1. Introduction
CU Emergency Medical Services ("CUEMS," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
2. Information We Collect
2.1 Personal Information
We collect the following categories of personal information:
- Identity Data: First name, last name, preferred name, pronouns, CU ID (CUID), Identikey
- Contact Data: Email address, alternate email, phone number
- Academic Data: Major, minor, title, graduation year
- Employment Data: Background check status, training completion dates
- Certification Data: EMT certifications, BLS/CPR cards, certificate numbers, expiration dates
- Activity Data: Event attendance, shift signups, time tracking entries
2.2 Technical Data
We automatically collect:
- IP address and browser user agent (for audit logging)
- Login timestamps and session information
- Actions performed within the platform (audit trail)
2.3 Data Classification
Per University of Colorado data classification standards:
- Confidential: Member PII (names, emails, CUIDs), certification records, academic information
- Highly Confidential: Health-related records (EMT certifications, medical training), background check information
- Public: Organization contact information, public event calendars, AED location data
3. How We Use Your Information
We use collected information to:
- Manage CUEMS membership and operations
- Schedule shifts and track attendance
- Maintain certification and training records
- Comply with university policies and regulations
- Respond to Colorado Open Records Act (CORA) requests
- Ensure platform security and prevent fraud
- Generate operational reports and analytics
4. Legal Basis for Processing
We process your data based on:
- Legitimate Interest: Operating CUEMS and managing membership
- Legal Obligation: FERPA, CORA, HIPAA compliance
- Consent: Where explicitly obtained for optional features
5. Data Sharing and Disclosure
We may share your information with:
- University of Colorado: As required for university operations and compliance
- Government Authorities: When required by law or CORA requests
- Service Providers: Technology services we use to operate the platform, such as email delivery
We do NOT sell your personal information.
6. Data Storage and Security
- Location: Data is stored on infrastructure managed by CUEMS, and access to it is restricted to authorized members
- Access Control: Role-based access control (RBAC) with principle of least privilege
- Audit Logging: All data access and modifications are logged with cryptographic integrity verification
7. Data Retention
We retain your data according to the following schedule:
- Active Member Data: Retained while you are an active member plus 7 years after separation
- Certification Records: Retained for the duration of certification validity plus 7 years
- Audit Logs: Retained indefinitely for compliance purposes (FERPA requires logs as long as records exist)
- Contact Submissions: Retained for 3 years unless associated with an ongoing matter
Data is soft-deleted (marked as deleted but retained) to support audit requirements before permanent deletion.
8. Your Rights
You have the right to:
- Access: Request a copy of your personal data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion (subject to legal retention requirements)
- Portability: Request your data in a machine-readable format
To exercise these rights, contact us at cu-ems@colorado.edu.
9. FERPA Notice
If you are a student at the University of Colorado Boulder, certain information may be considered "education records" under the Family Educational Rights and Privacy Act (FERPA). Your FERPA rights are protected, and we comply with all FERPA requirements regarding access, disclosure, and amendment of education records.
10. Cookies and Tracking
We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising technologies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.
12. Contact Us
If you have questions about this Privacy Policy, please contact:
CU Emergency Medical Services
University of Colorado Boulder
Email: cu-ems@colorado.edu
For university-wide privacy concerns, contact the CU Boulder Privacy Office.