measures to secure the Company’s services. These security measures include protections against system vulnerabilities, logical separation of Customer Data, robust network security, and encryption of data in transmission. Additionally, the Company’s Identity Confirmation feature automatically recognises recognises whether a user is logging in from devices and Internet Protocol (IP) addresses previously used and unfamiliar devices or IP addresses trigger additional authentication requirements before a user may log into the system.

Resile-controlled security features include:

• a granular sharing model whereby customer-designated system administrators determine which users can access different categories of data
• customizable password rules
• IP Range Restrictions that restrict the range of IP addresses from which a customer’s users may log into the Services
• customer-defined automatic log-off times
• the option to encrypt custom data fields at rest
• field audit tools
• two factor identification and
• restriction on editing a deleting on a field by field basis.

Controls for the security of data are based around:

• object permissions – What data tables an individual has access to and if they can create or edit data
• field level permissions – What data fields (columns in a data table) an individual has access to and if they are read only or can be edited
• sharing rules – Sharing rules control what records within a table is visible to a user.

Sharing rules are based on data such as this could be site, type of information or whether records are current or not.

The platform’s security model is extremely robust and customisable.