Paramedic+ — Privacy Policy

At a Glance

Who we are

Paramedic+, a Canadian AI training platform for paramedics and EMS professionals.

What we collect

Your name, email, professional role, and in-app training activity (scenario history, session timing, transcripts of your training conversations).

Voice audio

Streamed directly to OpenAI for real-time processing. We do not store your voice audio. Transcriptions of speech may be stored in your session history.

Third parties

Supabase (database, US), OpenAI (AI processing, US), and Render (hosting, US). All data is processed under appropriate safeguards.

Your rights

Under PIPEDA, you may access, correct, or request deletion of your personal information at any time. Contact us at privacy@paramedicplus.ca.

About This Policy

This Privacy Policy describes how Paramedic+ ("we," "us," or "our") collects, uses, stores, and discloses personal information when you use our platform. It applies to all users of the Paramedic+ web application and any related services.

We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. If you have questions about our practices, contact our privacy team at privacy@paramedicplus.ca.

By creating an account or using the Service, you consent to the collection and use of your personal information as described in this policy.

Information We Collect

We collect the following categories of personal information:

Category	What we collect	Why
Account info	Email address, first name, password (hashed — never stored in plaintext)	Create and secure your account; communicate with you
Profile	Professional role (e.g. PCP, ACP, EMT, Student)	Tailor scenarios to your scope of practice
Simulation activity	Scenarios attempted, time spent, milestones reached (transport, debrief), conversation transcripts from training sessions, audio token usage counts	Display your training history and progress; calculate weekly usage for service limits
API key (optional)	Your OpenAI API key, if you choose to provide one (Bring Your Own Key feature)	Process AI calls using your own OpenAI account. Stored encrypted — never readable in plaintext.
Session data	A session cookie stored in your browser for 7 days	Keep you logged in between visits
Usage logs	Server-side logs including timestamps, scenario IDs, and error events	Debug issues, monitor service health, and prevent abuse

What we do not collect: We do not collect payment card numbers, government-issued ID numbers, health card numbers, or any real patient health information. The Service is a training tool — no real patient data should ever be entered, and we have no system designed to receive it.

Voice Audio and AI Processing

The Paramedic+ simulation experience is built on real-time voice. When you speak during a simulation:

Your voice audio is streamed in real time to OpenAI's servers via a secure WebSocket connection for immediate transcription and AI processing;
We do not receive, record, or store your raw voice audio. It is processed by OpenAI and not written to any database we control;
Transcriptions of your speech (what you said to the AI patient or partner) may be stored in your session record in our database, so you and your debrief can reference what was said;
AI responses (text and audio) are generated by OpenAI's models. The audio component is streamed to your browser and not stored by us;
Anonymized audio token counts (a measure of volume, not content) are stored to calculate your weekly usage.

OpenAI's handling of your data during processing is governed by OpenAI's Privacy Policy. We use OpenAI's API under a data processing agreement that prohibits them from using API-submitted data to train their models by default.

How We Use Your Information

We use your personal information only for purposes you would reasonably expect given this Service:

To provide the Service: authenticating your account, loading your profile and training history, running simulations, and generating debrief feedback;
To track your progress: recording scenario completions, session time, and displaying your activity history on the dashboard;
To enforce usage limits: calculating your weekly audio usage to ensure fair access across all users;
To communicate with you: sending account-related emails (password reset, account notifications) — we do not send marketing emails without your explicit opt-in;
To improve the Service: analysing anonymized usage patterns (scenarios used, session lengths, common drop-off points) to fix bugs and improve scenario quality. This analysis does not reference your identity;
To ensure security and prevent abuse: detecting unauthorized access, rate limiting, and investigating reports of misuse.

We do not sell your personal information. We do not share it with advertisers. We do not use your data to build profiles for any purpose unrelated to providing this Service.

Third-Party Service Providers

We rely on the following third-party providers to operate the Service. Each acts as a data processor on our behalf and is bound by appropriate data processing terms. Because these companies are based in the United States, your personal information is transferred to and processed in the US, which is a cross-border transfer under PIPEDA. We rely on contractual safeguards to protect your information in transit.

Supabase (Supabase Inc.)

Database & Authentication — United States

Stores your account credentials, profile information, simulation history, and all structured data associated with your account. Authentication (sign-in, password hashing, password reset) is handled by Supabase Auth. Data is stored in encrypted-at-rest databases with access controls enforced at the row level.

OpenAI (OpenAI, LLC)

AI Models, Voice & Transcription — United States

Processes your voice audio in real time during simulations and generates AI patient responses, partner responses, and debrief feedback. Receives text transcripts from training sessions to generate contextual feedback. Under our API usage agreement, OpenAI does not use submitted data to train foundation models by default.

Render (Render Services, Inc.)

Cloud Hosting — United States

Hosts the Paramedic+ application server. All traffic between your browser and our server is encrypted via HTTPS/TLS. Server-side logs (including request metadata) are stored temporarily on Render's infrastructure for debugging purposes.

We do not use any advertising networks, analytics platforms (such as Google Analytics), or social media tracking pixels.

Cookies and Browser Storage

We use a single session cookie to keep you logged in. This cookie:

Is set when you sign in and expires after 7 days of inactivity;
Contains only an encrypted session token — no personal information is stored in the cookie itself;
Is essential for the Service to function and cannot be disabled while using the platform.

We do not use advertising cookies, third-party tracking cookies, or persistent analytics cookies of any kind. We do not use browser local storage to store personal information.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service:

Account information (name, email, role): retained until you delete your account;
Simulation history (session records, transcripts, debrief content): retained until account deletion. You may also request deletion of specific session records;
Usage logs: retained for up to 90 days for security and debugging purposes, then automatically deleted;
API keys: retained in encrypted form until you remove them in Settings or delete your account;
Voice audio: not retained by us — processed in real time and discarded.

When you delete your account, we will delete your personal data within 30 days. Anonymized, non-identifiable aggregate statistics (e.g. "X users completed this scenario this month") may be retained indefinitely.

Security

We take reasonable technical and organizational measures to protect your personal information:

All data in transit is encrypted using TLS/HTTPS;
Passwords are hashed using industry-standard algorithms by Supabase Auth — we never see or store your plaintext password;
API keys (if provided) are encrypted using Fernet symmetric encryption before storage — they are never stored or transmitted in plaintext;
Database access is controlled using row-level security policies — users can only access their own data;
We do not store voice audio, limiting the sensitivity of data at rest.

No security measure is perfect. If you believe your account has been compromised, contact us immediately at privacy@paramedicplus.ca.

Your Rights Under PIPEDA

As a Canadian resident, you have the following rights with respect to your personal information:

Access: You may request a copy of the personal information we hold about you;
Correction: You may request that we correct inaccurate or incomplete information. Basic profile information (name, role) can be updated directly in Settings;
Withdrawal of consent: You may withdraw your consent to the collection or use of your personal information at any time. Withdrawing consent may mean we can no longer provide the Service to you;
Deletion: You may request that we delete your account and associated personal information. We will fulfill verified requests within 30 days;
Complaint: If you believe we have not handled your personal information in accordance with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact us at privacy@paramedicplus.ca with the subject line "Privacy Request." We will respond within 30 days. We may ask you to verify your identity before processing your request.

Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at privacy@paramedicplus.ca and we will promptly delete the account and associated data.

Cross-Border Data Transfers

Paramedic+ is a Canadian service. However, we use service providers based in the United States (Supabase, OpenAI, and Render). When you use the Service, your personal information is transferred to and processed in the United States.

The United States does not have privacy laws equivalent to PIPEDA for all purposes. By using the Service, you acknowledge and consent to this transfer. We have entered into data processing agreements with each of these providers to ensure your data is handled with appropriate safeguards consistent with Canadian privacy standards.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change — particularly one that affects how we use your personal information — we will notify you by email at least 14 days before the change takes effect. Minor or clarifying changes may be made without prior notice.

The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date of any change constitutes your acceptance of the updated policy.

Contact Us

For any privacy-related questions, requests, or concerns, please contact our privacy team:

Paramedic+ Privacy
Email: privacy@paramedicplus.ca
Please include "Privacy Request" in the subject line.

We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. If a longer response time is required, we will notify you of the reason and expected timeline.

If you have a complaint that we were unable to resolve to your satisfaction, you may contact the Office of the Privacy Commissioner of Canada:
www.priv.gc.ca · 1-800-282-1376