Privacy Policy

CrowdCare is an emergency medical operations platform used by event medical teams, EMS agencies and venues (“customers”). It is operated by CloudClinic (“we”, “us”). This policy explains what information the CrowdCare app and website collect, how it is used and the choices you have. It applies to the CrowdCare web app at app.crowdcare.app, the CrowdCare mobile app, and this website.

Two kinds of people use CrowdCare

Staff users are clinicians, medics, coordinators and administrators who sign in with an account issued by their organization. Patients and the public do not have accounts; their information is entered by staff during care, or submitted by them through a public safety check-in page.

Information we collect

From staff users

• Account details: name, work email, phone, role, credentials and the organization you belong to.
• Activity in the app: records you create or edit, sign-in times, and an audit trail of actions, as required for medical record integrity.
• Device information: device type, operating system, app version, and, when you allow it, your location while on shift so dispatch can see where teams are.
• Camera and microphone, only when you use them: scanning a wristband or ID, photographing a document, or dictating a chart. Dictation audio is transcribed and then discarded; the transcript becomes part of the record.

About patients

• Identity and contact details, demographics, triage level, vitals, assessments, treatments, medications, transport and disposition, as documented by staff.
• Photos, when staff take them for identification or wound documentation.
• For reunification: missing and found person reports, descriptions, photos and last known locations. Photos may be compared with each other using automated face similarity to suggest possible matches; a trained coordinator reviews every suggested match before anything is acted on.

From the public safety check-in page

• What you choose to enter: your name, where you are, a contact number, and optionally a photo and whether you need help.

How information is used

• To deliver care and coordinate medical operations at an event.
• To reunite separated family members and friends.
• To produce the records and reports our customers are required to keep and file, including state EMS reporting (NEMSIS).
• To secure the service, prevent misuse and keep an audit trail.
• To support and improve the service. We do not sell personal information and we do not use health information for advertising.

Who information is shared with

• Your organization. Customer administrators control which staff can see which events, facilities and patients.
• Receiving facilities and agencies when a patient is transferred or transported.
• State and regulatory bodies where the customer is required to report.
• Service providers that host and operate the platform under contract and confidentiality obligations: cloud hosting and storage (Amazon Web Services), database hosting, email and SMS delivery, mapping, speech transcription and AI-assisted documentation. Providers process information only on our instructions.
• When required by law or to protect life and safety.

Health information and HIPAA

When CrowdCare is used by a covered entity or its business associate, protected health information is handled under a Business Associate Agreement with that customer. The customer is the owner and custodian of its patient records; we process them on the customer’s behalf.

Security

Data is encrypted in transit and at rest. Access is limited by role and by event assignment, every access and change is logged, and sessions expire. No system is perfectly secure; if we learn of a breach affecting you we will notify the affected customer and, where required, you.

Retention

Medical records are retained for as long as the customer and applicable law require, typically several years. Reunification reports are archived when an event closes. Account details are kept while the account is active.

Your choices and rights

• Staff users can delete their account at any time from Settings in the app. This closes the account and removes your name, email, phone number and password. Clinical records you documented remain part of the patient’s chart, as the law requires, attributed to a deleted user.
• Location, camera and microphone permissions can be turned off in your device settings at any time; the related features will stop working.
• Patients and members of the public who want to access, correct or delete information about them should contact the organization that provided care, since that organization controls the record. We will help the organization respond.
• Depending on where you live you may have additional rights under laws such as the CCPA or GDPR. Contact us to exercise them.

Children

CrowdCare accounts are for adult professionals. Patient records may describe minors, entered by staff or by a parent or guardian, because children receive care and get separated from their families at events.

Changes

We will post any changes to this policy here and update the date at the top. Material changes will be announced in the app.

Contact

Privacy questions and requests: privacy@crowdcare.app. Support: crowdcare.app/support.