PulseCert Privacy Policy

Last updated: October 12, 2026 · PulseCert is in beta.

PulseCert is software that CPR, first-aid and safety training centers use to run their classes: online booking and payments, a course finder, rosters, check-in, skills sign-off, online exams, messages, and completion and card records. This policy covers:

PulseCert is operated by PulseStart CPR & AED, Inc. ("PulseStart CPR"), a Florida corporation based in Miami ("PulseCert," "we," "us"). If PulseCert moves into its own company (the planned PulseCert LLC), we'll update this policy.

It doesn't cover a training center's own website, or services a center uses on its own, such as its own CRM, its Enrollware account, or the American Heart Association's eCard system. Those have their own privacy policies.

1. Who is responsible for your information

You are… Who decides how your information is used PulseCert's role
A student or booker at a training center that uses PulseCert That training center (the "controller," or "business" in California terms) Processor / service provider. We handle it only for the center and under its instructions.
A student of PulseStart CPR PulseStart CPR (PulseStart CPR & AED, Inc.), which also operates PulseCert. PulseStart's privacy policy at pulsestartnow.com applies to how PulseStart uses your information as a training center; this policy covers how the PulseCert software handles it. Both
A training-center owner, admin, instructor, front-desk or sales staff member, or a center that subscribes PulseCert, for account, sign-in, security, billing and support information Controller
A visitor to pulsecert.app marketing pages PulseCert Controller

Students: start with your training center for any question or request. If you contact us, we'll pass your request to the center and help it respond. We don't use student information for our own marketing, we don't use one center's students to market another center, and we don't sell it.

Our contract terms with centers are in the PulseCert Terms of Service. A separate data processing agreement for centers will be offered later.

2. Information we handle

Students and bookers (entered by the student, a booker, or the center's staff)

If center staff add you to a class (for example, as a walk-in or from a group roster), PulseCert creates a student record for you and emails you that you were added. You can't sign in until you claim the record with the emailed link (or "Email me a login link"). Staff also record whether you agreed to receive texts. - Name, email, mobile phone, and the class, date and location booked; waitlist entries. - For students under 18, a date of birth when center staff record it, and a parent or guardian contact. - For group bookings: the organizer's details and the team roster the organizer or employer enters. - For minors: the parent or guardian's name and contact details (see §9). For students under 13, a parent or guardian email is required. - Payment status and amounts (paid, deposit, refunded). Card numbers go directly to Stripe and are never stored by PulseCert. - Attendance and check-in time. - Skills results (Pass or Needs remediation, by station) and instructor notes. - Online exam results (score, pass/fail and answers). - Card records: course, issue and expiration dates, and the eCard or certificate number the center records. PulseCert doesn't issue cards (§3). - Messages sent to the student and their delivery status; replies. - The cancellation/refund policy text the student accepted at checkout, and when. - Whether you agreed to booking texts (the optional checkbox at booking, or your agreement recorded by staff), and when. - Referral codes, and how you found the class (campaign tags such as utm_source).

Course finder

You answer a few questions (for example, whether you work in healthcare, whether you need first aid, individual or group) so we can suggest a course. Your answers stay in your browser and aren't stored or sent to us, and no analytics events are recorded for them. If you submit the group-quote request form, we receive and store your contact details, the course you're interested in and your location. That request is emailed to the center and, if the center connected it, synced to the center's CRM (GoHighLevel). The suggestion is general guidance only. It isn't a determination of what your employer, school or licensing agency requires.

Staff

Training-center customers

Center name, branding, settings, subscription and billing records (through Stripe), and connected-service credentials (for example, the center's own Stripe, Twilio or GoHighLevel account). Credentials are stored write-only and shown masked.

Collected automatically

The PulseCert Staff app

Please don't enter health information (for example, in instructor notes or free-text fields). If a student needs an accommodation, the center handles that directly.

3. How we use information

Cards. PulseCert and PulseStart CPR don't certify anyone and don't issue AHA eCards, American Red Cross certificates, ASHI cards, or any other card. Cards come from the certifying organization (the AHA, ASHI or the American Red Cross), are emailed to the student by that organization and claimed by email, and AHA eCards can be looked up with the AHA eCard lookup at ecards.heart.org. PulseCert stores completion records and the card numbers a center records. The certifying organizations' own privacy policies apply to the information they hold.

4. Who we share information with

We don't sell personal information, and we don't share it for targeted ("cross-context behavioral") advertising.

Service providers ("subprocessors") that help run PulseCert:

Provider What it does Where
Railway Hosts PulseCert's servers, database and backups United States (us-east4, Virginia)
Stripe Card payments on booking pages (normally through the training center's own Stripe account) and center subscription billing United States
Twilio Sends text messages United States
Resend Sends email United States
GoHighLevel (LeadConnector) Syncs contacts to a center's own CRM, only if that center connects it United States
Sentry Error monitoring, only if enabled, server-side only (not in the Staff app) United States

We require our service providers to protect personal information at least as well as this policy does, and to use it only to provide their services to us. Stripe also uses payment information for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy. We'll update this list before adding a provider.

We may also share information: - with the training center whose student or staff member you are. If your employer or organization booked or paid, the center may share your attendance and completion with it; - with tools the center connects itself, such as its own Google Analytics ID on its booking pages, webhooks, data exports or API access. The center controls those, and their terms apply. PulseCert itself doesn't run advertising or analytics trackers; - when the law requires it (for example, a valid subpoena), or to protect people's safety, our rights or the service; - in a business transfer, if PulseCert is reorganized, merged or sold, including the planned move into its own company. This policy continues to apply to the information transferred; or - with your permission.

5. Text messages (SMS)

6. Email

Transactional emails (account setup, confirmations, receipts, reminders, exam links, card information) are sent through Resend. Marketing emails (for example, referral invitations and card-renewal reminders, which we treat as marketing) include a one-click unsubscribe link and the center's mailing address, and aren't sent at all if the center hasn't provided one. Emails that center staff write and send from the CRM are treated as marketing (with the unsubscribe footer) unless staff mark them as about your booking or account. Unsubscribing applies to that center only, and doesn't stop messages about classes you've booked.

Opt-out records. When you unsubscribe or text STOP, we keep your email address or phone number on that center's suppression list, as proof of your choice and so you aren't contacted again. We keep it even if you later delete your account.

7. How long we keep information

Information How long
Training records (registrations, attendance, skills and exam results, completion and card records) 3 years after the class or card date (the minimum certifying organizations such as AHA require), then anonymized
Audit and security logs; message logs As long as the training records they relate to
Payment and tax records As long as tax and accounting laws require, generally up to 7 years. After the training-record period, amounts and dates are kept without your name or contact details.
Opt-out (suppression) records The email or phone number you opted out with, for as long as that center uses PulseCert, so the opt-out keeps working
Staff and student accounts and records While in use. Deletion works per training center. Accounts are deleted within 14 days of a request: when it's approved (by the center, or automatically after 14 days if it doesn't act), that center's access is closed immediately, and your password, login links, sessions, phone, consents, preferences, date of birth and guardian details are erased. Your email is replaced with a placeholder, and addresses are scrubbed from that center's message logs and CRM sync records. Your shared login is erased once no other center you belong to uses it. Your name stays only on the training records and audit entries that must be kept, and is anonymized when their 3-year period ends (immediately if none). See the account deletion page.
A center's data when its plan ends (trial over, cancelled at period end, or unpaid) Read-only for 7 days, during which the center can sign in and export everything. Then the center is suspended: no one can sign in, and exports stop until it pays. Suspended centers' data is kept for 90 days, then deleted, except records the law requires us to keep and backups that roll off within 90 days. Centers are responsible for exporting the training records they must keep during the 7 days.
Group-quote requests and other leads with no booking 24 months after last activity
Backups Overwritten on our normal cycle, within 90 days

When a deletion request is approved, we erase what we don't need to keep right away and anonymize the rest at the end of its retention period, so it no longer identifies anyone. Opt-out records are the exception described above.

8. Security

We use encryption in transit (HTTPS) for every connection; hashed passwords and limits on repeated sign-in attempts; 12-hour sessions; secure device storage in the app; role-based access, so staff see only what their role allows and only for their own center; audit logs; masked storage of connected-service credentials; and payment handling by Stripe. No system is perfectly secure. If a breach affects your personal information, we'll notify the affected training center within 72 hours and, as the law requires (including Fla. Stat. § 501.171), the affected people and authorities.

9. Children and minors

PulseCert is used by businesses and their staff. It isn't made for children, and the PulseCert Staff app is for adult staff only. Some centers teach minors (for example, pediatric, babysitting or school programs). In those cases:

10. Your rights and choices

Wherever you live in the U.S., you can ask to see, correct, delete, or get a copy of your information, and to stop marketing (reply STOP to texts, or use the email unsubscribe link). You can request deletion with Delete my account in your account settings, by email (if you never claimed a login), or through your center. Requests are handled per center, and your account is deleted within 14 days. A center can refuse a deletion request only if it can't verify that the request came from you. Students may also contact their training center first. We'll confirm your identity, usually by replying to the email on file, and respond within 30 days. We'll tell you if we need more time, or if we can't do something and why. We may keep records the center or we must keep (see §7). We won't treat you differently for using these rights. We honor the browser Global Privacy Control signal as a request not to sell or share your information (we don't sell or share it anyway).

California and other state privacy rights. To the extent those laws apply to us: - Categories: identifiers (name, email, phone, account IDs, IP address); customer records (registrations and payment status); education and training information (attendance, skills, exam and certification records); internet activity (server and audit logs). - Sources: you, your training center, and the devices you use. - Purposes: those in §3. Disclosures: to the service providers in §4, for business purposes only. - No sale or sharing. We don't sell personal information or share it for cross-context behavioral advertising, and haven't in the past 12 months. We don't use sensitive information to infer characteristics about anyone. For student information, we act as the center's service provider. - Your rights: to know, access, correct and delete, and not to be discriminated against. An authorized agent may make a request with your signed permission. If we deny a request, you may appeal by replying to our decision; we'll answer within 45 days.

11. United States only

PulseCert and the Staff app are offered only in the United States, and information is stored in the United States. This policy is governed by Florida law.

12. Changes

We'll post updates here and change the "Last updated" date. For important changes, we'll tell training centers by email or in the dashboard before the change takes effect.

13. Contact us

PulseStart CPR & AED, Inc., operator of PulseCert
Email: support@pulsestartnow.com
Phone: (786) 292-8277, Monday–Friday, 9 AM–6 PM ET