1. Who we are
SafeNurse is the trading name used for this service. The legal controller is Think X Intelligent Systems LTD, company number 706889, with registered address Currygrane, Ballinalee, Co. Longford, N39 AE76, Ireland.
General and interim privacy enquiries: hello@safenurse.ie. Privacy contact: [LEGAL REVIEW REQUIRED: confirm privacy contact; hello@safenurse.ie is used pending confirmation]. DPO: We have not appointed a dedicated Data Protection Officer.
This policy covers the public website, enquiries, direct customer and account administration, and the SafeNurse platform preview. The iOS and Android apps are in preparation; future app permissions must be described in an app-specific notice before release.
2. Our data-protection roles
SafeNurse acts as a controller when it decides how and why to process public-website data, enquiries, direct customer administration, marketing preferences and platform account administration.
Where an employer, healthcare organisation, agency or other customer decides why and how workforce safety-session data is used, that organisation will normally be the controller and SafeNurse may act as its processor under written instructions. SafeNurse may still be an independent controller for account security, billing or legal-compliance records where it makes those decisions.
The customer organisation is responsible for its own lawful and transparent use of employee or contractor monitoring and safety information, including selecting a lawful basis and meeting employment obligations. Employee consent is not automatically appropriate: because of the power imbalance at work it may not be freely given. This explanation does not advise customers which basis applies to them.
3. Personal data we handle
Website visitors and enquiries
Server requests may expose IP address, requested page, browser, operating system, device and diagnostic information. If you contact us, we receive the details and content you provide. No public enquiry form was found in this repository.
Accounts, users and contacts
The current API handles name, email address, password hash, account role, bearer-session records, iOS/Android device tokens, and manager/professional relationship requests, approvals and revocations. The app also stores a safety-PIN hash and salt and daytime ICE contact name, phone and email locally on the device.
Safety and operational data
The code handles session start and end times, chosen check-in interval, check-ins, missed-timer status on the device, timestamps, Eircode or manually entered location, latitude and longitude, location updates, emergency alerts, approved recipients, acknowledgement, optional safe-resolution notes, event history, and mileage entries and notes. Manager views can include professional name, email, alert location and status. Notification device tokens are accepted by the API, but no external delivery implementation or delivery-status records were found.
Analytics and similar technologies
With consent, Google Analytics measurement ID G-KWE0QLT2G9 may collect online identifiers and information about pages, sessions, device/browser characteristics and approximate location derived from network information. See the Cookie Policy. Analytics is off until accepted.
4. Purposes, legal bases, recipients and retention
Where SafeNurse is a processor, the customer determines the Article 6 basis and any Article 9 condition; the table describes SafeNurse’s likely controller activities and the platform’s instructed processing. Final bases and periods require approval before launch.
| Data category | Purpose | Lawful basis | Typical recipients | Retention |
|---|---|---|---|---|
| Enquiries and prospective-customer details | Reply, assess needs and manage follow-up | Legitimate interests; steps requested before a contract; consent for optional electronic marketing | Authorised SafeNurse staff; approved communications providers | 12 months |
| Account, identity, organisation and role | Create/administer accounts, provide service, customer administration | Contract or steps before contract; legitimate interests; customer instructions where processor | Authorised staff; customer administrators; service providers | 12 months |
| Passwords, bearer sessions, device tokens, IP/device/security logs | Authentication, security, fraud and misuse prevention, notifications if later activated | Contract; legitimate interests; legal obligations where applicable | Authorised technical staff; hosting/security providers | API bearer sessions expire after 14 days; retention of session records and other security logs is not defined. |
| Safety sessions, check-ins, timestamps, location, alerts, acknowledgements, resolution notes and audit events | Provide the lone-worker safety record and enable approved response | Customer’s chosen basis and instructions where SafeNurse is processor; contract/legitimate interests for direct individual service, subject to Article 9 analysis | User; approved managers/contacts; customer administrators as authorised; service providers | 12 months |
| Access requests, approvals, refusals and revocations | Control and evidence access to new alerts | Contract; legitimate interests; customer instructions | Professional and manager concerned; authorised customer administrators | 12 months |
| ICE contact details | Keep emergency-contact information on the user’s device in the preview | Steps requested by the user; legitimate interests; customer basis where applicable | User/device only in current code | 12 months |
| Support communications and diagnostics | Troubleshoot, respond and improve reliability | Contract; legitimate interests; legal claims | Authorised staff and relevant service providers | 12 months |
| Google Analytics information | Measure website visits and use | Consent | SafeNurse; Google as configured provider | Google Analytics cookies use Google’s configured default duration of up to 2 years; Analytics property-level data retention is not confirmed. |
| Cookie preference record | Remember and demonstrate your choice | Legal obligation and legitimate interests; necessary storage under ePrivacy rules | SafeNurse; stored in your browser | 180 days after the choice, unless replaced or browser storage is cleared. |
We apply data minimisation and ask users and customers to keep information accurate. You can ask us to delete your details from the system at any time, and we will complete the deletion within 7 days.
5. Location and special-category information
The current app requests a one-off, high-accuracy device position when a user selects a location action or prepares an emergency alert. It also accepts coordinates or an Eircode entered manually. No continuous or background-location watcher was found. Current location and safety state persist in browser storage, and coordinates submitted in check-ins or alerts are stored by the API.
Location, visit patterns, incident details or resolution notes may reveal or allow inferences about health, disability, trade-union activity, religion or other special-category information, even when SafeNurse does not ask for it directly. Customers should prevent unnecessary sensitive detail in free text.
Where Article 9 applies, an Article 6 basis alone is insufficient. The relevant controller must identify and document a valid Article 9 condition before processing—for example employment/social-protection law obligations where supported by Union or Member State law, vital interests in the narrow circumstances where the person cannot consent, or explicit consent where it is genuinely freely given. SafeNurse has not selected one condition for every customer context.
7. International transfers
The SafeNurse system is hosted on Amazon Web Services in its Dublin, Ireland data centres, operated for us by Think X Intelligent Systems LTD. Some data may be transferred outside the EEA by Google (Google Analytics) and GatewayAPI (SMS messaging). Where this happens, the transfer relies on the safeguards those providers offer under GDPR, such as Standard Contractual Clauses or an adequacy decision. Before any transfer outside the EEA, the controller must confirm an adequacy decision or another lawful safeguard (such as approved Standard Contractual Clauses), complete any necessary transfer assessment, and make relevant information available on request.
8. Security and personal-data breaches
Measures visible in the repository include password hashing, hashed API tokens, 14-day session expiry, parameterised database queries, explicit CORS origins, a Content Security Policy in the app, consent-based access relationships and input validation. No system can be guaranteed secure. Sensitive state and the bearer token currently use web local storage; native secure credential storage, server-side rate limiting, complete role controls, encryption and operational monitoring were not evidenced.
SafeNurse must assess suspected personal-data breaches, limit harm, document decisions, notify the relevant controller without undue delay when acting as processor, and notify the DPC and affected people where GDPR thresholds require it. A documented breach-response procedure is not present in the repository.
No solely automated decision-making producing legal or similarly significant effects, and no profiling, was found. A countdown becoming overdue only changes on-screen text; it does not automatically escalate.
9. Is providing information mandatory?
Website browsing does not require analytics consent. Contact details are needed if you want a reply. Name, email and a password are required by the present account-registration API. Location text is required to record a check-in or alert, although coordinates are optional; without it that action cannot be recorded. Relationship details are needed to connect a professional and manager. Refusing optional data or analytics does not block the public website. An organisation may separately require workforce information under its own policy and legal basis.
10. Your data-protection rights
Depending on the circumstances, you may request access, correction, erasure, restriction, objection, or portability. You may withdraw consent at any time where consent is the basis, without affecting earlier lawful processing. Rights can be limited by law and portability applies only in specified cases.
Contact hello@safenurse.ie. If an organisational customer controls your safety data, contact it first; SafeNurse will assist the controller as required. Identity checks may be necessary. No documented data-subject request procedure was found.
You may complain to the Irish Data Protection Commission through its online contact form, at dataprotection.ie, or by post to Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. The DPC recommends first raising the issue with the organisation concerned.
11. Children
The platform is intended for working healthcare professionals and managers, not children. You must be at least 16 to use SafeNurse. Do not create an account for a child or submit children’s data unless the responsible controller has confirmed a lawful, necessary use and appropriate safeguards.
12. Changes and contact
We may update this policy as the service, providers or law changes. Material changes should be brought to users’ attention where appropriate. The effective date and version above show the current publication.
Questions: hello@safenurse.ie. This policy must be approved by an Irish solicitor and data-protection specialist before production launch.