MedID Privacy Policy

Last Updated: December 21, 2025

Table of Contents

  1. Introduction
  2. Information We Collect
  3. How We Use Your Information
  4. How We Store Your Information
  5. Information Sharing
  6. Your Privacy Rights
  7. Data Security
  8. Children's Privacy
  9. International Transfers
  10. Data Retention
  11. HIPAA Notice
  12. Policy Changes
  13. State-Specific Rights
  14. Do Not Track
  15. Contact Us
  16. Consent
IMPORTANT NOTICE: MedID handles sensitive medical and personal health information. This Privacy Policy explains how we collect, use, protect, and share your data. Please read this carefully before using the MedID application.

1. Introduction

Welcome to MedID ("we," "our," or "us"). MedID is a medical identification application that allows personal users (patients) to store their medical information and medical professionals to access this information in emergency situations.

This Privacy Policy describes:

2. Information We Collect

2.1 Account Information

When you create a MedID account, we collect:

2.2 Personal Profile Information (Personal Users)

Personal users may provide the following information in their medical profile:

Category Data Fields
Basic Identity First name, middle name, last name, birthdate, gender, preferred language
Contact Information Phone number with country code
Physical Characteristics Height, weight, hair color, eye color, profile photo
Address Street address (2 lines), city, state/province, zip/postal code (currently US addresses only)
Medical Information Blood type, organ donor status, medical conditions (selected from 342 conditions), medications (stored per condition), medical notes
Timestamps Profile last updated date (automatically recorded when you save changes)
Emergency Contacts Primary and secondary emergency contact names and phone numbers

2.3 Medical Conditions

We provide a database of 342 medical conditions that users can select from, including but not limited to:

2.4 Scanning and Access Information (Medical Professionals)

When medical professionals scan a patient's QR code or NFC tag, the following information is collected:

Server-Side Audit Logging (HIPAA Compliance):

These audit logs are stored server-side in an immutable format with cryptographic hash chain integrity to prevent tampering. Audit logs are retained for a minimum of six (6) years as required by HIPAA regulations.

Local Device Storage:

Local scan records are isolated per medical professional account using encrypted secure storage.

2.5 Device and Usage Information

2.6 Security and Fraud Prevention Logs

To protect against abuse and ensure HIPAA compliance, we log certain security events to our cloud database:

This data is used solely for security, fraud prevention, and HIPAA compliance. It is not used for analytics, advertising, or tracking.

3. How We Use Your Information

3.1 Primary Purposes

3.2 Medical Professional Access

Medical professional account holders can:

IMPORTANT: By using MedID as a personal user, you consent to medical professionals being able to access your complete medical profile when they scan your QR code or NFC tag. This access is intentional and designed for emergency medical situations.

4. How We Store Your Information

4.1 Cloud Storage (Firebase Firestore)

Your account information and medical profile are stored in Google Firebase Firestore, which provides:

4.2 Local Device Storage

Encrypted Secure Storage (Sensitive Data):

Sensitive medical information and protected health information (PHI) is stored using platform-native encrypted storage:

Data stored in encrypted secure storage includes:

Standard Storage (Non-Sensitive Data):

Non-sensitive preferences are stored in standard device storage:

Security Note: While we encrypt sensitive data, we still recommend:

4.3 Profile Photos

Profile photos are stored:

5. Information Sharing and Disclosure

5.1 Medical Professional Access

Personal user medical profiles are accessible to:

5.2 Third-Party Services

We use the following third-party services that may have access to your data:

Service Purpose Data Accessed
Firebase Authentication User login and authentication Email, password hash, Google OAuth tokens
Firebase Firestore Cloud database storage All profile and medical data
Google Sign-In OAuth authentication Google account email, ID token
Firebase Hosting Web page hosting (privacy policy, links) IP address, page views
Stripe Payment processing Payment card details, billing address, shipping address, email
Gmail (via Nodemailer) Email delivery Email addresses for account notifications
Firebase Cloud Functions Server-side processing Medical code validation, 2FA code generation and verification, email sending, server-side encryption/decryption, audit logging
Firebase App Check API protection and device attestation Device attestation tokens (DeviceCheck on iOS, Play Integrity on Android)
Firebase Secrets Manager Secure key storage None (encryption keys stored server-side only, never transmitted to devices)

5.3 We Do NOT Share Your Data With:

5.4 Legal Requirements

We may disclose your information if required by law or in response to:

6. Your Privacy Rights

6.1 Access and Portability

You have the right to:

6.2 Correction and Updates

6.3 Deletion Rights

You can delete your data by:

For assistance with account deletion, contact us at: support@nurevamedical.com

6.4 Objection and Restriction

7. Data Security

7.1 Security Measures

We implement comprehensive security measures to protect your medical information:

Encryption:

Authentication & Access Control:

Session Security:

Audit & Compliance:

Code Security:

Device Security:

7.2 Security Considerations

Please be aware of the following:

7.3 Your Responsibilities

8. Children's Privacy

MedID is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and stored in countries outside your country of residence, including the United States, where Firebase/Google Cloud Platform operates data centers. By using MedID, you consent to the transfer of your information to these countries, which may have different data protection laws than your country.

10. Data Retention

We retain your data for the following periods:

11. HIPAA and Medical Privacy

IMPORTANT - HIPAA NOTICE:

MedID handles Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). MedID has implemented comprehensive technical safeguards to protect your medical information.

HIPAA Security Features Implemented:

Important Limitations:

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

We encourage you to review this policy periodically for any updates.

13. State-Specific Privacy Rights

13.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

13.2 European Residents (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

14. Do Not Track Signals

MedID does not track users across third-party websites or respond to "Do Not Track" signals. We only collect data within the MedID application as described in this policy.

15. Contact Us

Privacy Questions or Concerns

If you have questions about this Privacy Policy or how we handle your data, please contact us:

We do not maintain a physical mailing address. Please contact us via email for all inquiries.

16. Consent

By creating a MedID account and using the application, you consent to:

© 2025 MedID. All rights reserved. | Terms of Service | Privacy Policy