RAPSA Lone Worker Privacy Policy

Effective date: 23 July 2026

This policy explains how the RAPSA Lone Worker Android application (“the App”) handles personal data. The organisation that gives you access to RAPSA normally acts as the data controller. TurvaTools provides and maintains the App and processes data on that organisation’s instructions.

Data the App handles

• Account data: name, work contact details, user and organisation identifiers, role, authentication status, and sign-in/session tokens.
• Lone-worker and operational data: shift state, check-in timers, safety status, alarms, acknowledgements, notes, event history, and timestamps.
• Location data: precise or approximate device location when you choose to provide it or when location monitoring is enabled for an active lone-worker shift. Location may be processed while the App is in the background so that safety monitoring can continue.
• Device and notification data: device and app version, push-notification token, notification delivery and acknowledgement status, connectivity state, and technical diagnostics needed to operate and secure the service.
• User-provided content: text, photographs, documents, camera input, or NFC tag information that you deliberately submit through RAPSA features.

Why data is used

Data is used to authenticate users, provide lone-worker monitoring, transmit safety alarms, show operational information, deliver and acknowledge notifications, investigate faults, prevent misuse, and meet the controller’s workplace-safety and legal obligations. The App does not sell personal data or use it for third-party advertising.

Permissions and choices

Location, notifications, camera, photos/files, and NFC are used only for the related App features. Optional permissions can be refused or changed in Android settings, although the related feature may then be unavailable. Location can be omitted when starting a shift where the controller permits this. The App does not access contacts, call logs, or advertising identifiers.

Sharing and service providers

Data is available to authorised users of your organisation and may be shared with its designated alarm receiving centre or safety personnel when required to respond to an alarm. Technical providers, including hosting and Google Firebase Cloud Messaging for push delivery, may process limited data on behalf of TurvaTools or the controller. Data may also be disclosed where required by law or to protect life, security, or legal rights. Personal data is not shared for independent marketing.

Storage, retention, and deletion

RAPSA stores service records for the periods configured by the controller or required by its contract and applicable law. Retention therefore depends on the organisation and the type of safety record. Session information and limited cached operational data are stored on the device and are removed when you sign out, clear the App’s data, or uninstall it. Push tokens are replaced or disabled when no longer needed. Backups and security logs may remain for a limited recovery or fraud-prevention period before scheduled deletion.

To request access, correction, restriction, export, or deletion, contact the organisation that issued your RAPSA account. It will assess the request under applicable law and any workplace-safety recordkeeping duties. For App privacy or technical questions, contact support@turvatools.com.

Security

The App uses encrypted HTTPS connections, protected authentication tokens, access controls, and operational logging. No internet service can guarantee absolute security, but access is limited to people and providers who need it for the purposes described above.

International transfers and children

Where a provider processes data outside the European Economic Area, appropriate safeguards required by applicable data-protection law are used. The App is a workplace-safety service and is not directed to children.

Changes

This policy may be updated when the App, providers, or legal requirements change. The effective date above identifies the current version.