Good luck with this. My comments:

Master data: name of locations and site sub-sections, people, their roles, etc. - in other words, all the lists you need in the background or pre-loaded (and kept up to date). This can kill a project that starts small and then cannot scale up. Best to figure all this out (and who will do it) right now.

Categories: the reported hazards should fit into the same categories as your accidents/risks/observations and whatever else you define as in your scope. If you can't relate the data you generate to all the other data you generate, then you're creating problems later.

Vendors: yup, there are lots and they will all ask you to do all the work above, there is no shortcut here. For my money, pick one that will allow you to scale up in a modular fashion and that can give you critical feedback (i.e. pick a knowledgable partner, not a servant that will just follow instructions and burn your budget). I also find reporting is going to BI, like Microsoft BI or Qlik, so don't get caught up in this.