HSE / National Ambulance Service (NAS) Community First responder (CFR) App privacy notice
Your privacy and data security are very important to us.
The HSE own and manage the NAS CFR App. We aim to be clear and transparent about the information that we collect about you and how we use it.
On this page you will find information about:
- the personal data we collect and what we use it for
- how long we hold onto your personal data
- who has access to your personal data
- your rights to your data
- how to make a complaint
- the role of the data controller and the data protection officer (DPO)
Using the app is your choice
It’s your choice if you want to download, use or delete the app. You do not have to use the CFR app to be a Community First Responder.
Deactivate your account / Deleting the app from your device.
You can deactivate your app account by logging out of the App. Logging in will reactivate your account. Uninstalling the App will completely remove your account and the app from your device.
This will pause your account, including push notifications if you have allowed these. You can reactivate your account by logging back into the app.
How to securely use the app
To use the CFR App you must:
- be part of an approved CFR scheme.
- be registered to use the CFR App.
- meet the minimum requirements to hold a CFR certificate.
- be in date (current) with all your mandatory certificates.
- have an up-to-date iOS or Android device.
To access your personal information on the app you will need:
- to engage with your local scheme co-ordinator to update/amend information relevant to you profile
Once you are authenticated, you must be logged into the app to view your profile.
Types of personal data we use
Your personal data is ‘processed’ when anything is done with it. For example, when it is collected or reviewed.
We process data about your:
- name – this is so we can correctly identify you and match you to your CFR scheme
- email address – to allow you to access and authenticate your profile and to allow use of two-factor-authentication if you get locked out of the app. This will allow a code to be sent to you via email
- mobile number – mobile phone numbers are stored to enable alternative communication in the event of an issue with the App. (e.g. SMS)
- location – this is so we can use maps to provide you with directions to the current incident you are agreeing to respond too
- use of the app – this is to improve the app and report how CFRs are contributing to support patient care in your community
You must give permission for your location data to be used to help you navigate from your current location at the time you receive an alert through to the location of the incident. We do not use location data for tracking, profiling or any other purpose.
How we process your personal data
We collect your personal data to support the response provided by CFRs. We do this in compliance with the GDPR and other relevant laws.
When you download the app, you can log in with one-time-only credentials. We will not process your personal data until you are successfully logged in.
You can use the app without logging in. But you will only be able to view general information e.g. the Become a CFR website. We will not process your personal data in the app if you are not successfully logged in.
Why we use your personal data
We use your data:
- so that the CFR App works correctly
- to give you access to information to support your response to an incident
- to communicate with you through the app
- share relevant incident information
Communicating with you
We use the CFR app to communicate with you about:
- information relating to an incident that you require to allow you to respond to an incident
- provide you with updates as you travel safely to an incident
- removing you from an incident to support and protect you, if we become aware that a scene is not safe.
- we may follow up with you after an incident to discuss your experience and put in place when necessary and in agreement with you, mechanisms and support to help you
If you do not log in to the app, you can still access general information taken from our website here.
Who can access your personal data
Only people who directly work on the app and who are authorised will have access to personal data in the app.
This includes:
- HSE staff who manage the operations and security of the app
- agents – such as customer care agents who provide customer support to users
- suppliers – such as Nearform and Amazon Web Services (AWS) whose technology we use
Access to your personal data depends on the role a person has. This is monitored to make sure that there is no unauthorised access.
Anyone who has access to personal data is bound by confidentiality and data protection agreements. They must keep your personal data secure and use it only for the purposes agreed with us.
How long we store your data
You can stop using the app at any time. If you delete the app, all your personal data in the app will be deleted from your phone.
You have the right to request to have your personal data removed from this service if you withdraw as a CFR responder, through your CFR Scheme co-ordinator. If you withdraw from the CFR scheme you will not receive any more responder alerts.
Read the summary of our Data Protection Impact Assessment (DPIA). This contains information on how we have developed the app in compliance with our data protection responsibilities.
Making a complaint
If you are not happy with how we are processing your personal data you can contact your local Community Engagement Officer here.
Alternatively you can contact our Data Protection Officer (DPO). The DPO ensures that we are compliant with data protection.
You can also make a complaint directly to the Data Protection Commission.
If there’s a problem with your personal data
If your information in the app is wrong or inaccurate you can contact your CFR Scheme co-ordinator who will be able to assist and update your personal data. If this cannot be resolved this can be escalated to your local Community Engagement Officer.
Data controllers
A data controller is an organisation or person that decides what data is processed. They also decide how and why this needs to be done. They are legally responsible for that data.
Data controllers involved in the app are:
- National Ambulance Service
National Ambulance Service
We are the data controller for all personal data collected and used by the app.
Data processors
Data processors are appointed by data controllers. A data processor is an organisation or person that processes data.
Data processors have contracts and agreements with us to process personal data in the app. They cannot process or transfer personal data in the app outside the European Economic Area (EEA).
Data processors include:
- Nearform – support for delivery and the backend tools
- Amazon – offers compute, storage and networking and hosts app components
- Cryo – security testing team who ensure the app is secure
Some of these data processors use sub-processors. Sub-processors cannot process or transfer personal data outside the EEA.
Sub-processors include:
- DataDog – used by Nearform to gather anonymous strictly necessary analytics
- Edgescan – used by Waystone as part of security testing
Your rights under GDPR
Under the GDPR, you have the right to:
- request a copy of the personal data we hold about you and to check that we are lawfully processing it
- have any incomplete or inaccurate information we hold about you corrected
- object to the processing of your personal data
- ask us to delete or remove personal data where there is no good reason for us to process it or where you have made an objection
- object to us making any automated decisions about you based on your personal data or profiling of you
- request to restrict or suspend the processing of your personal data
- request the transfer of your personal data in an electronic and structured way to you or someone else
How to exercise your rights
You can exercise your rights in a number of ways. These include:
- submit a data request
- contact your local Community Engagement Officer here.
- contact a Data Protection Officer (DPO)
- Requesting information from the HSE
Analytics data we process
We collect data about how you use the app. This is strictly necessary data. We do this so that we can check the security and essential operations of the app. The tools are set automatically.
We also collect this information to help us improve the app and report how CFRs are contributing to support patient care in your community
We also use optional analytics. This is to help us understand more about how you use the app and to plan for future updates. You can opt in or out of these analytics in the app settings.