Privacy Policy

When you order a Scansecure Emergency Smart Card and create your profile, we collect the following categories of information:

• Identity information: Your full name, date of birth, photograph (optional), and government ID references (not stored).
• Contact information: Phone number, email address, residential or mailing address for card delivery.
• Medical information: Blood group, known allergies, current medications, pre-existing conditions, and any other health details you voluntarily enter into your profile.
• Emergency contacts: Names, phone numbers, and relationships of people you designate as emergency contacts.
• Insurance information: Policy numbers and insurer details if you choose to add them.
• Payment information: Processed securely by our payment partners. We do not store card numbers or bank details on our servers.
• Technical data: IP address, browser type, device identifiers, and QR scan timestamps for fraud prevention and analytics.

Scansecure uses the information you provide exclusively for the following purposes:

• To fulfil your card order and deliver it to your specified address.
• To create and maintain your safe emergency profile accessible via QR code scan.
• To send you order updates, profile change confirmations, and service notifications.
• To improve our products and services based on aggregated, anonymised usage analytics.
• To prevent fraud, abuse, and unauthorised access to profiles.
• To comply with applicable Indian laws and regulatory requirements.

We will never use your medical information for advertising, profiling, or sale to third parties.

Scansecure does not sell, rent, or trade your personal or medical information. Your data is shared only in the following strictly limited circumstances:

• Emergency responders / anyone scanning your QR: The profile page linked to your QR is intentionally readable by anyone who scans it — this is the core purpose of the product. You choose what information appears on this public-facing view.
• Card printing and logistics partners: Name and delivery address are shared only as necessary to produce and ship your card. These partners are bound by confidentiality agreements.
• Payment processors: Payment data is handled directly by PCI-DSS compliant gateways (e.g., Razorpay). Scansecure does not receive or store raw payment credentials.
• Legal obligations: We may disclose information if required by a court order, government authority, or applicable Indian law.

We implement industry-standard security practices to protect your information:

• All data is transmitted over HTTPS with TLS encryption.
• Profile editing requires authenticated login; only public viewing is available via QR scan.
• Passwords are hashed using bcrypt; we never store plaintext passwords.
• Our servers are hosted on reputable cloud infrastructure with regular security audits.
• QR codes use unique encrypted identifiers that cannot be reverse-engineered to reveal personal data without accessing our systems.

While we take all reasonable precautions, no system is completely immune to breaches. In the event of a data breach affecting your personal information, we will notify you within 72 hours as required by applicable law.

The emergency profile page accessible via your QR code is designed to be publicly readable without login — enabling first responders, bystanders, or medical personnel to access critical information instantly.

• You have full control over which fields appear on the public profile.
• You can enable or disable the public view from your dashboard at any time.
• Editing any information requires authenticated access to your account.
• We log QR scan events (timestamp, approximate location) for your security dashboard.

Under India's Digital Personal Data Protection Act (DPDPA) 2023 and applicable regulations, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate information at any time via your dashboard.
• Erasure: Request deletion of your account and all associated data.
• Portability: Receive your data in a machine-readable format.
• Withdraw Consent: Opt out of non-essential data processing at any time.
• Grievance Redressal: File a complaint with our Data Protection Officer.

To exercise any of these rights, email us at hello@scansecure.in with your registered email address.

We retain your personal data for as long as your Scansecure account is active. If you request deletion of your account:

• Your public QR profile is deactivated immediately.
• Personal and medical data is permanently deleted within 30 days.
• Order and payment records may be retained for up to 7 years for accounting and legal compliance purposes, in accordance with Indian tax laws.
• Anonymised analytics data (no personally identifiable information) may be retained indefinitely.

For any privacy-related questions, concerns, or requests, please contact our Data Protection Officer:

We may update this Privacy Policy periodically. Significant changes will be communicated via email or a notice on your dashboard. Continued use of Scansecure after any update constitutes acceptance of the revised policy.