United States · Canada · United Arab Emirates · Singapore
International Privacy Policy
Last updated: 20 October 2026 · Lire en français
Part A of this policy applies to everyone in the United States, Canada, the United Arab Emirates and Singapore. Part B adds the rights and details that apply in your country:
Part A — How we handle your information
1. Who we are
MySafeCard is owned and operated by Artha Tech Solutions, a sole proprietorship based in Hyderabad, Telangana, India ("we", "us", "our"). We decide how and why your personal information is processed. Depending on where you live, this makes us the "controller", "business" or "organisation" responsible for it.
Privacy contact (this also covers the Data Protection Officer role in Singapore and the person in charge of the protection of personal information in Quebec): the Owner, Artha Tech Solutions — support@mysafecard.in (subject line "Privacy").
2. What we collect
| Information | Where it comes from | Why we use it |
|---|---|---|
| Account details: email address, display name (if you use Google Sign-In), the country you select | You; Google if you use Google Sign-In | Create and secure your account, sign you in, apply the right terms and privacy rights for your country, and contact you about your account |
| Card details: name, photo, date of birth, gender, nationality, address, phone number | You, or whoever creates the card for you | Show your emergency card to the people who open it. People who open the card see only the age worked out from the date of birth, never the date itself. |
| Pet card details: the pet's name, photo, species, breed, sex, age or birth date, colour, weight, whether neutered, microchip number, temperament, diet, allergies, conditions, medication, vaccinations and vaccination records, vet's name, clinic and phone, the owner contacts, and the Lost mode switch and message | You | Show the pet's card to whoever finds the pet, so they can call you. See Section 5. |
| Health information: blood group, allergies, medical conditions, blood pressure and blood sugar status and readings, medications, insurance details and any insurance documents you upload | You, or whoever creates the card for you | Show your emergency card to the people who open it. See Section 4. |
| Emergency contacts: name, phone number, relationship, and whether they approved being listed | You; the contact's own response | Show responders whom to call, and let a contact confirm they agree to be listed |
| Cardholder email (optional): an email address stored on a card you create for someone else | You | Kept for your reference only. It is never shown on the card. |
| Scan details: when someone opens a card, the time, the type of phone (make, model and operating system, as their browser reports it), the approximate area worked out from their network address, and, if they allow it, their device's location | The device of the person who opens the card | Tell the card's owner that their card was opened, on what kind of phone and roughly where, for example in an emergency or if the card or pet was lost. See Section 7. |
| "I'm helping" details: the name, and optionally the phone number and a short note, that a person who opens a card chooses to leave for the card's owner | The person who opens the card | Pass them to the card's owner, so the family knows who is helping and how to reach them. See Section 7. |
| Support messages and any images you attach | You | Answer your questions and keep a record of the help we gave |
| Device and usage data: push notification token, device platform, screens viewed, key actions in the app, crash reports and app performance data | Your device | Send notifications, keep the Service working, fix problems and improve it. This never includes health information, names or phone numbers. |
| Consent record: the date, time and version of the terms you accepted, the country you selected, your sign-in method and your device platform | You | Prove what you agreed to and when |
We do not collect your contacts list, calendar, browsing history or advertising identifiers. We never collect your own location when you use the app for your own account. Payments: when you pay to activate a card, Razorpay collects your payment details directly. We receive only the order and payment IDs, the amount, the currency and whether the payment succeeded, and we use them to activate the card, keep accounting records and help with payment questions. We never see or store your card or bank details.
3. Our legal reasons for using your information
Where the law of your country requires a legal basis, we rely on:
- Your consent, for your health information, for making your card viewable by anyone with its link, for scan location, for the details you leave with "I'm helping" and for newsletters. You can withdraw consent at any time (see Section 10). Doing so does not affect anything we did before you withdrew it.
- Providing the Service you asked for, for your account, cards, emergency contacts and support.
- Legitimate interests, for keeping the Service secure, preventing misuse, fixing problems and understanding how it is used, and for telling a card's owner the type of phone and approximate area when their card is opened, in ways that do not override your rights.
- Legal obligations, for keeping records the law requires and responding to lawful requests.
4. Your health information
Health information is sensitive, and we treat it that way. We use it only to display your emergency card, to help you when you contact support, and to keep the Service working (see Section 6).
We never sell your health information. We never use it for advertising, profiling, research or training artificial-intelligence models, and we never give it to any third party for that party's own purposes.
Before you save a card, we ask for your explicit consent to store this information and to make it viewable by anyone who has the card's link or QR code. If you do not consent, do not add health information to your card. You can remove it at any time, or ask us to delete the card.
5. Who can see your information
- Anyone with your card's link or QR code can see what you put on that card. On the Free plan they see the main details (such as name, photo, age, blood group, allergies, conditions, address and one emergency contact); with Plus they see everything you added and up to five contacts. Whatever the plan, we keep everything you entered, and you can always see and edit all of it. Emergency contacts on a person's card are shown only once they have approved being listed. Insurance documents, the cardholder email, the date of birth (only the age is shown) and scan details are never shown to people who open the card.
- Pet cards. A pet's owner contacts do not have to approve being listed: their names and phone numbers are shown to anyone who opens the pet's card, so that whoever finds the pet can call. Only list people who have agreed to that. When you switch on Lost mode, the card also shows that the pet is lost, with any message you write.
- Your emergency contacts see your name and their own details in the approval request.
- Our service providers process information only on our instructions and only to run the Service:
- Google (Firebase database, sign-in, file storage, server code, hosting, push notifications, analytics, crash reporting and performance monitoring);
- Amazon Web Services (Simple Email Service), which receives only your email address, your name and the email content. It never receives health information.
- Razorpay (Razorpay Software Private Limited, India), which processes payments for Plus. It receives the payment details you enter, the amount, and your email address. It never receives health information.
- MySafeCard's administrator. The owner of MySafeCard, currently the only administrator, can access account, card and support information through an internal admin panel. This is used only to support you, keep the Service secure and working, and meet legal obligations. Anyone we give this access to in future will be bound by confidentiality and the same limits.
- Legal requirements. We may disclose information where the law requires it, for example in response to a valid court order. Where the law allows, we will tell you first.
- Business transfer. If the Service is sold or transferred, your information may pass to the new owner. The new owner must keep protecting it as this policy describes, and we will tell you beforehand.
We do not sell your personal information, we do not share it for targeted or cross-context behavioural advertising, and we do not use it to make decisions about you that have legal or similarly significant effects without a human being involved.
For contacts outside India, the app gives you the approval link to send from your own phone. The messaging app or carrier you use to send it processes that message under its own privacy policy. Before the link is created, you accept responsibility for sending it only to that contact (see Terms, Section 10), and we store that acceptance, with its date and wording version, on the approval request.
6. Where your information is stored, and international transfers
Our database and file storage are hosted by Google Cloud in Delhi, India. Some server code runs in Google data centres in the United States. Emails are sent through Amazon Web Services data centres. Our administrator works from India. This means your information is transferred to and processed in countries outside the one you live in, and their data protection laws may differ from yours.
We protect those transfers with our providers' data processing terms, which require them to keep your information secure and use it only on our instructions. We apply the protections in this policy to your information wherever it is processed. Part B explains anything extra that applies in your country.
7. When someone opens a card: scan details and "I'm helping"
This section is about the person who opens someone else's card (the "scanner"). We never know who the scanner is: they don't need an account, and we don't ask for their name unless they choose to leave it.
- Scan alert. When a card is opened, its owner is told the time, and the type of phone it was opened on (for example "Samsung SM-A515F · Android 14 · Chrome"), as reported by the scanner's browser. On an iPhone this is usually just "iPhone".
- Approximate area. If the card's plan includes location alerts (Plus) and its owner has them on, we also work out the rough area (city, region, country and mobile or internet provider, for example "Near Austin, Texas · AT&T") from the scanner's network (IP) address, using MaxMind's GeoLite2 databases on our own servers. The IP address is held only until that lookup is done, then deleted. It is never stored with the alert or the card, and never used for anything else.
- Device location. On the same condition, the scanner's browser or phone may also ask them to share their location. This is optional, and the card is shown in full whether or not they agree. If they do, we store the latitude, longitude and time of that scan, so the card's owner can see where it was scanned. Each new scan replaces the previous one, and the most recent 20 are also attached to the notifications sent to the owner. On the Free plan, the scanner is not asked.
- "I'm helping". The card page offers the scanner a short form ("Helping this person?" or, on a pet's card, "Found this pet?"). If they fill it in, the name, phone number and note they give are sent to the card's owner as an alert. Leaving these details is entirely optional. To stop misuse, we limit how often the form can be sent from one network, using a one-way scrambled (hashed) form of the network address that can't be turned back into it.
The card page tells scanners that the owner is told when it's opened. Only the card's owner (and our administrator, see Section 5) can see scan details and "I'm helping" messages. They are never shown to other scanners and never used for analytics or advertising.
8. Cookies and similar technologies
Our website and web app use your browser's local storage to keep you signed in and to remember preferences. They also use Google Analytics for Firebase, which sets first-party cookies to count visits and measure how the Service is used. We do not use advertising cookies, and we do not allow advertising networks to track you on our site. You can block or delete cookies in your browser settings. The Service will still work, but you may need to sign in again.
9. How long we keep your information
- Cards are kept while your account is active. Cards are deleted by our team, at your request (Delete on the card in the app, or by email), so that a card is never deleted by mistake. We'll email you once it's done. When a card is deleted, its personal and health information is erased immediately. We keep only a blank record holding its ID, status, deletion date and your user ID, so that an old QR code or NFC tag shows "card not found" instead of an error.
- Your account. When you delete your account, we delete all your cards, photos, profile, push tokens, insurance documents and approval records.
- Approval requests expire after 24 hours. Sign-in codes expire after 10 minutes and are deleted once used.
- Scan details and "I'm helping" messages are kept with the card owner's alerts, and deleted with the card or the account. A scanner's IP address is deleted as soon as the area has been looked up. The records used to limit the "I'm helping" form hold only a scrambled (hashed) form of the network address, a count and a time; they can't be turned back into the address.
- Support messages are kept as a record of the help we gave. Attached images are deleted with your account. You can ask us to delete the messages.
- Payment records (order and payment IDs, amount, currency, date, the card paid for) are kept for 7 years after the payment, as tax and accounting law requires, even if you delete the card or your account.
- Consent records are kept for the life of your account and for 7 years afterwards, so that we can show what was agreed if there is a legal dispute. They contain no health information.
- Backups. We occasionally take a backup copy of the database for maintenance. Deleted information may remain in such a copy until that copy is deleted, which we do within 30 days. Backups are kept securely and never used for any other purpose.
10. Your choices and rights
Wherever you live, you can:
- see and correct any card directly in the app, and ask us to delete a card (Delete on the card);
- ask for a copy of your information, ask us to correct it or ask us to delete it;
- withdraw your consent, for example by removing health information, asking us to delete a card, turning off scan or location alerts on a card, turning off newsletters in Account Settings, or declining the location prompt; and
- delete your account at any time with Delete My Account on the app's Account tab (it opens our account deletion page), or by emailing support@mysafecard.in from your registered email address with the subject line "Account Deletion Request".
To make any request, email support@mysafecard.in. We will check that the request really comes from you, usually by replying to your registered email address. We will respond within the time your local law requires (see Part B), and always within 30 days unless we tell you we need longer and why. Exercising your rights is free, and we will never treat you differently for doing so. Part B lists the additional rights in your country and the regulator you can complain to.
11. Children
You must be at least 13 to create an account, and anyone under 18 (or under the age of majority where they live) needs a parent's or guardian's consent. A parent or guardian may create a card for a child. In that case the parent or guardian provides, and is responsible for, the child's information and can exercise the child's rights. If you believe a child under 13 has given us information without a parent's consent, contact us and we will delete it.
12. Security and data breaches
Information is encrypted in transit (TLS) and encrypted at rest by Google. Security rules stop users from reading or changing anyone else's private data. Our providers hold recognised security certifications such as ISO 27001 and SOC 2. MySafeCard is not end-to-end encrypted: our systems can read the data in order to show your card to responders and to support you.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant regulators as the law of your country requires.
13. Emails
We send emails needed to run your account, such as sign-in codes, welcome messages, reminders, security notices and notices of material changes to our terms or this policy. Newsletters and promotional emails are sent to users in these countries only with your consent, and every one includes an unsubscribe link. Our email provider, Amazon SES, receives only your email address, your name and the email content.
14. Changes to this policy
We will tell you about material changes by email and in the app before they take effect. The date at the top shows when this policy was last updated. Where your law requires fresh consent for a change, we will ask for it.
Part B — Country-specific information
United States
Consumer health data (Washington, Nevada, Connecticut and similar laws)
Most of what you put on a card is "consumer health data" under laws such as Washington's My Health My Data Act and Nevada's SB 370. Our separate Consumer Health Data Privacy Policy explains what we collect, why, whom we share it with and how to use your rights under those laws. We ask for separate consent to collect this data and to share it by making your card viewable through its link.
State privacy rights (California and other states)
Depending on your state, including California, Colorado, Connecticut, Virginia, Oregon, Texas and others, you may have the right to:
- know what personal information we have collected about you, and get a copy of it in a portable format;
- correct inaccurate personal information;
- delete personal information;
- opt out of the "sale" or "sharing" of personal information, targeted advertising and profiling. We do not do any of these. We also treat a Global Privacy Control signal from your browser as a valid opt-out request;
- limit the use of sensitive personal information. We use sensitive personal information only to provide the Service you asked for, which these laws permit; and
- not be discriminated against for using these rights.
In the last 12 months we have collected these categories of personal information, all for the purposes in Section 2: identifiers (name, email, phone); personal characteristics (age, gender, nationality); sensitive personal information (health information and, for people scanning a card, precise location); internet and app activity (usage analytics, and for people opening a card, the type of phone and the approximate area from their network address); and the contents of support messages and "I'm helping" messages. We disclosed them for business purposes only to the service providers in Section 5. We have not sold or shared any of them for advertising.
You or an authorised agent can make a request by emailing support@mysafecard.in. We will confirm we have received it within 10 business days and respond within 45 days. If needed, we may extend this by a further 45 days and will tell you if we do. If we deny your request, you can appeal by replying with the subject line "Appeal". We will answer within the time your state's law requires. If you are not satisfied, you can contact your state Attorney General.
Health breach notification
MySafeCard is not covered by HIPAA. If unsecured health information about you is accessed or disclosed without your authorisation, we will notify you and the U.S. Federal Trade Commission as required by the FTC's Health Breach Notification Rule, as well as anyone else state law requires.
Children
We do not knowingly collect personal information online from children under 13 except through a card created by their parent or guardian, as described in Section 11.
Canada
We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial laws such as Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta's PIPA and British Columbia's PIPA.
Person in charge of privacy
The Owner of Artha Tech Solutions is responsible for protecting your personal information and can be reached at support@mysafecard.in (subject line "Privacy").
Your rights
- Access your personal information and get a copy, and know how it has been used and to whom it has been disclosed.
- Have inaccurate information corrected.
- Withdraw consent, subject to legal or contractual limits. We will tell you what withdrawing will mean, for example that a card without its health information is less useful to responders.
- Quebec residents: receive your computerised information in a structured, commonly used technological format; ask us to stop disseminating your information or to de-index any link to it (deleting or editing your card does this); and be told about, and object to, any technology that identifies, locates or profiles you. The only such technology is the optional scan-location prompt in Section 7.
We will respond within 30 days.
Transfers outside your province and Canada
As explained in Section 6, your information is stored in India and partly processed in the United States. Before transferring it, we assessed that it would receive adequate protection, taking into account its sensitivity, the purpose, and our providers' contractual and security safeguards. Courts and authorities in those countries may be able to access it under their laws.
Breaches
If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada. If you live in Quebec, we will also notify the Commission d'accès à l'information, and we keep a register of incidents.
Commercial emails
In line with Canada's Anti-Spam Legislation, we send newsletters and promotional emails only with your consent, and every one identifies us and includes an unsubscribe link.
Complaints
Please contact us first. You can also complain to the Office of the Privacy Commissioner of Canada, or to your provincial regulator, such as Quebec's Commission d'accès à l'information, or the Information and Privacy Commissioner of Alberta or of British Columbia.
Language
This policy is available in French. Cette politique est offerte en français.
United Arab Emirates
We process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations. Health data may also be governed by Federal Law No. 2 of 2019 on the Use of Information and Communications Technology in Health Fields, and by its implementing resolutions, where they apply.
Consent
We process your health data, which is sensitive personal data, on the basis of your explicit consent, which you give when you save a card. You enter this information yourself, for your own use, to help you in an emergency. Before you save a card, we ask for your separate, explicit consent to store and process it outside the UAE, as described in Section 6. This is the consent permitted by Ministerial Resolution No. 51 of 2021 for health data covered by Federal Law No. 2 of 2019. You may withdraw consent at any time by removing the information or deleting the card.
Your rights
Under the PDPL you may ask us to:
- give you access to your personal data and information about how we process it;
- provide your data in a structured, machine-readable format, or transfer it to another controller where technically possible;
- correct inaccurate data, or complete incomplete data;
- erase your data;
- restrict processing while an objection or a correction is being considered; and
- stop processing your data, including for direct marketing, and not be subject to decisions based solely on automated processing. We do not make such decisions.
We will respond within the period set by the PDPL and its regulations, and always within 30 days.
Transfers outside the UAE
Your data is stored in India and partly processed in the United States (see Section 6). These transfers are made with your consent and under contractual safeguards with our providers that require them to protect your data.
Breaches
If a breach could affect the privacy, confidentiality or security of your data, we will notify the UAE Data Office and you, as the PDPL requires.
Complaints
Please contact us first. You may also complain to the UAE Data Office. If you live in or deal with us through the Dubai International Financial Centre or Abu Dhabi Global Market, their own data protection laws may give you additional rights. Contact us and we will help.
Singapore
We handle personal data in line with the Personal Data Protection Act 2012 (the "PDPA").
Data Protection Officer
Our Data Protection Officer can be reached at support@mysafecard.in (subject line "DPO").
Consent and withdrawal
We collect, use and disclose your personal data only for the purposes in this policy, which we tell you about when you sign up and when you save a card. You may withdraw consent at any time by giving us reasonable notice. We will tell you what withdrawing will mean. For example, if you withdraw consent for us to hold your card's information, we will no longer be able to show your card. We will then stop processing the data, and ask our service providers to stop, unless the law permits us to continue.
Access and correction
You may ask for the personal data we hold about you and how it has been used or disclosed in the past year, and ask us to correct any error. We will respond within 30 days. If we cannot, we will tell you within that time when we will be able to.
Transfers outside Singapore
Your data is stored in India and partly processed in the United States (see Section 6). We make sure it receives protection comparable to the PDPA through legally binding data processing terms with our providers.
Breaches
If a data breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission within 3 calendar days of assessing it as notifiable. Where the PDPA requires, we will also notify you.
Marketing
We send promotional emails only with your consent. We do not make marketing calls, or send marketing SMS or fax messages, to Singapore telephone numbers.
Complaints
Please contact our Data Protection Officer first. You may also contact the Personal Data Protection Commission.
Contact us
Email: support@mysafecard.in
Website: mysafecard.in/contact
Artha Tech Solutions, Hyderabad, Telangana, India