Security & privacy
Your health data belongs to you. We just keep it — and protect it.
Health data is sensitive personal data under the LGPD, Brazil's General Data Protection Law (Law 13,709/2018). That's why SOS Card was built with the LGPD in mind: you decide what shows and to whom, and you can delete your account whenever you want.
AES-256-GCMhealth record, ID numbers and contacts encrypted, with the key kept outside the database
2 access layersemergency info for everyone; the full record for someone who identifies as a health professional
You get notifiedon the Complete and Family plans, every time your QR is scanned and every time the full record is opened
We never sellnor use your health data for advertising
Who sees what
Each person sees only what they need to see.
The record has layers. You choose, item by item, what stays open in an emergency and what only a health professional can see.
Whoever scans the QR (anyone)
Health professional
People you authorize
For people who use SOS Card, the team dashboard doesn't show the health record (allergies, medications, illnesses, test results), whether a profile belongs to an autistic person (ASD), the profiles' names, phone number, CPF, address, QR code scans or location. Scans are released only under a court order, by the company's owner account, through a separate logged process. It shows only: for each account, the holder's name, the email, its status, plans and creation date; how many profiles the account has, people or pets, with each one's SOS Card number; the devices (code, type and status); on orders, the buyer's name; in the audit log, what the account did in the app, only in general terms (such as “Login” or “Edited personal details”) and without name, email or IP address; and in the Support area, messages sent through the contact form: name, email, subject and what the person wrote (that's why we ask people not to write health information).
Business and institutional clients (hotels, events, employers) have no access to the system and never receive anyone's record.
How we protect it
Real security, in several layers.
Encrypted health data
Protected login
Against abuse and bots
Everything logged
Lost it? Disable it
Connection and servers
What if something goes wrong? No system is 100% immune. If an incident with relevant risk happens, we notify the ANPD (Brazil's National Data Protection Authority) and the affected people within 3 business days, as required by ANPD Resolution No. 15/2024. Found a vulnerability? See how to report it (in Portuguese).
LGPD, art. 6
The 10 principles of the LGPD — and how each one shows up in SOS Card.
- 01PurposeYour health data serves one purpose: helping in an emergency. We don't use it for advertising and we don't sell it.
- 02AdequacyEvery piece of data we ask for has to do with emergencies: allergies, medications, contacts. No pointless questions.
- 03NecessityYou fill in only what you want. “No” and “I don't know” ask for nothing else — and “I don't know” never goes on the card.
- 04Free accessYour account and record data are in the app, and you can download a copy anytime.
- 05Data qualityYou correct your record instantly in the app — and the QR record changes at the same moment.
- 06TransparencyYou see who scanned your QR, when and from where, and who opened the full record.
- 07SecurityHealth record, ID numbers and contacts encrypted, key outside the database, two-step verification and real-time alerts.
- 08PreventionBlocking of bulk attempts, leaked-password checks, and a QR you can disable at once if it's lost.
- 09Non-discriminationWe never hand health data to health plans, insurers or employers to screen people.
- 10AccountabilityEvery access is logged. We have a data protection officer, a versioned policy and an incident response plan.
Legal bases
Why we're allowed to process each piece of data.
The LGPD only allows data processing under a legal basis. For health data, the rules are even stricter (art. 11).
Showing your record in an emergency
Your specific, highlighted consent (art. 11, I) and the protection of life (art. 11, II, “e”).
Keeping your account, cards and payments
Performance of a contract (art. 7, V).
Keeping access logs
Legal obligation under Brazil's Internet Civil Framework (Marco Civil da Internet, art. 15) — LGPD art. 7, II.
Security and fraud prevention
LGPD art. 11, II, “g” — for example, stopping anyone who tries to open records in bulk.
Notifications, medication reminders and the emergency button
Your consent, when you turn each feature on in the app (art. 7, I, and art. 11, I) and, when you press the button, the protection of life (art. 11, II, “e”).
Partner offers
We don't send any today. If we ever do, only with your optional consent, asked for first. Never based on health data.
What we never do
- • Sell data or share health data for economic advantage (art. 11, §4).
- • Hand health data to health plan operators, insurers or employers to screen risks or exclude people (art. 11, §5).
- • Advertise based on your health data, or advertise to and profile children and teenagers.
LGPD, art. 18
Your rights, one tap away in the app.
You can handle most requests yourself, without writing to anyone.
You can also find out who we share data with and request anonymization, blocking or deletion of unnecessary data. Requests to the data protection officer are answered within 15 days.
Children and teenagers. Only adults (18+) can create an account. A child's profile is created by their legal guardian, with the specific consent required by the LGPD (art. 14) and Brazil's Digital Statute of Children and Adolescents (Law 15,211/2025) — and used only in the child's best interest.
Cookies. Only the ones the service needs to work (for example, keeping you logged in) and one that remembers your language. No advertising or tracking cookies. The full list is in the privacy policy (in Portuguese).
Retention
How long we keep data — and when we delete it.
We keep nothing longer than necessary (LGPD, arts. 15 and 16). The periods below are applied automatically by the system.
Account and health record
For as long as the account exists. Deleted your account? The record is erased and the QR codes stop working.
Scans of your QR
12 months (Brazil's Internet Civil Framework requires at least 6).
Exact location of a scan
90 days — and only if the person who scanned allows it in the browser.
Login records
12 months.
Email and WhatsApp messages
30 days.
Location of an emergency button alert
90 days.
Contact form messages
30 days after the reply (with no reply, at most 180 days).
Security events and administrative actions
5 years (accountability and incidents).
Temporary SOS Card
The record is erased automatically at the end of the period (8 hours to 15 days) and the account is anonymized.
Service providers and international transfer
Who helps us run the service — each one only for its own task.
Some providers process data outside Brazil, in the countries shown below.
Vercel (USA)Website hosting, with servers in São Paulo. Processes IP addresses and technical logs.
Supabase (USA)Database, with servers in the São Paulo region. Health data arrives already encrypted.
Resend (USA)Email delivery: password recovery, QR scan alerts, alerts to trusted responders and customer service replies — no medical data.
Browser notification services (Google, Apple, Mozilla and Microsoft; USA)They deliver notifications to the phones of people who turned them on. They receive the device's subscription address and the encrypted message, which they can't read.
Cloudflare (USA)Bot checks at sign-up (including trusted responders), password recovery, the contact form, the virtual assistant and on suspicious access.
Anthropic (USA)The virtual assistant, which only gives directions. It receives the chat text, never your account data or your IP address. SOS Card doesn't store the conversation; Anthropic may keep it for a limited time, under its rules for business customers.
Telegram (United Arab Emirates)Internal security alerts for our team — never health data.
The full list, with every detail, is in our privacy policy (in Portuguese).
Data protection officer (DPO)
Talk to the person in charge of your data.
Legal name: Fênix Digital cursos profissionalizantes e tecnicos on line
CNPJ: 31.747.716/0001-80
Data protection officer: samu.bhz@gmail.com
Questions, requests about your data or complaints: we answer within 15 days.