LEAD2

Legal

Last updated 24 August 2026

What we collect, where it goes, how long we keep it, and what you can ask us to do with it.

Who we are

Lead2 is operated by Alpha2Echo Software Inc. (“we”, “us”), a corporation registered in [PROVINCE — TO CONFIRM], Canada. Our registered address is [ADDRESS — TO CONFIRM].

We are responsible for the personal information described here. This policy is written to meet Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). For questions, corrections, or complaints, contact help.medicplusplus@gmail.com.

You can use much of this site without an account

The ECG reference tools and the calculation drills need no account and collect no personal information. Your calculation practice history is stored in your own browser’s local storage and is never transmitted to us — it stays on that device, and clearing your browser data deletes it. We cannot see it, restore it, or connect it to you.

What we collect when you do have an account

  • Account information. You sign in with Google. We receive and store a user identifier, your email address, and your display name from that sign-in. We never receive your Google password.
  • Scenario session records. For every scenario you run we store the full transcript — every message you type or speak, and every response generated — along with timestamps, the actions you took, elapsed scenario time, and the resulting evaluation, scores, written feedback, and the reference material the evaluator used.
  • Billing information. If you subscribe, we store a Stripe customer identifier, a subscription identifier, your subscription status, which plan you are on, and when the current period ends. We never receive, see, or store your card number. Card details go directly to Stripe.
  • Technical and error data. Our servers log requests (the route, response status, and timing). If something breaks in your browser we may receive an error report containing the error message, a stack trace, the page address, and your browser’s user-agent string, tagged with your account identifier where we have one.

Why we collect it

  • To provide the service — running scenarios and producing evaluations.
  • To show you your own history and progress over time, which is a feature of the product rather than a by-product of it.
  • To take payment and manage your subscription.
  • To keep the service working and secure — diagnosing failures, preventing abuse, and limiting automated misuse.
  • To improve the product, including reviewing sessions to find where scenarios or the evaluator behave incorrectly. See the next section.

We do not sell personal information. We do not use it for advertising, and we do not share it with advertisers or data brokers.

Your sessions can be reviewed by our staff

Administrators of this service can read any user’s scenario transcripts and evaluations, not only their own. We use this to check that scenarios and grading are clinically and technically sound.

We think you should know this plainly rather than find it in a subclause. Session transcripts are the record of a training exercise, and reviewing them is how we catch a scenario that teaches the wrong thing or an evaluator that scores unfairly. Access is limited to administrators of Alpha2Echo Software Inc. Your transcripts are not visible to other users.

The one exception you will see in the product is an “exemplar” session — a curated model answer, generated by us and clearly labelled as a study reference, which is deliberately shown to every user. Exemplars are ours, not another trainee’s work, and no real user’s session is ever shown to another user.

Where your data goes, and out of Canada

We use the following service providers. Your information is processed on their systems, which are located outside Canada, and is therefore subject to the laws of the countries where they operate, including lawful access by courts and government authorities there.

  • Google (Firebase, Google Cloud) — authentication, database storage, hosting, logging, and the text-embedding model used to retrieve reference material. Also reCAPTCHA, which Google uses to distinguish real users from automated abuse. Primarily United States.
  • DeepSeek — the language model that generates scenario characters’ responses and produces evaluations. Your scenario messages and transcripts are sent to DeepSeek to do this. DeepSeek is based in the People’s Republic of China, and this processing takes place under Chinese jurisdiction.
  • Stripe — payment processing and subscription management. Stripe collects your payment details directly under its own privacy policy. Primarily United States and Ireland.
Please do not enter real patient information, real identifiable details about any third party, or anything confidential into a scenario. Scenarios are fictional and nothing you type into one needs to be real.

Voice mode

If you use voice mode, speech recognition and speech synthesis are performed by your own web browser, not by us. We never receive, record, or store audio — only the text your browser transcribes, which is then treated exactly like a typed message.

Be aware that some browsers, including Google Chrome, perform speech recognition by sending the audio to the browser vendor’s own servers. That is a transfer between you and your browser vendor, governed by their privacy policy, and it is outside our control and our visibility. If that matters to you, type instead of speaking.

How long we keep it

  • Session records are kept until you delete them or your account is closed. You can delete any of your own sessions from your progress page at any time; deleting a session removes its transcript.
  • Account information is kept while your account is open.
  • Billing records are kept as long as required by Canadian tax and financial record-keeping law, which is generally six years, even after you cancel.
  • Technical logs are kept on a short rolling basis for diagnostics.

Your rights

Under PIPEDA you may:

  • ask what personal information we hold about you and get a copy of it;
  • ask us to correct it if it is wrong;
  • withdraw your consent and ask us to delete your account and its data, subject to the billing-record retention above;
  • complain to us, and if we do not resolve it to your satisfaction, to the Office of the Privacy Commissioner of Canada.

Write to help.medicplusplus@gmail.com and we will respond within 30 days.

Security, and its limits

Access to the service requires authentication; our database is not directly reachable from a browser and is only ever accessed by our server; and all traffic is encrypted in transit. No online service can promise perfect security, and we do not.

Children

This service is for adults. You must be 18 or older to hold an account. We do not knowingly collect personal information from anyone under 18; if you believe a minor has created an account, tell us and we will remove it.

Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your information — a new processor, a new purpose — we will tell account holders directly rather than relying on you to re-read this page.