S.O.S. Helmet Privacy Policy

Effective Date: September 10, 2025

This policy describes what personal data we collect, why we collect it, and how we use it when you use our S.O.S. Helmet service. Your privacy is of utmost importance to us, and we are committed to protecting your data in compliance with Regulation (EU) 2016/679 (GDPR).

1. Data Controller

The Data Controller of your data is:

S.O.S. Helmet
Contact email for privacy issues: soshelmetproject@gmail.com

2. What Data We Collect and Why (Purpose and Legal Basis)

We collect various categories of data for specific purposes described below.

A) Data Voluntarily Provided by the User

Account Registration Data

Data collected: Email address, Password (stored as cryptographic hash, never in plain text).

Purpose: Create and manage your account, allow you access to the reserved area, recover password, and send essential service communications (e.g., registration confirmation).

Legal Basis: Performance of a contract (Art. 6.1.b GDPR), to which you are a party at the time of registration to our service.

Medical Profile Data (Special/Sensitive Data)

Data collected: First and Last Name, Date and place of birth, Place of residence, Blood type, Allergies, Relevant conditions, Notes for rescuers, Emergency contacts.

Purpose: The main and sole purpose of this data is to make it quickly accessible to rescuers or anyone scanning your NFC/QR tag in an emergency, to provide more effective and safer first aid.

Legal Basis: Explicit consent (Art. 9.2.a GDPR). We collect and process this health data only after obtaining your free, specific, informed, and unambiguous consent during the registration phase. You are aware and accept that this data will be displayed on a public web page, accessible to anyone possessing the unique URL associated with your tag.

B) Automatically Collected Data

Technical Navigation Data

Data collected: IP addresses, system logs.

Purpose: Ensure the security of our infrastructure, protect the service from cyber attacks (e.g., brute-force attempts), and diagnose technical problems.

Legal Basis: Our legitimate interest (Art. 6.1.f GDPR) to keep the service secure and functioning.

3. Nature of Data Provision

  • Providing Account Registration Data is mandatory to use the service. Without a valid email, it is not possible to create an account.
  • Providing Medical Profile Data is optional, but it is the core of the S.O.S. Helmet service. If you do not provide this data, the service loses its main utility, as there will be no vital information to show in case of emergency.

4. Who We Share Your Data With (Recipients)

Your data is not sold or transferred to third parties for marketing purposes. It is shared only with:

  • Rescuers and Anyone Scanning the Tag: As specified, your medical profile data is made publicly accessible via your tag's unique URL. This sharing is the fundamental feature of the service you agree to use.
  • Service Providers (Data Processors): We use third-party providers who process data on our behalf, in compliance with Art. 28 of the GDPR. These include:
    • Hosting Providers (e.g., Fly.io) to host our site and services.
    • Database Providers (e.g., MongoDB Atlas) for secure data storage.
    • Email Providers (e.g., SendGrid/Mailgun) for sending service emails (transactional).
    These providers have been selected for their high security guarantees and act according to our instructions.

5. Data Transfer Abroad

Some of our service providers may have their servers outside the European Economic Area (EEA). In this case, the transfer of your data is carried out in compliance with applicable regulations, ensuring an adequate level of protection (for example, through the signing of Standard Contractual Clauses approved by the European Commission).

6. How Long We Keep Your Data (Retention Period)

  • Your account and medical profile data are kept for as long as your account remains active.
  • If you decide to delete your account, all your personal and medical data will be permanently deleted from our systems.
  • Accounts created but not verified via email will be automatically deleted after 90 days.

7. Your Rights as a Data Subject

At any time, you can exercise the following rights by sending a request to the email address soshelmetproject@gmail.com:

  • Right of Access (Art. 15 GDPR): Obtain confirmation as to whether or not data concerning you is being processed and access such data.
  • Right to Rectification (Art. 16 GDPR): Correct or integrate your data if inaccurate or incomplete.
  • Right to Erasure ("Right to be Forgotten", Art. 17 GDPR): Request the deletion of your data.
  • Right to Restriction of Processing (Art. 18 GDPR): Request that the processing of your data be limited.
  • Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): Object to processing based on legitimate interest.
  • Right to Withdraw Consent: You can withdraw your consent to the processing of health data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with the competent Supervisory Authority (for Italy, the Garante per la Protezione dei Dati Personali).

8. Changes to this Policy

We reserve the right to update this Privacy Policy. Any changes will be communicated via our website or via email.