← Back to the app

Privacy notice — Major Incident Triage

Last updated: 30 October 2026. Written from how the app works at version 0.17.5; review it whenever the server, hosting or data handling change.

Who we are

Major Incident Triage is published by West Midlands Evidence Based Emergency Medicine Ltd (trading as EM Evidence), a company registered in England and Wales, company number 16644703, registered office 128 City Road, London, EC1V 2NX, which is the data controller for any personal data handled by the app's live-sharing server. It is registered with the Information Commissioner's Office (ICO) under registration number ZC277974. For any privacy question or request, email hello@emevidence.org.

What the app is

A tool for trained responders to log major incident triage (NHS England Ten Second Triage and Major Incident Triage Tool), interventions, positions and handovers. Intended purpose: training and exercise use only. Not for use with real patients. It is not a medical device and has not been approved for clinical use.

Information about casualties

• Records are about casualties, not about you. The app never asks for a name, date of birth or NHS number, and asks you not to enter patient-identifiable details in the free-text fields.
• Records stay on the device, in the browser's storage, until you close the incident. The app works with no internet connection.
• A record moves to another device only when you choose to: by QR code or by a file you save and send yourself.

Live sharing with a commander screen (optional)

• If you start or join live sharing, the device sends its records (triage category, timings, interventions, injuries, positions, the sector and place labels, free-text notes, your typed name, whether you signed in as a clinician and the sector you chose, the device's random code, its battery level and whether it is charging, and the app version) and any METHANE report over HTTPS to a small server, so an incident commander can see them on one screen protected by an incident code and PIN.
• The server is run for us by Netlify (Netlify Functions), set to run in Netlify's London (UK) region. Netlify also processes standard web server data (such as IP address and browser type) to deliver the site.
• The shared records are kept in Google Cloud Firestore in London (europe-west2), in the UK. Netlify and Google are both based in the United States and provide safeguards for international transfers under UK data protection law.
• Wrong-PIN attempts are counted against a hashed form of the connecting address for 15 minutes, to stop guessing; the address itself is not stored.
• Your own position (optional, off by default). When linking to an incident the app asks once whether to share your phone's position with the commander. If you say yes, the latest position (with its accuracy and time) goes with each report, about once a minute, so the commander can see where each triager is. Only people with the incident's code or PIN can see it; the server keeps only the latest position for each phone and deletes it with the incident. You can turn it on or off at any time in Settings → Share live. Saying no changes nothing else about the app.
• Call for help. Holding the 🆘 button sends an immediate report to the commander screen with your typed name, the time and your phone's position at that moment (the position is sent with a call for help even if position sharing is off, because it is what the commander needs to reach you). The call stays on the commander screen until you or the commander clears it; both are written to the audit trail on your phone.
• The server copy is deleted automatically 24 hours after the last update, or immediately when the phone that started the incident chooses End incident for everyone. You can stop sharing from your own device at any time.

Location

With your permission the app uses the device's location to record where each casualty was found and where the casualty clearing station is. Location is used on the device and is sent to the commander screen only as part of live sharing: casualty positions with each record, and your own position only if you choose to share it or call for help (see above). You can refuse or revoke the permission in the browser or phone settings; the app then records sector and place labels instead.

Camera

The camera is used to scan QR codes shown by other devices, to scan barcodes on triage tags and wristbands, and to read a printed tag number from a photo. Reading the printed number happens on the device (the text reader is downloaded once); no images are stored or sent anywhere.

Microphone (voice notes)

If you choose to dictate a note, the app uses the browser's speech recognition. Depending on the browser, the recording may be sent to the browser maker's online speech service (for example Google for Chrome, or Apple for Safari) to be turned into text; the app itself stores only the text. For this reason voice notes are available in training mode only: in real use the button is hidden, so no recording about a real casualty leaves the phone. Type the note instead.

What we do not do

• No accounts, no sign-in, no analytics, no advertising, no crash reporting and no cookies.
• Nothing is sold or shared with anyone else, apart from the browser's own speech service if you dictate a note (above). The map tiles are loaded from OpenStreetMap when you open the map, which sees the standard web request for each tile.

Android app

The Google Play app is the same web app opened in Chrome. The data above is held by Chrome on your phone; the app itself stores nothing and excludes everything from cloud backup.

Your rights

You can ask to see, correct or delete any information we hold by emailing us. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office.