Operator, purpose and scope
Continued Education — for the practicing paramedic is independently operated by Chance Veinotte, who is the platform’s privacy contact. Use the Privacy & Legal Contact form for privacy questions, access or correction requests, consent withdrawal, confidentiality reports or complaints. The form is available without a testing code. This policy describes this platform’s actual features; it does not cover separate websites or control external providers’ own practices. Patient information is not requested or permitted.
Information collected
The site stores a site-specific member identifier, first name, sign-in email where supplied by authentication, membership status, role, creation time, and confidentiality acknowledgment time and policy version. Accounts use Supabase for email and password authentication, email verification, and password resets. Passwords are handled by Supabase. Verified accounts create a site member profile; community participation requires administrator approval. Authentication emails are sent using the configured ZeptoMail service. We also store ECG descriptions and files, review decisions and feedback, paper titles, descriptions, selected year/month, files or URLs, discussion comments, saved-paper bookmarks, announcements, release times and read receipts, and administrator action records. Calendar data includes session type, facilitator, location, proposed/confirmed dates, availability, attendance, polls, votes and comments.
Why information is used
Information is used to provide profiles, access controls, moderation, publication, discussions, saved items, scheduling, notifications, requests and security. Your first name identifies your contributions and responses. Administrator action records support accountability. The site does not include an advertising network, third-party marketing tracker, payment collection or a sale-of-personal-information feature. Hosting and authentication providers process technical information needed to operate and protect their services.
Who can see information
Published ECGs, papers, comments and calendar information are visible to participants who have access. Availability, attendance and poll responses include participant names and may identify non-responders. Pending or denied ECGs and files are available to their author and administrators. Your saved-paper list and read receipts are not displayed to other ordinary members. Administrators can access membership details, including email addresses, review submissions, moderate content and manage requests. The Administrator testing code grants these powers to whoever holds it; it does not verify their identity. A shared access code is not a guarantee that recipients will keep a contribution confidential. Do not assume a professional or patient-care duty of confidentiality arises simply from membership.
Cookies and testing profiles
The platform sets signed, Secure, HttpOnly browser cookies for the selected testing role and a separate browser profile identifier. Access codes have no scheduled expiry. Access cookies have a browser storage lifetime of up to 400 days, refreshed when pages or APIs are used; browser settings can impose shorter limits. Lock Testing Site clears access but retains the profile identifier for later reuse. Clearing cookies may create a separate testing profile and prevent access to prior saved items. Code rotation revokes the corresponding access; changing the signing key revokes both roles. Required cookies are used for access and profile continuity, not advertising. Hosting or ChatGPT sign-in may use additional cookies under the provider’s policy.
Service providers and storage location
The site uses ChatGPT Sites/OpenAI hosting and access infrastructure and Cloudflare-hosted D1 structured storage and R2 file storage. Records and technical logs may be processed or stored outside British Columbia or Canada, subject to applicable law in those locations; Canada-only residency is not promised. Provider access, security, retention and legal-disclosure practices are governed by their own agreements and policies. The platform does not currently store an email/password login credential. Any future account or email provider will be described before that feature is enabled.
Notifications and optional email preferences
Announcements are released on site immediately or at their scheduled time; opening the bell marks displayed notifications as read. Calendar changes may create notifications, while individual availability responses and votes do not notify everyone. My Profile can store a personal notification email and separate preferences for announcements and calendar updates. These are optional and are not publicly displayed on posts. Email delivery is not connected: saving a preference or submitting a contact request does not currently send an automatic email. You may disable the preferences or remove the optional email address. Any future messaging will describe its purpose, provider and controls before activation.
Privacy and legal requests
The reporting form collects a reply email, an optional name, a category and message to review and respond to the request. Requests are stored privately for administrators, not published. Administrators review the queue and may respond manually using the supplied contact details; no automated confirmation or response is sent. Do not submit patient details, passwords or access codes. A hashed IP-derived counter limits repeated submissions and access-code guesses in 15-minute windows. The counter is set to expire after 30 minutes and is deleted during subsequent code or report submissions; it is not a permanent raw-IP record. Providers may separately retain technical logs.
Retention, removal and account restrictions
Profiles and contributions remain while needed to provide the community and address legitimate review, security or legal needs. Pending/denied ECGs remain available for review and author feedback until removed. Deleting a case removes its attachment and comments; removing an attachment alone keeps case notes. Deleting a paper removes its attachment, discussion and saved references. Deleting a session or poll removes its related options, responses and discussions as applicable. Removing an account clears its name, email, notification preferences, authored ECGs and papers, their attachments, comments, saved papers, read receipts and scheduling responses. A minimal identifier and removed status remain to enforce the restriction; audit records and organizational session/poll records may also remain. Banning an account restricts access without deleting existing content. Acknowledgment records and reports may be retained as reasonably needed for accountability and legal obligations. The operator reviews retention rather than promising an automatic deletion period. Copies already downloaded and provider-managed backups/logs cannot necessarily be recalled immediately.
Safeguards and limitations
Role checks, protected file routes, administrator review for ECG uploads, signed access cookies, same-origin write checks and attempt limits help protect information. These measures cannot guarantee security, correct anonymization, content accuracy or a recipient’s conduct. Do not upload information the site is not authorized to receive. If a possible disclosure is reported, administrators will assess and take reasonable containment and other steps required by applicable obligations. This policy does not certify compliance with a named standard or promise protection equivalent to a clinical records system.
Access, correction, withdrawal and complaints
Use the reporting form to request access to or correction of your personal information, discuss retention or deletion, withdraw optional consent or complain about handling. Do not send identity documents in an initial request. Proportionate identity verification may be necessary before releasing records; exceptions, legal retention duties and lawful access limits may apply. The operator will handle requests within applicable legal requirements. Some information is needed to provide membership and contributions, so withdrawing necessary consent may end those features. Optional notification preferences can be changed in My Profile. You may contact the Office of the Information and Privacy Commissioner for British Columbia or another competent regulator; this process does not limit those rights.
Updates and external policies
The effective date identifies this version. Material changes will be communicated on the site or through an updated acknowledgment where appropriate. External publisher links and other websites have their own policies. See OpenAI’s Privacy Policy and Cloudflare’s Privacy Policy. For background, see BC’s Personal Information Protection Act and OIPC guidance for private organizations. Applicable obligations depend on the actual circumstances and cannot be replaced by this notice.