AID60
Back to Home

Privacy Notice

Last updated: June 2026.

Who we are

AID60 is an emergency identification system operated by Halorex Technologies Limited ("we", "us"), the data controller. You can contact us about privacy or your data rights at contact@halorex.com.

Halorex Technologies Limited is registered in England and Wales under company registration number 17007008. Registered office: 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom.

What AID60 does

AID60 links a physical device (bracelet, card, sticker or pendant) with a QR code and NFC tag to a public emergency profile. Scanning or tapping a device opens that profile so that emergency responders can see the information the profile owner chose to make public.

Personal data we process

  • Account data: email address, name, password (stored only as a secure hash) or Google sign-in identity.
  • Special-category health data you choose to enter: medical conditions, allergies, medications, blood type, implants/devices and free-text notes.
  • Profile photo, if you upload one (re-encoded on our servers; embedded location/EXIF metadata is removed).
  • Emergency-contact information you add (relationship, phone number, optional name and note).
  • Profiles you manage on behalf of a child or dependent, including a private confirmation of your authority.
  • Device and activation records: Device ID, public link, activation date and current status.
  • Security and audit data: login attempts, profile-update events and data-rights requests.
  • Scan data: timestamp, approximate device type, a hashed IP and referrer, used for security and basic analytics.

Purposes and lawful bases (UK GDPR)

  • Providing the emergency-profile service and your account — performance of a contract.
  • Publishing your chosen emergency information — your explicit consent, which you control per field and can withdraw at any time.
  • Special-category health data — Article 9(2)(a) explicit consent and, where relevant, protection of vital interests in an emergency.
  • Security, fraud prevention and preventing unauthorised re-claiming of devices — our legitimate interests.

What you control and what is public

  • You decide, field by field, what appears on your public profile; hidden and empty fields are never sent to the public page or its API.
  • Emergency contacts appear publicly only when you confirm they have consented AND you mark them visible.
  • You can disable a profile, mark a device lost, or edit or remove information at any time from your dashboard.
  • We never expose account email, internal IDs, activation codes, private relationship labels, consent records or audit logs on public pages.

Retention

We keep data only as long as needed for the purposes above. Our current schedule is:

  • Active account, profile and medical data: kept while your account and profile remain active.
  • Profile photos: kept until replaced, removed, or the profile/account is deleted.
  • Active device ownership records: kept while the device is linked to your account.
  • Lost or disabled device records: a minimal ownership/audit record is kept to prevent unauthorised re-claiming and fraud; full medical data is not retained just because a device record is.
  • Security and audit logs: 12 months (longer only if a security incident or legal duty requires).
  • Routine technical/server logs: 90 days.
  • Contact-form messages: up to 24 months.
  • Data-rights request records: a minimal compliance record for 6 years (without the deleted content).
  • Backups: a rolling lifecycle of no more than 30 days.

These retention periods are AID60's current policy and are subject to final review by a qualified UK data-protection professional.

Impact analytics and incident reporting

To understand how AID60 is used and to record genuine real-world assistance, we keep an Impact & Safety Log. We deliberately keep routine usage analytics separate from confirmed assistance, and we never treat a profile view or a call-button tap as proof that a person was helped, that an emergency intervention was completed, or that a life was saved.

  • Usage analytics (impact events): minimal, non-medical events such as a device being issued or activated, a profile being completed, a public profile being accessed, or an emergency contact/services button being tapped. We store only an event type, a timestamp, the device identifier, an approximate device type and a truncated one-way hash of the IP address. We do NOT store medical data, full IP addresses or precise location. A public-profile access is not proof of a QR/NFC scan, and a tel: tap is not proof of a completed call.
  • Incident reports: if you tell us AID60 was involved in a real situation, we store the factual details you provide and link the report to your account (we identify you by your secure account reference, not by copying your email into the report). Please do not include medical details in a report.
  • Confirmed incidents: reports an authorised reviewer has assessed and confirmed, kept as a record of verified assistance.
  • Testimonials and marketing material: used only where you have given separate testimonial permission and only while that permission remains valid and the material is in use.

When we use your contact details

We may send you essential service messages about your own report — such as a submission confirmation, a security notice, a request to correct information, or a status update — regardless of your marketing choices, because these are part of providing the service you asked for. We will only contact you for optional follow-up about an incident if you gave follow-up contact permission, and we will only use your details for marketing or a testimonial if you gave that separate permission.

Your three separate permissions and how to withdraw them

  • Anonymous statistics — permission to include your report in anonymous impact figures.
  • Optional follow-up contact — permission for us to contact you about your incident.
  • Testimonial / marketing — permission to use your story in testimonials or marketing (subject to a separate agreement).

All three are optional and are unticked by default. You can grant or withdraw any of them at any time from your dashboard or by emailing contact@halorex.com. Withdrawing testimonial permission immediately stops any new marketing use and flags existing material for removal review. We keep a minimal, auditable record of each permission and its withdrawal to demonstrate compliance; we do not delete that evidence simply because a permission is later switched off.

Incident review, retention, anonymisation and deletion

Reports are reviewed privately and move through clear statuses (submitted, under review, needs information, confirmed, rejected or withdrawn) before anything is treated as confirmed. Each report has a retention category and a review date, and may be placed under legal hold. Authorised staff can, with a documented reason, retain a record for a further period, redact unnecessary detail, anonymise it, or delete it where permitted — and every such action is written to an audit trail. We do not automatically delete confirmed or unconfirmed incidents; deletion stays disabled until our retention policy and lawful bases are approved.

These periods are configurable and are subject to owner and legal review before production:

  • Identifiable or pseudonymous impact-analytics events: 13 months, then deleted or irreversibly aggregated/anonymised.
  • Unconfirmed, rejected or withdrawn incident reports: 24 months after closure, then deleted or irreversibly anonymised unless a documented legal reason requires longer.
  • Confirmed incidents: identifiable records kept for 6 years after the incident is closed or last materially updated, then deleted or anonymised; aggregate anonymous statistics may be kept separately.
  • Testimonial and marketing material: kept only while permission is valid and the material is in use, reviewed at least every 24 months.
  • Consent and withdrawal evidence: kept only as long as necessary to demonstrate compliance, with the period documented and reviewed.

We support earlier deletion, redaction, legal hold and anonymisation on request. This schedule and the lawful bases above require review by a qualified UK data-protection professional before production use.

Cookies and browser storage

AID60 uses only essential, security-related cookies to keep you signed in (an HttpOnly, Secure session cookie). We do not use advertising or behavioural-tracking cookies, and we do not run non-essential analytics in your browser.

Your rights

  • Access and correct your data (from your dashboard).
  • Download a copy of your data (Download my data on your dashboard).
  • Disable public visibility immediately.
  • Withdraw consent for any optional information.
  • Request deletion of a profile or your account by contacting contact@halorex.com. We may need to verify your identity before completing the request.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

Deleting your data

You can delete an individual profile or your entire account yourself from your dashboard, or by contacting contact@halorex.com. When you request deletion, the affected emergency pages stop showing information immediately. Deletions have a 30-day recovery period during which you can cancel; after that, personal and medical data is permanently deleted or anonymised. We keep only the minimum information needed for legal, financial, fraud-prevention or security purposes. During the 30-day recovery period, linked AID60 devices remain securely associated with your account. After permanent account deletion, those devices remain securely quarantined by AID60 and are not automatically released, transferred or made claimable. Any later ownership reset requires identity and ownership verification.

Important

AID60 does not send automatic notifications, SMS or push messages in this version, and does not independently verify medical information or emergency-contact consent — that remains the responsibility of the profile owner or authorised manager.