What we collect
Account data: name, email, and billing information (billing is handled by Stripe; we do not store full card numbers).
Profile data you enter: emergency contact, and any medical, insurance, and legal information you choose to add across the three levels.
Documents you upload to your Level 3 vault.
Scan events: when your code is scanned, including approximate location, time, and the access level viewed.
How we use it
To provide the service: display your chosen information when your code is scanned, notify you of scans, process your subscription, and support you. We use a CRM and an email provider to send account and service messages. We do not sell your personal information.
How your information is shared
Level 1 information you mark public is shown to anyone who scans your code. Level 2 information is shown to approved responders. Level 3 documents are released only by the method you configure. We share data with service providers (hosting, database, payments, email, CRM, sticker fulfillment) strictly to operate the service.
Security
Profile data is stored in an access-controlled database with row-level permissions enforcing the three levels. Level 3 documents are encrypted before storage in private storage and released only through an authenticated, logged process. We maintain an audit log of Level 2 and Level 3 access. No system is perfectly secure; you acknowledge the inherent risks of transmitting information online.
Your rights and international users
You may access, correct, or delete your information through your account or by contacting us at hello@healthqr.net. If you are in the EU/UK, you have rights under GDPR/UK GDPR; health information is treated as special-category data and processed on the basis of your explicit consent when you choose to add it. [Data-controller identity, retention periods, and international-transfer basis to be inserted per counsel.]
Children
Where a profile is created for a minor, it must be set up and managed by a parent or legal guardian, who is responsible for the information and consents to its processing.
Draft for counsel review.