Privacy Policy

Effective date: 5 November 2026

Applies to: the Onslow Priority — Rapid Aid application and every part of it: emergency and non-emergency reporting, dispatch and coordination, the resource map, the emergency guide library, alerts and notifications, welfare checks, community features, radio and event channels, planning and modelling tools, the Raptor portal, and the public pages.

This policy says what the platform holds, who can see it, how it is protected, and what you control. It is written to be read rather than to impress.

The short version

Information is used for emergency coordination, account operation and security. The application also records security-related visit and interaction information, including on public pages, as described below. It does not sell or rent personal information for advertising.
What you see follows your role. A resident, a community responder, a dispatcher and an administrator do not open the same screens, and medical detail and restricted incident categories are held to the personnel authorized to work them.
Access controls and transport security are not the same as end-to-end or application-level field encryption. Do not assume that every profile or incident field is separately encrypted by this application.
Your location is used when you share it: on a report you are making, to find resources near you, or while you are actually responding to a call. Alerts follow the locations you deliberately subscribe to, not wherever you happen to be standing.
You can review, export and delete your own account and its data from inside the application.
Connecting to an agency's own CAD, MDT, radio or paging system is optional. The platform works fully without any such connection, because it runs on what people enter and what the community records. Where an organization chooses to connect one, it is read-only by default, the organization switches each part of the exchange on itself, and turning it off stops the exchange immediately.

What is collected

Account and contact details. Your name, email address, phone number where you give one, role and permissions, and the verification or qualification records behind any responder capability you hold.

Emergency information you choose to enter. Anything you add to your own emergency profile: emergency contacts, blood type, allergies, medications and conditions, accessibility, mobility and communication needs, property access details, and known scene hazards. Nothing in it is required in order to use the application, and every field is yours to fill in, change or leave empty.

Location. GPS coordinates when you attach a location to a report, when you ask for resources near you, and while you are actively responding to a call. A location you set by hand is treated as a location you set, and is labelled as such.

Incident and response records. The report itself, notes, photographs, video, audio and transcripts, confirmation levels, call stages with their timestamps, resources pulled onto a call, handoffs, and the after-action record written from what happened.

Welfare and check-in records. Scheduled check-ins, your activity status where you choose to set it, the contacts you designate, and any escalation that followed a missed check-in.

Messages and notification records. Internal messages between personnel, notifications created in the application, and whether one was read, acknowledged or dismissed. A record of a notification says it was created in the application; it does not claim it was received or acted on.

Device, session and security records. Sign-in records, session re-validation and two-factor checks, console access records, audit entries for sensitive changes, and the endpoint used to deliver push notifications to your device. Security logging also records the connecting IP address, browser information, time, a generalized page path, and interaction categories such as activating a button or link. These logs can be associated with your account when signed in. New log entries do not retain URL query strings, private link tokens or the text of a control you activate. Security logging runs automatically, including for visitors without an account; it is not an advertising profile.

Resource records. Equipment and trained personnel registered by a community, a business or an individual: what it is, where it is, how to reach it, its access detail, its inspection and expiry dates, and the alert contacts its owner asked to be told when it is needed.

What is not collected

The application does not use the information described here to build an advertising profile, purchase personal data from brokers, or sell or rent personal information. Security and operational logs are collected as described in this policy. Hosting, authentication, mapping and other service providers may process information to deliver their services; do not interpret the absence of an advertising profile as the absence of all operational logging.

How information is used

To route a report to dispatch and to the agencies configured to receive it.
To alert eligible, verified nearby responders for the kinds of incidents the community has enabled, and nobody else.
To find the nearest appropriate resource and to tell the people who asked to be told when that resource is needed.
To deliver guidance and instructions while professional help is on the way.
To run welfare monitoring and escalation when a check-in is missed.
To keep an accurate record of what happened, what was tried, and what a responding crew needs to know.
To protect the service itself: authentication, access control, abuse and rate limits, and audit trails.

Who can see what

Access follows role, verification and the configuration of the community or agency involved — not whoever is holding a phone.

Medical information, mental-health crises and restricted law-enforcement incidents are held to the personnel authorized to work them. Those categories are not published, shared, or carried on a public page.
A community responder receives what they need in order to act on the call they were alerted to: what the call is, how far away it is, what is needed to hand, and a route. The personal detail behind a call — the caller's identity, their triage answers and their medical snapshot — stays with the personnel cleared for that call, and a law-enforcement, mental-health or probable-death call is described at category level to everyone who is not cleared for it.
A shared call link or public page shows only what was deliberately published or shared for that call, and never the identity of the person who called.
Resource alert contacts are told when the resource they hold is pulled onto a call, and can withdraw that at any time.
Administrative and console actions are recorded in an audit trail kept separately from the incident record.

Health and medical information

Medical information requires especially careful handling. The application includes role-based display rules and record-access controls, but those features alone do not establish HIPAA compliance or end-to-end encryption. A deployment that handles protected health information for a covered entity requires a documented risk assessment, appropriate access and retention controls, staff procedures, and any required business-associate agreements before that use is approved. This policy is not a compliance certification. Do not enter information you are not authorized to disclose.

When information leaves the platform

With the communities, agencies and participating organizations responsible for the incident, under their own access rules.
With a third-party service only where access has been formally granted and recorded, and only through a read-only connection where one exists.
Where the law requires it, or where it is necessary to protect someone from serious harm.
Never for advertising, marketing, profiling, or sale.

How long it is kept

Your account and the information in it are kept while your account is open. Incident records, response records and audit records are public-safety records: they are retained under the record-keeping obligations of the agency or community responsible for them, which can mean that deleting an account does not erase an incident record that an agency is required to keep. Retention questions for those records are answered by that agency.

How it is protected

The application is served over HTTPS. It uses authenticated accounts, record-access rules, console credential checks and audit records. Additional console and second-device checks depend on the feature and deployment configuration; they should not be interpreted as protection for every operation or as proof of compliance. Profile and incident fields must not be assumed to have separate application-level encryption. Security controls, retention arrangements and access assignments require ongoing review. A suspected security incident must be assessed by the deployment operator, with notifications made where applicable law requires them.

Your choices and controls

What you put on your emergency profile, and whether your emergency QR code shares it.
The alert locations you subscribe to — a home, a school, a workplace, a parent's address — and when to remove one.
When your location is shared, and which device answers your two-factor check.
Whether a resource you hold alerts its contacts when it is pulled onto a call.
Your information-sharing consent, which you can change in your profile settings.
Exporting your data and deleting your account, from inside the application.
Writing to us with any question or request, using the address below.

Your rights

You can ask for a copy of what the platform holds about you, ask for corrections, and ask for deletion. Export and account deletion are available to you directly inside the application. Deletion removes your account and its data; records a public-safety agency is required to retain are handled under that agency's policy, and we will tell you when that applies. Requests that cannot be met inside the application can be made using the contact address below, and applicable North Carolina and federal law applies to them.

Children

The platform is not directed to children under 13, and an account is not created for a child by the platform itself. Where a minor takes part — a school programme, a young person's account managed by a guardian, a youth welfare check — a parent or guardian is responsible for setting it up and for the information entered.

Community and agency responsibility

Each participating community, agency and organization decides what is enabled, who may access it, the requirements a community responder must meet, and its own escalation and retention rules. Those decisions, and the handling of records under them, belong to that community or agency, and its own notices and policies apply alongside this one.

Changes to this policy

This policy is dated, and a change is published here when it takes effect. A change that materially affects what is collected or who can see it is shown in the application rather than made quietly. The published wording is maintained by the administrators of this deployment.

How to reach us

Questions, requests and concerns about privacy can be sent to Cameron.anderson.work.contact@gmail.com, or raised inside the application from the privacy and rights page. This policy is the platform's own statement and is not legal advice; a deploying agency may publish its own additional notices.