Rescue Ally Privacy Policy

Effective Date: 8/18/2025
Last Updated: 9/1/2026

1. Introduction

Rescue Ally ("we," "our," "us") is a field medicine documentation app that enables wilderness medicine practitioners to document patient care in remote settings. This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Rescue Ally mobile application and related services.

Important: This app is designed for medical practitioners to document patient information during wilderness medicine situations. We comply with:

HIPAA (U.S. Health Insurance Portability and Accountability Act)
CCPA/CPRA (California Consumer Privacy Act & California Privacy Rights Act)

If you do not agree with this Privacy Policy, please do not use our services.

2. Information We Collect

User Information You Provide

Account details: Name, email, phone number
Professional credentials: Wilderness medicine training status and certifications
Communications: Support requests and feedback

Patient Information You Document

Patient conditions
Vital signs
Treatments
Clinical notes as entered by you during field medicine situations

Information Collected Automatically

Location data: GPS coordinates when you enable location services during rescue operations
Device data: Device type, operating system version, app version
Usage data: App feature usage and crash logs for service improvement

SMS Communications

We optionally collect your phone number as a method of authentication (login) and to contact you about your account. We do not send promotional or marketing text messages. You can opt out by switching to email-based authentication. Read the full SMS Terms and Conditions and Privacy Policy for more information.

Email Communications

We use your email address to sign you in, to answer your support requests, and to send you notices about your account, your purchase, and changes to these policies.

We also occasionally send product email — for example, a one-time message to someone whose free trial ended, letting them know what their purchase options are. These are sent from a separate sending domain, every one of them carries an unsubscribe link, and we honor opt-outs immediately. Opting out of product email never affects sign-in or account email, which you need in order to use your account.

Assessment Sharing Records

When you share an assessment — as a message, as a direct app-to-app transfer, or as an exported file — we store a record in your account that the share happened: what was shared, how, and when. For message shares, that record includes the message text you sent. We keep these records specifically for HIPAA audit purposes: protected health information leaving the app is a disclosure, and an auditable record of when it happened, how, and from whose account is part of handling patient data responsibly. Share records sync across the devices you sign in on, the same way your assessments do, so an assessment's sharing history survives a lost or wiped phone. A message you have drafted but not yet sent stays on the device you wrote it on — drafts do not sync. They are stored under the same protections as the assessment they belong to, and they are deleted when you delete that assessment.

AI Scribe Audio (Preview Feature)

Rescue Ally includes an optional AI Scribe feature, currently in preview (free to use while we refine it; pricing has not yet been determined). When you choose to use Scribe:

On-device AI: Audio is recorded and transcribed, and observations are extracted, entirely on your device. Your recordings and transcripts are never sent to any third-party AI provider (such as OpenAI or Anthropic) for processing.
AI is not perfect: Scribe's transcripts and suggested observations are AI-generated and may contain errors. You are responsible for reviewing and correcting every observation before relying on it.
Improving the feature: If you accept the in-app Scribe Usage Agreement, your recordings (audio and transcript) are securely uploaded to Rescue Ally — and only to Rescue Ally — to help us improve the feature's accuracy. You can delete a recording at any time; deleting an assessment removes its audio from our servers. The full Scribe Usage Agreement is available on this site.

3. How We Use Your Information

We use your information to:

Provide and operate the field medicine documentation services
Enable secure documentation and transfer of patient information during medical handoffs
Sync your assessments, vitals, and related records across the devices you sign in on
Respond to your support requests
Send you account, purchase, and policy notices, and occasional product email you can unsubscribe from
Improve app features and security
Comply with legal and regulatory requirements

We will NEVER:

Sell any medical data
Share patient information except when you explicitly transfer it to other medical professionals
Use patient data for advertising or marketing purposes

4. Information Sharing

We may share your information with:

Medical professionals when you explicitly transfer patient data during handoffs
Your team, if you are a member of a team account — assessments you record under that team can be read by team members your team's administrator has authorized to do so
AWS (our cloud provider) under a signed HIPAA Business Associate Agreement for secure data storage
Payment processors — Apple, for purchases made through In-App Purchase, and Stripe, for purchases made on our website. They handle your payment details; we never see or store your card number.
Legal authorities when required by law

We do not use any third-party AI provider (such as OpenAI or Anthropic) to process your recordings or patient data. The AI Scribe feature runs entirely on your device, and recordings you choose to share to improve the feature are sent only to Rescue Ally (stored in AWS under our HIPAA Business Associate Agreement).

5. Data Security

We protect your information through:

Encryption: AES-256 encryption for data at rest and TLS encryption for data in transit
Access controls: Multi-factor authentication. Data within a user account is private to that account, with one exception you choose: if you join a team account, assessments you record under that team can also be read by the team members your administrator has authorized.
Secure infrastructure: HIPAA-compliant cloud services with our AWS Business Associate Agreement

6. Data Retention

Data Type	Retention Period	Reason
Account data	Until you delete your account or 24 months of inactivity	Service provision
Patient health information	7 years	HIPAA requirements
Location data	30 days after operation closes	Operational necessity
Support communications	3 years	Customer service
AI Scribe recordings (audio + transcript)	Until you delete the recording or its assessment	Feature improvement (with your consent)
Assessment share records	Until you delete the assessment they belong to	Handoff record keeping

7. Your Privacy Rights

HIPAA Rights (Healthcare Information)

Access and receive copies of your patient health information
Request corrections to patient health information
Request restrictions on use or disclosure
File complaints with the Department of Health and Human Services

California Rights (CCPA/CPRA)

Right to Know: What personal information we collect and how we use it
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: We do not sell personal information (opt-out not applicable)
Non-discrimination: We will not discriminate against you for exercising these rights

To exercise your rights: Use the Privacy Center, where you can download a copy of your data or request deletion of your assessments or your entire account. You can also visit our FAQ or email privacy@rescueally.org

8. Data Exports and File Sharing

When you export patient data (such as PDFs for medical handoffs):

You will receive clear warnings about maintaining HIPAA compliance
Exported files are stored in app-controlled space to prevent automatic cloud backups
You acknowledge responsibility for continued HIPAA compliance after export
All export activities are logged for audit purposes
Exported files include a random identifier for that specific export, and a link built from it, so a document can be traced back to its sharing record. The identifier is randomly generated and contains no information about you or the patient

9. Breach Notification

If a data breach occurs that affects your information, we will:

Notify you as soon as reasonably possible
Report to appropriate authorities as required by law (HHS for HIPAA breaches, California Attorney General for CCPA breaches)
Provide information about what happened and steps we're taking to address it

10. Children's Privacy

This app is designed for professional medical use and is not intended for children under 13. We do not knowingly collect personal information from children under 13 without parental consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification before they take effect.

12. Contact Us

Rescue Ally Privacy Team
Email: privacy@rescueally.org
Phone: +1 (303)-578-8161

For HIPAA-related questions or to file a complaint, you may also contact the Department of Health and Human Services Office for Civil Rights.

This privacy policy is designed to be clear and straightforward while meeting our compliance obligations. If you have questions about how we handle your information, please contact us.