Privacy policy
Last updated 30 September 2026
This policy explains how UCR Consulting (Pty) Ltd ("we") handles personal information in Incident Commander, in line with the Protection of Personal Information Act (POPIA).
Who is responsible
UCR Consulting (Pty) Ltd (registration 2022/249553/07), 22 Cross Road, Glenhazel, Johannesburg, South Africa. Our Information Officer is Uriel Rosen, registered with the Information Regulator (registration 2026-003267), and can be reached at support@incidentcommanders.com.
For information about incidents and patients, the organisation that uses Incident Commander (for example an ambulance or rescue service) is the responsible party. We process that information on its behalf, as its operator, and only to provide the service, under the data processing agreement each organisation accepts. For account and billing information, we are the responsible party.
What we collect
- Account details: email address, name as shown to the team, call sign and cellphone number if you add them.
- Incident and patient information entered by your organisation: triage results, descriptions, locations, photos, identification details for family reunification, messages and reports.
- Location when you choose to use GPS in the app.
- Technical details needed to run the service, such as device type for alerts and security logs.
- Billing details are collected and held by Paddle, our payment partner. We do not see or store card numbers.
How we use it
Only to provide and secure the service, to support your organisation, to send service emails and alerts, and to meet legal duties. We do not sell personal information or use patient information for advertising.
Who we share it with
- People in your own organisation, according to the roles your super admin sets.
- People you choose to send a scene share link to: they see only the scene map, never patient details.
- Service providers that host or support the service: Supabase (database, stored in the European Union), Netlify (website hosting), Google (maps), Paddle (payments), Resend (email), Anthropic (the optional "Ask the log" AI search: names, ID numbers, phone numbers and email addresses are removed before the log is sent, and Anthropic does not use it to train its models) and open map services (addresses and routes). They may only use the information to provide their service to us.
Information stored outside South Africa
The database is hosted in Frankfurt, Germany, in the European Union. POPIA (section 72) allows this because the EU's General Data Protection Regulation protects personal information at least as strongly as POPIA does, and our providers are bound by contract to protect it. Some providers (for example Google for maps, Resend for email and Anthropic for AI search) may process limited information in other countries under similar contractual protections.
Keeping it safe
Each organisation's information is kept separate by rules inside the database. All information is encrypted while it travels between your phone and our servers, access is by invitation, and each role only sees and changes what it needs.
How long we keep it
Incident and patient records are medical records and are kept until your organisation asks us to delete them. Account details are kept while your account is active.
When an incident is closed, the app downloads the full record (the debrief report, every record as a spreadsheet, the scene map and the photos) to the device of the person who closed it. It can be downloaded again from the debrief report. Your organisation is responsible for that copy: where it is stored, who can see it, how long it is kept and when it is deleted, in line with the laws that apply to it.
Your rights
You may ask to see, correct or delete your personal information, or object to how it is used. For patient information, contact the organisation that recorded it; we will help them respond. You may also complain to the Information Regulator of South Africa.
Contact
Information Officer: Uriel Rosen, support@incidentcommanders.com, UCR Consulting (Pty) Ltd, 22 Cross Road, Glenhazel, Johannesburg, South Africa.