Privacy Policy

CSTSetup is run by a small team of surgical technologists. This policy explains what we collect, why we collect it, and what we will never do with it. If anything here is unclear, email [email protected] and a person will answer you.

The short version

• We collect what an account needs to work, plus the content you choose to create.
• We do not sell your information and we do not share it with advertisers.
• The site sets one cookie, to keep you signed in. There are no advertising or analytics trackers on it.
• Your card details never reach our servers.
• You can delete your account yourself from your dashboard, and deleting it takes your record with it.

What we collect

When you make an account

• Your email address. It is the only thing we require, because signing in is a code sent to your email rather than a password you have to invent and remember.
• Your name, phone number, avatar and profile links, if you choose to add them. Every one of these is optional and can be left empty.
• Two factor details, if you turn on an authenticator app: the secret that makes those codes work and your backup codes.

When you use the site

• The content you create: setups, instruments, comments and contributions, and any photos or files attached to them.
• Your study history: which cards you reviewed and how you graded yourself. This is the record that makes a card come back at the right time instead of at random.
• Records that keep the site working and safe: your IP address against your sign in sessions and against anything you submit, and the date you were last active.

When you subscribe to Pro

• What you bought, when it renews, and whether it is currently active.
• We never see or store your card number. Payments on the web go through Stripe, and payments in our apps go through the App Store or Google Play.

Cookies

One, and it doesn't follow you anywhere.

• lcars_session keeps you signed in for up to 30 days. Without it you would be signed out on every page.

There is no advertising cookie, no analytics cookie and no third party script of any kind. The site sends a Content Security Policy that permits scripts only from ourselves, so a tracker could not run here even if somebody added one by mistake.

If your school enrols you in a program

An accreditation program is the one place where somebody other than you sees your records, and that is the whole point of it. If a school or hospital enrols you:

• Your instructors and your program owner can see your name, your email, your case logs, your clinical hours and your progress toward your standard.
• If your program records clinical hours, each clock in and clock out stores the time and, when your program has location checks switched on and your device offers one, the coordinates it happened at and how far that is from the site. You are never prevented from clocking in, including when you decline the location request or your phone cannot get a fix.
• If your program uses preceptor sign off, the preceptor sees only the cases they are being asked to sign, and their attestation is recorded alongside those cases.
• Your own Pro subscription is not shown to your program. Whether you pay for Pro yourself is private, and a program roster deliberately does not carry it.

Your program controls its own settings and holds its own records. If you want something in your program record corrected or removed, start with your program, and email us if that does not resolve it.

Who else touches your data

We keep this list short on purpose.

We do not sell your personal information to anybody, and we do not share it with advertisers or data brokers. We will hand over information where a valid legal process requires it of us.

How long we keep things

• Sign in sessions expire after 30 days.
• An invitation nobody accepts is deleted after 90 days, together with the empty account that was holding the place.
• The database is backed up hourly and those backups roll: roughly a day of hourly copies and a month of daily ones. Something you delete can survive in a backup until that copy rolls out.
• Everything else we keep for as long as your account is open.

Deleting your account

You can delete your account yourself, whenever you want, from your Dashboard under Security. We confirm it with a code from your authenticator app, or one sent to your email if you do not use one, and then it is done. You do not have to ask us and you do not have to give a reason.

Deleting removes what we hold about you. We apply the European erasure standard here for everybody, wherever you live: where something has to remain on the site, because other people's study material is built on top of it, it remains with its connection to you removed. It stops being information about you, which is the whole point of that rule.

There is one exception, and it belongs to your program rather than to us. If a school or hospital enrolled you in an accreditation program, the record they built stays with them: your case logs, your clinical hours and your name on their roster. That is their accreditation evidence, and they may be required to hold on to it long after you have finished. If you want it removed, ask your program directly.

Children

You must be at least 13 to use CSTSetup in the United States and the United Kingdom, and at least 16 anywhere else. If you are under 18, a parent or guardian needs to read and agree to our Terms of Service on your behalf.

Your choices

You can read most of the site without an account at all. You can leave every optional field empty. You can decline the location request on a clinical shift and still clock in. Some things stop working without the information they need, and we will always tell you which rather than collecting it quietly.

Changes to this policy

If we change something that matters, we will update the date at the top of this page. Continuing to use CSTSetup after a change means you accept it.

Questions

Email [email protected]. You may also want our Terms of Service, our Refund Policy and our Security Policy.