Global Assistance Member Privacy Notice v1.0

For Eligible Members · Version 1.0 · Last Updated: Oct 8, 2026

The short version

Your employer or the organization you travel with has arranged Global Assistance membership for you. It is run by Special Projects and Services Limited, known as SPS. If you have a medical or security emergency while travelling, you can call our Global Response Centre and we will help.

To do that we need information about you, including health information in an emergency. We received your basic details from the organization that arranged your membership. We share what is necessary with hospitals, ambulance and evacuation providers, security teams and, where relevant, insurers.

We do not tell your employer your diagnosis or clinical details. We tell them what they need to know to look after you and to meet the costs, such as where you are, that you are safe, and what arrangements are being made. Section 8 explains this.

If your organization has given you the Global Assistance app, it can see where you are. The app is part of a travel safety platform that your organization uses to look after its people while they travel. Your organization’s security or travel team can see your location on it, send you alerts and message you. We use the same app to reach you and find you in an emergency. Section 7 explains how this works and how to control it.

You have rights over your information, including the right to see it. Section 12 explains how to use them, and section 11 explains how we keep it secure. The rest of this notice sets it all out in full.

1. Who we are

Special Projects and Services Limited, company number 05275388, registered at Berkeley Square House, Berkeley Square, London W1J 6BD, United Kingdom, and operating from 706 Shell Store, Canary Drive, Hereford HR2 6SR. We are wholly owned by Concentric Group, Inc. We are the controller of the personal data described in this notice, and we are registered with the Information Commissioner’s Office under reference Z252956X.

There is one exception. Where your organization uses the Global Assistance platform to monitor the safety of its own people, your organization decides why and how your information is used for that purpose, and it is the controller for it. We provide the platform on its behalf. Section 7 explains the difference.

Our Data Protection Officer can be reached at dpo@concentric.io or +1 (866) 828-5855 (within the US and Mexico) or +44 (0) 1432 760179 (within the UK, Switzerland, and EEA).

This notice covers the assistance and response services provided under the Global Assistance membership your organization has arranged. A separate notice covers visitors to our websites.

2. Where we get your information

From the organization that arranged your membership. Your name, date of birth, contact details, role, and either your inclusion on a list of covered people or a declaration of a specific trip. This is usually the first information we hold about you, and we receive it before you have any contact with us.
From your organization’s travel bookings. If your organization has connected its travel booking system to the Global Assistance platform, your flight, hotel and other itinerary details are loaded into it so that alerts and support match where you are going.
From you. What you tell us when you contact the Global Response Centre, use the Global Assistance app, check in through the app, share live video with us during an emergency, or complete forms and consents.
From your phone. Your location, if you have the Global Assistance app installed and location enabled. Section 7 explains when this is collected.
From people acting for you. A colleague, relative or travelling companion may contact us on your behalf, particularly if you are unwell or unreachable.
From those who treat or assist you. Hospitals, doctors, ambulance and evacuation providers, security teams, and local authorities.
From insurers and similar arrangements. Where other cover applies to your situation.

3. What information we hold

We do not hold all of this about everyone. Much of it only arises if you have an incident.

Identity and contact details, including date of birth, nationality, passport and visa information, home address and home country.
Your employer or organization, your role, and your travel plans and dates, including itinerary details loaded from your organization’s travel bookings where that applies.
Health information, including your medical history where we need it, your condition, diagnosis and treatment, medication, whether you are fit to travel, and clinical notes from our medical team and from those treating you. This is a special category of data and we treat it with additional care.
Details of your emergency contact or next of kin.
Incident and security information, including your location, threat assessments, and records of any evacuation.
Information about allegations, detention or arrest, where we are helping with wrongful detention, a disappearance or a kidnap. This is also treated with additional care.
Recordings of your calls and messages to the Global Response Centre, and our case notes and correspondence.
Live video from the scene of an emergency, any images or video you send us, and the written summaries, translations and clinical observations produced from them. Video may also show other people who are with you at the time.
Location, check-in and device information from the Global Assistance app, including a history of where the app has reported you as being, the times you checked in, the alerts you were sent and whether you read them, and messages exchanged through the app.
Cost, payment guarantee and insurance information.

4. Why we use it, and our legal basis

What we do	Why	Our legal basis
Set up and administer your membership	To know who is covered and to verify eligibility when you call	Necessary for the contract with your organization, and our legitimate interest in running the programme
Provide the Global Assistance app and send you alerts	So you have risk information and warnings for where you are, and a direct line to us	Necessary for the contract with your organization, and our legitimate interests
Use your location from the app during an incident	To find you quickly and get help to the right place	Your vital interests and our legitimate interests
Answer an emergency call, triage and coordinate care	To get you appropriate help quickly	Your vital interests and our legitimate interests. For health information, because it is necessary for medical care provided by or under the responsibility of a health professional bound by confidentiality, or because you are unable to consent and it is in your vital interests
Use live video to assess you during an emergency	So a clinician can see your injury or the situation, guide whoever is with you, and locate you accurately	Your vital interests and our legitimate interests. For health information, the medical care condition above, or because you are unable to consent and it is in your vital interests
Arrange evacuation, repatriation or security response	To move you somewhere safer or to appropriate treatment	As above
Contact your next of kin	So the people close to you know what is happening	Your vital interests and our legitimate interests
Keep your organization informed	So it can meet its duty of care and pay for what it has agreed to pay for	Necessary for the contract with your organization, and legitimate interests. Limited as described in section 8
Record calls and messages	Accuracy of the clinical and operational record, quality and training	Our legitimate interests, assessed and documented. Where a call includes clinical information, the medical care condition above
Recover costs from insurers or other cover	Because the membership is secondary to insurance you already have	Our legitimate interests, and for health information, the establishment or defence of legal claims
Meet legal, regulatory, tax and sanctions obligations	Because we have to	Compliance with a legal obligation

Your organization has its own reasons for using the Global Assistance platform, mainly to know where its people are when something happens and to meet its duty of care to you. It is responsible for having a proper legal basis for that and for telling you about it. Its own privacy notice should cover this. If it does not, ask your organization.

We do not rely on your consent as our main legal basis. That is deliberate. Your membership was arranged through your employer, and consent given in that context is not freely given in the way data protection law requires. It also would not help you in an emergency where you are unable to give it. Any separate clinical consent you give to treatment or transport is a different thing and is not affected by this.

We do not make decisions about you by automated means alone. Some of our tools use automation to help our clinicians, for example transcribing and translating a call, producing a written summary of it, or estimating your pulse and breathing rate from a video. A qualified clinician reviews these and remains responsible for every decision about your care. You can ask us to correct anything one of these tools has recorded about you.

5. Recorded calls and messages

Calls and messages to the Global Response Centre may be monitored or recorded. We will tell you at the point of contact when this is happening. Recordings are kept securely, access is restricted, and they are deleted in line with section 10.

If you are in a country where all parties must agree before a call is recorded, we will ask you at the start of the call.

6. Live video during an emergency

If you contact the Global Response Centre and our clinicians need to see what is happening, we may send you a text message with a link. Opening it turns on the camera on the phone at the scene and streams what it sees to our clinical team. Nothing needs to be installed.

You are asked before it starts. Before any video begins, a message appears on the phone asking you to agree to share video, audio and location. If you decline, nothing is shared and we will help you in the usual way. Whoever is holding the phone can stop the video at any point.

Why we use it. Seeing the injury or the scene lets a clinician assess you far more accurately than a description alone, guide whoever is with you through what to do, and pinpoint where you are so that help reaches you.

What happens to the video. We decide whether a stream is recorded. Where it is, the video is stored in encrypted form in the United Kingdom and forms part of your case file, with the same restrictions on who can see it as the rest of your medical information. No video is stored on your own phone.

Other people may appear. Video from the scene may show people who are with you, including family, colleagues or bystanders. We ask our clinicians to keep the camera on the patient wherever possible, and anything else captured is treated as part of your case record and used for nothing else. If you are able to, please let those with you know.

Automated help for our clinicians. Our systems may transcribe and translate the conversation, produce a written summary, and estimate your pulse and breathing rate from the video. These are tools that assist a clinician. A qualified clinician always reviews them and remains responsible for any decision about your care, and you can ask us to correct anything they have recorded.

This service is provided for us by GoodSAM Ltd, a company based in London, registered with the Information Commissioner’s Office under reference ZA094052.

7. The Global Assistance app

If your organization has made it available, you can install the Global Assistance app on your phone. It gives you risk information and alerts for the countries you travel to, lets you check in to confirm you are safe, lets you message your organization’s security team, and has a button that puts you straight through to the Global Response Centre.

The app does two different jobs, for two different organizations.

For us, it is how we reach you with alerts and how we find you if you press the emergency button or we cannot get hold of you during an incident. We are responsible for that use.
For your organization, it is a travel safety tool. Your organization has access to a secure web portal that shows where its people are, which of them are near an incident, and who has checked in. Your organization decides who in its security, travel or HR team can see this, what it is used for, and how it tells you about it. Your organization is responsible for that use, and we run the platform on its behalf.

The app is built and operated by Safeture AB, a company based in Sweden, which handles your information under a written agreement with us. The App Store lists a privacy policy from Safeture, which covers their platform generally. This notice covers what we do with your information, and your organization’s own privacy notice should cover what it does. Your company may choose to deploy another version of the Global Assistance app, in which case you should look to your organization’s own privacy notice for details on its data practices.

Where your location comes from. The app can report your location in three ways, depending on how your organization’s programme is set up:

Automatically from your phone, using GPS, mobile network and Wi-Fi. The app can do this even when it is closed.
When you check in. Pressing the check-in button sends your position at that moment.
From your travel bookings, if your organization has connected its booking system. This uses the places in your itinerary rather than your actual position.

Automatic positioning is not always accurate. If you are connected to Wi-Fi or a VPN, the app may report the location of the network rather than where you actually are. If you are in an emergency, tell us where you are rather than assuming we can see it.

Who can see your location. The Global Response Centre can see it when we are helping you. Your organization’s nominated portal users can see it as described above. Safeture’s staff can access it only to run and support the platform. Nobody else can.

Turning it off. You control location permissions in your phone settings and can turn them off or change them at any time. You can also choose to share only when you check in. If you turn location off, you will not get alerts based on where you are, your organization will not be able to see where you are, and we may not be able to find you quickly in an emergency. Turning it off does not affect your membership or your right to call us for help.

Outside working hours. The app does not know when you are working and when you are not. If you would rather not be located outside work, turn location off or use check-in only. Your organization should have told you what it expects. If it has not, ask.

What else the app collects. Your name and contact details, an identifier for your device, the alerts sent to you and whether you opened them, messages exchanged through the app, and information about how you use it.

How long it is kept. Your location history, check-ins, alerts, and messages are kept on the platform for 18 months and then deleted, unless it relates to an incident, in which case it is kept with your case file.

8. What your organisation is told

Your organization pays for the membership and has duties towards you, so we keep it informed. What it receives from us is limited to what it needs.

We normally tell your organisation	We do not tell your organisation
That an incident has occurred and roughly where	Your diagnosis
That you are safe, and your general welfare and operational status	Your medical history or test results
Whether you are fit to travel or continue working	Clinical notes or the details of your treatment
What arrangements are being made and when	What you discussed with our clinicians
Costs incurred and to be incurred	Recordings of your calls, or video from the scene

If your organization uses the Global Assistance platform, it can also see your location, check-ins and alert history directly, without asking us. Section 7 explains this. Nothing from your case file, your calls or your video appears on the platform.

We will share clinical details with your organization only if you agree, if it is necessary to protect your life or someone else’s, or if the law requires it.

9. Who else we share it with

Hospitals, clinics, doctors and other medical professionals treating you.
Air, ground and sea ambulance operators, charter operators, medical escorts and airlines.
Security providers, protection teams and transport contractors.
Translators, local support agents, and where necessary mortuary and repatriation agents.
Police, embassies, immigration and other authorities, where they are involved in helping you or where we are required to tell them something.
Insurers, reinsurers, underwriters and brokers, where other cover applies to your situation or where we are recovering costs.
Specialist crisis response providers, in kidnap, detention or missing person cases.
Safeture AB, which operates the Global Assistance app and platform described in section 7.
Your organization, through its access to the Global Assistance platform, as described in sections 7 and 8.
GoodSAM Ltd, which provides the live video service described in section 6.
MedicOne Systems, which provides the clinical record system we use for repatriation and transport cases.
Other companies in the Concentric Group, for operational support.
Our professional advisers and auditors.

We do not sell your personal data and we do not use it for advertising.

10. Where your information is held, and how long we keep it

Our Global Response Centre is in the United Kingdom, but some of your information is stored in the United States. Our email, file storage and collaboration systems run on infrastructure located in the United States, shared with our parent company Concentric Group, Inc. That means the information we hold about you, including health information, is stored there, and colleagues in our United States offices may access it to help run the service.

For that arrangement we rely on the UK Extension to the EU-U.S. Data Privacy Framework, and on approved contractual safeguards where the Framework does not apply. We assess the risk before transferring and review that assessment at least once a year.

Live video is handled differently. It is stored in the United Kingdom and is not transferred outside it.

Information from the Global Assistance app, including your location history, is held by Safeture AB on servers in the European Economic Area. The United Kingdom recognises the EEA as providing adequate protection, so no additional safeguard is needed for that transfer.

Emergencies also happen wherever you are, so we will often need to send information to the country you are in, including countries whose data protection laws differ from those in the United Kingdom. Where we do this to get you urgent help and there is no other route available, we rely on the fact that it is necessary to protect your vital interests.

You can ask us which countries your information is held in and what safeguards apply, using the contact details in section 1.

We keep your information only as long as we need it. In practice that means:

Data	Period	Source and trigger
Case files including health data	8 years	Trigger: case closure
Case files where the Eligible Member was under 18 at the time	Until the 25th birthday, or if aged 17 at conclusion of treatment; if the child died, 8 years after death	Trigger: date of birth
Mental health records	20 years	Trigger: From last contact; or 8 years after the death of the service user
Maternity records	25 years	Trigger: From the date of the last live birth
Records of deceased persons (GP context)	10 years	Trigger: From date of death
Recordings of, and messages exchanged during, contact with the Global Response Centre where linked to a case	Retained with the case file	Trigger: case closure
Recordings of contact with the Global Response Centre not linked to a case, on any telephony or messaging platform	18 months	Trigger: date of the contact
Census, eligibility and travel declaration data	7 years	Trigger: expiry of the Period of Agreement
Financial, recovery and sanctions records	7 years	Trigger: expiry of the Period of Agreement
Location history, check-in and alert records on the Global Assistance Platform not linked to an incident	18 months	Trigger: date of collection
Location history, check-in and alert records on the Global Assistance Platform linked to an incident	Retained with the case file	Trigger: case closure
Signed Agreement, Schedule and amendments	Indefinite	Trigger: date of collection

When these periods end we delete or anonymise the information, including in our backups. If we need to keep something for longer, for example because of a legal claim, that has to be authorised by our Data Protection Officer and reviewed.

11. How we protect your information

We run a formal information security management system that is independently certified to the international standard ISO/IEC 27001:2022. The certification specifically covers the travel risk management and medical response services provided under your membership, so it applies to the way we handle your information in an emergency and not only to our office systems.

In practice that means your information is encrypted when we store it and when we send it, access is limited to the people who need it for your case, that access is logged, and our staff are bound by confidentiality obligations. Health information is held separately from our commercial systems and is reachable only by those with a clinical or operational need. Live video is encrypted in transit and at rest, and access to it is controlled by us rather than by the supplier.

Access to the Global Assistance platform is limited to named users. Your organization is responsible for deciding who in its team has access and for removing access when it is no longer needed.

Your organization can ask us for copies of our current certificates or they can be found on our trust center at trust.concentric.io. No system is completely secure, but if something does go wrong and your information is affected in a way that is likely to put you at risk, we will tell you.

12. Your rights

You have the right to be told how we use your information, to see a copy of it, to have it corrected, to ask us to delete it, to ask us to restrict how we use it, to object to our use of it, and in some cases to receive it in a portable form. These rights have limits, and some will not apply where we need to keep information for legal reasons or to defend a claim.

To use any of them, contact dpo@concentric.io. You do not need to use a particular form and you can ask us verbally. We do not charge, and we will normally respond within one month. We may ask you to confirm your identity first.

If you ask to see your information and it includes clinical records, we will deal with you directly. We will not route it through your employer.

If your request is about how your organization uses your location or the Global Assistance platform, your organization is responsible for answering it. You can still contact us and we will pass your request on and help where we can.

If you are unhappy with how we have handled your information, please tell us so we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, or to the supervisory authority where you live or work.

13. If you give us someone else’s details

If you nominate an emergency contact or next of kin, please tell them that you have given us their details and point them to this notice. We will not normally contact them until there is an emergency, so we usually cannot tell them ourselves in advance.

14. Members under 18

Membership is available from age 16, so some members are under 18. We handle their information with the same care and, where appropriate, we involve a parent or guardian.

15. Changes to this notice

This is version 1.0, effective October 8, 2026. Previous versions remain available at https://concentric.io/global-assistance-member-privacy-notice/ so you can see what applied at any given time.