Privacy Policy | AED Log

Last updated October 13, 2026. This policy replaces the version effective January 17, 2019.

This Privacy Policy explains how AED Log (“AED Log,” “we,” “us” or “our”) collects, uses, shares and protects personal information when you visit aedlog.com, contact us, or use the AED Log customer portal, mobile web app or reseller console (together, the “Service”). We don’t sell personal information.

Who this policy covers

Website visitors, including people who fill in our contact or demo forms.
Customers and their users: organizations that use AED Log to manage their AED and safety equipment programs, and the people they invite.
Resellers and their staff, who offer AED Log to their own customers under their own brand.
People whose information customers enter, such as responders, site contacts and the people involved in an incident. We handle that information on behalf of the customer, which decides what to enter and who can see it. If you have a question about information an organization keeps about you, please contact that organization first; we’ll help it respond.

If your organization uses AED Log through a reseller’s branded portal, the reseller can also see and manage your account, and its own privacy policy covers how it uses your information.

Information we collect

Information you give us

Contact and demo requests: your name, email address, phone number, organization and anything you tell us in your message.
Account information: your name, email address, phone number, password (stored only as a secure hash), time zone and settings, and your two-factor sign-in setup. If you register a passkey, we store its public key, never your fingerprint or face data.
Program records you add to the Service: your organization’s locations (addresses and site contacts), AEDs and other equipment, inspections (who inspected, results, notes and photos), responders and their certifications (contact details, certificate numbers and card images), documents, and incident reports (what happened, the response, the responder, a narrative and photos).
Limited patient details: an incident report has an optional patient section limited to an age range, sex and a short note. It is meant to stay non-identifying: please don’t enter names, dates of birth, medical history or diagnoses.
Billing information: your organization’s name, billing contact and invoices. Card and bank details are entered directly with our payment processor, Stripe; we only keep the card brand, last four digits, expiration date or bank name, so we can show which payment method is on file.
Integration details: if you connect Slack, Microsoft Teams, Discord or AED Sentinel, we store what the connection needs, such as a webhook address or your AED Sentinel sign-in, encrypted.

Information collected automatically

Usage and device information: your IP address, browser and device type, the pages you visit and when, and the website that referred you.
Activity log: the Service records important actions in an account (for example, changes to equipment, users or settings), with who made them, when, and the IP address and device used, so the account has a reliable history.
Cookies and similar technologies, described below.

Information from others

Your organization or reseller, when they invite you or add your details as a responder or contact.
AED Sentinel, if your organization connects it: details about each monitored AED, such as its serial number, model, status, placement, battery and pad dates, signal strength and the latest camera image of the device.
Public recall data from the U.S. Food and Drug Administration, which we match to your AEDs. No customer information is sent to the FDA.

How we use information

To provide the Service: keeping your program records, sending the reminders, alerts, digests and calendar entries you choose, producing reports and documents, and running the integrations you connect.
For billing: processing payments, issuing invoices and receipts, and managing renewals.
To support you: answering questions, setting up accounts, importing your records when you send them to us, and fixing problems.
To keep the Service secure: verifying sign-ins, limiting repeated attempts, recording activity and preventing misuse.
To communicate with you: service and account messages, such as invitations, password resets, alerts, billing notices and important changes. With your consent or where the law allows, we may also send news about AED Log; every marketing email has an unsubscribe link. We may learn whether an email was opened or a link clicked, to improve our messages.
To understand and improve the Service and our website, using usage information, often in aggregated or de-identified form.
To meet legal obligations and protect the rights, property and safety of our customers, the public and AED Log.

We don’t sell personal information, and we don’t share it for targeted advertising. We don’t use the records in your account for advertising.

Cookies and analytics

On aedlog.com, we use two analytics services to understand how visitors use the website and to improve it. Google Analytics tells us which pages people view and how they found us. Microsoft Clarity shows us how people use our pages through heatmaps and recordings of clicks, scrolling and mouse movement; it is set to mask what you type into forms. Both use cookies and receive your IP address and device information, and Google and Microsoft handle that data under their own privacy policies (Google, Microsoft). You can block these cookies in your browser, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout. Our contact and demo forms use Cloudflare Turnstile to tell people from bots, which processes your IP address and browser signals.
In the Service, we use only the cookies it needs to work: a session cookie that keeps you signed in, a security token that protects your forms, and, if you tick “Remember me,” a cookie that keeps you signed in on that device. Your light or dark display preference is saved in your browser. The Service has no advertising or tracking cookies.

Most browsers let you block or delete cookies. If you block the Service’s cookies, you won’t be able to sign in. Our website doesn’t respond to “Do Not Track” signals.

How we store and protect information

Where it’s kept: the Service and its file storage are hosted by DigitalOcean in the United States, and our website is hosted by KnownHost. If you use the Service from outside the United States, your information is transferred to and processed in the United States.
Security measures: connections use encryption (HTTPS); passwords are hashed; two-factor secrets and integration credentials are encrypted; uploaded files are kept in private storage and opened only through links that expire after a few minutes; and access within an account follows each user’s role and permitted locations. Only Account Owners and Administrators can see incident patient details, and those details are left out of alerts, chat messages and the activity log. Users can protect their sign-in with an authenticator app or passkeys, and an account can require two-factor sign-in for everyone.
Support access: AED Log support staff, and your reseller if you have one, may open your account to help you. A banner shows while they do, and every action they take is recorded in your activity log.
How long we keep it: we keep account and program records for as long as the account is active, because they are your compliance history. The activity log is kept as a permanent record. When an account closes, we keep its records so they can be restored or exported, and we delete or de-identify them when the organization asks, except for records we must keep for legal, tax, accounting or security reasons, such as invoices. Sign-ups that are never verified are removed after seven days.

No method of transmission or storage is completely secure, so we can’t guarantee absolute security, but we work to protect your information and will notify you of a breach as the law requires.

Sharing and service providers

We share personal information only as described here:

Within your organization: other users in your account can see records according to their role and location access.
With your reseller, if your organization uses AED Log through one, so it can manage, bill and support your account.
With service providers that work for us under contracts that limit their use of the information: app hosting and file storage (DigitalOcean), website hosting (KnownHost), email delivery (Mailgun), payment processing (Stripe), website security and network delivery (Cloudflare), and website analytics (Google Analytics and Microsoft Clarity).
With services you choose to connect:
- Slack, Microsoft Teams and Discord receive the alert messages you route to them: the alert, equipment, location, date and a link. Incident alerts never include the narrative or patient details.
- AED Sentinel and ReadiCheck, from Readiness Systems, receive the inspections you record on linked AEDs if you turn on write-back: the AED’s status, the inspection time, battery and pad dates, and your inspection notes.
- Calendar apps receive the events in your personal calendar feed. The feed’s private link works without signing in, so keep it to yourself; you can replace it at any time, which stops the old link.
These services handle the information under their own privacy policies.
For legal reasons: when we believe in good faith that the law, a court order or other legal process requires it, or that it’s needed to protect the rights, property or safety of AED Log, our customers or the public.
In a business transfer: if AED Log is involved in a merger, acquisition or sale of its business, information may transfer as part of it, under this policy’s protections.

Your choices and rights

Your profile and notifications: you can update your profile, password and sign-in security in your account, and choose for each alert type whether to get it right away, in a daily or weekly digest, or not at all.
Marketing emails: unsubscribe with the link in any marketing email. You’ll still get service and account messages.
Exports: users with access to reports can download their organization’s records as CSV or PDF reports.
Access, correction and deletion: you can ask us to tell you what personal information we hold about you, to correct it, to delete it or to give you a copy. If the information is part of an organization’s records, such as your responder profile, we’ll pass your request to that organization, which decides on it.
State privacy rights: depending on where you live, such as California, you may have rights to know, access, correct and delete personal information, and to opt out of its sale or use for targeted advertising. We don’t sell personal information or use it for targeted advertising. We’ll verify a request before acting on it, you may use an authorized agent, and we won’t treat you differently for using your rights.

To make a request, email info@aedlog.com.

Health information and children

AED Log is a program management tool, not a medical record system, and it isn’t designed to hold medical records or protected health information. The incident patient section is deliberately limited and restricted, as described above.

The Service is meant for organizations and their adult staff and volunteers, and it isn’t directed to children under 13. We don’t knowingly collect personal information from children. An incident report may note that a patient was under 18 as an age range, without identifying the child. If you believe a child has given us personal information, contact us and we’ll delete it.

Links to other websites

Our website and the Service link to other websites, such as state legislature sites and our integration partners. We aren’t responsible for their content or privacy practices, so please read their policies.

Changes to this policy

We may update this policy as the Service changes. We’ll change the date at the top of this page, and for significant changes we’ll notify Account Owners by email or in the Service before they take effect.

Contact us about privacy

Questions or requests about privacy are welcome:

AED Log
6351 W Montrose Ave, Suite #204
Chicago, Illinois 60634

Email: info@aedlog.com
Phone: (855) 248-2464

AED Log Privacy Policy