Privacy Policy & Data Handling Procedures
Last updated: September 12, 2025
Applies to: ReadyOps™ (“ReadyOpsChannel”), a private community managed by the All Hazards Consortium (AHC) and operated on the Signal app.
1) Who we are & scope
ReadyOpsChannel is an invite‑only operational messaging service for vetted utilities, contractors, and government partners. It runs on the encrypted Signal app and is governed by the private sector’s SISE legal framework. This policy explains what we collect, how we use it, and the procedures we follow to keep information secure and appropriate for operational use.
Covered: account creation, onboarding, participation in ReadyOpsChannel groups, program meetings/briefings, directories, support, and drills/TTXs. Not covered: how Signal processes data (see Signal’s own privacy policy) or any public websites/tools you access from the channel.
2) Information we collect
Account & enrollment data
• Name, employer, role, work email/phone, sector/region
• Seat assignment details (Account Holder, license status)
• Onboarding/attendance logs for required training
• Support tickets and correspondence
Operational participation
• Posts you share in ReadyOpsChannel Signal groups
• Limited moderation metadata (e.g., message date/time, relevance tags)
• Directory entries (name, role, organization) visible to members
Billing & admin
• Purchasing org, number of seats, term status, invoices/receipts.
We do not collect consumer marketing profiles, ad‑tracking cookies, or sell personal information.
3) Why we use your information
• Provide secure access to private Signal groups and maintain a vetted member directory
• Moderate for “operational‑only” relevance and route/relay critical updates between working groups when appropriate
• Run program briefings, after‑action reviews, and drills
• Provide support (email/text) and manage licenses, renewals, and reassignments
• Maintain service integrity, safety, and compliance with SISE rules
Legal bases: performance of contract (membership), legitimate interests (security, abuse prevention, event coordination), and consent where required (optional communications).
4) Sharing & disclosure
We share information only as needed to operate the program:
• Within the community: your directory entry (name, role, org). Operational updates you post are visible to members of relevant groups.
• Program operations: AHC staff and designated moderators may review content for operational relevance and, when appropriate, relay verified information between related private groups to speed response.
• Vendors: limited data with trusted processors for ticketing, email/SMS support, invoicing, and project management.
• Compliance & safety: if required by law or to protect people, infrastructure, or the service.
We do not sell personal data.
5) Retention
• Account & billing records: kept for the active subscription term and a reasonable period afterward for audit/compliance.
• Directory: updated during your term; removed or archived upon expiration.
• Operational content: remains in Signal. We do not create a permanent external archive by default. If operationally necessary (e.g., after‑action notes), we extract the minimum data needed and store it securely with restricted access.
6) Security
• ReadyOpsChannel relies on Signal’s end‑to‑end encryption for message transport.
• Access is invite‑only; users must complete onboarding and agree to behavioral standards.
• Program staff monitor for misuse and remove off‑topic, promotional, or inappropriate content.
• We implement least‑privilege access, MFA on admin systems, and vendor due diligence. No method is 100% secure, but we apply safeguards proportionate to the sensitivity and operational purpose of the service.
7) Member responsibilities
• Keep your Signal client and device OS up to date.
• Do not share screenshots or redistribute content outside authorized channels unless explicitly permitted.
• Post operational information only; avoid PII unless essential to safety or logistics.
• Follow state/agency disclosure rules when sharing government information.
8) Your choices & rights
Subject to applicable law:
• Access, correct, or update your profile
• Request removal from the directory
• Object to non‑essential processing (e.g., optional updates)
• Request deletion of support tickets or extracted after‑action notes where feasible
Contact us (below) to exercise rights. We may need to retain some data for safety, legal, or audit purposes.
9) Procedures
A. Access control & vetting
• Membership is invitation‑based and role‑driven. Seats are capped monthly to protect signal‑to‑noise.
• Identity and role are verified during onboarding; users must accept SISE terms and usage standards.
B. Onboarding
• Provide Signal install guide, verify identity and work email/phone, and deliver a short training on rules of engagement and posting standards.
C. Moderation & content routing
• Enforce “operational‑only” use; remove off‑topic posts.
• When appropriate, relay verified, need‑to‑know updates between aligned state/sector groups to reduce delays.
• Maintain a minimal log of moderation actions (who/when/what category).
D. Incident response
• Report suspected account compromise or misuse to program staff immediately.
• We may suspend or revoke access while investigating.
• Notify affected parties if a security issue materially impacts confidentiality or availability.
E. Data requests
• Route privacy inquiries to the program team; verify identity before responding.
• Respond within applicable legal timelines.
F. Retention & disposal
• Annual review of extracted operational notes; securely delete when no longer needed.
• Prompt removal of expired members from directories and access lists.
G. Vendor management
• Approve vendors with security reviews and DPAs; restrict data shared to the minimum necessary.
H. Drills & after‑action
• Use exercises and AARs to validate procedures and improve.
10) Children
ReadyOpsChannel is a professional service; it is not intended for children under 16 and should not be used by them.
11) Changes to this policy
We may update this document as the program evolves. We’ll post the new date here and, when material, notify members via Signal and/or email.
12) Contact
Program support & privacy requests: [email protected]
Controller: All Hazards Consortium (on behalf of the ReadyOpsChannel working groups)