Legal & privacy
Privacy Policy
A clear account of how AmbuCAD handles information, who can access it, and the choices available to you.
Document status
Last updated 10 August 2026 · Privacy contact: info@ambucad.co.uk
Who this policy is for
AmbuCAD is an operational coordination platform for event medical teams and private ambulance services. This policy describes the information processed through an AmbuCAD workspace, public website, and account services.
Customer workspaces: the organisation that creates a workspace normally decides why and how event, staff, job, communications, and location information is used. That organisation is normally the data controller, and AmbuCAD acts as its service provider or processor under the customer agreement.
AmbuCAD account and service information: AmbuCAD may act as controller for account administration, billing, service security, support, and website operation. For privacy questions, contact info@ambucad.co.uk. The final legal-entity and registered-address details must be confirmed before public launch.
Information we handle
Depending on how your organisation uses AmbuCAD, this may include names, email addresses, usernames, company membership, roles, clinical grades, account security records, event and job details, team status, operational messages, audit logs, vehicle information, and support correspondence.
AmbuCAD’s Data Handling Rules prohibit patient-identifying information. Non-identifying presenting complaints and pertinent operational notes may be used when required. Caller name and phone number are limited to a genuine operational callback and must not be patient details. On Duty may request location only for an active team assignment.
How information is used
Information is used to authenticate users, provide the workspace, coordinate response activity, maintain operational and audit history, secure the service, provide support, and meet legal or contractual obligations. AmbuCAD does not use customer operational data for advertising.
AmbuCAD uses TomTom for map display, address search and traffic-aware routing. Only the address or coordinates needed for that feature are sent to TomTom; patient details, clinical notes, messages and free-text operational notes are not sent to mapping providers.
Lawful basis & permissions
The customer is responsible for identifying an appropriate lawful basis and giving any required notices for information entered into its workspace, including workforce, patient, incident, and location information. AmbuCAD relies on the customer agreement and legitimate interests or legal obligations for its own account, security, and service administration, and will obtain consent where a feature legally requires it.
Access, retention & security
Access is limited by account, company, event assignment, and role permissions. Site administrators do not have routine in-app access to company event data and cannot act as a company administrator. An exceptional request requires completed documentation from the company owner and is handled outside the routine product workflow.
Companies can retain GPS history for 30, 60, or 90 days; the default is 30 days. When an account or company is archived, access and active credentials are revoked while clinical, operational, and audit evidence is retained where needed for accountability, legal obligations, or the organisation’s approved retention schedule. Account-export files are expired and removed after their short-lived access period. AmbuCAD operational data is stored on the AmbuCAD server and is not replicated to an off-site backup service.
AmbuCAD uses authenticated access, role permissions, protected session cookies, password hashing, encrypted MFA secrets, HTTPS in production, and audit records to help protect the service.
Your rights and requests
Depending on applicable law, people may have rights to access, correct, erase, restrict, object to, or receive a copy of their personal information. Signed-in users can use Privacy & data to request an account export or archive their account. An archive revokes access; it does not erase clinical, operational, or audit evidence that must be retained.
Contact your organisation’s AmbuCAD administrator first for workspace data, or info@ambucad.co.uk for AmbuCAD account or website information.
Changes & contact
We will update this page when the service, providers, or legal requirements change. For privacy questions or requests, contact your organisation’s AmbuCAD administrator or info@ambucad.co.uk.