← Back to Pandu SOS · Português · Español · Français · Deutsch · Italiano

Privacy Policy

Last updated: 1 November 2026 · Controller: Fábio José dos Santos

Summary: Pandu SOS has no account or password. What you fill in stays on your phone. So that the QR updates itself, we keep an encrypted copy of your information: the key that opens that copy exists only inside your QR, so not even Pandu can read your health data.

In plain words: Is a medical QR code safe?

1. Who we are

Pandu SOS is a free website that creates an emergency QR code, available at usepandu.com.br. Contact: [email protected].

2. What you fill in

Name, date of birth, blood type, allergies, health conditions, medicines, health insurance, emergency contacts and notes. Everything is optional except the name. Health data is sensitive personal data (under Brazil's LGPD, the EU's GDPR and the data protection laws of many countries): that is why Pandu SOS is built so that nobody except whoever scans your QR can read it, not even us.

3. Where the data is kept

On your phone, in the browser's storage, so you can edit it later.
On our server, encrypted (dynamic QR). Your phone encrypts the information with AES before sending it. The server only keeps: a random code, the encrypted data and a fingerprint (hash) of the editing password, which stays only on your phone. The decryption key travels only inside your QR, in the last part of the link (after the “#”), which browsers never send to any server. Without the key, what we store is unreadable, to us as well.
“Text only” QR: if you choose this option, the information is written inside the QR itself and nothing is sent to the server.
Please note: anyone who scans your QR will see that information. That is how a rescuer can help you. Only add what is useful in an emergency.

Open counter (optional, off by default). If you turn it on in "More options", the server also keeps how many times per day your QR was opened, with nothing about who opened it (no IP, no location). Only you see it, and turning it off erases the numbers. With "Change my QR", the old QR is turned off and its encrypted copy is erased.

End date (optional). If you choose, in "More options", a date for the QR to turn itself off, the server keeps that date with the encrypted copy. After that date, the QR stops opening and the encrypted copy is erased.

4. Whoever scans it

The emergency page fetches the encrypted copy, decrypts it on the scanner's own phone, shows it on screen and saves nothing on that device. If the person taps “Send my location”, their phone asks for permission and the location goes only in the WhatsApp message they send to your contact themselves.

5. Visit counting

Pandu uses no cookies and no Google Analytics. To know whether Pandu is helping, we run our own counter that only records what happened (for example “QR created” or “QR scanned”), the language and the country. It keeps no IP address and nothing about you or your card.

6. Hosting

The website and the dynamic QR server run on Cloudflare, a cloud provider. As with any website, technical access data such as the IP address and browser type may be logged; we also use it temporarily to limit abuse (too many submissions).

7. Your rights

You can edit or delete everything at any time on the website itself. The “Delete my data” button deletes the information on your phone and the encrypted copy on the server: from then on, whoever scans your QR will see that it was turned off. If you clear your browser data without using that button, you lose the editing password and can no longer change that QR; in that case, write to [email protected]. Old “Text only” QRs keep the information from that moment: throw them away if you wish.

8. Health notice

Pandu SOS is not a medical service and does not replace emergency care. In an emergency, call your country's emergency number.