Privacy Policy

Effective date: September 2026

This Privacy Policy applies to the website at paramedicfoundation.org, operated by The Paramedic Foundation (EIN 46-3271401), a Minnesota nonprofit corporation and a tax-exempt charity under Section 501(c)(3) of the Internal Revenue Code. It applies wherever you are located, and it states additional rights for individuals in the European Economic Area, the United Kingdom, Switzerland, and California.

The Paramedic Foundation also operates under registered assumed names, including American College of Paramedics and American Paramedic Association. A website operated under a registered name carries its own privacy notice, which identifies The Paramedic Foundation as the organization responsible. The notice for the American College of Paramedics, at americanparamedics.org/privacy-policy/, states TPF’s position on identity verification and biometric information.

This policy covers information TPF collects through this website. It does not cover information TPF collects about the people who work for it. If you are an employee, officer, director, volunteer, contractor, or consultant engaged by TPF, the information TPF holds about you, including background screening information, is governed by TPF’s Personnel and Screening Privacy Notice, which is provided to you at engagement.

What information TPF collects

Contact form submissions

When you submit the contact form on this website, The Paramedic Foundation collects your name, email address, and message content. TPF also collects optional fields you choose to fill in: organization name, state, and inquiry type. Your IP address and submission timestamp are recorded automatically for security and spam prevention purposes.

Newsletter signup

If you subscribe to TPF Updates through the MailerLite signup form on this website, TPF collects your email address and, if provided, your name. MailerLite is TPF’s email service provider. Their privacy policy is available at mailerlite.com/legal/privacy-policy. You may unsubscribe at any time using the link in any email TPF sends.

Donation processing

If you make a donation through the Zeffy form on this website, your payment and contact information is collected by Zeffy and their payment processor, Stripe. This includes your name, email address, billing address, and payment card details. TPF does not receive or store payment card data. Zeffy operates under PCI DSS compliance through Stripe. All financial transactions are encrypted in transit and at rest. Zeffy may contact you to provide a tax receipt, handle a dispute, or respond to a direct inquiry. They do not use donor contact information for solicitation. Zeffy’s privacy policy is available at zeffy.com/en-US/privacy. Stripe’s privacy policy is available at stripe.com/privacy.

Analytics and behavioral tracking

This website uses third-party analytics tools to understand how the site is used, identify technical issues, and improve content and navigation. These tools may collect your IP address (typically anonymized), browser type, and device type. They also collect pages visited, time on page, click patterns, scroll depth, and general geographic location at the country or region level.

Current tools in use include:

• Google Analytics: provides aggregate traffic and behavior data. Google Analytics sets cookies to distinguish visitors and track sessions. Data is processed by Google LLC under their Privacy Policy. TPF has enabled IP anonymization. You may opt out using the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity: provides session recording and heatmap analysis to help TPF understand how visitors interact with page content. Clarity may record mouse movements, clicks, and scroll behavior in anonymized or pseudonymized sessions. No payment information or passwords are captured. Data is processed by Microsoft Corporation under their Privacy Statement. You may opt out of Clarity tracking at clarity.microsoft.com/optout.

The Paramedic Foundation may add or change analytics tools over time. TPF will update this section when it does. All tools are selected with data minimization in mind. TPF does not use advertising networks, behavioral retargeting pixels, or tools that share your data with third-party advertisers.

Server logs

The TPF web host (SiteGround) automatically collects standard server log data when you visit the site, including your IP address, browser type, pages visited, and timestamps. This data is used for security monitoring and site performance and is retained per SiteGround’s standard retention policies.

Cookies

This website uses cookies. A cookie is a small text file placed on your device by your browser when you visit a site. You may configure your browser to decline or delete cookies, though some site features may not function correctly if you do. Cookies set on this site include:

• Session and security cookies: required for basic website functionality and contact form spam prevention. These expire when you close your browser or shortly after submission.
• Google Analytics cookies: persistent cookies (typically lasting up to 2 years) that track sessions and distinguish returning visitors. Prefixed _ga and _gid.
• Microsoft Clarity cookies: session and persistent cookies used to associate page views within a session and to distinguish users across sessions. Prefixed _clsk and _clck.
• MailerLite cookies: may be set if you subscribe to the TPF newsletter, to track whether you have opened or clicked links in emails TPF sends.

How TPF uses your information

The Paramedic Foundation processes your information on the following legal bases:

• Legitimate interest: contact form submissions are processed to respond to your inquiry. Analytics data is processed to understand how the site is used and to improve it. This processing is proportionate and does not override your privacy interests.
• Consent: newsletter subscription data is processed on the basis of your explicit consent. You may withdraw that consent at any time by unsubscribing, without any penalty. Withdrawal does not affect the lawfulness of processing before withdrawal.

TPF does not use your information for advertising, profiling, or any purpose unrelated to the activities described in this policy. TPF does not sell personal information.

Who TPF shares your information with

The Paramedic Foundation shares your information only with the service providers necessary to operate this website and respond to your inquiries:

• SiteGround: web hosting provider
• MailerLite: email marketing platform for newsletter subscribers
• WP Mail SMTP / Microsoft 365: email transmission for contact form messages
• Google LLC: Google Analytics traffic and behavior data
• Microsoft Corporation: Microsoft Clarity session and heatmap data
• Zeffy: donation platform; processes donation transactions on behalf of TPF and provides donor tax receipts
• Stripe: payment processor used by Zeffy for financial transactions; handles payment card data under PCI DSS compliance

TPF does not share your information with data brokers, advertisers, or analytics aggregators beyond the tools named above.

International data transfers

TPF is located in the United States, and the service providers named above are located in the United States. If you contact TPF, subscribe to updates, donate, or browse this website from outside the United States, the personal information described in this policy is transferred to and processed in the United States, where data protection law differs from the law of your country.

Where TPF transfers personal information of an individual in the European Economic Area, the United Kingdom, or Switzerland to the United States, and that transfer requires a specific legal safeguard, TPF puts that safeguard in place before the transfer, using the standard contractual clauses approved for that purpose or another mechanism permitted by applicable law. TPF also applies the commitments set out below to that information, whatever the mechanism relied on.

TPF’s cross-border data protection commitments

TPF adopts the following commitments voluntarily for personal information it receives from outside the United States. They are modeled on the internationally recognized principles that govern transatlantic data protection, and TPF holds itself to them as a matter of policy.

Notice. TPF tells you what it collects, why, who it shares information with, how to contact TPF, the choices you have, and how to raise a complaint. This policy is that notice.

Choice. TPF does not use your information for a purpose materially different from the purpose for which it was collected, and does not disclose it to a third party for such a purpose, without offering you the opportunity to decline. Sensitive information is not used or disclosed for a new purpose without your affirmative consent.

Accountability for onward transfer. Before TPF passes your information to a service provider, TPF requires by contract that the provider process it only for the limited and specified purposes TPF states, provide at least the same level of protection as these commitments, notify TPF if it can no longer do so, and stop processing or take other reasonable steps if that happens. TPF remains responsible for the handling of information it transfers to a provider acting on its behalf.

Security. TPF takes reasonable and appropriate measures to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, having regard to the risk and the nature of the information.

Data integrity and purpose limitation. TPF limits personal information to what is relevant for the purposes of processing, does not process it in a way incompatible with the purpose for which it was collected, takes reasonable steps to keep it accurate, complete, and current, and retains it only for as long as it serves that purpose.

Access. You may obtain confirmation of whether TPF holds personal information about you, access to that information, and correction, amendment, or deletion of information that is inaccurate or has been processed in violation of these commitments, except where the burden or expense of providing access would be disproportionate to the risk to your privacy, or where the rights of another person would be violated.

Recourse, enforcement, and liability. TPF investigates and attempts to resolve complaints about its handling of personal information under these commitments. TPF responds within one month of receipt, extended by up to two further months where a complaint is complex, in which case TPF says so within the first month. If you are not satisfied with the response, you may escalate to the Board of Directors of The Paramedic Foundation by writing to the address below. You may in every case lodge a complaint with the data protection authority in your country.

TPF is not certified under, and does not claim participation in, any government data transfer certification program. These commitments are adopted voluntarily and are additional to, not a substitute for, the rights applicable law gives you.

Legal disclosure

TPF may disclose personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements. TPF may also disclose personal information when required by law, regulation, or valid legal process. This includes court orders, subpoenas, or government requests. Information related to publicly funded consulting engagements may also be subject to public records laws in the jurisdictions where those engagements are conducted. Where feasible and permitted, TPF will notify affected individuals before disclosure.

Data retention

Contact form submissions are retained for 3 years from receipt, or, where a submission becomes part of an engagement record, for the period TPF’s Records Retention Schedule sets for that record. Analytics data is kept per each platform’s default settings. Google Analytics retains data for up to 14 months. Microsoft Clarity retains data for up to 13 months. Newsletter subscriber data is retained until you unsubscribe. Donation transaction records are retained by Zeffy and Stripe per their own policies and applicable financial regulations. TPF retains donor name and email address for tax receipt and nonprofit recordkeeping purposes.

Your rights

You have the right to request access to, correction of, or deletion of personal information TPF holds about you. To make a request, email The Paramedic Foundation at info@paramedicfoundation.org with the subject line "Privacy Request." TPF will respond within one month of receipt. Where a request is complex, or you have made several, TPF may extend that by up to two further months, and if it does it will tell you within the first month and explain why.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights. These include the right of access; the right to rectification of inaccurate information; the right to erasure; the right to restrict processing; the right to data portability; the right to object to processing carried out on the basis of legitimate interests; and the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with the supervisory authority in your country: in the European Economic Area, the data protection authority of your member state; in the United Kingdom, the Information Commissioner’s Office; and in Switzerland, the Federal Data Protection and Information Commissioner. TPF asks that you raise the matter with TPF first so that it can try to resolve it, but you are not required to do so.

If you are a California resident, you have rights under the CCPA. These include the right to know what personal information is collected and the right to opt out of its sale. TPF does not sell personal information.

For analytics opt-outs, see the specific tool links in the Analytics section above.

Third-party links

The TPF website includes links to third-party websites including LinkedIn, ircp.info, government agency websites, and academic publications. This Privacy Policy does not apply to those websites. TPF encourages you to review the privacy policies of any third-party sites you visit.

Children

This website is not directed at children under 13, and TPF does not knowingly collect personal information from anyone under 13.

Changes to this policy

The Paramedic Foundation may update this Privacy Policy periodically. When it does, TPF will update the "Last updated" date at the top of the page. Material changes will be noted in the policy.

Contact

The Security and Privacy Officer of The Paramedic Foundation is accountable for this policy and for handling privacy requests and complaints. Questions about this Privacy Policy or TPF’s data practices may be directed to that role at:

The Paramedic Foundation
23 W Central Entrance, PMB 321
Duluth, MN 55811
info@paramedicfoundation.org