The worst incident reports are WhatsApp voice notes. Use an HTML first-notice form so operations learns what, when, and who to call back—then complete RIDDOR, OSHA, or insurer forms in the systems those regimes actually specify.
24/7 alerts if you run events.
Injury, near miss, security, other.
A form is not an ambulance.
RIDDOR, OSHA, insurer, or Datix as applicable the same day.
An incident report is a contemporaneous account of an accident, near miss, data incident, or security event. In the UK, serious workplace injuries may need RIDDOR reporting to the HSE; this website form does not file RIDDOR. In the US, OSHA logs and workers’-comp first reports of injury are separate. Clinics may also have statutory incident duties; NHS organisations use Datix-class systems, not a marketing form, as the record.
Use This form as the public or staff-facing first notice: reporter contact, date, and narrative. Relabel request type to ‘injury’, ‘near miss’, ‘property’, ‘information security’, ‘other’.
Capture enough to start the investigation. Do not crowdsource medical diagnoses or other people’s government IDs.
Never collect SSN, NI, or passport scans of injured persons on this form. Staff can attach those to an insurer file later through a controlled process.
Serious organisations have a QMS. Small venues have a Google Form. This HTML is the branded middle.
A form for sites, events, and small clinics.
NHS and large UK providers should keep the official record there.
US employers still complete those in the required systems.
Your broker’s first-notification-of-loss is a different form; use this only to wake your own team.
A password-free public form will attract noise. For staff-only reporting, put the URL on the intranet and still use your form backend spam controls.
If the incident involves US PHI or UK health data, lock down who can open the dashboard. A broken-ankle report can still identify a patient.
No. Use the HSE RIDDOR process when the criteria are met.
No. It notifies your team so they can decide what the OSHA record requires.
Collect in details if needed. Do not demand their ID documents on a public form.
UK GDPR personal-data breaches have ICO notification clocks. US incidents may involve state AG and HIPAA breach rules. This form can wake the DPO; it is not the notification.
Typed acknowledgement of activity risks for gyms, events, and classes—not a magic shield against negligence.
Post-activity or settlement-style release language captured as a web acknowledgement.
Permission to use a person’s image in marketing, with named event and typed signature.