Privacy Policy

Shofar Frontline (the "App" or "Platform") is a digital disaster risk reduction and management platform developed and operated by High Meridian Technologies. It supports Local Government Units (LGUs), barangays, disaster risk reduction and management offices, emergency operations centers, authorized responders, and other approved users in issuing alerts, reporting incidents, coordinating personnel and resources, managing tasks, and supporting emergency and disaster operations.

This Privacy Policy describes the personal data we may collect, how and why we process it, who may receive it, how long it may be retained, the safeguards applied, and the rights available to data subjects under the Philippine Data Privacy Act of 2012, its Implementing Rules and Regulations, and relevant issuances of the National Privacy Commission.

By accessing or using the Platform, you acknowledge that you have read this Privacy Policy. Where consent is legally required, it will be requested separately and will not be inferred merely from continued use of the Platform.

2.1 High Meridian Technologies as Personal Information Processor

For operational, personnel, constituent, incident, response, and official LGU records processed through a participating organization's deployment of Shofar Frontline, the participating LGU or DRRM organization generally determines the purposes and essential means of processing. In these circumstances, the participating organization acts as the Personal Information Controller, while High Meridian Technologies acts as the Personal Information Processor by providing hosting, maintenance, transmission, storage, security, technical support, and related platform services according to the organization's lawful instructions and the applicable agreement.

2.2 High Meridian Technologies as Personal Information Controller

High Meridian Technologies separately acts as a Personal Information Controller when it independently determines the purposes and means of processing, including for:

• client and customer administration, contracting, subscription management, and billing;
• management of authorized platform administrators and organizational contacts;
• technical support, customer service, and service communications;
• platform security, access logging, fraud and misuse prevention, and incident response;
• service reliability, diagnostics, maintenance, and improvement;
• management of High Meridian personnel, contractors, and service providers; and
• compliance with High Meridian Technologies' own legal, regulatory, contractual, and audit obligations.

The precise allocation of responsibilities may be further defined in the service agreement, data processing agreement, data sharing agreement, or other lawful arrangement between High Meridian Technologiesand the participating organization.

3.1 Account and profile information

• full name, email address, mobile or telephone number, and username;
• organization, LGU, office, barangay, team, station, or operational unit;
• position, designation, responder role, assigned area, and access level;
• profile photograph, personnel or responder identifier, and account status; and
• authentication and account-management records.

3.2 Location information

• approximate or precise device location, subject to device permissions;
• location attached to an incident report, task, response activity, facility, hazard, or resource;
• responder or personnel location during an authorized operation, where enabled; and
• date and time associated with location information.

Location information may be used to geotag reports, display incidents and resources on maps, route or dispatch responders, support operational coordination, and improve situational awareness. The Shofar Frontline mobile app accesses device location only while the app is open and in use; it does not collect location in the background. Location access can be turned off at any time in the device settings or in the app's Profile settings.

3.3 Incident, task, and operational information

• incident type, description, date, time, location, urgency, and status;
• information about affected persons, households, communities, facilities, hazards, damages, injuries, needs, or casualties;
• acknowledgments, dispatches, assignments, response updates, and closure information;
• responder notes, operational observations, situation reports, and assessment information;
• resource requests, availability, deployment, and utilization records; and
• health and medical information about patients or casualties recorded by authorized personnel in patient data sheets, such as vital signs, injuries, conditions, and care given; and
• other information lawfully submitted for emergency response, coordination, documentation, audit, or public-safety purposes.

Health information is sensitive personal information under the Data Privacy Act of 2012. It is collected only by users whose role has been authorized by the participating organization, is used only for emergency care, response, and official documentation, and is visible only to authorized personnel.

3.4 Photographs, video, audio, and attachments

• photographs and videos captured or uploaded for incident or field documentation;
• voice notes or audio recordings attached to reports or communications;
• documents and other supporting files; and
• available metadata such as date, time, and location associated with an attachment.

3.5 Communications and collaboration data

• direct, group, incident-room, or operations-room messages;
• sender, recipient, date, time, delivery, and read-status information; and
• attachments and notification history.

3.6 Device, technical, security, and usage information

• device model, operating-system version, App version, build number, language, and time zone;
• IP address, application or device identifiers, push-notification token, and connectivity information;
• login history, system events, audit trails, access records, and administrative actions;
• crash reports, diagnostics, performance information, and security logs; and
• feature interactions and usage information needed for service operation, reliability, security, and improvement.

3.7 Support and administrative information

• contact information, support requests, complaints, inquiries, and correspondence;
• screenshots, screen recordings, device details, and troubleshooting information; and
• records of actions taken to resolve a request or complaint.

Depending on the functions enabled in a particular deployment, the App may request access to location, camera, photos or media, microphone, notifications, and network connectivity. Denying a permission may limit the related feature but should not affect unrelated functionality.

4.1 Biometric authentication results — not biometric data

The App may allow a user to authenticate using the biometric capability of the user's device, such as fingerprint or facial authentication. Shofar Frontline does not collect, receive, copy, transmit, or store the user's fingerprint image, facial image, biometric template, or other biometric data. Biometric processing is performed locally by the device's operating system. The App receives only an authentication result, such as success, failure, or cancellation, and uses that result to allow or deny access.

• create, verify, secure, and administer user accounts;
• authenticate users and enforce role-based access controls;
• issue and deliver alerts, warnings, advisories, assignments, and operational notifications;
• receive, verify, map, route, and manage incident reports;
• coordinate responders, teams, tasks, resources, and emergency operations;
• maintain dashboards, status histories, situation reports, and audit trails;
• support communications among authorized users;
• provide customer service, troubleshooting, training, and technical support;
• protect the Platform against unauthorized access, fraud, misuse, and security threats;
• maintain, diagnose, improve, and document the reliability and performance of the Platform;
• comply with legal, regulatory, contractual, records-management, audit, and public-safety obligations; and
• establish, exercise, or defend legal claims.

We do not sell personal data and do not use incident, responder, or constituent data for unrelated behavioral advertising.

Depending on the data, purpose, circumstances, and participating organization, processing may be based on one or more lawful grounds, including:

• valid consent for optional features or processing activities where consent is legally appropriate;
• performance of a contract or steps taken at the request of a data subject before entering into a contract;
• compliance with a legal or regulatory obligation;
• protection of life, health, safety, or vital interests;
• performance of constitutional, statutory, public-authority, or governmental functions;
• legitimate interests that do not override the rights and freedoms of the data subject;
• establishment, exercise, or defense of legal claims; and
• other lawful grounds recognized under applicable Philippine law.

Not all processing is based on consent. Where consent is the applicable basis, it may be withdrawn, subject to legal and operational limitations. Withdrawal does not affect processing that was lawful before the withdrawal.

Personal data may be disclosed or made accessible only when reasonably necessary, authorized, and legally permitted.

7.1 Participating LGU or organization

Authorized personnel of the participating LGU, barangay, DRRM office, emergency operations center, government agency, or organization may access information according to assigned role, jurisdiction, office, area, and operational need.

7.2 Emergency and response partners

Where necessary for emergency response, public safety, or legal compliance, incident information may be shared with duly authorized police, fire, rescue, health, social welfare, public works, utility, national government, and other response agencies.

7.3 Service providers

We may use service providers for cloud hosting, storage, backups, push notifications, maps, geolocation, authentication, communications, cybersecurity, system monitoring, diagnostics, and technical support. Service providers are expected to process data only for authorized purposes and to apply appropriate confidentiality and security safeguards.

7.4 Legal and regulatory disclosures

Information may be disclosed when necessary to comply with law, lawful government requests, court orders, investigations, emergency requirements, public-safety obligations, contractual enforcement, security investigations, or legal claims.

The current version of Shofar Frontline uses the following service providers, each acting on our behalf and only for the purpose described:

• Hostinger — hosting of the application servers and database;
• Cloudflare — network delivery and protection of our websites and API (processes connection data such as IP addresses);
• Expo and Google Firebase Cloud Messaging — delivery of push notifications (processes the device push token and the notification content);
• OpenStreetMap — map tiles shown on maps in the web dashboard and app (your device requests the tiles directly, which shares its IP address with the tile server); and
• public hazard feeds — OpenWeather, USGS, GDACS, and PHIVOLCS — which our servers query using the coordinates of the participating LGU, never a user's personal data or location.

The App does not include advertising, analytics, or third-party crash-reporting SDKs, and we do not sell personal data or share it with third parties for their own purposes. If the App crashes or hits an unexpected error, it sends an error report — the error message and technical details, the App version, device model and operating-system version, and your account ID if you are signed in — to our own servers only, so we can find and fix problems. If the services we use change, we will update this section and our Google Play Data safety declaration.

Some service providers may store or process information outside the Philippines. Where cross-border processing occurs, High Meridian Technologies and the participating organization will take reasonable steps to ensure a lawful purpose, appropriate contractual arrangements, confidentiality obligations, security safeguards, and continued protection consistent with applicable Philippine privacy law.

Personal data is retained only for as long as reasonably necessary for the applicable purpose, subject to law, public-record and records-management requirements, DRRM and incident-documentation obligations, audit needs, security requirements, contractual commitments, dispute resolution, and legitimate operational requirements.

Users may request deletion of their Shofar Frontline account and associated personal data through the public account-deletion page: https://app.shofar-ews.com/account-deletion.

We may need to verify the identity and authority of the requester before processing a deletion request. Subject to applicable legal exceptions, High Meridian Technologies and/or the participating organization will delete, anonymize, or securely dispose of the account and associated personal data within a reasonable period.

Certain information may be retained when required for official public records, incident documentation, public safety, pending investigations, audits, fraud prevention, security, legal compliance, dispute resolution, or the establishment, exercise, or defense of legal claims. Deleting an account may therefore not remove an incident report or official response record that the participating organization is legally required to retain. Where appropriate and lawful, access may be restricted or direct identifiers may be removed.

High Meridian Technologies and participating organizations apply reasonable and appropriate organizational, physical, and technical safeguards proportionate to the nature and risks of the processing. These may include encryption in transit, secure authentication, access controls, role-based permissions, audit logs, secure coding and deployment, server and database safeguards, monitoring, backups, recovery procedures, confidentiality obligations, personnel controls, and incident-response procedures.

No system can guarantee absolute security. Users must protect credentials and devices, avoid sharing accounts, and promptly report suspected unauthorized access, device loss, misuse, or disclosure.

High Meridian Technologies and participating organizations maintain procedures for identifying, assessing, containing, investigating, documenting, and responding to suspected personal data breaches. Where required by law, the responsible Personal Information Controller will notify the National Privacy Commission and affected data subjects.

Subject to applicable law and lawful limitations, data subjects may exercise the following rights:

• the right to be informed;
• the right to access;
• the right to object;
• the right to correction or rectification;
• the right to erasure or blocking where legally applicable;
• the right to data portability where applicable;
• the right to file a complaint with the National Privacy Commission;
• the right to damages where provided by law; and
• other rights recognized under applicable privacy law.

Requests may be submitted to High Meridian Technologies using the contact details below. Where the participating LGU or organization controls the relevant information, the request may be referred to that organization's Data Protection Officer or privacy office. Identity and authority may be verified before a request is acted upon.

Shofar Frontline is intended primarily for authorized adult LGU personnel, DRRM officers, responders, barangay personnel, administrators, volunteers, and approved users. It is not designed for children to create or independently manage accounts unless a participating organization has established an appropriate lawful basis, authorization process, and child-protection measures.

Incident reports may contain information about minors when necessary to protect life, provide assistance, coordinate emergency response, document an incident, or comply with law. Such information must be accessed and used only by authorized personnel for legitimate purposes.

Shofar Frontline may use automated or artificial-intelligence-supported tools to help organize reports, identify possible duplicates, classify incidents, generate summaries, identify patterns, support situational awareness, or recommend operational actions. Such tools are intended to assist authorized personnel and should not replace accountable human judgment in decisions that significantly affect individuals, emergency response, resource allocation, or public safety.

• use only the account assigned to the user and protect credentials and devices;
• submit accurate information and only data necessary for an authorized purpose;
• avoid uploading unrelated, excessive, or unlawfully obtained personal information;
• respect confidentiality, role-based access, and participating-organization policies;
• avoid using incident information for personal, political, discriminatory, commercial, or unauthorized purposes; and
• promptly report suspected misuse, compromise, loss, or unauthorized access.

We may update this Privacy Policy to reflect changes in App features, data practices, participating organizations, service providers, law, security requirements, or operational procedures. The updated version will display a revised "Last updated" date. Material changes may also be communicated through the App, website, email, or the participating organization.

For privacy questions, requests, complaints, or concerns, contact:

High Meridian Technologies

Door 5, Mega Power Bldg. 2, Gold St., San Rafael Village
Barangay 10-A, Poblacion District, Davao City, Philippines

Email: [email protected]
Website: https://app.shofar-ews.com/
Account deletion: https://app.shofar-ews.com/account-deletion

Where your account is managed by a participating LGU or organization, you may also contact that organization's Data Protection Officer or privacy office for requests concerning official operational or incident records.