Privacy Policy
Medic Corps Ops · Effective 16 September 2026
Medic Corps Ops is a coordination tool for disaster relief teams. It is not a consumer app: accounts are created by request and approved by an administrator, and everything in it exists to help a small number of people work one disaster response together.
This policy explains what the app records, who can see it, and what happens to it afterwards. It covers two different groups of people, and the difference matters: the volunteers and staff who use the app, and the residents and local contacts they record information about.
If you use the app
What you give us
- Your account — email address and password, held by Google Firebase Authentication. We never see your password.
- Your profile — name, phone number, and the skill sets you describe when you sign up.
- Your availability — the dates you offer for a response, if you offer any.
What the app records as you work
- Precise location, while the app is open, to show where you are on the operational map, to place a location accurately, and to open the nearest one. It is not collected in the background and is not used to track your movements.
- Photographs and voice notes you capture, attached to the location you captured them at.
- Messages you send in a location's conversation or in the response-wide room.
- A notification token for each device you sign in on, so the app can tell you when something needs you. Signing out removes that device's token.
- NFC tags you tap at a communications centre. Tags are read to join a network; nothing is written back about you.
Something written about you, that you cannot see
Coordinators can record notes about the people they have worked with — strengths, and things worth knowing before staffing the next response. A note is never shown to the person it is about. That is deliberate: a note somebody will read is a note nobody writes honestly.
If you want to know what has been recorded about you, ask an organization administrator.
If information about you was recorded by someone using the app
Relief teams record what they find so that help arrives in the right place. If you were visited, or if you are the contact for a place, the app may hold:
- Your name, role at that location, phone number and email address.
- Notes about what the location needs, how many people are there, and how to reach it.
- Photographs of the location, of damage, and — where equipment was installed — of the recipient and the installed device.
- The location's coordinates.
This information is visible to the people working that response, and to the organization's administrators. It is not sold, not advertised against, and not shared with anyone outside the organization except as described below.
To ask what is held about you, to correct it, or to ask for it to be removed, contact the organization using the address at the foot of this page. A request that concerns an active response may take longer, because the record may be in use.
Who can see what
Access is decided by role, and enforced by the server rather than by the app. In outline:
- Volunteers and team leaders see the response they are assigned to.
- Coordinators and administrators see the responses they run, and the roster.
- Communications liaisons see equipment and network records across every response, and no relief or household data at all.
- Local contacts see only the one location they are attached to.
Where it is stored, and who processes it
- Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging) stores the data and delivers notifications, on Google Cloud infrastructure in the United States.
- Mapbox provides map imagery. Map requests reach Mapbox; your account details do not.
- Apple and Google deliver push notifications to your device.
Network credentials for field communications equipment are encrypted with AES-256-GCM before they are stored, and are handed to your device's operating system to join a network without being displayed.
How long it is kept
- Approved accounts are kept. Responses reference people by name months afterwards, and an after-action review has to still say who was there. An account that is no longer needed is suspended rather than deleted: access is withdrawn, the record remains.
- Denied sign-ups are deleted. If an administrator turns down a request to join, that person's sign-in, profile and anything they had submitted are removed entirely.
- Location records outlive a response and are retained by the organization as part of its record of the work.
What the app does not do
- No advertising, and no advertising identifiers.
- No analytics or behavioural tracking.
- No sale or sharing of personal information.
- No background location.
- No accounts for children. The app is for authorized relief personnel and is not directed at anyone under 13.
Your choices
- Notifications can be turned off per location and per response inside the app, and entirely in your device settings.
- Location, camera, microphone and photo access are asked for at the point they are used, and can be withdrawn in your device settings. The map and the record will keep working; placing a location accurately will not.
- Signing out removes that device's notification token.
Changes
If this policy changes in a way that affects what is collected or who can see it, the effective date above will change and the organization will tell its members.