Privacy notice

The kitchen asks for your dietary and medical details so it can feed you without hurting you. Those details are visible only to the leads running your operation, are never sold or shared with anyone outside Team Rubicon, and are permanently deleted after the operation's retention period. You can decline and sign in with a lead in person instead.

At sign-in, from you:

• Your name and ICS role, and a phone number if you give one.
• Allergies, intolerances and dietary choices, each with how serious it is and any note you add.
• Whether you carry an auto-injector and where it is kept. This is shown to the kitchen team so somebody can find it in an emergency.
• The days and meals you are on site for.
• PPE sizes — shirt, gloves, boots, respirator, hard hat — so logistics can order kit that fits.
• Optional preferences: food you like, food you would rather avoid, anything that lifts morale.
• The date and time you agreed to this notice.

No date of birth, no address, no health number, no emergency contact, no photograph. The form does not ask for a medical diagnosis — only what you cannot eat and how serious it is.

One reason: so the food served to you is safe. A severe allergy that the kitchen does not know about is the failure this whole system exists to prevent. Sizes are used only to order protective equipment. Preferences are used only to cook things people actually want.

• The leads and assistants assigned to your operation. Somebody working a different deployment cannot see your record, and the system returns “not found” rather than “access denied” so it does not even confirm that your operation exists.
• The organisation's administrator account.

It is not sold, not used for marketing, and not shared with any third party. There are no analytics, advertising or tracking services in this application. This build sends nothing to any external service — there is no AI integration and no outbound data transfer.

Printed sheets are an exception worth naming: once a brief or roster is printed, the paper leaves the application's access controls behind. Printed copies carry a handling warning and should be destroyed at demobilisation.

Volunteer records are deleted a set number of days after the operation ends — 30 by default, and your operation's figure is shown on the sign-in page. Deletion is permanent: records are removed from the database, not flagged as hidden, and your restrictions are deleted along with them. A lead can also purge an operation's volunteer data at any time before then.

Safety checks performed before a meal is served are kept as an operational record — these store the dish and whether it was cleared or held, and deliberately do not store anyone's restrictions.

• You can decline the form and give your details to a lead in person instead.
• You can leave any field blank, including sizes and preferences.
• You can ask a lead to correct or delete your record at any point during the operation. Ask in person — the kitchen acts on what it has, so a correction only helps once it is in.

Health information about identifiable people is personal information under Canadian privacy law, including PIPEDA and the applicable provincial legislation where the operation is running. It is collected with your consent, used only for the purpose described above, kept only as long as stated, and held in Canada where the hosting configuration allows.

Questions, corrections or complaints: speak to the Food Unit Leader or Incident Commander on your operation.