LoneApp privacy notice

The LoneApp apps for iPhone and Android, and the manager dashboard · Last updated 21 October 2026

Account availability and deletion. App downloads, company subscriptions and live monitoring are separate. Your employer must complete the company readiness checks and enable live monitoring before relying on the service for live work. You can ask to delete your account in the app (section 6). For accounts in controlled testing, each deletion goes through the agreed owner-decision process: support confirms the request with your employer’s company owner, who decides, as the employer’s decision under section 6, whether any specific records must be kept. Once that decision is made and anything open has been handed over, support completes the deletion. How long any kept data is held is set out in section 4. A feature described in this notice is not confirmation that it is enabled for your account.

If you're 16 or 17

LoneApp is a safety app your employer gives you so someone knows you're OK when you work alone. Here is what that means for you, in short. Everything in the rest of this notice applies to you too.

Who decides: your employer chose LoneApp and decides how it's used (section 1). Before you use it, your employer should explain how monitoring works, include it in its risk assessment for young workers, and choose suitable managers as your responders.
When your location is shared: only while you have an activity running, or while an alarm about you is still open. It stops when the activity ends and any alarm is resolved. LoneApp never asks to track you "all the time" and doesn't track you outside activities and alarms.
How you can tell: while your location is being shared, your phone shows it. On Android you'll see a "LoneApp is monitoring you" notification; on iPhone, the location indicator at the top of the screen.
Who sees it: your company's managers and the responders your employer picked (section 3). LoneApp support's diagnostic access doesn't include your location; support only handles it when carrying out a privacy request (section 7).
If there's an alarm: if you press SOS, don't check in, or the phone detects a possible fall or no movement and you don't answer, your responders get your name, phone number, last location and emergency contact details by app, email, text or call. Messages that have been sent can't be taken back (section 8).
Fall and no-movement detection is on during activities to keep you safe. Your movement is analysed on your phone; we only receive the details of each warning (section 2).
What we never do: no ads, no selling your data, no analytics or tracking software, and no profiling beyond the safety features. We don't ask your age; everyone gets the same protections.
Your rights are the same as everyone's: you can ask for a copy of your data or to delete your account (sections 6 and 7). A parent, carer or someone you trust can help you, but we'll check with you that the request is yours.
Questions or worries: ask your manager, or email us at help@loneapp.co.uk. You can also contact the Information Commissioner's Office at ico.org.uk.

1. Who we are and our role

LoneApp is a lone-worker safety app provided by Safety Inspectors UK Ltd (company 13332790), 9 River Court, Brighouse Road, Middlesbrough, England, TS2 1RT. Contact: help@loneapp.co.uk.

Your employer (our customer) is the controller of its workforce's data in LoneApp. We process that data on its instructions to provide lone-worker monitoring. If you're a worker, please read your employer's privacy notice too.
We are the controller of customer account and billing records, support and privacy correspondence, privacy request records and verification evidence, and our own support staff's audit trail.

2. What we process and why

About workers (processed for the employer)

Name, work email, phone number, role and team: accounts, sign-in, showing who is working and contacting responders.
Emergency contact and response instructions: shown to responders and included in alarm messages.
Activities: type, note, start, expected end, check-ins (including whether made in the app, from the lock screen or from a notification), extensions, how and by whom they ended.
Location (coordinates, accuracy, time): only while an activity is running or an alarm is unresolved, including with the screen locked. It's shown to your company's managers and responders and sent in alarms. If precise location is turned off on the phone (Precise Location on iPhone, approximate location on Android), the approximate position the phone provides is used in the same way, and managers are shown that positions are approximate.
Motion-based detection (experimental) of a possible fall or inactivity during an activity. Motion is analysed on the phone. Our servers receive:
- detection status and sensor coverage, summarised at most every 5 minutes;
- for each "Are you OK?" warning, the measurements behind it (no location or free text);
- only when a manager switches one activity to controlled testing (impossible while live monitoring is on): a short movement trace around each warning, up to 6 seconds.
Warning and alert diagnostics: when and how the app registered a warning, how it was shown, whether the worker answered "I'm OK" or asked for help and how long they took, and when alerts were raised, with timings. These are used to check that safety features work and to investigate a missed or late alert.
Device status: battery, low-power mode, app state (open or in the background, and when the app was last started), permissions, device model, operating system (iOS or Android) and its version, app version, last contact.
Alarms and their history: who acknowledged and resolved them, outcome notes and delivery records.
Push notification tokens (from Apple on iPhone, from Google's Firebase Cloud Messaging on Android), each linked to the sign-in on that phone. We delete our copy when you sign out or that sign-in expires. Invitations (email, name, role, code), which expire after 14 days.
Security data: password hashes (never the password), sign-in sessions and failed sign-in counts.

About customer businesses (our own records)

Billing records: the company name, the billing contact's email, Stripe customer and subscription references, seats and billed periods. Card details are held by Stripe, not by us. No worker data is sent to Stripe.
Support records: time-limited support access grants your company gives, subscription notes, our support staff's accounts and audit trail (including IP addresses).
Privacy request records: stages, masked addresses verification codes were sent to, evidence descriptions, authority, outcomes, and any retention exceptions applied. Company data exports are built at the company's or a person's request, checked for other companies' information and credentials, kept only for the delivery window, and deleted when the request is closed.

Lawful bases

Workforce data: your employer decides the lawful basis, as controller. For lone-working safety this is typically legal obligation (its health and safety duties towards staff who work alone) and legitimate interests (protecting them, and checking that warnings and alarms work, including warning diagnostics and controlled-test traces).
Our own records: contract (the customer relationship), legal obligation (accounting records) and legitimate interests (security, accountability and handling disputes).

We don't use anyone's data for advertising, don't sell it, and don't profile people beyond the safety features described here. The apps contain no advertising, analytics or tracking software. The Android app includes Google's Firebase Cloud Messaging only to receive notifications, with Firebase analytics switched off.

3. Who receives data

Your company's managers and responders: information about their own company's staff, according to role and team.
Our suppliers, who process data to run the service:
- Rork, and Cloudflare through Rork: hosting and storage;
- Resend: email (alarm emails with name, phone, last location and response instructions; activity updates; invitations; verification codes);
- Twilio: SMS and voice alarms (name, phone, last location, alarm type);
- Apple: push notifications to iPhones and app distribution (App Store);
- Google: push notifications to Android phones (Firebase Cloud Messaging) and app distribution (Google Play);
- Stripe: payments;
- Hostinger: serving the manager dashboard's files;
- Microsoft (Microsoft 365 / Exchange Online): our support and privacy mailbox, help@loneapp.co.uk, which holds the messages you send us, anything you attach and our replies;
- OpenStreetMap: map images on the dashboard (section 9).
Resend, Twilio, Stripe, Hostinger and Microsoft process data under their published data-processing terms, which form part of our agreements with them. Apple delivers push notifications to iPhones under the Apple Developer Program License Agreement. Google delivers them to Android phones as our processor under the Firebase Data Processing and Security Terms. Google also collects technical information about how the service is used, such as IP addresses and app identifiers, and uses it under its own privacy policy to provide, secure and improve its services (Google calls this Firebase Service Data). Push notifications contain names, the alarm type, short status text and internal references to the activity or alarm; we don't put locations, contact details or anything workers type in them. Each notification is set to expire within 60 minutes, or when the worker's next check-in is due, and Apple and Google discard any they couldn't deliver by then. OpenStreetMap is independent (section 9). Rork's data-processing terms are being confirmed with Rork; we'll update this notice when they are.
LoneApp support staff: read-only diagnostics only under a time-limited grant your company gives, and when handling privacy requests.

International transfers:

Resend stores email data in the USA, under the UK Extension to the EU-US Data Privacy Framework and standard contractual clauses.
Twilio processes texts and calls in the USA under its data protection addendum.
Stripe uses the UK Extension to the Data Privacy Framework and contractual clauses.
Hostinger's data-processing terms include standard contractual clauses and the UK international data transfer addendum for any transfer.
Microsoft 365 stores our support mailbox in the United Kingdom.
Apple's push service operates worldwide.
Google's Firebase Cloud Messaging may process notifications in any country where Google or its subprocessors have facilities. Transfers to Google in the USA use the UK Extension to the EU-US Data Privacy Framework, and Google's standard contractual clauses apply where that isn't available (Firebase Data Processing and Security Terms, section 10).
Where Rork and Cloudflare store hosting data, and the safeguard for any transfer outside the UK, is being confirmed with Rork.
OpenStreetMap: global cache network (section 9).

4. How long we keep data

Ended activities, check-ins, locations and resolved alarms: your company's retention setting, 90 days unless it chooses otherwise (7 to 3,650 days). Records linked to an unresolved alarm are kept until it's resolved. Detection measurements, traces and diagnostics are deleted with the activity they belong to.
Company audit entries: your company's audit setting, 730 days by default.
Sign-in sessions: until they expire or you sign out. Push tokens: until you sign out or that sign-in expires. The Android app creates a Firebase installation ID when it's first opened. Google keeps it until we ask Firebase to delete it, then removes it from its live and backup systems within 180 days; the current Android app doesn't yet make that request when you sign out.
When you delete your account: see section 6. The 90-day period doesn't apply: you don't wait for it.
Removed staff profiles and device status: kept while the account is open, so past incident records still show who was involved; deleted when the company asks, when the person asks (section 6), or with the account when it's closed (section 6, "Company owners").
"Are you OK?" prompt records (times, deadlines and outcomes; no location or free text) and used or expired invitations: kept with the account; deleted when the person is deleted or with the account.
Privacy request records (stages, evidence descriptions, authority, outcomes, the deletion record): 6 years after the request closes, so LoneApp can show the request was handled lawfully.
Billing and accounting records: 6 years from the end of the financial year (30 April) in which the last billed period ends.
Support correspondence: 2 years after the last message; 6 years where it forms part of a privacy request or a claim.
LoneApp's own admin audit trail (including IP addresses): 2 years from each entry.
Our suppliers' own records: Resend keeps email records for 30 days. Twilio keeps message records under its own retention policy, and we can ask it to delete an individual message. Deleted items in our support mailbox can be recovered for 14 days. How long our hosting provider keeps its logs is being confirmed with Rork.

5. Security

Passwords are stored only as hashes. Each company's data is held in its own isolated database. Our support staff sign in with a password and an authenticator code, and need a fresh code for every privacy action. Support access to your company's diagnostics is read-only and only under a time-limited grant your company gives.

6. Deleting your account

Ask in the app: Profile → Your account → Delete my account, with your password. That's the whole request: you don't need to email or phone anyone.

If the app says requests can't be made there yet: email help@loneapp.co.uk from the address you use for LoneApp. That is a complete request. LoneApp support handles it and responds within one calendar month (section 7).

Sign-in: if nothing needs handing over, your sign-in ends straight away and LoneApp stops monitoring you.
- Sometimes something needs handing over first: a running activity, an open alarm or "Are you OK?" warning, a team responder role, being your company's only company-wide manager, or owning the company account.
- Then you stay signed in and monitored until it's handed over. LoneApp never ends your activity or resolves an alarm for you.
- Your sign-in then ends automatically.
What's deleted: your account and the personal data associated with it, including your activity, check-in, location and alarm records. Where you appear in colleagues' records (for example as a responder), your name and contact details are replaced with "Deleted person".
Specific legal exceptions only: your employer decides, as the controller, whether a specific record linked to your account must legally be kept. Examples: an incident reportable under RIDDOR, an HSE or police investigation, an insurance or legal claim, or a court order.
- A general wish to keep safety records isn't enough.
- Any kept record is held separately and seen only by LoneApp support.
- It's reviewed at least every 12 months, and deleted once no legal requirement or hold applies.
Timing: we always respond within one calendar month, saying where your request stands. When deletion finishes depends on handing over anything open (above) and your employer's decision about records; we email you when it has finished.
Confirmation: the confirmation says what was deleted and anything kept, why and until when.

Company owners: deleting your own account doesn't close your company's account. If nobody can take over ownership, you can choose separately to close the company's account, in the app where available, otherwise by emailing help@loneapp.co.uk.

New work is paused first, while check-ins, SOS and alarms keep working.
Your team hands over anything open, and the subscription must be set not to renew.
Once fully closed, nobody at the company can sign in and LoneApp stops monitoring everyone.
Closing the account is the company's instruction to delete its data 30 days later. Your verified closure request is all the authority LoneApp needs: we don't contact you again for the deletion, even if your own account has ended in the meantime, unless company ownership has changed. During the 30 days the company can still ask for an export.

7. Your other rights

You have the right to access your personal data (including a copy), and to correction, deletion, restriction, objection and portability. You can also complain to the ICO.

How to ask: in the app for deletion, or email help@loneapp.co.uk for anything else. For workforce data you can also ask your employer, which decides as controller. Every request gets a reference and is tracked against its legal deadline.
Identity: we confirm it with a one-time code sent to the email address we hold for you (valid 30 minutes, single use). Former staff without that mailbox can use a live identity check matched against other records we hold. A code only proves you control a mailbox; it's never treated as consent to delete anything.
Company decisions (exporting a whole company's data, closing or deleting it) are accepted only from the company owner or a representative the company has authorised in writing. Once the account has been fully closed on the owner's verified request, that closure request is the company's standing instruction for the deletion 30 days later; a fresh owner confirmation is needed only if company ownership has changed.
Deadline: one calendar month from the day we receive your request (the next working day if it falls on a weekend or bank holiday). For complex requests we can extend this by up to two months; if so, we tell you why within the first month. A failed or expired verification never closes your request.
Copies: other people's personal data is withheld unless including it is justified. We tell you what was withheld and why.

8. What deletion can't reach

Messages already delivered (email, text, voice, push notifications) can't be recalled.
Our messaging suppliers keep their own records: Resend for 30 days; Twilio under its own retention policy, and we can ask it to delete an individual message (section 4).
Our hosting provider keeps recovery copies of the database for up to 30 days. Whether any longer-lived copies exist is being confirmed with Rork, and we'll update this notice when it is. We won't restore from a backup unless deleted data can be kept unavailable until every completed deletion has been re-applied.

9. Cookies and the dashboard

The manager dashboard sets no cookies and uses no advertising or analytics trackers. It keeps in your browser:

your sign-in session, until you sign out;
an invitation you were writing, for up to 2 hours, only if you leave to buy seats and come back.

Its map loads images from OpenStreetMap's tile servers. Your browser sends them your IP address and the map area being viewed, which can show roughly where your staff are. No names or other details are sent.

10. Complaints, contact and changes

Contact us first at help@loneapp.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk. We update this notice when our processing changes, and change the date at the top.