Privacy Policy

Last updated August 26, 2026

This app exists to hold details about children so that someone caring for them can act quickly. That is sensitive by definition, so this page says plainly what is collected, what happens to it, and how to get it back or get rid of it.

Who we are

Emergency Contact is a product of SupportNow. We are the controller of the information described below. To reach a person about anything on this page, write to [email protected].

What you give us

You enter this yourself, and none of it is required to look around the site:

• Your household — a name and a street address.
• People — names, preferred names, dates of birth, how each person is related to the household, phone numbers and email addresses, a daytime routine, and a comfort item.
• Medical details — allergies and their severity, medications and doses, free-text medical notes, doctors and dentists, insurance carrier and member ID, and any consent form you upload.
• Your account — first and last name, email address, and a password we only ever store hashed.
• Kids Safety Score answers — your nine answers and the score they produce. A name and email here are optional, and skipping is offered as plainly as saving.

What we collect automatically

We record page visits to understand how people find the site and where they get stuck. That record includes your IP address, browser and operating system, the page you arrived on, the site that referred you, and campaign tags on the link you followed, including advertising click identifiers from Google, Meta and Microsoft when an ad brought you here. We do not run third-party advertising or analytics scripts in your browser; this is recorded by our own server.

We set these cookies, and no others:

• Session and sign-in — keeps you signed in. Required.
• Your unfinished card — lets you build a card before making an account, and is cleared the moment the card becomes yours.
• Your quiz response — ties your score to you so you can come back to it.
• Visit measurement — the analytics described above.

What we do with it

We use it to build and display your Emergency Card, to show the card to whoever scans one of its QR codes, to email you a reminder at six and twelve months asking whether the page on your fridge is still right, to answer you when you write to us, and to keep the service working and secure.

We do not sell your information, and we do not share it with advertisers or data brokers. We do not use anything you enter about a child to target advertising.

Who can see a card

This is the part worth understanding. Every QR code on your printed card contains a long, random, unguessable token. Anyone holding that link can see that child's page without signing in. That is the entire point — a paramedic or a neighbour cannot be asked to log in — but it means the printed page should be treated like a spare key.

You can revoke it at any time from your card page. Revoking rotates the token, which stops every printed copy of every code working at once, everywhere. Reprinting does not do this.

Where it is stored

Data is held in a Postgres database in the United States. Allergy details, medication details and medical notes are encrypted in the database itself, so they are unreadable in a backup or a database dump. Everything travels over HTTPS. Passwords are hashed and cannot be read by us or recovered by us.

Who else touches it

We use as few outside services as we can. The ones we use are:

• Heroku (Salesforce) — hosting and the database.
• Mailgun — sending the emails described above.
• Amazon Web Services — storing consent forms you upload.

Each processes this information on our instructions and for no purpose of their own.

How long we keep it

Your card and account are kept until you ask us to delete them, because the product is useless if it forgets. Visit records are kept for two years. When you delete something in the app it is marked deleted and stops appearing anywhere immediately; it is purged from the database within 30 days.

Children

This service is for parents and guardians, and is not directed to children. An account holder must be 18 or older. The information about a child in your card is entered by you, the adult responsible for them, and is shown only to whoever you hand a printed card to. We never ask a child for anything directly.

What you can ask for

You can ask us for a copy of everything we hold about you, ask us to correct it, ask us to delete it, or object to our using it. Write to [email protected] and we will answer within 30 days. Depending on where you live you may also have the right to complain to a data protection regulator. We will never charge you or treat you differently for asking.

Changes

If we change this policy in a way that affects what happens to your information, we will email account holders before it takes effect. The date at the top always reflects the current version.