EMCE logo EMCE The ultimate app for EMS Education

Legal

Privacy Policy

How EMCE collects, uses, shares, and protects personal information.

S2N Ventures, LLC d/b/a EMCE
Privacy Policy
Last Updated: September 23, 2026

This Policy explains how S2N Ventures, LLC d/b/a EMCE (“EMCE,” “we,” “us,” or “our”) handles personal information through our websites, web and native applications, support, and related services (the “Service”). Personal information includes information that identifies or can reasonably be linked to a person, including information inferred about that person.

EMCE is an educational service. Do not submit HIPAA protected health information or identifiable patient or other protected personal health information, including through AI tools, attachments, narratives, or support messages. See Health information below.

This Policy describes our practices; it is not blanket consent to processing. Where consent or another legal authorization is required, it must be obtained separately. Our Terms of Service, including the Institutional Education Data Terms, govern our obligations to educational institutions.

1. Our Role and Your Institution’s Role

When an educational institution or other organization (your “Institution”) uses EMCE to manage educational activities, it determines the purposes for processing its student records and the people authorized to access them. EMCE processes those records on its behalf, as a service provider or processor where those legal classifications apply. Your Institution’s notices and policies also apply to its own collection, use, and disclosure of information.

For our own website inquiries, business contacts, billing administration, and certain account, security, and legal functions, EMCE determines the purposes of processing and is responsible for those activities. Information about service use that forms part of an institutional education record remains subject to our education-data restrictions.

Where FERPA applies and its school-official exception is used, EMCE performs outsourced institutional functions under the Institution’s direct control regarding use and maintenance of education records. The Institution must establish the applicable legal basis for disclosure. Neither an EMCE account nor acceptance of a privacy notice automatically supplies FERPA consent or makes a third-party AI vendor a school official.

2. Information We Collect and Its Sources

The information processed depends on your role, the features used, and your Institution’s settings. We collect information from you, your Institution, other authorized users, linked services you authorize, and your interactions with the Service.

  • Account and profile information: Name, email, profile image, contact details, account and profile identifiers, role, organization, cohort, certification level, preferences, and sign-in information supplied by you, your Institution, or an identity provider. We use this information to create and secure accounts, establish roles, communicate, and associate activity with the correct educational program.

  • Educational content and records: Evaluations, scores, skills, competencies, faculty and preceptor feedback, attendance, schedules, assignments, permitted encounter documentation, and files supplied by authorized users. We use this information to document learning, support instruction and review, and provide progress, completion, and accreditation reports.

  • AI interactions: Typed prompts, voice recordings you make in an AI feature, uploaded files and images, conversation history, the evaluation or form being worked on and the names of the people on it, tool results used by an AI feature, and generated responses or inferred assessments. We use this information to provide the requested AI assistance and support human review. Content an assistant adds to an evaluation becomes part of that record, and a PreceptoBot conversation is stored with the evaluation while it is being edited so it can resume.

  • Support and business communications: Contact-form details, correspondence, feedback, and documentation you provide, including screenshots. We use this information to respond to inquiries, troubleshoot, and manage our customer relationship.

  • Purchase and billing information: Purchaser and billing contacts, purchases, invoices, transaction identifiers, payment status, and tax information. We use this information to process purchases, keep financial records, and resolve billing issues.

  • Device, usage, and security information: IP address, browser and device details, app version, timestamps, feature usage, diagnostics, cookies or similar identifiers, sign-in and security events, and, for assessments, integrity events such as start, completion, and abandonment times, response time per question, attempt counts, and, for closed-book exams, the number of times the app was sent to the background or a screenshot was attempted. We use this information to operate and protect the Service, understand usage, diagnose and improve reliability, and give Institutions the integrity record for their assessments.

  • AI and integration administration: Provider/model identifiers, request timing, token usage, tool-call counts, errors, and, where MCP is available, application authorizations, acceptance versions, sharing options, and access events. We use this information to operate AI features, manage permissions, document institutional instructions, and investigate misuse.

Stripe processes online payment credentials. EMCE does not store or have direct access to your full card or bank account details. Identity providers such as Google, Microsoft, or Apple supply the sign-in information authorized for the connection and also process information under their own notices.

Do not submit unnecessary sensitive information. Educational records and AI inferences can be sensitive even when they contain no patient information. If a feature requests device permissions, such as access to a camera or location, review the request and use your device settings to control access.

3. How We Use Information

We use information for the purposes described above and to:

  • Deliver educational, scheduling, reporting, and administrative functions requested by your Institution and make records available to authorized users.
  • Authenticate users, maintain permissions, prevent abuse, investigate incidents, and enforce our agreements.
  • Send necessary account, transaction, service, and security communications.
  • Respond to inquiries and send permitted promotional communications, subject to applicable consent requirements and your communication preferences.
  • Comply with legal obligations, resolve disputes, and maintain necessary business and compliance records.
  • Improve reliability and usability through operational information and permitted aggregate or de-identified analysis.

We do not sell personal information, share it for cross-context behavioral advertising, or use advertising trackers. We do not use institutional Education Data for targeted advertising, create unrelated commercial student profiles, or use it to train or fine-tune general-purpose AI models. Education Data is used only for authorized institutional purposes as described in Section 4A of the Terms. A general reference to improving the Service does not expand those purposes.

Aggregate reporting, including reporting about educational trends, must not identify individuals. Data with names removed can still be personal information. We apply the Terms’ de-identification restrictions and do not attempt to re-identify information maintained as de-identified.

4. Health Information

EMCE supports educational documentation and is not a patient-record system. Our Terms prohibit PHI and identifiable health information. HIPAA’s defined term “PHI” is distinct from Canada’s broader protections for personal information under PIPEDA and applicable provincial or territorial privacy and health-information laws.

Use fictional scenarios or information lawfully de-identified before entry. Patient names, initials, record numbers, photos, exact encounter dates, clinical locations, or rare clinical details can identify a patient, alone or in combination. Removing direct identifiers does not establish HIPAA Safe Harbor or another legal anonymization standard. Structured encounter fields are not a guarantee of de-identification.

If prohibited information is entered, stop sharing it and promptly notify your Institution and requests@emce.help, without including the health information in your email. We will coordinate appropriate restriction, removal, and remediation and meet any applicable legal obligations. A contractual prohibition does not remove protections that law gives to information actually received.

5. AI and Large Language Models

AI provided within EMCE

EMCE uses AI and large language models in these features: PreceptoBot (evaluation documentation and tutoring assistance), EMS Oracle (study assistance), Eval Studio (evaluation-form creation from descriptions or uploaded documents), AI-generated Learning Center content (clinical pearls, study cards, and practice exams), and simulation-scenario generation. Your Institution turns each of these on or off for its organization or organizational units; none is available unless enabled.

How requests are processed depends on the feature:

  • In-app assistants (PreceptoBot, EMS Oracle, Eval Studio) send requests from the app to Google’s Gemini models through Firebase AI Logic, using its Gemini Developer API backend. These requests are authenticated with your EMCE sign-in and Firebase App Check rather than an API key in the app.
  • Server-generated content (simulation scenarios and Learning Center content) is produced by EMCE’s servers using Gemini through Vertex AI in a Google Cloud region matching your environment (United States or Canada).
  • Alternative providers. EMCE can switch an in-app assistant to OpenAI or Anthropic models by configuration, for example to evaluate a model or work around a provider problem. Those requests pass through EMCE’s server, which adds the provider credential, and are sent to the provider’s API in the United States.

Depending on the feature, the provider receives your prompt, voice recordings, uploaded files, relevant conversation history, and the context needed to perform the request, such as the evaluation being edited. This can include educational content and personal information in those materials. Sending information to an AI feature involves processing by the provider; it is not confined to your device or EMCE’s primary database region. Requests through the Gemini Developer API, OpenAI, or Anthropic are not restricted to the region where your Institution’s records are stored.

EMCE uses each provider’s paid API service. The providers’ published terms for those services state that prompts and outputs are not used to train their models unless the customer opts in, and EMCE does not opt in. Education Data remains subject to the purpose and provider restrictions in our Terms. A no-training commitment does not mean no retention: providers keep prompts and outputs for limited periods for abuse monitoring, safety, and legal purposes, and some features use short-lived caches. Those periods are set by the provider and change over time; see Google’s Gemini API terms and Vertex AI retention documentation, OpenAI’s API data controls, and Anthropic’s commercial retention policy. We do not promise zero retention. Contact us for information about the arrangements relevant to your Institution.

Students under 18. Some providers’ terms restrict use of their services by persons under 18, and the Gemini Developer API used by the in-app assistants is one of them. An Institution that enrolls students under 18 is responsible for confirming that an AI feature is permitted for those students before enabling it, or for leaving it disabled for the affected organization or unit.

AI request metadata is used for diagnostics and usage analytics. Turning off an AI feature prevents future use of that feature; it does not automatically delete previously saved prompts, outputs, institutional records, or provider copies subject to applicable retention requirements.

AI can produce inaccurate or biased statements and inferences about people. An output saved to a student’s record is subject to the same access and correction processes as other record content. Our Terms require human review and prohibit using AI output as the sole basis for consequential decisions. Your Institution makes educational decisions and should explain its review and challenge procedures. Do not use EMCE AI for patient-care decisions.

Institution-selected AI assistants and MCP access

If Model Context Protocol (“MCP”) access is made available, it is a separate disclosure path to a connected application, such as an AI assistant, chosen by your Institution. MCP access requires institutional opt-in, acceptance of the MCP Data Sharing Addendum by a Director of the Institution, and an eligible user’s authorization of the connected application. This Policy does not enable the feature or replace that Addendum.

Under the initial offering, authorized Administrators and Directors can create connections tied to one profile and Institution. Read-only results may include:

  • Organization structure, units, cohorts, schedule locations and contacts, and course and requirement information.
  • Profile names, roles, status, cohort, certification level, and email addresses, including relevant instructor assignments and permissions.
  • Evaluations, scores and performance detail, permitted structured encounter information, and workflow history.
  • Authorized calendars and attendee information. Students of other organizations who appear on shared events are identified only by role, never by name.

Evaluation comments, patient-encounter narratives, and faculty notes are each off by default and shared only after a separate institutional opt-in. Enabling any of them does not permit PHI. Files, attachments, profile phone numbers and postal addresses, and device or account identity identifiers are excluded from the initial MCP data results. Organization and site contact details may still be included. Read-only access prevents changes to EMCE records through MCP; it still allows the connected application to receive and retain copies.

EMCE records institutional acceptance and sharing choices and maintains authorization and access records as described in the Addendum. The Addendum also governs disabling access and acceptance of material revisions. Revoking access stops future authorized requests, normally within a few minutes; it does not recall data already delivered or remove it from a recipient’s conversation history, logs, or backups.

A customer-selected application is not automatically an EMCE service provider. Its handling of received information is governed by its own terms, the Institution’s agreement with it, and applicable law. The Institution must evaluate permitted uses, training, retention, international processing, and deletion before authorizing disclosure. EMCE remains responsible for its own processing and disclosures.

6. When We Disclose Information

  • Within your educational relationships. Your Institution and authorized faculty, administrators, preceptors, and other participants receive information needed for their roles and permitted activities. Shared placements or schedules can involve other organizations. Public links, exports, and calendar subscriptions can disclose the information selected for sharing; authorized users must check recipients and scope.
  • To service providers. We use providers for hosting, authentication, storage, payments, communications, support, diagnostics, analytics, and AI. They receive information needed for their functions, subject to applicable contractual restrictions. Providers processing Education Data must comply with the protections in our Terms. Payment and identity providers may separately process information for their own legal and service obligations.
  • At an authorized direction. We disclose information through integrations, exports, and separately authorized connected applications. MCP-specific disclosures are explained above. A user may authorize only information they have authority to share.
  • For legal and safety purposes. We disclose information where law requires or permits it to respond to valid legal process, protect people or systems, investigate misuse, or establish or defend legal claims. Education records remain subject to applicable use and redisclosure restrictions; a general business interest does not override FERPA.
  • In a business transaction. Information may be disclosed in a merger, acquisition, financing, or sale, subject to appropriate confidentiality, applicable law, and continuing contractual protections. A transaction does not itself authorize new uses of Education Data.
  • With specific permission. We may use a testimonial or disclose information for another stated purpose with valid permission from the appropriate person or Institution.

7. Cookies, Analytics, and Communications

We use cookies and similar technologies for functions such as sign-in, preferences, security, and usage measurement. Our marketing website (emceapp.com) uses Google Tag Manager to load Google Analytics, which measures page visits and site usage. The EMCE app uses Google Analytics for Firebase and Amplitude to measure feature usage, including AI request metadata such as the provider, model, duration, and token counts, but not prompt or response content. In the app, analytics events are associated with your account, profile, role, and organization identifiers so that we can understand usage by role and program. We do not use these services’ advertising features and do not share this information with advertisers.

You can control cookies through browser settings and permissions through your device. Blocking storage may affect sign-in or other functionality. Where applicable law requires consent for nonessential technologies, they must be subject to that consent. Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, we will honor it for the processing covered by that signal. Browser “Do Not Track” signals do not have a uniform implementation standard and are distinct from legally recognized opt-out signals.

You may unsubscribe from promotional emails using their unsubscribe link or by contacting us. Necessary service, billing, and security communications may continue. We do not use institutional Education Data for targeted ads.

8. Storage Locations and International Processing

EMCE is based in the United States. Primary platform data for US customers is stored in Google Cloud’s US regions, and primary platform data for Canadian customers in Google Cloud’s Montréal region. Selecting a Canadian environment does not by itself mean that every provider, support activity, AI request, or connected application processes information exclusively in Canada: EMCE staff access the Service from the United States for support and operations; the in-app AI assistants and any OpenAI or Anthropic requests are processed outside Canada; and payment, email, analytics, and error-reporting providers may process information in the United States. Processing outside your province, state, or country may be subject to foreign laws and lawful access by courts or authorities there. Server-generated AI content uses a Vertex AI region matching your environment, but Anthropic describes global inference routing by default and the Gemini Developer API is not region-restricted. A storage-region selection does not restrict AI inference to that region. We do not promise Canada-only AI processing.

Canadian public institutions may be subject to provincial access-and-privacy and health-information laws, such as Manitoba’s FIPPA and PHIA or Saskatchewan’s LA FOIP and HIPA, that impose their own requirements on service providers. We work with those institutions to document the safeguards and agreements those laws require.

We remain accountable for information entrusted to our service providers as required by law and use appropriate contractual and other safeguards. Institutions with residency or transfer requirements should confirm the applicable arrangements with EMCE before enabling a feature or connection. Where additional assessments, agreements, notices, or legal transfer mechanisms are required, those requirements still apply; accepting this Policy is not a substitute for them.

9. Retention and Deletion

While an Institution uses the Service, we retain its educational records and its users’ accounts without a fixed expiration date unless the Institution instructs otherwise. Graduation, inactivity, or an individual account closure does not trigger automatic removal of institutional records, because the Institution, not the individual, controls them. When an Institution’s use of the Service ends, we delete or de-identify its Education Data within 90 days, as set out in our Data Processing Addendum, except where law, a legal hold, or a pending records request requires retention, and sooner where a state student-privacy law requires. These practices are subject to applicable retention limits, valid individual rights, and contractual requirements; they do not authorize keeping information after its lawful purpose has ended. AI providers’ copies have separate retention rules, described above.

Retention purposes and requirements differ by category:

  • Institutional records: the Institution’s lawful instructions, educational and accreditation needs, applicable agreements, and legal retention duties.
  • Account and support information: the active relationship, unresolved requests, account administration, and necessary legal obligations.
  • Billing and transaction information: applicable tax, accounting, dispute, and other legal recordkeeping requirements.
  • Diagnostics, security, and authorization records: operational needs, incident investigation, evidence of permissions, and legal obligations. MCP acceptance records are kept for as long as the Institution’s relationship with EMCE continues and as required afterward, and the MCP access audit log is kept for up to ten years. Application error reports and server logs are kept for the limited periods set in those tools. Analytics events in Amplitude and Google Analytics currently have no fixed expiry.
  • AI inputs and outputs: PreceptoBot conversations are stored with the evaluation being edited; content an assistant adds to a record follows that record’s lifecycle; provider copies follow the provider’s retention rules described above.

Where an applicable obligation or valid request requires deletion, we will delete the information or de-identify it where legally permitted. Residual backups remain protected and expire through the applicable backup cycle; retained copies must not be reused for unrelated purposes. Legal holds and pending record-access requests may prevent immediate deletion. Contact us for retention information applicable to a particular record or service.

Closing your account, leaving a program, or turning off an integration does not necessarily delete records your Institution is required or authorized to keep. We assist Institutions with lawful exports and deletion requests. Copies already received by an Institution or a connected application are subject to that recipient’s responsibilities and retention arrangements.

10. Your Rights and Choices

Depending on applicable law and our role, you may have rights to access or obtain a copy of personal information; correct inaccuracies; request deletion or restriction; withdraw consent; object to processing; and receive a portable copy. Some laws also provide rights to information about recipients, opt out of sale, sharing, targeted advertising, or certain profiling, limit certain uses of sensitive information, and obtain review or an explanation of qualifying automated decisions. These rights have legal conditions and exceptions; describing them does not mean EMCE conducts each listed activity.

For institutional education records, contact your Institution first. It determines FERPA inspection and amendment requests and other educational record obligations. We will assist it and route requests we receive to the appropriate Institution when necessary. This does not limit rights you may exercise directly against EMCE under applicable law.

For EMCE-managed information or help finding the right contact, email requests@emce.help with “Privacy request” in the subject, or use our contact form. Describe the request and your relationship with EMCE; do not include passwords, patient information, or unnecessary sensitive documents. We may verify identity and authority using information proportionate to the request. Authorized agents may submit requests with appropriate proof of authority.

We respond within applicable legal deadlines and explain any lawful denial, exception, or extension. For example, PIPEDA access requests generally require a response within 30 days, subject to permitted extensions. If applicable law gives you an appeal right, reply to our decision or contact us with “Privacy appeal”; we will review it and respond within that law’s deadline. You may also complain to the relevant state regulator, the Office of the Privacy Commissioner of Canada, or the applicable provincial or territorial authority. FERPA concerns may be directed to the US Department of Education’s Student Privacy Policy Office. We do not unlawfully discriminate or retaliate against you for exercising privacy rights.

11. Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the information we process. No service can guarantee absolute security. Our Trust Center provides available security and assurance information; request access through requests@emce.help.

We investigate security incidents and provide notices to affected Institutions, individuals, or regulators as required by applicable law and agreements. Security limitations do not excuse those obligations. Keep credentials secure and promptly report suspected account misuse.

12. Students and Age Requirements

EMCE supports adult and institution-sponsored secondary-school education. Students must be at least 13. Students who lack legal capacity to enter an agreement may use EMCE only through an authorizing, supervising Institution, with an authorized adult accepting the institutional agreement and any legally required parent or guardian consent or acceptance. Independent users and contractual representatives must be at least 18 and have legal capacity under applicable law. These requirements match our Terms.

We do not require a date of birth to use EMCE and do not independently verify users’ ages. Under our Terms, Institutions authorizing student access must confirm their students’ eligibility and arrange any required parent or guardian involvement. An account’s existence does not establish that its user is an adult or that EMCE has verified the user’s age.

The Service is not directed to children under 13, and we do not knowingly authorize their use. If you believe we have collected information from a child under 13, contact us so we can investigate, restrict access, and arrange appropriate deletion, subject to applicable law. EMCE remains responsible for its own child and student privacy obligations.

For school records, parents generally hold FERPA rights until the student turns 18 or attends a postsecondary institution at any age. Dual enrollment can affect which rights apply to each school’s records. Contact the relevant Institution for access, correction, or disclosure questions. A parent’s agreement to account use does not automatically give access to records for which FERPA rights have transferred to the student.

Student information is subject to the education-data protections in this Policy and our Terms, including restrictions on advertising and model training. AI features and connected applications may have additional age, institutional authorization, and safety requirements. Eligibility for an EMCE account does not establish eligibility for every such feature. In particular, the provider terms for our in-app AI assistants restrict use by persons under 18; Institutions enrolling minors should leave those features disabled for the affected organization or unit unless they have confirmed the feature is permitted. Purchases of EMCE Pro for a student under 18 must be made by the Institution or a parent or guardian.

13. Changes to This Policy

We will post changes with an updated date and provide reasonable advance notice of material changes through the Service or another appropriate channel, unless legal or urgent security needs require a different timetable. We obtain consent or institutional authorization for new processing where required. Posting a notice or your continued use alone does not authorize materially different uses of previously collected information. Applicable agreements and statutory rights continue to govern.

14. Contact Us

For privacy questions, requests, or concerns, contact EMCE’s Privacy Officer, the individual accountable for our compliance with PIPEDA and other privacy laws, at requests@emce.help, use our contact form, or write to:

S2N Ventures, LLC d/b/a EMCE
Attn: Privacy Officer
PO Box 270697
Saint Paul, MN 55127
U.S.A.