Privacy Policy
Last updated November 9, 2026
This policy explains what Precept collects, why, and who it's shared with. Precept is run by SquidSkull (legal name HedgesLabs LLC). Questions go to aaron@hedgeslabs.com.
Short version: we collect what it takes to run Precept for your program, we don't sell it or use it for ads, and your program controls its students' records.
What we collect
- Account details: name, email and program name for directors, staff, students and preceptors who sign in.
- Program records: what your program enters, such as rosters, clinical shifts, skills, patient contact counts, sign-offs, time cards, tests, surveys and documents.
- Billing: the program's billing contact, address and purchase order number. Card and bank details go straight to Stripe. We never see or store full card numbers.
- Messages you send through the contact page, and answers to the optional survey in the demo (with your email only if you choose to leave it).
- Basic technical data: the server logs any website keeps (IP address, browser, pages asked for), used to keep the service running and secure. Clock-in uses your phone's location only at the moment you clock in or out, and only if you allow it.
- Anonymous visit counts: when you open the home page, the demo or the sign-up page, your browser sends a random ID it keeps for this site, what you did (for example "opened the demo" or "viewed as a student"), and the name of the site or link tag that brought you, such as facebook.com. No name, email, IP address or anything you type in the demo goes with it. It only tells us how many people try the demo. There are no ad trackers or cookies from other companies.
The open demo at /demo/ keeps its sample data in your own browser. Nothing you type in the demo is sent to us.
How we use it
Only to run Precept: to sign you in, save and show your program's records, take payments, answer messages, and keep the service secure. We don't sell personal information, show ads, or use program records to train AI models.
Student records and FERPA
Records about students are education records that belong to the program. We handle them as a school official under the program's direct control (FERPA, 34 CFR 99.31(a)(1)). We use them only for the program's purposes, don't share them with anyone else, and delete them when the program asks. Students who want to see or correct their records should ask their program, and we'll help the program do it. Colleges that need a signed data privacy agreement can ask through the contact page.
Patient information
Precept isn't built to hold patient health information. Our Terms ask programs not to enter anything that identifies a patient.
The student patient log is different from the rest of Precept: it is saved only in the browser on the student's own phone or computer and is never sent to us or to the program. It asks for no names, birth dates, addresses, phone numbers or record numbers. It stays there until the student deletes it with the Delete my patient log button or clears the browser's history and site data. Only what a student later puts into a patient contact report and sends is saved by Precept.
Who we share it with
Only these service providers, and only so they can run their part of Precept:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | United States (us-east-1) |
| Vercel | Hosting the website | United States |
| Stripe | Card payments, invoices and sales tax | United States |
| FormSubmit | Emailing contact page messages to us | United States |
| Google Fonts | Website fonts (sees your IP address when a page loads) | United States |
We'd also share information if the law requires it, and we'd tell the program first unless the law forbids that.
Security
All traffic is encrypted (HTTPS). Each program's data is walled off in the database so only that program's members can read it. Passwords are stored hashed by Supabase, never in plain text. If we learn of a breach that affects your program's data, we'll tell the program director within 72 hours. For more detail, see Security and privacy for IT reviewers.
How long we keep it
While the account is open. When a program closes its account, we delete its records within 30 days. Backups roll off within a further 30 days. Billing records are kept as long as tax law requires.
Your choices
- Directors can export or delete their program's records any time.
- Anyone can ask us what we hold about them, or ask us to fix or delete it, at aaron@hedgeslabs.com. For student records, we'll work through the program.
- Precept is for adult EMS students and staff. It isn't meant for children under 13.
Changes
If we change this policy in a way that matters, we'll email program directors at least 30 days before it takes effect.