Privacy Policy

EMS Education(“we”, “us”) runs this website and its products, starting with RemacReady, an exam prep product for the NYC REMAC paramedic credentialing exam. This policy covers every EMS Education product and page.

The service is intended for adults aged 18 or older who are certified EMS providers, such as EMTs and paramedics, including providers preparing for a credentialing exam.

We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will delete it.

We collect only what we need to run the service:

• Account details: your email address and password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them in plain text.
• Profile details you give us: for example your name, age, state, EMS agency, certification details (such as certification level and dates) and EMS training history. Some of these fields may be optional.
• Survey answers: if you choose to answer an optional survey, we keep your answers.
• Study activity: the questions you answer, your choices, scores, time spent and your exam date if you set one.
• Technical data: cookies needed to keep you signed in, and standard server logs (such as IP address, browser type and the pages requested) kept by our hosting provider for security and reliability.
• Messages and sign-ups: if you use the contact form, apply to a partner program or join the newsletter, we keep what you send (such as your name, email, organization and message), the time you agreed to receive email, and a one-way hash of your IP address used only to limit spam.
• Payment details: checkout is not open yet. When it opens, payments will be handled by a payment processor; we will not store full card numbers.

• To run your account: to sign you in, save your progress, and show you your review and stats.
• To personalise your studying: for example, to suggest your weakest subjects or tailor content to your certification level and region.
• For product research: to understand who uses EMS Education, which questions are hard or unclear, and which products to build next. We use aggregated or de-identified data for this wherever we can.
• For an optional survey and promotional free month: we may offer a free month of premium access to people who complete a short survey about their EMS background and study needs. The survey is optional. Declining it does not affect your free account.
• To contact you about your account, security, or important changes to the service.
• To keep the service safe: to prevent abuse, fraud, and copying of the question bank.

We do not sell your personal data. We do not share it for cross-context behavioural advertising.

We share personal data only with:

• Service providers that run the service for us under contract, such as our hosting provider (Vercel) and our database and authentication provider (Supabase), and, once checkout opens, a payment processor. They may use your data only to provide their service to us.
• Authorities, when the law requires it.
• A successor, if EMS Education is merged or sold, in which case this policy continues to apply to your data.

We will not share your profile details with your EMS agency or employer, or with REMAC, REMSCO or any other credentialing body.

We keep your account, profile and study activity for as long as your account is open. If you delete your account or ask us to, we delete your personal data within 30 days (TODO: confirm period with counsel), except where we must keep something to meet a legal obligation, resolve a dispute or prevent fraud.

Backups roll off on a fixed schedule, so deleted data may remain in an encrypted backup for a short period before it is overwritten. Aggregated, de-identified statistics (for example, how often a question is answered correctly) may be kept after your account is deleted because they no longer identify you.

You can:

• update most profile details yourself in your account settings;
• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your account and personal data;
• skip or withdraw from optional surveys at any time.

To make a request, email privacy@[TODO: domain] from the address on your account. We will confirm your request and respond within 30 days. We will not treat you differently for exercising these rights.

Data is encrypted in transit, access to it is restricted by role, and database rows are protected so each user can read only their own records. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

We use cookies that are needed to keep you signed in. We do not use advertising cookies. If we add analytics, we will update this policy first.

We will post any changes on this page and update the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.

Questions or requests about privacy: privacy@[TODO: domain] (TODO: replace with the real address before launch).