Privacy Policy — ProtaRes

Last updated: April 2026 · Version 1.0

1. Who We Are

ProtaRes Ltd ("we", "us", "our") is the data controller for personal data processed through the ProtaRes mobile application. We are registered with the Information Commissioner's Office (ICO).

Data Protection Officer: Chisom Ezeani
Contact: chisom@protares.co.uk
Address: ProtaRes Ltd, United Kingdom

2. What Data We Collect

2.1 Account Data

When you register, we collect your name, email address, and optionally your phone number. If you sign in with Google, we receive your name and email from your Google account.

2.2 Professional Credentials

If you are a healthcare professional, we collect your credential type (GMC, NMC, HCPC, or first aid certificate), credential number, and expiry date. Credential numbers are encrypted before storage and verified against official professional registers.

2.3 Location Data

When you set your status to "on duty", we track your location to match you with nearby emergencies. Location data is retained for a maximum of 24 hours and then automatically deleted. We do not track your location when you are "off duty".

2.4 Emergency Response Data

When you respond to an emergency, we record your response status, arrival time, interventions performed, and handover details. This data is retained for clinical governance and quality assurance purposes.

2.5 Video and Audio (Witness Mode)

If you use Witness Mode, video and audio from the emergency scene may be transmitted to dispatchers and responding personnel. This data is processed for the purpose of emergency coordination and clinical assessment.

2.6 Device Information

We collect your device type, operating system, and push notification token to deliver emergency alerts.

3. Lawful Basis for Processing

Data Category	Lawful Basis	Justification
Account data	Contract	Necessary to provide the service
Professional credentials	Consent + Legitimate Interest	Verify qualifications for patient safety
Location (on duty)	Explicit Consent	You choose to go on duty; opt-in required
Emergency response data	Legitimate Interest	Clinical governance and service improvement
Witness Mode media	Legitimate Interest + Vital Interest	Emergency coordination, potential life-saving
Push notification tokens	Contract	Necessary for emergency alert delivery

4. How We Use Your Data

To match you with nearby emergencies based on your location, qualifications, and predicted trajectory
To verify your professional credentials against GMC, NMC, or HCPC registers
To send you emergency alerts via push notifications or SMS
To coordinate emergency response between responders and emergency services
To generate your Green Badge for on-scene credential verification
To produce anonymised statistics for service improvement
To comply with clinical governance and audit requirements

5. Data Sharing

We share your data only in the following circumstances:

Emergency services: When you respond to an emergency, your name, credential tier, and ETA are shared with dispatchers and emergency services on scene.
Service providers: We use Supabase (database and authentication), Google Cloud (maps and authentication), and Twilio (SMS alerts). These providers process data on our behalf under data processing agreements.
Legal obligations: If required by law, court order, or regulatory authority.

We never sell your personal data to third parties. We never share your location data with other responders — only dispatchers can see responder locations during active emergencies.

6. Data Retention

Data Type	Retention Period
Location history	24 hours (automatically deleted)
Push notification tokens	Until you uninstall or 90 days inactive
Emergency response records	7 years (clinical governance requirement)
Account data	Until you delete your account
Credential verification records	Until credential expires + 1 year
Audit logs	7 years (anonymised after account deletion)
Consent records	7 years (legal requirement)
Witness Mode media	90 days (unless required for investigation)

7. Your Rights Under UK GDPR

You have the following rights:

Right of access: Request a copy of all personal data we hold about you. Use the "Download My Data" feature in the app, or email us.
Right to rectification: Update your profile information at any time in the app.
Right to erasure: Delete your account via Settings > Privacy > Delete Account. We will erase your personal data within 30 days. Emergency response records will be anonymised (not deleted) for clinical governance.
Right to restrict processing: You can go "off duty" at any time to stop location tracking. You can disable push notifications in your device settings.
Right to data portability: Use the "Download My Data" feature to receive your data in a machine-readable format (JSON).
Right to object: Contact us to object to any processing based on legitimate interest.
Right to withdraw consent: Withdraw location consent at any time by going off duty or revoking location permission in your device settings.

To exercise any of these rights, email chisom@protares.co.uk or use the in-app privacy settings. We will respond within 30 days.

8. Data Security

We implement the following security measures:

All data transmitted between the app and our servers is encrypted using TLS 1.2 or higher.
Credential numbers are encrypted at rest using AES-256-GCM.
Authentication tokens are stored in secure device storage (Keychain on iOS, Keystore on Android).
Row Level Security ensures users can only access their own data.
Green Badge QR codes regenerate every 60 seconds and cannot be reused.
We conduct regular security assessments and penetration testing.
Access to personal data is restricted to authorised personnel on a need-to-know basis.

9. Children

ProtaRes is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it immediately.

10. International Transfers

Your data is primarily stored in the United Kingdom and European Economic Area. Some service providers (Google, Supabase) may process data in the United States under Standard Contractual Clauses or equivalent safeguards approved by the UK Information Commissioner.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via push notification or email. The "Last updated" date at the top of this page indicates the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

13. Contact Us

ProtaRes Ltd
Data Protection Officer: Chisom Ezeani
Email: chisom@protares.co.uk