Privacy policy

Privacy Policy

AED Team
Effective 27 September 2026

Who we are and what this covers

AED Team supplies and services automated external defibrillators, and runs the AED Registry — the portal where you manage your AED programme, record inspections, and reorder parts.

This policy explains what we hold about you and the people who run your programme, why we hold it, who else sees it, and how long we keep it. It covers the Registry, the inspections your people carry out through it, and the records we keep to supply and service your equipment.

Our customers are organisations. Most of the personal information we hold is about the people who work for them.

What we hold, and why

Your people. Names, email addresses and phone numbers for the people who run your AED programme, inspect your devices, or are listed as responsible for a unit. We need these to give them access to the Registry, to tell them when something needs doing, and to record who did what.

Where your AEDs are. Addresses, buildings, floors, rooms, and a description of where each unit sits — along with map coordinates. This is how a responder finds a defibrillator in an emergency, and it is the heart of what the service does. We treat it as confidential information about your premises. Cabinet access codes, where you record them, are stored with the same care.

Inspection records. Who inspected which device, when, their answers to each check, and any notes they wrote. Where the phone offers it, we record the location of the inspection and how accurate that location reading was.

Photographs and recordings taken during inspections. When an inspector uses the camera to check a status light or read an expiry date, we keep what the camera saw:

• a still image of the device's status indicator;
• a recording of the attempt, kept only when the app could not confirm the indicator by itself — so that a judgement made by a person can be checked later rather than taken on trust;
• for each, the time the phone reported, the time we received it, the location and its accuracy, who was signed in, the browser and device used, the network address it arrived from, and a fingerprint of the file that lets us show the image has not been altered since.

These images are taken inside your premises. The camera is pointed at a device on a wall, but we recognise that a workplace may appear in frame.

Commercial records. Orders, estimates, invoices, shipment and serial-number records, and payment references.

Sign-in information. Email address, a hashed password where one is used, and the time of the last sign-in.

Cookies and similar technology

We set a cookie to keep you signed in, and store a short-lived access token in your browser. That is all. We do not use advertising cookies, and we do not run third-party analytics or tracking on the Registry.

Who else sees it

We use other companies to run the service. They act on our instructions and may only use your data to provide their part of it. We do not sell personal information, and we do not share it for advertising.

• DigitalOcean hosts the service and its database.
• Cloudflare carries traffic between your browser and us.
• Anthropic reads text from photographs of pad and battery labels, when an inspector chooses to use the camera for that. Only the label photograph is sent, with no account or personal details attached. Indicator stills and attempt recordings are never sent. Under our agreement this content is not used to train Anthropic's models.
• Stripe processes payments.
• Amazon Web Services sends our email.
• Intuit (QuickBooks) and Shopify synchronise commercial records where you use those integrations.
• Google authenticates AED Team staff signing in to our internal systems.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

PulsePoint is different, and it is your choice. If you turn it on for a device, that device's location is published to the emergency responders using PulsePoint — that is the point of it. It is off unless you switch it on, and you can switch it off for any device at any time.

Where your data is held

The service runs on servers in the United States. If you are outside the United States, using the Registry means your information is transferred there.

Using inspection photographs to improve the service

We use the photographs and recordings described above to improve how reliably the app recognises a device's status indicator — replaying them so that detection works across the range of lighting, cabinets and mounting positions that exist in the real world.

When we do this:

• Captures are reviewed by our own staff.
• They are used across customers, not only within your own account. This is deliberate, and you should understand what it means: a photograph taken at your site may inform how the app reads an indicator at somebody else's. It is what makes the improvement general — the app has to work in a dim stairwell and a sunlit lobby, and no single customer's sites cover that range.
• What we take from them is how a device's indicator looks under different conditions, not who or where you are. We do not use captures to identify anybody, and we do not sell them or share them for advertising.
• A capture is a photograph of equipment, taken by your own inspector, framed on the device. It is not a photograph of a person. Where somebody is incidentally in frame, that image is not used for improvement work.
• Captures stay within AED Team. We do not send them to any third party to train a general-purpose model.

If you would rather your captures were not used this way, tell us and we will exclude your account. Excluding your account does not affect your service in any way.

How long we keep it

Where a law requires us to keep something longer, we keep it for that long and no longer.

Your choices and your rights

You can see and correct the information in your account at any time through the Registry.

Ask us and we will:

• give you a copy of the records we hold for your programme;
• correct anything that is wrong;
• delete what we are not required by law or contract to keep;
• stop using your inspection captures to improve detection;
• tell you who we have shared your information with.

Write to the address at the end of this policy. We will respond within 30 days. If your request is complicated we may take longer, and we will tell you why before the 30 days are up.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act. We extend the rights listed above to everybody whose information we hold, wherever they are, rather than only where a law compels us to.

Health information

The Registry records the condition of equipment, not the condition of patients. We do not collect information about anybody who has been treated with a defibrillator, and the service has no feature for reporting or storing clinical data from a device.

If that changes, we will say so here before it does, and we will address what obligations come with it at that time.

Children

The Registry is a tool for the staff who run an AED programme. It is not directed at children and we do not knowingly collect information from them. Where a device is installed in a school, the records we hold concern the equipment and the staff responsible for it.

Security

Traffic between your browser and the service is encrypted. The storage underlying our servers is encrypted at rest by our hosting provider. Passwords are stored hashed, never in a form we can read. Access is limited by role: a customer sees only their own programme, and an inspector only the devices assigned to them. Photographs are addressed by a cryptographic fingerprint of their contents, which means an altered image cannot pass as the original.

No service is perfectly secure. If a breach affects your information, we will tell you without undue delay, and in any event within 72 hours of confirming it, along with what we know and what we are doing about it.

Changes to this policy

We will tell you before this policy changes in a way that affects what we collect, how we use it, or who sees it. The effective date at the top always reflects the current version.

Contact us

Questions about this policy, or a request about your information:

Shok Enterprises, LLC DBA AED TEAM
2115 Colonial Avenue
Roanoke VA 24015
844-233-1600
info@aedteam.com