Privacy Policy

1. Information We Collect

When you use Path2Medic, we collect the following types of information:

• Account Information: Your name and email address when you create an account.
• Payment Information: Payment processing is handled securely by Stripe. We do not store your credit card numbers or full payment details on our servers. Stripe may collect billing information necessary to process your transactions.
• Exam and Study Data: Your exam responses, scores, and study session data are stored in our database (hosted on Supabase) to provide personalized practice exams, track your progress, and generate targeted study recommendations.
• Simulation Submissions: If you purchase a Full-Length NREMT Simulation, your answers and submission timestamps are stored alongside your account so we can generate your personalized Readiness Report. Simulation responses support your individual Readiness Report and assessment delivery. We may review relevant information when a report fails validation or when you ask us to investigate a technical problem. Optional troubleshooting recordings are described in §3.
• Marketing Consent: If you opt in to marketing emails at checkout, we store a record of your consent (timestamp and source) for audit purposes under CAN-SPAM and GDPR.
• Usage Data: We collect basic analytics about how you interact with the platform to improve our services.

The Path2Medic apps (iOS and Android)

The Path2Medic mobile apps use your account email to sign you in, keep your sign-in session in the device's secure storage (iOS Keychain / Android encrypted storage), and store your practice and course activity — your answers, results and progress — together with your account on our servers, along with the certification level on your profile. That is everything the apps collect.

The apps do not collect or use: advertising or tracking identifiers, location, contacts, photos, camera or microphone access, push-notification tokens, or crash/analytics SDKs. There is no advertising in the apps. The analytics and advertising tools described in §3 (Google Analytics, PostHog, Meta/TikTok/Reddit/Google ads pixels, Metricool, Microsoft Clarity) run on our website only — they are not part of the apps. Purchases are never made inside the apps; memberships and other purchases are made on path2medic.com, and the apps simply give signed-in members access to what they already purchased.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our exam preparation platform.
• Generate personalized practice exams and post-tests based on your performance.
• Produce personalized Readiness Reports for Simulation buyers.
• Process payments and manage your subscription.
• Send important account notifications (e.g., purchase confirmations, report delivery, subscription notices, password resets).
• Send marketing emails only if you opt in at checkout. You can unsubscribe at any time from the footer of any marketing message.
• Respond to your support inquiries.

3. Cookies, Analytics, and Advertising

We use the following cookies and similar technologies:

• Essential cookies: Required to keep you logged in and maintain your session. These cannot be disabled without breaking the platform.
• Analytics (Google Analytics 4): We use GA4 to understand how the platform is used so we can improve it (e.g., which pages convert, which exam formats users struggle with). GA4 is configured with IP anonymization. You can opt out by installing the Google Analytics Opt-Out Browser Add-on.
• Product analytics (PostHog): We use PostHog to understand how people move through the site — which steps of the quiz and checkout they complete or abandon — including session replay. Replay is limited to on-site behaviour and is not used for advertising.
• Simulation troubleshooting (Microsoft Clarity): With your permission, we use behavioral analytics, heatmaps, and session replay on our standalone simulations, including forms used through partner academies, to investigate bugs and improve usability. Replay can show page layout, clicks, scrolling, dragging, navigation, browser and device information, and technical events such as question type and position. It is a reconstruction of interactions on the simulation page, not a recording of your camera, microphone, desktop, or other tabs.
• Advertising and retargeting (Meta Pixel, TikTok Pixel, Reddit Pixel, Google Ads): We use advertising pixels to measure ad performance and to show relevant Path2Medic ads to people who have visited our site. Under California privacy law (CPRA), this use of advertising pixels is treated as a “sale” or “share” of personal information. You can opt out per platform at your Facebook ad preferences, TikTok’s privacy settings, Reddit’s privacy settings, and Google Ads settings — or by enabling “Limit Ad Tracking” on your device.
• Social media measurement (Metricool): We use Metricool to attribute visits that arrive from our social media posts.

Every tracker listed above except essential cookies is consent-gated: none of them load unless you accept on the cookie banner or, for standalone simulations, choose Allow recording in the simulation. Declining leaves the platform fully usable.

California residents can also exercise their right to opt out of the sale or sharing of their personal information by emailing vincent@path2medic.com with the subject line “Do Not Sell or Share My Personal Information.” We will process the request within 15 business days.

Microsoft Clarity and your simulation privacy choices

Clarity uses cookies and similar technologies to process usage data. We configure simulation recordings to mask page text and input content, remove names, email addresses and purchase tokens from the page URL before loading Clarity, and avoid sending those values as custom analytics identifiers. The signed launch link is retained separately in your tab's session storage to preserve refresh and submission behavior; it is not added to Clarity tags or the saved answer checkpoint. If the URL cannot be safely prepared, recording stays off. Do not enter real patient information into the Service.

Our purpose for using Clarity is troubleshooting and service improvement. We request analytics storage only and set advertising storage consent to denied. Microsoft collects or receives usage data through Clarity and processes it under its own terms, which also describe Microsoft Advertising. For Microsoft's collection and use of this information, see the Microsoft Privacy Statement and Clarity Terms.

Recording is optional and intended for adults aged 18 or older. It stays off until you choose Allow recording, and Global Privacy Control prevents it from loading. You can decline before starting or withdraw permission through Privacy in the simulation header or the choices on its completion screen. Withdrawal stops further capture on that page; it does not automatically delete earlier recordings. Recording choices are stored for this browser on the simulator's domain, separately from the main site's cookie choices. Contact us to request access or deletion as described below.

4. Data Storage and Security

Your data is stored securely on Supabase (our database provider) and protected with industry-standard encryption. Payment data is processed and stored by Stripe in compliance with PCI DSS standards. We implement reasonable security measures to protect your personal information from unauthorized access, alteration, or destruction.

5. Data Sharing and Sub-Processors

We do not rent your personal information. We disclose information to providers that support the Service, including those below. Analytics and advertising disclosures may be considered a sale or sharing under some privacy laws, as described in §3. Some providers, including Microsoft, also process information under their own privacy terms.

• Stripe — payment processing, invoicing, and statement-descriptor management
• Supabase — database hosting, authentication, and file storage
• Vercel — website hosting, edge functions, and runtime logs
• Resend — transactional email delivery (purchase confirmations, report delivery, password resets, account notifications)
• Mailchimp — marketing email delivery for buyers who explicitly opt in at checkout
• Google Analytics 4 — aggregate usage analytics with IP anonymization
• Microsoft Clarity — optional simulation session replay, heatmaps, and technical troubleshooting (see §3 for choices and Microsoft's privacy terms)
• Meta Pixel — advertising measurement and retargeting on Meta platforms (see §3 for opt-out)

Path2Medic is a registered fictitious name (d/b/a) of Ibis SaaS Holdings, LLC, a Florida limited liability company and the data controller for information collected through the Service. Customer data is held by the LLC, not by individual personnel.

6. Legal Basis for Processing (GDPR)

For users in the European Economic Area, United Kingdom, and similar jurisdictions, we process your personal information on the following legal bases: (a) your consent for marketing emails, optional simulation recordings, and analytics/advertising cookies; (b) performance of a contract for account creation, payment processing, exam delivery, and report generation; (c) our legitimate interests for security monitoring, fraud prevention, aggregate analytics, and platform improvement; and (d) compliance with legal obligations for tax records, payment records, and similar statutory requirements.

7. Data Retention

We retain personal information only as long as needed for the purposes described in this policy:

• Account and study data (website and apps): for as long as your account is active, plus up to 7 years after closure where required by tax or audit obligations.
• Payment records: retained by Stripe per its retention policy and by us for 7 years for tax/accounting purposes. When you delete your account, our copy of these records is kept only in minimized form — your contact details are removed; Stripe retains its own records independently.
• Simulation submissions and Readiness Reports: retained alongside your account for as long as you maintain access, so you can re-reference your report and we can spot longitudinal trends if you take a second Simulation.
• Marketing consent records: retained until you withdraw consent, or until your account is deleted.
• Clarity recordings and analytics: retained under Microsoft Clarity's data retention policy, separately from your assessment answers and reports.
• Backups and logs: up to 90 days for security and operational integrity.

8. Deleting Your Account, and Cancelling vs Deleting

You can delete your account yourself — no email or support request is needed — from the Account tab in the Path2Medic app, from your account page, or at path2medic.com/delete-account (sign in first).

• What deletion does: your profile, saved answers, practice history and course progress are deleted, and any live membership is cancelled immediately — you will not be charged again. Payments already made are not automatically refunded; contact us within the refund window if you want one. Purchase records we must keep for accounting are kept with your contact details removed. Deletion takes effect immediately and cannot be undone.
• Cancelling is different: cancelling your subscription stops future payments but keeps your account — you can still sign in on the website and app, your saved answers and history stay, and you can resubscribe at any time.
• Academy accounts: accounts managed by a partner academy (for example Rescue Academy or JP Medic) are handled in their own portals and cannot be deleted from the app or this page.

You also have the right to access the personal data we hold about you, to request correction of inaccurate data, and to cancel your subscription at any time. To exercise any of these rights, or if the deletion flow does not work for you, contact us at vincent@path2medic.com.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

10. Contact

If you have questions about this privacy policy or our data practices, contact us at vincent@path2medic.com.