Privacy Policy
Sultana EMR Trainer · emr.shscte.com
Sultana High School CTE Program · Hesperia, California
Effective Date: June 2025
This website (emr.shscte.com) is an instructional tool operated by a CTE instructor at Sultana High School in Hesperia, California, as part of the Hesperia Unified School District. It is used exclusively for EMT training coursework. It is not a commercial service, public forum, or general-access website. Access is limited to enrolled CTE students and their instructor.
What This Site Is — And Is Not
This site does not have a public comments section, public registration, a blog, or any publicly accessible content. It is a closed instructional platform. The following standard WordPress privacy items do not apply to this site:
Only students and teachers with accounts created by the instructor can access this site. There is no path for a member of the public to create an account or submit data.
Information We Collect
2.1 Student Account Information
Student accounts are created by the instructor. Students do not self-register. The following information is stored for each student account:
- Display name (first and last name or preferred name as provided by the instructor)
- Username (assigned by instructor)
- Email address (used for password reset only, if needed)
- WordPress role:
emr_student
Students do not directly submit personal information to create their accounts. The instructor creates all accounts.
2.2 EMR Form Submissions
When a student submits an EMR practice form, the following data is stored in the site database:
- All fields entered on the EMR form
- The student’s WordPress user ID (to link the submission to their account)
- The scenario ID the form was submitted against
- Date and time of submission
All information entered on EMR forms is fictional, instructor-created scenario data used for educational practice. This site does not collect, store, or transmit any real patient health information. It is not a covered entity under HIPAA.
2.3 Login Cookies
When a student or instructor logs in, WordPress sets standard session cookies to maintain the login. These cookies:
- Contain no personal data beyond an encrypted session identifier
- Last for two days by default, or two weeks if “Remember Me” is selected
- Are removed when the user logs out
A temporary cookie is also set when visiting the login page to check that your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
2.4 Server Logs
Like all web servers, Bluehost’s hosting infrastructure automatically records standard server access logs including IP addresses, browser type, pages visited, and access timestamps. These logs are used for security and server administration only and are not analyzed for user behavior or shared with any party.
Education Records & FERPA
This site is operated for instructional purposes within Hesperia Unified School District. Student submissions are education records as defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. Education records are accessible only to the student and their instructor. No student data is shared with third parties, sold, or used for any purpose outside of this instructional activity.
Under FERPA, eligible students (or parents/guardians of students under 18) have the right to:
- Inspect and review their education records
- Request amendment of records they believe are inaccurate
- Request deletion of their submissions by contacting their instructor
- File a complaint with the U.S. Department of Education if they believe their FERPA rights have been violated
Student Privacy & COPPA
This site serves high school students, some of whom may be under 13 years of age. In compliance with the Children’s Online Privacy Protection Act (COPPA):
- Students do not self-register on this site
- All student accounts are created directly by the instructor
- Students do not submit personal information to create accounts
- No behavioral advertising, tracking, or profiling of any student occurs on this site
- No student data is shared with any third-party commercial service
Additionally, this site complies with California’s Student Online Personal Information Protection Act (SOPIPA), which prohibits using student data for advertising, building profiles for non-educational purposes, or selling student information.
Who We Share Your Data With
We do not sell, rent, or share student data with any third party for commercial purposes. The only data sharing that occurs is:
- Bluehost (web hosting) — stores all site data on their servers as a necessary part of operating the website. Bluehost is the sole infrastructure sub-processor.
- Brevo (email delivery) — if a password reset is requested, the reset email is sent through Brevo SMTP. Only the recipient email address is transmitted. No other data is shared with Brevo.
No analytics services, advertising networks, social media platforms, or other third parties receive any data from this site.
How Long We Retain Your Data
| Data Type | Retention Period |
|---|---|
| Student account (username, email, name) | Retained for the duration of enrollment in the CTE course. Deleted at instructor’s discretion at end of semester or upon request. |
| EMR form submissions | Retained for the duration of the course. Instructor may delete at any time. Students may request deletion. |
| Login session cookies | 2 days (or 2 weeks if “Remember Me” is selected). Removed automatically on logout. |
| Server access logs | Managed by Bluehost per their data retention policies. Not directly controlled by this site. |
Your Rights Over Your Data
Students (and parents or guardians of students under 18) have the following rights:
- Request a copy of any personal data stored about the student on this site
- Request correction of inaccurate account information
- Request deletion of EMR form submissions
- Request deletion of the student’s account entirely
To exercise any of these rights, contact your instructor directly. Requests will be fulfilled within a reasonable time. Certain data may be retained for legal or administrative purposes even after a deletion request.
How We Protect Your Data
- All traffic is encrypted via HTTPS (SSL/TLS — Let’s Encrypt certificate)
- The WordPress login URL is obscured (not at the standard /wp-login.php path)
- A web application firewall (Wordfence) is active on the site
- Public self-registration is disabled — no one can create an account without the instructor
- Student accounts have restricted permissions and cannot access the WordPress admin area or other students’ data
- Regular site backups are maintained via UpdraftPlus
Contact
If you have questions about this privacy policy or how student data is handled on this site, contact:
CTE Instructor — Sultana High School
Hesperia Unified School District
15576 Main St, Hesperia, CA 92345
Website: https://emr.shscte.com