Privacy Policy · SENTINEL 971

This Privacy Policy explains how The Goldens Cards ("we", "us", "our") collects, uses, shares and protects personal data when you use the SENTINEL 971 mobile application for iOS and Android, its web application, and this website (together, the "Service"). We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and other applicable laws.

1. Who we are

The Goldens Cards
Abu Dhabi, United Arab Emirates
Trade licence CN-4119980
Support: https://sentinel971.tgsad.dev/support

2. Scope — a simulation and training app

SENTINEL 971 is a simulation and training application for emergency dispatch and EMS workflows. It is not connected to any live emergency service, and all calls, incidents, callers, patients and locations in training scenarios are simulated or fictitious. Users must not enter real patient or third-party personal data. The personal data we process is therefore mainly the data of our users themselves (account, training activity and support requests), for which we act as the controller. Where a training centre enrols its trainees, that centre may also act as controller of its trainees' training records, and we process them on its behalf.

3. Data we collect

a) Data you provide

Account data: name, email address, phone number, role, organisation, station and profile photo (optional), and your password (stored only in hashed form by our authentication provider).
Training activity: the scenarios you run and the actions, notes, reports, scores and timings you record in them. Scenario content is fictitious (see section 7).
Support data: what you send us in a support ticket or account deletion request — name, email, platform, and the content of your messages.

b) Data collected automatically

Location data, only if you allow it and only during scenarios that use it (see section 6).
Device and log data: device model, operating system version, app version, IP address, time of access, and crash and error reports needed to keep the Service working and secure.
Permissions you grant: the app may ask for location, camera (to attach images such as ECG strips), microphone or notifications. Each is used only for the feature you use, and you can turn it off at any time in your device settings.

4. How we use data

To provide the Service: run simulated calls, incidents, dispatch, unit tracking, patient care reports and hospital pre-alerts, and to record and show your training results.
To create and manage your account, authenticate you and apply your role permissions.
To keep the Service safe and reliable: security monitoring, fraud and abuse prevention, troubleshooting and audit logs.
To answer support tickets and requests, and to send service messages (for example ticket replies or security notices).
To meet legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not use your personal data to train AI models.

5. Legal basis

We process personal data because it is necessary to perform our contract with you or your organisation, to comply with legal obligations, for our legitimate interest in keeping the Service secure and improving it, or on the basis of your consent where required (for example optional device permissions). You may withdraw consent at any time without affecting earlier processing.

6. Location data

Unit positions shown in training scenarios are simulated. Some exercises (for example field drills) may use your device's location to place your training unit on the map. This happens only if you grant location permission, only while you are signed in to that exercise, and is visible only to participants and instructors of that exercise. You can turn location off at any time in your device settings; the rest of the app keeps working.

7. Simulated patient data — no real health data

The electronic Patient Care Report and other clinical screens are used only with fictitious patients created for training scenarios. Names, ID numbers, vital signs and other details in scenarios are invented. Users must not enter real patient information, real Emirates ID numbers or any other real health data. If real data is entered by mistake, tell us through the support page and we will delete it promptly.

8. How we share data

We share personal data only when needed and only with:

Your training organisation and instructors, who can see the training activity and results of trainees they manage.
Other participants in the same exercise, who see your name, role and actions within that exercise.
Service providers who host and run the Service for us under written confidentiality and data-protection terms — for example cloud hosting, database and authentication providers, mapping and tracking services used in exercises, and email delivery for support messages. They may use the data only to provide their service to us.
Authorities, when required by UAE law, a court order or a lawful request from a competent government authority, or when necessary to protect someone's life or safety.
A successor in the event of a merger or transfer of the business, under the same protections as this policy.

9. International transfers

Some of our service providers may process data on servers outside the UAE. Where this happens we transfer data only as permitted by the PDPL and applicable sector rules, and we use contractual and technical safeguards to protect it.

10. How long we keep data

Account data: while your account is active. After deletion, it is removed within 30 days, except where we must keep it as explained below.
Training activity and results: while your account is active, and deleted with your account. If a training organisation enrolled you, it may keep a record of your results for its own course records.
Support tickets: up to 24 months after the ticket is closed, then deleted.
Security and audit logs: up to 12 months, unless needed longer to investigate an incident.
Backups: deleted data disappears from rolling backups within a further 30 days.

11. Security

We use encrypted connections (HTTPS/TLS) for all traffic, encryption at rest provided by our hosting providers, hashed passwords, role-based access control, access logging and regular updates. No system is perfectly secure; if we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as required by law.

12. Your rights

Subject to applicable law, you have the right to: access your personal data and receive a copy; correct inaccurate data; delete your data; restrict or object to processing; withdraw consent; and data portability. You may also complain to the UAE Data Office or the competent authority. To use any right, open a ticket under "Privacy / personal data request" on our support page. We will respond within 30 days and may need to verify your identity first.

13. Deleting your account

You can delete your SENTINEL 971 account at any time inside the app or by submitting a request on our account deletion page. Section 10 explains what is deleted and what must be kept.

14. Children

The Service is intended for adult trainees and professionals and is not directed to children. User accounts are not available to anyone under 18, and we do not knowingly collect personal data from children. Scenarios may include fictitious patients of any age.

15. Tracking and advertising

We do not track you across other companies' apps or websites, we do not use advertising identifiers and we show no ads. This website uses only strictly necessary cookies (for example to keep the support administrator signed in) and no analytics or advertising cookies.

16. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date, and for important changes we will notify users in the app or by email.

17. Contact us

The Goldens Cards
Abu Dhabi, United Arab Emirates
Trade licence CN-4119980
Support: https://sentinel971.tgsad.dev/support