Learn what is stored, who can view it, how to change or delete it, and the current service scope.
Purpose and fields
Enter chosen emergency, contact, health and travel fields under your own or authorized guardian control. Existing M31 Accounts verifies ownership. Do not send unnecessary ID, address or medical-record files.
Storage and access
Profiles and shared locations are encrypted on the server. PIN and activation codes are managed as verification hashes, not plaintext in public files or QR URLs. A server encryption key is used; external KMS integration is not claimed.
Retention and deletion
Profiles remain until managed or deleted by the owner. Scan/location access expires after 24 hours with scheduled cleanup. Guardian email sessions expire after 8 hours. Mail jobs are cleaned after 7 days; policy changes require updated notices.
Email and external processing
M31 Accounts handles sign-in, Cloudflare provides service and data storage, and Google Gmail sends consented emails. Emails contain no medical details, PIN or precise location. Consular contact selection maps consented GPS to a country on the device without sending coordinates to an external map API. Automatic LINE and SMS delivery is not provided.
Device storage and choices
Browser storage may remember language and demonstration cart items/quantities; the tab may remember market selection. Actual medical data is not stored in localStorage. Location refusal, visibility edits, email opt-out, suspension and deletion are distinct controls.
Electronic signature and consent records
Saving a profile records signer name, capacity, handwritten signature, consent choices, disclosure settings, text version, language, server-recorded time and account identifier. Records are encrypted and only the signed-in owner can view or download them. Signatures are excluded from QR, PIN and guardian notifications. Profile deletion removes its signature records. Changes require a new signature; no historical signature is generated for existing profiles. This feature does not replace certified digital certificates, external trusted timestamps or verification of legal guardian authority.
M31 SOS · VISUAL GUIDE
Personal information is stored according to the purpose and scope.
QR, access password, and activation code are separated, and location sharing is handled with separate consent.
Schematic for functional/product design explanation · Not in actual condition
Information has three separate layers
Public information includes language, communication guidance and only selected, consented minimum emergency fields. Consider the need and risk before publishing allergies, medicines to avoid, conditions, medicines, devices, pregnancy or blood group. Blank fields do not mean there is no condition or allergy.
PIN-protected fields can include name, age, guardian and backup contacts, surgery, history, doctor, insurance and embassy details. Care responsibilities and private notes are owner-only and do not appear in QR views even with the PIN.
Check before choosing visibility
Mode A hides all profile information before PIN verification, including allergies and conditions. Mode B shows selected, consented minimum fields and locks details. Mode C also shows only fields explicitly selected from allowed public fields.
To withdraw disclosure, edit and save the profile and rescan on another device. Previously captured or copied screens cannot be recalled. Confirm authority and separate consent for health-data storage and public disclosure.
Current mode B publishes language and communication only; health fields stay PIN-protected. To publish health information, choose mode C and confirm field selections and separate disclosure consent.
Finder location requires separate consent
Opening QR does not request GPS. Only after consent and tapping the current-location button is device permission requested. Review coordinates, accuracy and measurement time, then explicitly confirm sending before storage.
The shared location belongs to the finder’s device; this is not live tracking of the wearer. Permission denial, inaccuracy and connection failure are possible, with no IP fallback. Encrypted location is accessible only to the owner and consenting verified guardians, expiring after 24 hours.
Editing, loss and deletion differ
Edit and save when contacts, medicines, surgery or travel details change. Linked QR codes use the updated profile, so profile edits alone do not require reprinting. Always scan to confirm after changes.
Suspend a lost tag in tag management; suspended QR codes reveal no profile. Profile deletion separately removes linked tags, scan records and recipients. Recovery is not guaranteed, so confirm the target and impact first.
Tag suspension is available to owners; unsuspension, physical replacement ordering and central Accounts closure are separate features. Identify the needed action and check status and support guidance.
Included in M31 Software Buffet · All members can use SOS digital features free of charge. Charges apply only to optional printed products and keyrings.
Optional visit analytics: Google Analytics
Only after you allow analytics on public information pages, Google Analytics 4 processes visit statistics such as page, language, browser/device and approximate connection region. Google measurement and cookie processing may involve processing overseas. Analytics events exclude emergency form values, medical data, PIN, QR identifiers, signatures, account identifiers, URL query strings, fragments and full referrer addresses. Tags are not installed on personal QR, member, login or administrator screens. Advertising personalization and automatic form measurement are disabled. Consent is optional; declining does not affect service. Change your choice at any time using Analytics settings in the footer. Your choice is stored in this browser; Google Analytics cookie expiry is configured to 180 days.
