Privacy Policy | Apollo EMS

1. Overview

This Privacy Policy explains how Apollo EMS collects, holds, uses, discloses, and otherwise handles personal information in connection with:

the Apollo EMS websites and applications;
tenant-hosted Apollo EMS environments;
mobile apps, APIs, and integrations;
support, onboarding, billing, and account administration;
related communications, notifications, and operational services.

Apollo EMS is designed for emergency medical services, event medical operations, rostering, workforce management, incident reporting, case and patient workflows, messaging, reporting, telematics, and related operational activities. Because the Service may be used in healthcare and safety-critical environments, Apollo EMS may handle personal information that is sensitive, including health information.

This Privacy Policy is intended to help individuals understand how Apollo EMS manages personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), and other applicable privacy and health-records requirements.

2. Apollo EMS's Role

Apollo EMS may handle personal information in two different roles:

2.1 Customer-controlled tenant data

Most information stored inside a customer's Apollo EMS tenant is controlled by that customer organisation. For example, an EMS provider, event medical provider, employer, clinic, or other customer may decide what patient, staff, client, shift, incident, payroll, and operational information is entered into the Service and why.

In that context, Apollo EMS generally provides the software platform and processes that information on the customer's behalf under contract.

2.2 Apollo EMS-controlled data

Apollo EMS may also handle personal information for its own business purposes, such as:

creating and administering accounts;
authenticating users and securing the Service;
providing support and onboarding;
managing subscriptions, invoices, and billing;
monitoring performance, errors, abuse, and platform security;
communicating service updates and important notices.

If you are a patient, worker, contractor, volunteer, or client whose information was entered into Apollo EMS by one of our customers, you should usually contact that customer first for questions about your records, access requests, correction requests, or privacy complaints relating to that information.

3. The Personal Information We Collect and Hold

The kinds of personal information Apollo EMS may collect and hold include:

3.1 Account and identity information

name, username, display name, title, and role;
email address, phone number, postal or business contact details;
organisation, tenant, and employment or engagement details;
authentication information such as password hashes, passkey credentials, refresh tokens, multi-factor status, and related security metadata.

3.2 Workforce and operational information

rosters, shift assignments, attendance, availability, qualifications, accreditations, equipment and uniform records;
payroll-related information, earnings rates, timesheets, and work history;
internal permissions, audit trail information, activity history, and administrative actions.

3.3 Patient, case, incident, and clinical information

patient identity and contact details where entered by a customer;
health information, case notes, incident details, injuries, treatment details, medications, clinical observations, and related records;
signatures, witness details, investigation records, attachments, and supporting evidence;
details about services provided to an individual, including event or case participation and outcome information.

3.4 Client and business information

client organisation names, contact people, contact details, booking details, and event information;
invoicing, billing contacts, subscription records, plan details, and transaction references.

3.5 Communications and content

messages, emails, SMS content, in-app notifications, push notification metadata, support requests, and feedback;
uploaded files, PDFs, forms, photos, videos, audio, and other attachments;
comments, canvas or note content, and structured workflow data submitted through the Service.

3.6 Device, usage, and technical information

IP address, browser type, operating system, app version, device identifiers, and approximate technical location data inferred from network traffic;
log data, request metadata, timestamps, page or screen activity, and security events;
crash reports, diagnostics, error context, and performance telemetry;
cookie, session, and preference information used to keep users signed in and maintain app settings.

3.7 Location and telematics information

GPS or location-related information, trip history, asset identifiers, timestamps, and telematics events where those features are enabled by a customer;
mapping or geospatial data associated with incidents, events, or tracked assets.

3.8 Integration and third-party data

information imported from or sent to customer-enabled integrations such as payroll, accounting, messaging, identity, mapping, or communication services;
profile and directory information provided by connected services;
metadata about third-party accounts or app connections.

4. How We Collect Personal Information

Apollo EMS may collect personal information:

directly from individuals when they sign up, sign in, use the Service, contact support, submit forms, upload files, respond to notifications, or interact with integrations;
from our customers and their authorised users when they create accounts, import records, upload documents, manage rosters, submit clinical records, or otherwise use the Service;
from devices, browsers, mobile apps, APIs, and logs generated when the Service is used;
from third-party services a customer or user connects to Apollo EMS, such as messaging, payroll, accounting, identity, push notification, mapping, or billing services;
from cookies and similar technologies used for authentication, preference storage, security, and diagnostics;
from publicly available or third-party sources where permitted by law and relevant to support, billing, compliance, fraud prevention, or service delivery.

In some cases, Apollo EMS may receive personal information indirectly because a customer organisation, employer, health service provider, or team administrator uploads or records it as part of their use of the Service.

5. Why We Collect, Hold, Use, and Disclose Personal Information

Apollo EMS may collect, hold, use, and disclose personal information to:

provide and operate the Service;
create and manage tenants, accounts, permissions, and authentication flows;
deliver rostering, case management, incident management, messaging, reporting, payroll, telematics, file management, and other product features;
communicate with users, including service notices, security alerts, reminders, notifications, and support responses;
send emails, SMS messages, push notifications, and other communications requested, configured, or authorised by a customer or user;
process subscriptions, invoicing, overage charges, and billing administration;
maintain audit trails, investigate misuse, detect fraud, and protect the security, integrity, and availability of the Service;
monitor service health, troubleshoot issues, improve performance, and develop or test features;
comply with legal obligations, lawful requests, professional obligations, regulatory requirements, and safety or emergency obligations;
support integrations or workflows chosen by a customer, including exporting, syncing, importing, or displaying relevant information in connected systems.

Where Apollo EMS handles health information or other sensitive information, we do so only as permitted by law, including where:

the information is needed to provide the relevant service or platform function;
the customer or individual has provided consent, or another person with authority has done so;
the collection, use, or disclosure is required or authorised by law;
the handling is reasonably necessary to lessen or prevent a serious threat to life, health, or safety;
the information is being processed on behalf of a customer that is itself responsible for the primary collection and use.

6. How We Disclose Personal Information

Apollo EMS may disclose personal information:

to the relevant customer organisation and its authorised users within that customer's tenant;
to service providers, contractors, and infrastructure providers who help us host, secure, support, monitor, communicate, and bill for the Service;
to third-party integration providers at the direction of a customer or user, such as accounting, payroll, messaging, mapping, identity, telematics, or communication services;
to payment processors and billing providers for subscription and invoice handling;
to communications providers to send email, SMS, and push notifications;
to professional advisers, auditors, insurers, and regulators where reasonably necessary;
to law enforcement, courts, regulators, emergency services, or other authorities where required or authorised by law;
to other parties where necessary to investigate unlawful conduct, protect rights, prevent fraud, respond to a security incident, or address a serious threat to life, health, or safety;
in connection with a business restructure, merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and legal safeguards.

Apollo EMS does not disclose customer tenant data to unrelated third parties for their own independent marketing purposes simply because they are a vendor. Where a customer enables an integration or authorises a communication, the relevant data may be disclosed to that recipient to carry out the requested function.

7. Optional Features, Integrations, and AI-Assisted Workflows

Apollo EMS supports a range of optional and customer-enabled features. Depending on configuration, relevant personal information may be processed through those features, including:

messaging and notification services;
payroll and accounting integrations;
mapping and geospatial services;
mobile push notification services;
telematics and asset-tracking workflows;
customer support and diagnostics tooling;
document extraction, workflow automation, MCP, or AI-assisted features and integrations.

If your organisation enables a third-party integration or AI-assisted workflow, the information disclosed will depend on the scope of that feature, your configuration, and the actions taken by authorised users. Customers are responsible for ensuring they have an appropriate legal basis, notice, and permissions for the data they choose to connect or transmit through optional integrations.

8. Cookies, Authentication, and Similar Technologies

Apollo EMS uses cookies and similar technologies for legitimate operational purposes, including:

keeping web users signed in and maintaining secure sessions;
storing authentication-related state such as refresh-token cookies;
saving product preferences, such as interface settings;
protecting the Service against misuse, fraud, and unauthorised access;
debugging issues, measuring performance, and supporting diagnostics.

Some of these technologies are essential to provide the Service and cannot reasonably be turned off without affecting functionality.

Apollo EMS may also collect app and browser diagnostics, including error reports, request metadata, console or network error data, and limited replay or session context where diagnostic tooling is enabled. This helps us troubleshoot issues and improve reliability.

9. Passkeys and Authentication Data

Apollo EMS supports passkey-based authentication in some environments. When a user uses a passkey, Apollo EMS may process public-key credential data, tenant/account identifiers, authentication challenges, timestamps, and related security metadata.

Apollo EMS does not receive the user's raw fingerprint, Face ID data, or other raw biometric template from their device. Biometric checks are handled by the user's device or platform authenticator.

10. Health Information and Other Sensitive Information

Because Apollo EMS may be used by emergency medical and related service providers, we may handle health information and other sensitive information. This can include information about injuries, illnesses, treatment, medications, clinical assessments, incident reports, signatures, employment and qualification records, telematics-derived behaviour, and other high-risk categories of personal information.

Apollo EMS takes the sensitivity of this information seriously. Access to this kind of data is generally restricted by tenant, permission, workflow, and feature controls. Even so, customers remain responsible for deciding what sensitive information they collect through Apollo EMS, for ensuring that collection is lawful, and for providing any notices, consents, and disclosures required in their context.

11. Overseas Disclosure

Apollo EMS is likely to disclose personal information to overseas recipients in some circumstances.

Where practicable, likely overseas disclosure locations include:

the United States, including where customers use services relating to communications, billing, diagnostics, mapping, mobile push infrastructure, AI-assisted tooling, or certain customer-enabled integrations;
New Zealand, including where customers use accounting or payroll integrations such as Xero;
other countries in which a customer's chosen integration provider, recipient, or service provider operates, where that disclosure is reasonably necessary to provide the relevant feature or communication.

Apollo EMS seeks to use reputable providers and appropriate contractual or technical safeguards where reasonable. However, customers should understand that enabling third-party integrations, sending communications to overseas recipients, or using optional external tools may result in cross-border disclosures.

12. How We Hold and Protect Personal Information

Apollo EMS holds personal information in a combination of cloud-hosted databases, secure object storage, application logs, backups, search indexes, support systems, and integrated services.

We use a range of technical and organisational measures designed to protect personal information, including measures such as:

access controls and authentication protections;
tenant separation and permission-based access;
encrypted or key-protected handling for some stored data;
HTTPS/TLS and other security controls for data in transit;
secure cloud infrastructure and private storage settings for restricted files;
audit, security, and operational logging;
token expiry, credential rotation, and other account-security measures.

No method of transmission over the internet or method of electronic storage is completely secure. While Apollo EMS takes reasonable steps to protect personal information, we cannot guarantee absolute security.

13. Data Quality and Retention

Apollo EMS takes reasonable steps to help ensure personal information we handle directly is accurate, up to date, and relevant for the purpose for which it is used.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

provide the Service and maintain customer records;
comply with contractual, legal, tax, accounting, regulatory, and audit obligations;
resolve disputes and enforce agreements;
investigate incidents, misuse, or security events;
maintain backups and disaster recovery processes.

Retention periods vary depending on the data type and context. For example:

customer tenant data is generally retained according to the customer's subscription, instructions, contractual terms, and legal obligations;
support, billing, and security records may be retained for a reasonable period after the relevant interaction or account relationship ends;
authentication tokens and session artefacts may expire automatically after a defined period.

When Apollo EMS no longer needs personal information, we take reasonable steps to delete, de-identify, archive, or otherwise handle it in accordance with applicable law and our operational requirements.

14. Access and Correction

If Apollo EMS holds personal information about you, you may request access to it and ask that it be corrected if it is inaccurate, out of date, incomplete, irrelevant, or misleading.

If your information is contained in a customer-controlled Apollo EMS tenant, you should contact the relevant customer organisation first. That organisation is usually best placed to action access and correction requests for patient, workforce, incident, payroll, and operational records it controls.

If Apollo EMS handles the relevant information directly, or if you are unsure who to contact, you can email [email protected]. We may need to verify your identity before processing a request, and we may refuse access or correction where permitted by law.

15. Complaints

If you believe Apollo EMS has breached the Privacy Act, the APPs, or otherwise mishandled your personal information, you may make a complaint by contacting [email protected].

Please include:

your name and contact details;
the organisation or tenant involved, if known;
a description of the concern;
relevant dates, accounts, documents, screenshots, or reference numbers;
the outcome you are seeking.

Apollo EMS will review the complaint and respond within a reasonable time. We may ask for more information to investigate.

If you are not satisfied with our response, or if the complaint relates to a customer-controlled tenant and remains unresolved, you may also contact the Office of the Australian Information Commissioner ("OAIC") or any other applicable regulator.

16. Direct Marketing and Service Messages

Apollo EMS may send administrative, operational, security, billing, and service-related communications that are necessary to provide the Service.

If Apollo EMS sends marketing communications directly for its own products or services, we will do so in accordance with applicable law. Individuals can opt out of marketing communications using the unsubscribe method provided or by contacting us.

Customer organisations are responsible for ensuring their own use of Apollo EMS messaging, SMS, email, and notification features complies with applicable privacy, spam, and telecommunications laws.

17. Anonymity and Pseudonymity

Where lawful and practical, individuals may interact with Apollo EMS without identifying themselves, or by using a pseudonym, such as when making a general enquiry.

However, in many cases this is not practical because Apollo EMS is used for authenticated, auditable, and operationally significant workflows involving identity, access control, clinical records, payroll, rosters, incident records, or legal compliance.

18. Changes to This Policy

Apollo EMS may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, technology, security practices, or operational needs. The current version published by Apollo EMS will apply from its stated effective date.

19. Contact

For privacy questions, access requests, correction requests, or complaints, contact:

[email protected]