Effective date: July 13, 2026 · Arzoo Salami, doing business as SurgeReady, California. Contact: arzoo@getsurgeready.com
This policy explains what we collect across our website, document kits, and drill software, why, and what your choices are. Short version: we collect the minimum needed to run the products, we don't sell or rent personal information, and drill data belongs to the organization that created it.
| Context | Data | Why |
|---|---|---|
| Free worksheet download | Email address | To deliver the file and send occasional preparedness notes (unsubscribe anytime) |
| Kit purchase | Name, email, payment handled by our payment processor — we never see or store card numbers | Delivery, receipts, the update service we advertise |
| Software account | Name, email, password (stored only as a salted cryptographic hash), organization name, role | Authentication and account management |
| Software use | Exercise records: scenarios, timestamped observations, evaluator names as entered, simulated-patient triage tags, audit log of account actions | This is the product — generating your reports |
| Technical | Server logs (IP address, request time), a session cookie | Security (rate limiting, abuse prevention) and keeping you signed in |
We use a single first-party session cookie for sign-in. We do not use advertising trackers. We use privacy-respecting, cookieless analytics that record only aggregate page views (no personal profiles, no cross-site tracking).
To provide and secure the products, deliver purchases and updates, respond to support requests, send the emails you signed up for, and meet legal obligations. We do not sell or rent personal information, use it for third-party advertising, or train AI models on your organization's exercise data.
Only service providers needed to operate: our website hosting provider, payment processing and kit delivery (Lemon Squeezy, which acts as merchant of record — the seller of record for kit purchases — and processes your payment details under its own privacy policy), and form handling (Formspree) — each bound to use data only to provide their service. We disclose information if required by law, and in a merger or acquisition your data transfers under this policy's protections. Within the Software, your data is visible to members of your own organization according to their roles — never to other customers.
Account and organization data are kept while your account is active. If a subscription lapses, your organization's records remain stored and readable for at least 12 months — we serve safety agencies and do not hold compliance records hostage. Lead-magnet emails are kept until you unsubscribe. Server logs rotate within 90 days. To delete your account and organization data, email us; we will complete deletion within 30 days except records we must keep (e.g., tax records of purchases).
Passwords are stored only as salted scrypt hashes; sessions use HttpOnly cookies; each organization's data is isolated and every access is scoped to your organization; account activity is recorded in an audit log your administrators can view; the service enforces rate limiting and standard security headers, and runs over HTTPS in production. No system is perfectly secure — if we learn of a breach affecting your personal information, we will notify affected users without unreasonable delay, consistent with applicable law.
Email us to access, correct, export, or delete your personal information. Marketing emails always include unsubscribe links; transactional emails (receipts, license keys, security notices) are sent as needed to operate the service. Depending on your state (e.g., California), you may have additional statutory rights — we honor access and deletion requests from all users regardless of state. We do not discriminate for exercising these rights, and we do not sell personal information as defined by the CCPA.
Our products are for organizations and their adult personnel. They are not directed to children under 16, and we do not knowingly collect their information.
Material changes will be posted here with a new effective date and, for account holders, emailed. Questions, requests, or complaints: arzoo@getsurgeready.com or the postal address shown in the footer of our emails.