Delete your account
and the information behind it
Email us from the address you registered with and we will erase your VCMS account. This page explains exactly what goes, what has to stay, and how long it takes.
This page covers the VCMS platform and the Android app VCMS Site Access (au.com.aiida.vcms.app). No account or app is needed to read it.
Three steps, one email
There is no form to fill in and nothing to install. We ask by email because it is the one channel that proves the request came from the address on the account.
- 01Email us
Send your request to info@securevcms.com from the email address you registered with. Include your full name and, if you know it, the organisation or site you registered for. The link above opens a message with those fields already laid out. If you cannot send from that address, say so and we will verify you another way before anything is deleted.
- 02We confirm and route it
We acknowledge your request within 5 business days. AIIDA GROUP PTY LTD operates VCMS on behalf of the organisations that use it, so your record sits with the organisation whose site you attended. We identify which one, pass the request on, and stay responsible for seeing it done.
- 03It is done within 30 days
We write back to confirm what was deleted and to name anything that had to be kept, with the reason. If it is going to take longer than 30 days — which in practice means a legal hold on the record, such as an open incident investigation — we tell you that inside the 30 days rather than letting it run on.
Two things you can do yourself, now
Neither needs us, and both take effect immediately.
Cancel your pass. In the app or the portal, open My pass and cancel it. It stops working straight away — that is the control to use if you have lost your phone or your visit is off, and it does not delete the rest of your record.
Withdraw a consent. Anything you consented to is listed in the portal with the date and the version you agreed to, and each one can be withdrawn on its own. Withdrawing a consent is narrower than deleting the account, and it is reversible.
Deleting the account is the one that cannot be undone. If you want your record back afterwards you would have to register again from scratch, and a contractor would need a fresh invitation from the site before that is even possible.
Deleted when the request is actioned
Name, email address, phone number, employer, and the emergency contact you gave — on both the visitor and the contractor record, whichever you hold.
The QR pass and its access code are revoked immediately, along with any copy added to Google Wallet. A revoked pass will not open anything and cannot be reinstated.
The photo of your ID document and the selfie taken for the identity check, which are held in a separate store from the operational record so that deleting them deletes rows rather than clearing a column somebody has to remember.
Licences, tickets, insurances and any other evidence you supplied, unless a specific document is still required as proof of competency for work already performed.
Your password and every active session. You will not be able to sign in again, and a new registration would start an entirely new record.
Held after deletion, and why
We would rather tell you this on the way in than surprise you with it afterwards. Where a record has to be kept, your name and contact details are stripped out of it — what remains is the fact, not the person.
That you were on a site, on a date, between two times. A work health and safety regulator can compel the site operator to produce this, and it is the record that protects you as much as them after an incident. It is kept without your contact details attached.
The record that you completed an induction and accepted the site rules, for the same reason. Attributable to your record, not to your name and address.
Hours recorded against shifts are close to payroll. Where they have been submitted or approved they are kept for the period the relevant employment and tax records require.
An append-only record of what was done in the system and by whom. It is tamper-evident by design, which means entries cannot be removed from it without breaking the chain that makes it worth keeping. Your deletion is itself written into it.
These are the platform’s default periods. The organisation running VCMS can shorten or extend them for its own deployment, and a legal hold — an open investigation, a claim, a regulator’s notice — pauses disposal of the records it covers until the hold is lifted. Ask the organisation whose site you attended for the periods that apply to you.
What expires on its own
Most of what VCMS holds about you is disposed of on a schedule whether you ask or not. These are the default windows, measured from your last activity.
90 days, then deleted
90 days, then scrubbed
12 months after your last visit, then scrubbed
3 years after your last activity, then scrubbed
2 years active, then archived; destroyed at 7 years
If the request goes nowhere
Email info@securevcms.com again and say it is a second request. If you are not satisfied with how AIIDA GROUP PTY LTD has handled it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, which is your right under the Privacy Act 1988 (Cth) and costs nothing.