1. Who this policy covers
This policy explains how EMS Matrix, LLC ("EMS Matrix", "we", "us") handles personal information in the EMS Matrix portal, mobile app and website. It applies to:
- Members: people an agency invites to use the app (crew, supervisors, administrators, medical directors).
- Agency contacts: people who sign up for, buy or administer the Service for an agency.
- Website visitors: people who visit emsmatrix.com or request a demo.
For members, the agency you belong to decides what the Service is used for and controls your records. We process your information on the agency's behalf and under its instructions. Questions about how your agency uses your records should go to your agency first.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, email, phone number, provider level, station, hire date; optional home address and emergency contacts | Your agency, or you |
| Credentials and training | Certification and license numbers, expiration dates, photos of certification cards, training and continuing-education records | You or your agency |
| Scheduling and time | Shifts, availability, trade and time-off requests, clock-in and clock-out times, timesheets, pay codes, payroll ID, notes you add | You and your agency |
| Location and network at clock-in and clock-out | Your phone's GPS position and the public IP address of your network at the moment you tap Clock In or Clock Out | Your phone and our servers, when your agency requires it |
| Other network addresses | The IP address recorded when you accept terms or confirm clinical content | Automatically |
| Messages, forms and documents | Messages, form submissions, attachments, acknowledgments | You |
| Uploaded files for import | Files and photos you upload for import | You or your agency |
| Device and app | Device type, operating system, app version, push-notification token, error reports | Automatically |
| Website and demo requests | Information you enter in a demo or contact form | You |
| Billing | Billing contact, invoices, payment status. Agencies pay by check; we do not collect card or bank account numbers | Agency contacts |
3. Location
- Clock in and out. If your agency requires location to clock in, the app reads your phone's location only when you tap Clock In or Clock Out. That position, and the network address you were on, are stored with the punch so your agency can review where it was made. Your agency's administrators, supervisors and payroll staff can see it, and it is included in your agency's records exports. It is kept with your agency's time records.
- Hospital directory. If you allow it, the app uses your phone's location to sort hospitals by distance. That location stays on your phone; it is not sent to or stored by EMS Matrix.
- No background tracking. The app asks only for location access while it is in use and does not record your location at any other time.
4. Patient information
EMS Matrix is intended for workforce and operations records, not patient care. Our terms prohibit agencies and members from entering patient names or other patient identifiers anywhere in the Service. If patient information is entered by mistake, report it to support@emsmatrix.com without repeating it; we will restrict access where technically possible, investigate, tell the agency, and remove the information or preserve it where the law requires.
5. How we use information
- To provide the Service to your agency: schedules, time clock, timesheets, credential reminders, messaging, forms, documents and protocol access.
- To produce the timesheet export files your agency downloads and sends to its own payroll provider. EMS Matrix does not process payroll.
- To apply your agency's time-clock rules and keep a record of where a punch was made for your agency's review.
- To store files and photos you upload for import until your agency reviews them.
- To send notifications you or your agency have turned on, by push or email.
- To secure the Service, prevent misuse, and investigate and fix problems.
- To keep audit records your agency relies on, such as who approved a protocol set and when.
- To improve the Service using de-identified, aggregated information.
- To meet legal obligations.
We do not sell or rent personal information and we do not share it for targeted advertising.
6. Artificial intelligence
- Uploaded files. Files and photos you upload for import (for example a certification card or roster) are reviewed and approved by a person. We do not use AI to read your uploads.
- Building and fixing the software. We use AI-assisted coding tools (from Anthropic and OpenAI) to build and maintain EMS Matrix. When we investigate a problem, these tools may see limited agency account data. They have read-only access. We do not store patient health information in EMS Matrix.
7. Who we share it with
- Your agency. Administrators and supervisors in your agency see the information their roles allow.
- Service providers (subprocessors) who process data for us under contract to run the Service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, file storage | United States (Virginia) |
| Render | Application hosting | United States (Ohio) |
| Cloudflare | Domain, network security, content delivery, and bot checks on public forms | Global network |
| Resend | Email delivery | United States |
| Expo (relayed by Apple and Google) | Push-notification delivery | United States |
| Sentry | Error and crash reports: error details, device, browser and app version, page path, and a random internal account and agency ID. Screenshots, session recordings and request contents are turned off. | United States |
| Anthropic | AI-assisted software development and debugging (Claude Code); read-only access to limited agency account data when investigating issues | United States |
| OpenAI | AI-assisted software development and debugging (Codex); read-only access to limited agency account data when investigating issues | United States |
- Your agency's payroll provider, only through export files your agency's administrators download and send themselves.
- Legal and safety. When required by law, subpoena or court order, or to protect the rights, safety or property of anyone.
- Business transfer. If EMS Matrix is acquired or merges, this policy continues to apply to the information transferred.
8. Cookies and similar technologies
The portal uses cookies needed to keep you signed in and, if you choose "Trust this computer" during two-step sign-in, a cookie that remembers that computer for 30 days. Public forms use a Cloudflare security check that may set its own cookie. Display preferences are stored in your browser. We do not use advertising cookies or website analytics.
9. How long we keep it
- Files uploaded for import are kept with the agency's data.
- After an agency's subscription ends and it confirms in writing that it is ending service, it may request a final export for thirty (30) days. After that period, we delete its data from our active systems within 30 days. Copies in our backups expire and are deleted within 7 days after that, so all copies are gone within 37 days after the export period ends, unless the law, a court order or a legal hold requires us to keep it.
- We do not delete an agency's data because its account is suspended, unpaid or inactive. Deletion happens only after the agency confirms it is ending service, and it is done by hand.
- We keep billing records, such as invoices, as long as tax and accounting law requires.
- If your agency removes you, your sign-in is disabled and your records stay with your agency as its records.
10. Security
We use encryption in transit, database-level separation between agencies, role-based access, two-step sign-in for EMS Matrix staff, logged and time-limited staff support access (view-only unless the agency turns on support changes for a session, or in an emergency needed to restore or protect the Service; every support session and change is logged), hashed storage of passwords and recovery codes, and audit logs. No system is perfectly secure. If we become aware of a security breach that affects your data, we will notify the affected agency without undue delay, and no later than 72 hours after we become aware of it. We will notify you directly where the law requires. Two-step sign-in is available to agency administrators, and each agency decides whether to require it.
11. Your choices and rights
- Access and correction. You can see and edit much of your own profile in the app. For personnel records your agency controls, ask your agency.
- Deleting your account. You can delete your account from Settings in the app or the portal, or by emailing support@emsmatrix.com. This removes your login, contact details, address and emergency contacts, notification settings and certification card images. Your name and your agency's records about your work (timesheets, punches, training records, acknowledgments, messages and form submissions) stay with your agency as its records, because employment and public-records laws may require it to keep them.
- Location. You can turn location off in your phone's settings. If your agency requires location to clock in, you may need to clock in another way your agency provides.
- Notifications. You can turn push notifications off in your phone's settings.
- State privacy rights. Depending on where you live, you may have rights to know, access, correct or delete personal information. Because we process member data for agencies, we may forward your request to your agency. We will not discriminate against you for exercising these rights.
12. Children
Members aged 13 to 17 may use the Service only after their agency obtains a parent's or guardian's consent. We do not allow anyone under 13 to use the Service and do not knowingly collect their information.
13. Changes
We will post changes here and update the date above. For material changes we will also notify agency administrators in the portal.
14. Contact
EMS Matrix, LLC
687 Ball Run Rd., Bidwell, OH 45614