Privacy Policy

1. Introduction

Wogan Solutions (“we,” “our,” or “us”) operates OpsSight, a multi-tenant software-as-a-service platform for emergency medical services (EMS) and fire operations intelligence. Our registered business address is in Texas, United States.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use the OpsSight platform, including our website at opssight.ioand all related applications, APIs, and services (collectively, the “Service”).

OpsSight is designed exclusively for verified government and private EMS and fire agencies in the United States. If your agency is subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), please read Section 11 (HIPAA) carefully, as it governs our obligations with respect to protected health information (“PHI”) your agency uploads to the Service.

By accessing or using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, you must discontinue use of the Service.

2. Information We Collect

2.1 Account and Agency Information

When an agency administrator creates an account, we collect:

• Name and email address of authorized users
• Agency name, type (EMS, fire, combined), and jurisdiction
• Billing information (processed by our payment processor; we do not store raw card data)
• Role assignments within your agency (Administrator or Viewer)
• Email ingestion address configuration and preferences
• Notification and reporting preferences

2.2 Uploaded Agency Data (Including PHI)

The core function of OpsSight is to ingest, process, and analyze operational data uploaded by your agency. This data may include:

• CAD dispatch data — incident numbers, dispatch timestamps, unit assignments, response times, incident locations (address, GPS coordinates), incident type codes, and disposition
• Patient Care Reports (PCR) — patient demographics (age, gender), chief complaint, vital signs, medications administered, procedures performed, crew assignments, and hospital destinations
• Roster and personnel data — employee names, employee IDs, certifications, and crew assignments
• Schedule data — shift assignments, unit staffing, and coverage periods

Patient Care Reports may contain PHI as defined under HIPAA. We act as a Business Associate with respect to any PHI your agency uploads, as further described in Section 11.

2.3 Usage and Operational Data

When you use the Service, we automatically collect certain technical information, including:

• IP address, browser type and version, operating system
• Pages visited, features used, and time spent on the platform
• Import history — file names, file types detected, record counts, processing status
• Error events and application crash reports (via Sentry)
• API request logs with timestamps and response codes
• Audit logs — all administrative actions, data access events, and configuration changes

2.4 Cookies and Similar Technologies

We use cookies and similar technologies as described in Section 12. Essential cookies are required for authentication and security. Analytics cookies are only set after you provide explicit consent through our cookie consent banner.

3. How We Use Information

We use the information we collect to:

• Deliver the Service — process uploaded files, calculate operational metrics (response times, NFPA compliance, unit performance), generate dashboards and reports, and refresh materialized analytical views
• AI-assisted data extraction — de-identify uploaded files and route them through our AI processing pipeline for structured data extraction, as described in Section 4
• Billing and account management — process subscription payments, send invoices, manage trial periods and plan upgrades
• Communication — send import notifications, error alerts, security notices, and product updates via Resend; respond to support requests
• Security and fraud prevention — authenticate users, enforce role-based access control, detect unauthorized access, maintain audit logs, and investigate security incidents
• Service improvement — analyze aggregated, de-identified usage patterns to improve platform reliability, performance, and feature development
• Legal compliance — maintain records as required by applicable law, respond to lawful requests, and enforce our Terms of Service

We do not use your agency’s operational data, patient data, or PHI to train machine learning models, build advertising profiles, or provide analytics to third parties for commercial purposes.

4. AI Data Processing

OpsSight uses an AI-assisted import pipeline to extract structured data from agency files that cannot be parsed deterministically (for example, custom CAD export formats we have not seen before). The AI component is powered by Claude Haiku, operated by Anthropic, PBC.

4.1 HIPAA Safe Harbor De-Identification

Before any data is transmitted to Anthropic’s API, OpsSight applies an automated de-identification process consistent with the HIPAA Safe Harbor method (45 CFR § 164.514(b)). This process:

• Removes or redacts all 18 Safe Harbor identifiers (names, geographic data smaller than state, dates other than year, phone numbers, ages over 89, etc.)
• Applies known-value substitution (replacing specific patient names with tokens like [NAME_1])
• Runs safety-net pattern matching to catch residual identifiers
• Maintains a rehydration lookup table stored only in memory during the processing session

No PHI is transmitted to Anthropic.Only the de-identified payload is sent to the Claude Haiku API. After the AI returns structured field mappings, OpsSight rehydrates the result using the in-memory lookup to restore original operational values (such as unit IDs and incident numbers) before saving to your agency’s database partition.

4.2 Template Learning — No Repeated AI Calls

When the AI successfully extracts data from a file format, OpsSight saves a deterministic field-mapping template. All subsequent imports of the same format are processed entirely within OpsSight without any AI API call. This means the vast majority of your agency’s imports do not involve Anthropic’s services at all.

4.3 No Model Training on Customer Data

Anthropic does not use data submitted via API calls to train or improve its models. We do not share agency data or derived analytics with Anthropic for any purpose other than the specific API call required to process your file. Our data processing agreement with Anthropic reflects these restrictions.

5. Information Sharing and Disclosure

We do not sell your personal information or your agency’s operational data. We do not share data with advertising networks, data brokers, or third parties for marketing purposes. We disclose information only in the following circumstances:

5.1 Subprocessors

We use the following subprocessors to deliver the Service. Each is bound by appropriate data processing agreements:

5.2 Law Enforcement and Legal Process

We may disclose information if required to do so by law or in response to a valid legal process, such as a court order, subpoena, or government request. Where permitted by law, we will notify the affected agency before disclosing their data so they may seek a protective order. We will not voluntarily provide law enforcement with access to any PHI without appropriate legal authority.

5.3 Business Transfers

In the event of a merger, acquisition, sale of substantially all assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify affected agencies by email and provide notice on our website prior to any such transfer, and your data will remain subject to the protections of this Privacy Policy.

5.4 With Your Consent

We may share information for any other purpose with your explicit consent.

6. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, and destruction:

• Encryption at rest — All data stored in our PostgreSQL database is encrypted using AES-256 encryption provided by Supabase on AWS infrastructure. Sensitive credentials and configuration secrets are encrypted at the application layer using AES-256-GCM before database storage.
• Encryption in transit — All communications between your browser and our Service are protected by TLS 1.2 or higher. Data transmitted between OpsSight and subprocessors uses TLS-encrypted connections.
• Authentication and access control— User sessions are authenticated via Supabase Auth with server-side JWT validation. Role-based access control (RBAC) restricts data modification to Administrator-level accounts. Multi-tenancy is enforced at the database query level — agencies cannot access each other’s data.
• Rate limiting — Authentication endpoints enforce rate limits (5 requests per 15 minutes per IP) to prevent brute-force attacks. API endpoints have tiered rate limits.
• CSRF protection — All state-modifying API endpoints validate Origin and Referer headers to prevent cross-site request forgery.
• Audit logging — All administrative actions, data access events, import operations, and configuration changes are logged with user identity, timestamp, and action detail. Audit logs are retained for six years consistent with HIPAA requirements.
• Error monitoring — Application errors are reported to Sentry with stack traces. Sentry is configured to scrub personal identifiers from error payloads before transmission.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting PHI, we will notify affected agencies in accordance with applicable HIPAA Breach Notification Rule requirements (45 CFR Part 164, Subpart D).

7. Data Retention

7.1 Active Subscriptions

We retain your agency’s data — including imported incidents, personnel records, and configuration — for the duration of your active subscription.

7.2 Post-Cancellation

Following cancellation of your subscription, we retain your data for 30 days to allow you to export it via the data export feature. After 30 days, your agency’s data is permanently deleted from production systems. Backups are purged on a rolling schedule within 90 days of the deletion event.

7.3 Audit Logs

Audit logs are retained for six (6) years from the date of the logged event, consistent with HIPAA’s documentation retention requirements (45 CFR § 164.530(j)).

7.4 Backups

Automated database backups are encrypted and retained for up to 30 days. Backup purges occur automatically. We do not restore data from backup after the 30-day post-cancellation window has passed.

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information. As a Texas-based business serving U.S. customers, we honor rights available under the Texas Data Privacy and Security Act (TDPSA, effective July 1, 2024), the California Online Privacy Protection Act (CalOPPA), and other applicable state laws.

8.1 Rights Available to Agency Administrators

• Access — Request a copy of the personal information we hold about you or your agency account
• Correction — Request correction of inaccurate personal information in your account profile
• Deletion— Request deletion of your account and associated personal data (note: this may affect your agency’s ability to access historical operational records)
• Export— Export your agency’s operational data in machine-readable format (CSV/Excel) at any time via the data import history page
• Opt-out of analytics — Decline or withdraw consent for Vercel Web Analytics through the cookie consent banner accessible in the platform footer
• Non-discrimination — We will not discriminate against you for exercising any of these rights

8.2 PHI Rights

If your agency uploads PHI, individual patients whose data is processed through OpsSight may have rights under HIPAA (such as the right of access to their records). These rights must be fulfilled by your agency as the HIPAA Covered Entity. OpsSight will cooperate with your agency to fulfill patient rights requests as required by our Business Associate Agreement.

8.3 How to Submit a Request

To exercise any of the rights above, email privacy@opssight.io with your agency name and the specific right you wish to exercise. We will respond within 45 days. For complex requests, we may extend this period by an additional 45 days and will notify you of the extension.

9. Children’s Privacy

OpsSight is a business-to-business platform designed for use by EMS and fire agency personnel. It is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information without verifiable parental consent, we will delete that information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us at privacy@opssight.io.

10. Do Not Track and Global Privacy Control

Some browsers transmit “Do Not Track” (DNT) signals. OpsSight does not currently respond to DNT signals because there is no industry-standard interpretation of what DNT requires.

We do honor the Global Privacy Control (GPC) signal as required by the Texas Data Privacy and Security Act (TDPSA). If your browser transmits a GPC signal indicating an opt-out of sale or sharing, we treat it as a request to opt-out of any non-essential data collection, including consent-gated analytics. Because we do not sell personal information, the practical effect of honoring GPC is that we will not activate Vercel Web Analytics for your session.

11. HIPAA Compliance

11.1 Business Associate Status

When your agency (a HIPAA Covered Entity) uploads Patient Care Reports or other files containing PHI to OpsSight, we act as a Business Associate as defined under HIPAA (45 CFR § 160.103). We process PHI solely on behalf of and at the direction of your agency, for the purposes of providing operational analytics and data management services.

11.2 Business Associate Agreement

We execute a Business Associate Agreement (BAA) with each agency that uploads PHI to OpsSight. The BAA governs our obligations with respect to PHI, including permitted uses, security requirements, breach notification timelines, and return or destruction of PHI upon termination. You must have a signed BAA in place before uploading any PHI. If you do not have a current BAA, contact privacy@opssight.io.

11.3 PHI Safeguards

We implement the following controls specific to PHI protection:

• PHI is stored exclusively within your agency’s tenant partition — no PHI is shared across agencies
• PHI is encrypted at rest (AES-256) and in transit (TLS)
• Access to PHI is restricted to authenticated users within your agency with appropriate roles
• Before any AI processing, PHI is de-identified using HIPAA Safe Harbor methodology — no PHI is transmitted outside OpsSight infrastructure to AI providers
• All access to PHI-containing records is logged in our six-year audit trail
• We do not use PHI for any secondary purpose (such as research, marketing, or model training)

11.4 Breach Notification

In the event of a breach of unsecured PHI, we will notify your agency without unreasonable delay and no later than 60 days following discovery of the breach, as required by the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D). Your agency, as the Covered Entity, is responsible for notifying affected individuals, HHS, and (where applicable) media, in accordance with HIPAA timelines.

12. Cookies and Tracking Technologies

12.1 Essential Cookies

We use essential cookies that are strictly necessary for the Service to function. These cookies cannot be disabled without breaking core functionality:

• Authentication session cookies — Set by Supabase Auth to maintain your logged-in session. These are HTTP-only, Secure, SameSite=Lax cookies that expire with your session or after your configured inactivity period.
• Cookie consent preference — A cookie that stores your response to the consent banner (accept/decline) so we do not re-prompt on every page load.

12.2 Analytics (Consent Required)

With your explicit consent, we use Vercel Web Analytics to collect anonymized, aggregated usage statistics. Vercel Web Analytics does not use cookies, does not track individual users across sites, and does not create advertising profiles. Data collected includes page views, referrer information, country-level location, and device type.

You can withdraw your analytics consent at any time by clicking “Manage Cookies” in the platform footer and selecting “Decline.” If your browser sends a GPC signal, analytics are disabled automatically.

12.3 No Advertising Cookies

We do not use advertising cookies, retargeting pixels, or any third-party tracking technologies for marketing purposes. We do not participate in cross-site advertising networks.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Send an email notification to the administrator email address on file for your agency
• Display an in-app notice in the OpsSight dashboard for at least 30 days

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using the Service and may request deletion of your data as described in Section 8.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to privacy inquiries within 45 days. For urgent matters related to a potential data breach or PHI exposure, please indicate “URGENT” in the subject line of your email.