Privacy Policy
Patient records are different. Information your organisation records about patients (and most records inside the app) belongs to your organisation, which is the controller. We process it only on their instructions as their processor — see our Data Processing Agreement. If you were treated by a team using E-Responder and have questions about your record, please contact that organisation.
1. Who we are
HEIMDELL TECH AI LTD, registered in England and Wales (company no. 16478408), 11 Lower Croft, Penwortham, Preston, PR1 9DJ, United Kingdom. Registered with the Information Commissioner's Office, reference ZC079121. Contact: contact@heimdell-tech-ai.co.uk.
2. What we collect, and why
| Information | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Account details — name, email, role, callsign, phone number, qualifications, password (stored only as a secure hash) | To create and secure your account and let your team work together | Contract with your organisation; our legitimate interest in running a secure service |
| Company and billing contact details — company name, plan, subscription status (card details are held by Stripe, not us) | To provide the subscription and take payment | Contract; legal obligation (accounting records) |
| Live location — only while "Share my location" is on, or when you press SOS | To show your team where you are and to raise SOS alerts | Legitimate interest in staff safety (you control it and can switch it off; SOS is your choice) |
| Security logs — sign-ins, IP address, device type, and actions such as viewing or changing patient records | To protect accounts, investigate misuse and give your organisation an audit trail | Legitimate interests (security); helping your organisation meet its legal duties |
| Emails you send us | To answer you | Legitimate interests |
We do not use advertising or tracking cookies, and we do not sell personal information. The app stores data on your device (browser storage) so it can work offline. That storage is essential to the Service and is cleared when you log out.
3. Who we share it with
Only with the service providers we need to run E-Responder:
| Sub-processor | What for | Data involved | Location |
|---|---|---|---|
| Fasthosts Internet Ltd | Server hosting (virtual private server) and email delivery | All Service data, stored encrypted | United Kingdom |
| Stripe Payments UK Ltd / Stripe, Inc. | Subscription billing and payment processing | Company and billing contact details, payment details (held by Stripe, never by us) | UK / EEA / USA |
| Anthropic, PBC | Writing the optional AI post-event report | Event summary data with patient names, NHS numbers, phone numbers, staff names and exact GPS removed on the user's device before sending | USA |
| what3words Ltd | Converting a GPS position into a what3words address | Latitude and longitude only | United Kingdom |
| OpenStreetMap Foundation (tile servers) | Background map on the live team map | The user's IP address and the map area viewed | UK / EU |
We may also disclose information where the law requires, or to protect someone's life in an emergency.
4. International transfers
Some providers above process data in the USA. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum, with additional safeguards. For AI reports, names, NHS numbers, phone numbers, staff names and exact GPS positions are removed on your device before anything is sent.
5. How long we keep it
- Account details: for as long as your account is active, then deleted with your organisation's data as set out in our Terms (90 days after the subscription ends, plus up to 35 days in backups).
- Live location: only your most recent position is kept, and it is deleted after 12 hours or when you switch sharing off or log out.
- Security and audit logs: 2 years.
- Billing records: 6 years, as required by UK tax law.
6. Security
Data travels over encrypted connections (HTTPS). Records and files are encrypted on our servers (AES-256). Passwords are stored only as a salted hash. Access within your organisation is limited by role, and every company's data is kept separate from every other company's.
7. Your rights
You can ask for a copy of your personal information, ask us to correct or delete it, object to or restrict how we use it, or ask for it to be transferred. Email contact@heimdell-tech-ai.co.uk. If your request is about records your organisation controls, we will pass it to them and help them respond. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Changes
We will post any changes here and tell account holders about significant ones.