Privacy notice
100% confidential.
Your information exists for one reason only: to help you in an emergency. It is seen only by you and by whoever opens your card with its PIN, and only the parts you choose.
Version 3 · September 2026
Who we are
MedID is a free, non-commercial emergency medical card service for people in Sri Lanka. The data controller contact is listed on this page once MedID launches publicly.
What we collect
Your email and password (stored as a secure hash); the details you choose to enter, which may include health information such as blood type, allergies, conditions, medicines and treatment wishes; your photo; your emergency contacts' names, phone numbers and emails; records of when your card is opened; and a location if a responder chooses to share it.
Why and on what basis
To show your emergency information to people helping you. We rely on your explicit consent (Personal Data Protection Act No. 9 of 2022, Schedule I (a) and Schedule II (a)). In a real emergency where you cannot consent, showing information you chose to share also protects your vital interests (Schedule II (c)).
Who can see it
Information you mark “Emergency” is shown to anyone who has your card and enters its printed PIN. “Private” information also needs your private PIN. “Only me” is never shown to others. We do not give your information to any third party, and we do not use it for any other purpose: no advertising, analytics, research or selling.
How we protect it
Health information and photos are encrypted at rest. PINs and passwords are hashed. Wrong PINs lock the card temporarily and you are alerted. Cards can be cancelled instantly.
How long we keep it
Until you delete your account. Activity records are deleted after 12 months, and security records after 1 day.
Where it is stored
Your information is stored, encrypted, on servers in Mumbai, India: the database is run by Supabase and the website by Vercel, and alert emails are sent through our email provider. They act only on our instructions under contract. They are service providers, not third parties who may use your data. Because this is outside Sri Lanka, and Sri Lanka has not yet recognised any other country's data-protection law as adequate, the laws of that country may apply to those servers and it may be harder to enforce your rights there. We apply the same safeguards wherever your data is stored, and you can delete it at any time. We ask for your explicit consent to this when you sign up (PDPA s.26(5)(a)).
Your rights
You can see, correct, download and delete your data at any time from “Privacy & data”, and withdraw your consent by deleting your account. You can complain to the Data Protection Authority of Sri Lanka.
Children
Accounts are for people 18 and older. Parents and guardians can add their children and others they care for under Family, and give consent on their behalf.