Privacy Policy · EMStriq

1. Who we are and what this covers

MEGI Technologies LLC ("EMStriq," "we," "us") provides a program-management and clinical-training-record platform for EMS education programs and the clinical sites that host their students (the "Service"). The Service runs at emstriq.com, app.emstriq.com, org.emstriq.com, eval.emstriq.com (preceptors), the clinical-site surface, related subdomains, and any mobile applications we offer.

This Policy explains what information we collect, how we use and share it, how long we keep it, how we protect it, and the choices you have. It applies to everyone who interacts with the Service:

Institution staff (program directors, faculty, coordinators, medical directors, administrators);
students and applicants of an Institution;
independent students who ask to join a clinical site directly, without a school on EMStriq;
preceptors who evaluate students;
clinical-site members who run a site's EMStriq account;
sponsors who pay seat fees for students; and
visitors to our marketing site, including people who request a demo.

1.1 Our role depends on who you are

Institutions are our customers. When an EMS program uses the Service to manage its students, the program (the "Institution") decides what data is collected and why. We process that data on the Institution's behalf and under its instructions. Under FERPA we act as a school official under the Institution's direct control. Where an Institution has signed a Business Associate Agreement with us, we act as its business associate under HIPAA for the data that agreement covers.
Clinical sites that open a site account are also our customers, under the Terms for Clinical Sites. Information a site enters about its own operations (units, shifts, team, forms, settings) belongs to the site.
Students, applicants, preceptors, sponsors, and site contacts use the Service because an Institution or a clinical site invited them. Most of what we hold about you is controlled by that Institution; many requests about it (correction, deletion, access to education records) are handled through the Institution. We handle your account credentials, your document wallet (§2.8), and your direct communications with us.
Independent students who join a clinical site without a school on EMStriq deal with us directly. For them, we decide how their account, pass, and scheduling information is processed, and we share it with the sites they ask to join (§6).
Visitors to our marketing site interact with us directly.

2. Information we collect

We collect information in three ways: you (or your Institution or site) provide it, it is generated as you use the Service, and a small amount comes from service providers (for example payment status from our payment processor).

2.1 Account and identity

Name, email address, mobile number if you choose to add one, password (stored only as a one-way hash), student level or role, license or certification numbers you choose to record, time zone and display preferences, notification preferences, and the versions and dates of the legal documents you accepted. Staff who must use two-step sign-in also have an authenticator secret (encrypted with a key held outside the database) and recovery codes. Some people sign in with one-time codes sent to their email instead of a password (§2.11).

2.2 Application and admissions data (applicants)

If you apply to a program through the Service: the information the Institution's application form asks for (contact details, education and employment history, certifications, references, answers to custom questions), documents you attach, interview scheduling, scores and outcomes, and the Institution's decisions and notes. What is collected is configured by the Institution.

2.3 Onboarding and compliance documents (students)

Documents and dates the Institution or a clinical site requires before or during clinical training, which may include immunization and titer records, tuberculosis screening, physical examinations, drug-screening and background-check results, CPR and other certifications, insurance, agreements, attestations, declinations or exemptions, and signed forms. These often contain sensitive personal information, including health information about you. They are encrypted with a key unique to the Institution (or, for a site's own forms, to the site) and are visible only to authorized staff of that Institution or site and to you.

2.4 Clinical logging data (students)

Records of patient encounters, procedures, and medications you document for training and competency tracking: patient age (capped at 90+), gender, date and time of service, facility or unit, chief complaint, assessment and exam findings, diagnosis or impression, disposition, procedures and attempts, medications and routes, vital signs, team-lead status, and narrative notes. These records are designed to be de-identified. The Acceptable Use & Data Minimization Policy prohibits entering patient names, medical record numbers, Social Security numbers, full dates of birth, addresses, contact details, photos, account or insurance numbers, or free text that names a specific person, and every student attests to those rules. Your Institution's staff can read and grade these records; your preceptor can verify your procedures and give feedback.

2.5 Scheduling and attendance

Your availability, shift preferences, bid rankings, shift sign-ups, assignments, swap and drop requests (including a reason, when you drop close to the start), requests you send to clinical sites, and clock-in and clock-out times, including whether you were automatically clocked out after a shift.

2.6 Location at clock-in and clock-out

When you clock in or out of a shift, the app may ask your device for its location. Your Institution chooses one of three settings:

Full (the default): we store the coordinates of the clock-in and clock-out, the distance from the shift's site, and a flag if you were not nearby.
Distance only: we compute the distance and the flag when you punch, then discard the coordinates before anything is stored.
Off: the app never asks for your location, and we ignore any location a device sends.

We collect location only at the moment you clock in or out, never in the background or between punches. Your Institution also sets how long stored coordinates are kept (from 1 day to 10 years, or until the Institution removes them); after that period they are erased automatically and only the distance and flag remain. If you deny location access on your device, you can still clock in, and the record shows that no location was available.

2.7 Evaluations, grades, and outcomes

Preceptor verification of your procedures, preceptor scores, comments and feedback, the preceptor's name, credential, and agency, and the preceptor's signature image; faculty chart grades; assessment and exam results the Institution records; phase progression; competency and minimum-requirement status; graduation checklist items; program completion, certification-exam, and employment outcomes the Institution records for accreditation reporting; and your answers to course, site, preceptor, and resource surveys (reported to the Institution in aggregate, as described in the Service).

2.8 Your document wallet and share links

Students can keep their own documents (for example certifications and immunization records) in a personal wallet. Wallet documents belong to your account, not to any one program, stay available for 7 months after your last program ends (§9), and are encrypted with a key unique to your account. When you send a wallet document to a program, the program receives its own copy under its own key. You can create a share link that lets someone without an account view or download the documents you choose, for a period you choose (up to 31 days), optionally ending after the first download. We record each time a share link is opened or downloaded, using a short digest of the link and the viewer's network (never the raw address), and show that log to you.

2.9 Forms and electronic signatures

When you sign a form electronically in the Service, we record your consent to sign electronically (with its wording version, time, IP address, and browser); your signature (a drawn image, encrypted under your wallet key, or a typed name); the fields you completed; your date of birth if the form needs it (stored encrypted); the time, IP address, and browser of the signing; and fingerprints (SHA-256 hashes) of the form before and after signing. The signed form carries a certificate page with those details, so its owner can later confirm it has not been altered. A signed copy goes to the form's owner (your program or the clinical site) and a copy to your wallet.

2.10 Preceptors, clinical sites, independent students, and sponsors

Preceptors. Name, credential, agency, and work email (we do not collect preceptor phone numbers); one-time sign-in codes; the evaluations, verdicts, feedback, and signature images you submit; and, to protect against a student grading their own shift, a keyed hash of a device identifier and of the network and browser used. We never store those identifiers in raw form. A saved signature is offered back only on the same device.
Clinical-site members. Name, work email, role on the site's team, and the site's units, shifts, schedules, forms, settings, and decisions. Card details for a site that pays for independent students are collected and stored by our payment processor (§2.12).
Independent students. Name, email, your student level, the sites you ask to join and their decisions, your availability and schedule, forms you sign for a site, and your pass purchases. An independent student's shifts are scheduling only: no clinical logging, clock-in, or preceptor evaluation happens in EMStriq for them.
Sponsors. Contact name, email, and organization; the students and amounts on your invoices; your approvals or declines; and payment status.

2.11 Sign-in and security events

Sign-ins and failed sign-ins, one-time code requests (codes are stored only as hashes and expire within minutes), password resets, two-step sign-in events, sessions, bot-protection results, and rate-limit counters keyed by network address.

2.12 Billing information

Whether a seat, pass, or site coverage has been paid, by whom, and when; invoices and receipts; sponsor and site billing contacts; tax-exemption certificates; and refunds. Payments are processed by a PCI DSS-compliant payment processor, which collects card or bank details directly. We do not receive or store full card or bank account numbers; we receive payment status and a masked identifier.

2.13 Reports of concern

If you report a concern about your clinical experience (for example harassment, unsafe conduct, patient safety, or an exposure or injury), we store the report, encrypted, along with who filed it and its case history. Reports are not anonymous: they are visible, with your name, only to the staff your Institution has authorized to receive them. They are never shown to preceptors or clinical sites.

2.14 Communications and support

Messages we send you, your replies, support requests, feedback you submit in the app, and the contents of any correspondence with us. Emails we send are designed never to contain clinical logging data.

Messages with clinical sites. A clinical site and a student it schedules can write to each other in the Service. We store each conversation: the text (up to 2,000 characters a message, no attachments), who wrote it and when, any shift it refers to, and when each side last read it. Messages must not contain patient information. When a new message arrives we email a link saying a message is waiting, never the message itself.

2.15 Technical and usage data

IP address, browser and device type, operating system, app version, times and pages or screens accessed, error and crash reports (captured by our own system, with clinical fields scrubbed), content-security-policy reports, and server logs. We use this to run and secure the Service. The Service itself uses no third-party analytics, advertising, or session-replay tools; our public marketing pages use cookieless web analytics (§2.18).

2.16 Cookies and browser storage

We use only the cookies and browser storage the Service needs to work:

sign-in and security cookies for your session, for two-step sign-in (including an optional 30-day "trust this browser" setting), and for the separate sessions of the preceptor portal, clinical-site accounts, and the sponsor portal;
a device cookie that lets us tell whether the same device was used by a student and by the preceptor grading them (we store only a keyed hash of it);
preference cookies and storage (theme, the program, course, and cohort you were last viewing, calendar view, and similar settings); and
on-device data for offline use (§2.17).

We do not use advertising cookies, and our marketing-site analytics set no cookies or browser storage (§2.18). If we ever add product analytics to the Service itself, it will be off by default and controlled by a setting in the Service.

2.17 On-device data (offline use)

So you can keep working without connectivity in the field, the app stores a copy of your recent data and any entries not yet sent encrypted on your device, with a key issued to your account. This copy is removed when you sign out, can be cleared from Settings, and expires after 30 days without use.

2.18 Marketing site and demo requests

If you request a demo, we collect your name, email, program, and message. Bot protection runs on forms (§7).

Our public marketing pages (emstriq.com) use cookieless web analytics to understand which pages visitors read and which links they follow: page views, time on page, clicks on links and buttons, where on a page people click and how far they scroll, the referring site, and browser and device type. It sets no cookies and stores nothing in your browser. Your IP address and browser are combined with a random value that changes every day into a one-way code used only to count visitors, and the IP address is not stored with the events. We do not record what you type, do not record sessions, and do not link these events to a name, an email, or an EMStriq account; a demo request is counted as an event without the details you entered. Requests pass through our own servers first, so the analytics provider never receives our cookies. None of this runs anywhere in the Service after you sign in, and we do not use it for advertising.

3. How we use information

We use information to:

provide the Service, including admissions, onboarding, forms and electronic signatures, scheduling and attendance, clinical logging, evaluation, grading, competency tracking, graduation, and accreditation and certification reporting;
coordinate students' clinical placements between programs and clinical sites, including messages between sites and students;
authenticate you and secure accounts and data, including detecting a student and a preceptor using the same device;
process payments, invoices, sponsorships, independent student passes, site coverage, and tax exemptions;
send transactional communications (account, onboarding, scheduling, evaluation, billing, and security notices);
provide support and respond to your requests;
monitor, debug, and improve the Service, including through our own error reports;
detect, prevent, and respond to fraud, abuse, and security incidents; and
comply with law, enforce our terms, and protect rights and safety.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use Customer Data to train artificial-intelligence models. The Service does not currently use artificial intelligence to process Customer Data. If we introduce such a feature, we will describe it here and in the Service before it processes your data.

4. Aggregated and de-identified data

We may create and use data that no longer identifies an Institution, clinical site, student, patient, or other person (for example, how many procedures of a type are logged across programs) for benchmarking, research, product improvement, and public reporting. We will not attempt to re-identify it.

5. Legal frameworks

FERPA. For education records, we act as a school official with a legitimate educational interest under the Institution's direct control, use records only as the Institution authorizes, and do not redisclose them except as the Institution directs or FERPA permits. When an Institution sends student documents to a clinical site through the Service, we record the disclosure for each student. Requests to inspect, correct, or amend education records go to your Institution.
HIPAA. Clinical logging data is designed to be de-identified. Where an Institution nonetheless treats it as protected health information and signs our Business Associate Agreement, we use and disclose that data only as the agreement permits and apply the safeguards described in our Security Overview.
Electronic signatures. Forms are signed under the federal ESIGN Act and state Uniform Electronic Transactions Act laws, after you consent to sign electronically. You can ask the form's owner for a paper copy instead.
State privacy laws. Many state consumer-privacy laws exempt FERPA education records and HIPAA-regulated data and do not apply to data processed on behalf of an institution. Where a state law does apply to you, §11 describes your rights.
Children. The Service is not directed to children under 13. Students under 18 may use the Service only under their Institution's supervision and with any consent the law requires the Institution to obtain.

6. How we share information

We share information only as follows:

With your Institution. Institution staff with the appropriate permissions see the student data, clinical logging data, evaluations, documents, and billing status for the programs they administer. Which staff see what is controlled by the Institution's role and permission settings. Reports of concern are visible only to staff the Institution authorizes to receive them. Institution staff with permission to view a student can read, but not write in, that student's conversations with clinical sites the Institution works with. The student is told this in the conversation, and each time staff open one it is logged.
With clinical sites. A clinical site with its own account sees students of a linked school only as needed to schedule them: the student's full name while the student has a request or a shift at that site (initials otherwise), program, course, and student level, what the student sent the site (availability, hours requested, and a note), the times (never the titles) of required school events, and forms the student signs for that site. It does not see a school student's email or phone number. For a independent student it sees name, email, and level. A site sees a student's onboarding documents only when the student's Institution sends them in a document packet. Sites never see clinical logging data, grades, or reports of concern. A site may share read-only schedule views with its own crews; those views show initials, program, and level only. A site's members share one inbox for messages with students and see which member wrote each reply. An Institution can turn off site messages for its students.
With preceptors. A preceptor evaluating you sees your name, the shift, and the procedures, encounters, and charts on that shift they are asked to review. Preceptors never see your onboarding documents, billing, or other students' records.
With sponsors. A sponsor paying your seat sees your name, program, invoice amount, due date, and payment status, and nothing clinical.
With other students. Where the Institution enables it, other students may see your name on a shift roster or in bid results. They never see your clinical records, grades, or documents.
With people you choose. When you create a wallet share link, anyone holding that link can view the documents you chose until it expires or you revoke it.
With service providers. The companies in §7, under contracts that restrict their use of data to providing services to us.
For legal reasons. To comply with law, subpoenas, or court orders (we notify the Institution where permitted); to enforce our terms; and to protect the rights, property, or safety of EMStriq, our users, or others.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy and any Business Associate Agreement or FERPA Addendum.
With your direction or consent.

7. Service providers

We use a small number of service providers to run the Service. All are located in, or store our data in, the United States, and each is bound by contract to use data only to provide its service to us. By category:

Cloud hosting for the application, our database interface, and scheduled jobs. Data passes through these servers; server logs scrub clinical fields.
Managed database for account, program, clinical logging, evaluation, billing, and audit records.
Object storage and off-site backups for uploaded documents (encrypted by us before upload) and encrypted database backups, kept in a separate region.
Payment processing and tax calculation for card and bank payments, payer name and email, and amounts.
Transactional email delivery for email addresses and message content (never clinical data).
Bot protection on sign-up, sign-in, application, and similar forms, which sees your IP address and a challenge token.
Map tiles loaded in staff browsers to show sites and clock-in locations on a map, which see the browser's IP address and the map area requested.
Address lookup (public geocoding services) for clinical-site street addresses, so the Service can place a site on a map. No student information is sent.
Web analytics for our public marketing pages only (§2.18), which receives page views and clicks with the visitor's IP address and browser type, never information from the Service.

We do not currently send text messages or push notifications. If we add either, we will update this list first. Providers that can hold regulated data are under a Business Associate Agreement. Institutions receive the named list of providers with their Business Associate Agreement or FERPA Addendum and are notified before we add or replace one, as those agreements require.

8. Access controls and support access

8.1 Database-enforced access. Data is protected by database-enforced access rules so that a user, Institution, or clinical site can read only the records it is entitled to.

8.2 Roles and permissions. Institutions assign granular permissions to staff (for example view students, grade charts, review documents, receive reports of concern, manage billing, export accreditation reports). Clinical sites assign owner and scheduler roles. Students see only their own records.

8.3 Two-step sign-in. System administrators, and Institution staff wherever their Institution requires it (the default), must use an authenticator app in addition to their password.

8.4 Support access. EMStriq personnel access accounts only for support, security, and legal purposes, through administrative tools that log who accessed what. Our personnel never sign in as, or act as, a user.

8.5 Audit trails. We keep records of grading, chart locking, attestations, document review, document disclosures to clinical sites, staff actions in the program console, and changes to data (which record changed, which fields, and who changed it, without storing the values themselves).

9. Retention

Account data: while your account is active. A deactivated account keeps its program records because Institutions need them for accreditation. Deleting an account removes your sign-in, contact details, wallet, saved signature, devices, and preferences. Your enrollments and everything in them (clinical logging, evaluations, grades, and forms you signed) stay with each program under your name, because they are the Institution's education records. Reports of concern you filed stay with the program record too, because the Institution needs them to respond and to keep its case history.
Application data: an application from someone who does not enroll, with its attachments, interview notes, and comments, is deleted 2 years after the cohort it applied to starts (or 2 years after it was submitted, when the cohort has no start date). An application from someone who enrolls becomes part of their student record. Unfinished application uploads are deleted after 2 days.
Onboarding documents and signed forms: while the Institution (or the clinical site) uses EMStriq, plus its chosen retention period. Encrypted at rest.
Wallet documents: while you are enrolled in a program or hold an Independent Student Pass, and for 7 months after the last one ends (the completion date your program records, the date your cohort ended if your program never marked you complete, or the date you withdrew or your pass ran out). We remind you to download them at about 6 months (with your program's graduate survey, when it sends one) and again 14 days before they are removed, and the wallet shows the date. Enrolling again or getting a new pass keeps them. You can delete them sooner yourself. They are not deleted when a program you belonged to leaves EMStriq, and a program keeps its own copy of anything you sent it.
Clinical logging, evaluations, grades, and outcomes: while the Institution uses EMStriq, plus the accreditation retention period the Institution selects.
Clock-in coordinates: for the period the Institution sets, then erased automatically (§2.6). Distance and flags are kept with the attendance record.
Messages with clinical sites: while the student and the site use EMStriq. A conversation becomes read-only, and both sides keep its history, when the student no longer has a place at the site or the Institution turns site messages off. It is deleted when the student's account is deleted. When an Institution leaves EMStriq, conversations at its own sites and those of students whose accounts leave with it are deleted.
Share links and document-packet links: usable for at most 31 days; their access logs are kept with the student or program record.
Invoices: permanently. Other billing and tax records: at least as long as financial-record and tax law requires.
Data-change and security logs: 6 years, to support HIPAA documentation requirements.
Records of disclosures to clinical sites: as long as the student's education record they relate to, as FERPA requires.
Error reports: 90 days once resolved, and no longer than 365 days.
Copies of sent emails: 30 days.
Backups: daily encrypted backups are kept 35 days and one backup a month is kept 370 days, in write-once storage that cannot be altered or deleted early. Backups are not used to restore individual deleted records.
On-device offline copy: until sign-out, clearing, or 30 days without use.

When an Institution leaves EMStriq, it has 90 days to export its data (up to 365 days if it asks before the window ends). We then delete its data and encryption keys, confirm the storage is empty, and send a destruction certificate. Copies in backups age out on the schedule above (up to 370 days). We keep invoices permanently, tax-exemption certificates for financial records, and signed Business Associate Agreements for six years after they end.

10. Security

We maintain a security program aligned to the HIPAA Security Rule. Highlights:

Encryption in transit (TLS) for all connections, and encryption at rest for databases, storage, and backups.
Per-Institution and per-site encryption of uploaded documents and signed forms (AES-256-GCM, with a key derived uniquely for each), and per-person encryption of wallet documents and signatures.
Hashed tokens and codes: share links, packet links, crew links, preceptor codes, and sign-in codes are stored as keyed hashes, never in usable form.
Two-step sign-in for staff (§8.3).
Encrypted on-device cache for offline use, removed at sign-out.
Data minimization by design: the clinical dataset is structured to exclude direct identifiers, emails exclude clinical data, and logs scrub clinical fields.
Audit trails (§8.5) and incident response with defined roles and timelines, and customer notification obligations under our Business Associate Agreement.

No system is perfectly secure. If you believe your account or data has been compromised, contact security@emstriq.com immediately.

11. Your choices and rights

Access, export, correction, deletion. For education records (grades, evaluations, clinical records, onboarding documents), contact your Institution; FERPA gives you rights to inspect and request amendment, and your Institution controls those records. For your account data and your wallet, you can update or delete most of it in Settings, or contact us at privacy@emstriq.com. Independent students can make every request directly to us. We will verify your identity before acting.
Share links. You can revoke any wallet share link at any time and see every time it was opened.
Location. You can deny location access on your device; you can still clock in.
Notifications. Manage email notifications in Settings, including the email that a clinical site sent you a message. Sign-in, security, and some program messages cannot be turned off while your account is active.
Paper signatures. You can ask the owner of a form for a paper copy to sign instead of signing electronically.
Offline copy. Sign out or use the reset option in Settings to remove the encrypted on-device copy of your data.
State privacy rights. Depending on where you live, you may have the right to know what personal information we hold, to access, correct, or delete it, to receive a portable copy, and to not be discriminated against for exercising those rights. We do not sell or share personal information for advertising, so there is nothing to opt out of on that front. Submit requests to privacy@emstriq.com; where the data is controlled by your Institution we will refer the request to it and help fulfil it. You may appeal a decision by replying to our response. Authorized agents may submit requests with proof of authority.
Do Not Track. We do not respond to browser Do Not Track signals because we do not track users across third-party sites. We honor Global Privacy Control signals where the law requires.

12. International users

The Service is operated from the United States and is intended for U.S. EMS education programs and clinical sites. If you access it from elsewhere, your information is transferred to and processed in the United States.

13. Changes to this Policy

We may update this Policy. We will post the new version with its effective date and, for material changes, notify Institutions and clinical sites and ask users to acknowledge it in the Service. The Service records which version each user accepted.

14. Contact

Privacy questions and requests: privacy@emstriq.com
Security: security@emstriq.com
Mail: MEGI Technologies LLC, 5900 Balcones Drive, STE 100, Austin, TX 78731
Privacy and Security Officer: privacy@emstriq.com