Privacy Policy

Organization: Life Support Services Address: 35852 Orchard Street Privacy Officer / Information & Privacy Coordinator: Aaron Smith Email: aaron@lifesupportservices.ca • Phone: 519-764-0010 Effective date: 2026-07-02

Life Support Services ("we", "us", "our") respects your privacy. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial health privacy legislation (including Ontario's Personal Health Information Protection Act (PHIPA) and Alberta's Health Information Act (HIA) where applicable).

1. The ten PIPEDA principles

We are guided by the ten fair information principles set out in PIPEDA:

1. Accountability — We are responsible for personal information in our

custody and control. Our designated Privacy Officer (above) is accountable for our compliance with this policy.

1. Identifying purposes — We identify the purposes for which personal

information is collected at or before collection.

1. Consent — We obtain meaningful consent before collecting, using, or

disclosing personal information, except where the law allows otherwise.

1. Limiting collection — We collect only the personal information we

need for the purposes we have identified.

1. Limiting use, disclosure, and retention — We use or disclose

personal information only for the purposes for which it was collected (unless you consent otherwise or the law requires it), and we retain it only as long as needed for those purposes.

1. Accuracy — We keep personal information accurate, complete, and

up to date.

1. Safeguards — We protect personal information with security

safeguards appropriate to its sensitivity (see §6).

1. Openness — We make information about our privacy practices readily

available to you.

1. Individual access — On request, we tell you what personal

information we hold about you and let you check its accuracy.

1. Challenging compliance — You may challenge our compliance with

this policy by contacting our Privacy Officer.

2. Information we collect

We collect the following categories of personal information, only as needed to operate the portal and deliver the services you ask for:

• Account information — name, email, role, organization, sign-in

credentials, two-factor authentication metadata.

• Certification information — courses you complete, certificates

issued, expiry dates, instructor of record, any wallet pass identifiers you choose to generate.

• Patient health information (PHI) — when you submit a Patient Care

Report (PCR) or similar clinical form, the form may include health information about a patient. We treat this as PHI under PHIPA / HIA and apply additional safeguards (see §6 and §10).

• Form submissions — content of any form you submit through the

portal, including attached files.

• Payments — billing name and address, the last four digits of any

card used, and a token issued by our payment processor (Square). We never store full card numbers on our systems.

• Location — if a form you submit requests the location of a call or

scene, we capture your device's location at that moment only.

• Device & log information — IP address, browser type and version,

pages viewed, timestamps, and security-relevant events (sign-ins, failed attempts, two-factor challenges).

3. How we use your information

• To create and maintain your account.
• To deliver courses, issue certificates, and provide certification

status to you and to authorized recipients you designate.

• To process payments for courses, materials, or services you book.
• To deliver operational emails and (only with your consent) marketing

emails.

• To detect and respond to security incidents, fraud, and misuse.
• To meet our legal, regulatory, and contractual obligations.

4. Who we share it with

We do not sell personal information. We share it only as required to provide the service or as required by law:

• Form recipients — When you submit a form (e.g. a PCR), the

submission is routed to the recipient(s) configured for that form (e.g. medical directors, your station, hospital partners).

• Payment processor — Square processes card payments on our behalf.

Square receives the card data directly from you; we receive only a token and result.

• Hosting provider — SiteGround hosts the portal infrastructure.
• Email provider — Microsoft (or Twilio SendGrid for transactional

email, depending on configuration) sends outbound email on our behalf.

• Analytics — If an analytics provider is configured, aggregated

usage data is sent to it; you can decline analytics cookies in the cookie banner.

• Law enforcement and regulators — Where required by law, by a valid

legal order, or to protect the rights, property, or safety of others.

5. Retention

We keep personal information only as long as needed for the purpose for which it was collected and as required by applicable retention rules:

• Account information — for as long as the account is active, and a

short tombstone after deletion for audit-trail integrity.

• Certification records — for the lifetime of the certification and

for a reasonable period afterwards to support recertification, public verification, and legal-retention requirements.

• Form submissions / PHI — per the retention rule attached to each

form by the form owner. PHI retention is set to meet provincial health records retention standards (typically 10 years from the date of last contact, or until a minor patient reaches the age of majority + 10 years, whichever is longer).

• Payments — per applicable tax and accounting law.
• Logs (sign-in, audit, mail) — typically up to 12 months.

6. Security safeguards

We protect personal information with a combination of physical, organizational, and technical safeguards, including:

• Encryption at rest for sensitive personally identifiable information

(PII) and PHI in the database.

• TLS for all data in transit.
• Two-factor authentication, with mandatory enrollment for privileged

roles.

• Role-based access controls and "preview as" audit logging.
• Sign-in alerts (new device, impossible travel) and an account

security center.

• Tamper-evident audit logs for privacy-relevant actions.
• Periodic backups and a documented breach-response procedure.

No system is perfectly secure, but we take reasonable care to make sure our safeguards remain appropriate to the sensitivity of the information.

7. International transfers

Some of our service providers (e.g. payment processor, email provider, analytics) may store or process data outside of Canada, including in the United States and the European Union. When this happens, the data is subject to the laws of the jurisdiction where it is stored, which may allow access by foreign government and law-enforcement authorities. We select providers that publish reasonable safeguards (encryption, access controls, contractual data-protection terms) and we only share what is necessary to provide the service.

8. Cookies and similar technologies

We use cookies and similar technologies to operate this site, including for authentication, CSRF and CAPTCHA protection, and to remember your preferences. We do not enable optional tracking (e.g. email-open tracking) without your consent. You can manage your cookie choices using the cookie banner shown on first visit and at any time from your browser's cookie settings.

9. Children

This portal is for emergency-services professionals and instructors. It is not designed for or directed to children under the age of 16, and we do not knowingly collect personal information from children.

10. PHIPA-specific disclosures (Ontario)

Where Life Support Services acts as (or as an agent of) a health information custodian under PHIPA, the custodian is [PHIPA custodian — if your organization is in Ontario and handles PHI, set in Settings → Privacy].

When you submit a Patient Care Report or other form containing PHI:

• Collection is limited to what is necessary for the purpose of

documenting and reporting the call.

• The submission is encrypted at rest and accessible only to the

recipients configured for the form.

• We support patient access and correction requests submitted through

the custodian.

• Suspected privacy breaches involving PHI are documented in our breach

log and, where required, reported to the Information and Privacy Commissioner of Ontario and to affected individuals.

11. Your rights

You have the right to:

• Access the personal information we hold about you (you can

download a portable copy from your account's privacy page).

• Correct information that is inaccurate or incomplete.
• Withdraw consent for uses that are not strictly necessary to the

service (e.g. marketing emails).

• Delete your account (subject to legal-retention rules — see §5).
• File a complaint with our Privacy Officer at aaron@lifesupportservices.ca.

If you are not satisfied with our response, you may also contact the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or your provincial regulator (e.g. https://www.ipc.on.ca in Ontario).

12. Updates

We may update this policy from time to time. When we make a material change, we will ask you to re-accept it on your next sign-in. The current version, version history, and effective date are recorded with each policy publication.

This policy is a generic template adapted for a Canadian EMS training organization. It is not a substitute for legal advice. Please have it reviewed by your own legal counsel before publishing it as your operational privacy policy.