Privacy notice.

Draft version · last updated 12 October 2026

Who we are

aid.mt is run by Aftermath Ltd (company registration C110654, VAT MT31570511), 34 Mosta Road, St Paul’s Bay, Malta. We are the controller of the personal data described here.

To contact us about privacy, use the contact form and choose “Privacy or my data”. We are confirming whether we must appoint a data protection officer, and will publish their details here before launch.

What this notice covers

This notice covers the aid.mt website, the aid.mt app preview and the responder application. It is a draft for the preview stage and will be updated before launch.

What we collect

• Account details — your name, email address, phone number, language and password (stored only as a secure hash).
• Trusted contacts — the names and contact details of people you invite, and whether they agreed.
• Medical profile (optional) — for example blood type, allergies, medication and conditions. Encrypted before it is stored.
• Alert records — when an alert was raised, how its status changed, and your location during the alert if you allowed it.
• Responder applications — identity, professional registration, training, insurance, conduct certificate and references.
• Waiting list and messages — your email, the plan or topic you chose and what you wrote to us.
• Technical data — a shortened, one-way-coded form of your IP address used for security and rate limiting, and essential cookies (see the cookie notice).

Why we use it, and our legal basis

• To provide the account and safety features you ask for — performance of a contract (GDPR Article 6(1)(b)).
• To process your optional medical profile and health information during an alert — your explicit consent (Article 9(2)(a)); where you are physically or legally unable to consent, to protect your vital interests (Articles 6(1)(d) and 9(2)(c)).
• To verify responders — our legitimate interest in keeping people safe (Article 6(1)(f)) and, where it applies, a legal obligation (Article 6(1)(c)). Conduct certificates are handled only as Maltese law allows (Article 10).
• To keep the service secure and prevent abuse — our legitimate interests (Article 6(1)(f)).
• To handle waiting-list sign-ups — your consent (Article 6(1)(a)); to answer your messages — our legitimate interest in replying (Article 6(1)(f)).

These legal bases are being reviewed by counsel as part of a data protection impact assessment (DPIA), which will be completed before any live processing.

Health data

Health data is special category data. We keep it apart from everything else. It is encrypted, never used for advertising, marketing or AI training, never combined with data from other Aftermath platforms, and never shared with medics.mt. You can change or delete it at any time in the app.

Location

We use your location only while an alert is open, and only if you allowed it. We don’t track you in the background. A responder’s location is used only while they are available or on an assigned alert, and they are told when it is being used.

Who we share it with

• The trusted contacts you chose, during an alert.
• Verified responders, once the service is operating — only the minimum needed, and only after they are assigned.
• Service providers who host and run the service for us (for example hosting, email and maps), under data processing agreements.
• Public authorities, where the law requires it.

We do not sell your data. A list of our service providers will be published here before launch.

AI

Our in-house assistant, Aftaris, may help our team with non-critical admin and support. It is never used for medical decisions, and we do not send medical profiles or alert locations to it.

International transfers

We aim to keep data in the European Union. If a provider transfers data outside the European Economic Area, we will rely on an adequacy decision or standard contractual clauses, and say so here.

How long we keep it

• Account data: while your account is open, then deleted or anonymised, unless the law requires us to keep it longer.
• Medical profile: until you delete it or close your account.
• Alert records: for a limited period for safety review, complaints and legal claims. The exact period will be set after legal review and published here.
• Waiting list: until we send the launch message, or sooner if you ask us to remove you.
• Contact messages: for as long as we need to deal with them. The maximum period will be confirmed before launch.

Your rights

You have the right to access, correct and delete your data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time (this doesn’t affect what we did before). Ask us through the contact form.

You can also complain to Malta’s data protection authority, the Information and Data Protection Commissioner (IDPC), at idpc.org.mt.

Security

We use encryption in transit and at rest, separate encryption for medical profiles, strict access controls, two-step sign-in for staff and an audit log that can’t be quietly edited.

Changes

We will post changes on this page and tell you in the app when they matter.