Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Patient Health Information (PHI): For patients who create a profile — medical history, allergies, medications, conditions, insurance information, emergency contacts, advance directives, and uploaded documents such as insurance cards and photo identification.
• Employee Information: For EMS staff — employment details, certifications, driver's license information, emergency contacts, and scheduling data.
• Call/Transport Data: Patient demographics, scene and destination addresses, chief complaints, insurance details, and stretcher form data collected during dispatch and transport operations.
• Communications: Messages sent through our in-app messaging system between staff, dispatchers, and patients.

1.2 Information Collected Automatically

• Device Information: Device type, operating system, unique device identifiers, and mobile network information.
• Location Data: GPS coordinates for unit tracking, geofencing, and dispatch operations. Location data is collected only while actively using the Services for dispatch purposes.
• Usage Data: Pages visited, features used, actions taken, access times, and IP addresses for security auditing and system improvement.
• Push Notification Tokens: Device tokens for delivering push notifications on iOS and Android devices.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our EMS dispatch, tracking, and patient care services.
• Process and manage emergency and non-emergency medical transport calls.
• Enable real-time GPS tracking of EMS units for dispatch coordination.
• Facilitate communication between dispatchers, field crews, and patients.
• Verify patient insurance eligibility through our integrated clearinghouse services.
• Generate and manage medical documentation including stretcher transport forms and ePCR reports.
• Send notifications about call assignments, status changes, schedule updates, and certification expirations.
• Comply with HIPAA, state EMS regulations, and other applicable healthcare laws.
• Maintain audit logs for HIPAA compliance and security monitoring.
• Prevent fraud, abuse, and unauthorized access to the Services.

3. HIPAA Compliance

RescueLink EMS is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA). We implement the following safeguards:

• Encryption at Rest: All Protected Health Information (PHI) is encrypted using AES-256 encryption in our database.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
• Access Controls: Role-based access control ensures users can only access data appropriate to their role (dispatcher, field crew, billing, administrator).
• Audit Logging: Every access to patient records is logged with user identity, timestamp, IP address, and action performed.
• Message Encryption: All messages in our HIPAA-compliant messaging system are encrypted at rest.
• Minimum Necessary: We limit PHI disclosure to the minimum necessary to accomplish the intended purpose.
• Business Associate Agreements: We maintain BAAs with all third-party service providers who may access PHI.

4. Information Sharing

We do not sell your personal information. We may share information in the following circumstances:

• For Treatment, Payment, and Operations (TPO): PHI may be shared with healthcare providers, insurance companies, and billing entities as permitted by HIPAA for treatment, payment, and healthcare operations.
• With EMS Agencies: Call and patient data is shared with the EMS agency responsible for the transport, including dispatchers and assigned crew members.
• Insurance Verification: Patient insurance information may be transmitted to insurance clearinghouses (such as Stedi) for eligibility verification.
• ePCR Integration: Call data may be transmitted to electronic patient care report systems (such as emsCharts) used by the transporting agency.
• Legal Requirements: We may disclose information when required by law, regulation, legal process, or governmental request.
• Service Providers: We use third-party services for email delivery, push notifications, and hosting. These providers are contractually bound to protect your data.

5. Data Retention

• Patient Records: Retained in accordance with state and federal healthcare record retention requirements (minimum 7 years for adult records, longer for minors).
• Audit Logs: Retained for a minimum of 7 years as required by HIPAA.
• Account Data: Retained while your account is active and for a reasonable period thereafter.
• GPS Position History: Unit position data is retained for 7 days for operational purposes, then automatically purged.
• Messages: Retained while the conversation is active. Encrypted messages may be retained for compliance purposes.

6. Your Rights

Depending on your jurisdiction and role, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your account and associated data, subject to legal retention requirements.
• HIPAA Rights: Patients have the right to access their PHI, request amendments, obtain an accounting of disclosures, and request restrictions on certain uses of their PHI.
• Notification Preferences: You can control which notifications you receive and through which channels (push, email, SMS) in your profile settings.
• Data Portability: Request your data in a machine-readable format.

7. Location Data

Our mobile applications collect GPS location data for the following purposes:

• Unit Tracking: Real-time location of EMS units for dispatch coordination and response time optimization.
• Geofencing: Automated status suggestions when units arrive at or depart from call locations.
• Trail History: Short-term movement history for operational review (retained 7 days).

Location data is collected only when the app is in use for dispatch operations. You may disable location services through your device settings, but this will limit dispatch functionality.

8. Push Notifications

Our mobile applications send push notifications for:

• New call assignments and dispatch alerts
• Call and unit status changes
• New messages
• Schedule reminders
• Certification expiration warnings

Push notification content does not include Protected Health Information. You can manage notification preferences in your profile settings or disable push notifications through your device settings.

9. Security

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Multi-factor authentication (MFA) support
• Role-based access control (RBAC)
• Automatic session timeout and forced password changes
• HIPAA-compliant audit logging
• Regular security assessments and monitoring
• Content Security Policy (CSP) headers
• Bcrypt password hashing with configurable rounds

10. Third-Party Services

We use the following third-party services:

• Cloudways/DigitalOcean: Cloud hosting and infrastructure
• Resend: Transactional email delivery
• Pusher: Real-time WebSocket communications
• Stedi: Insurance eligibility verification and payer discovery
• emsCharts: ePCR charting system integration
• Traccar: GPS device tracking server
• Anthropic (Claude): AI-assisted medical narrative review
• OpenStreetMap/Nominatim: Geocoding and map data

Each third-party service has its own privacy policy. We maintain Business Associate Agreements with services that may access PHI.

11. Children's Privacy

Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. Patient profiles for minors should be created and managed by a parent or legal guardian. If you believe we have collected information from a child under 13, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Continued use of the Services after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this privacy policy, wish to exercise your rights, or need to report a privacy concern:

For HIPAA-related complaints, you may also contact the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr.