Privacy Policy

1. Introduction

At Vera, protecting your privacy is a core value. This policy details how we collect, use, store, and protect your personal and medical information when using the Vera application, the website, and the physical QR stickers (collectively: "the Service").

We operate in accordance with the Protection of Privacy Law, 1981 (חוק הגנת הפרטיות, התשמ"א-1981) (including Amendment 13, 2025 / תיקון 13, התשפ"ה-2025), the Protection of Privacy Regulations (Data Security), 2017 (תקנות הגנת הפרטיות (אבטחת מידע), התשע"ז-2017), and the European GDPR (Regulation 2016/679) insofar as it applies to users residing in the European Union.

We recommend reading this policy carefully. Use of the Service constitutes consent to the collection and processing of information as detailed in this policy, subject to dedicated consent mechanisms for sensitive medical information as described in Section 7.

This Privacy Policy was drafted in Hebrew. In case of any discrepancy between the Hebrew version and this translation, the Hebrew version shall prevail.

2. Definitions

• "Personal Information" — Any information that identifies or enables the identification of an individual, as defined under the Protection of Privacy Law (חוק הגנת הפרטיות).
• "Sensitive Information" (Information of Special Sensitivity / ISS) — Medical or health-related information, or any information classified as having special sensitivity under Amendment 13 to the Protection of Privacy Law, and "Special Category Data" under Article 9 of the GDPR.
• "Processing" — Any operation performed on information, including collection, storage, access, use, transfer, deletion, or destruction.
• "Data Controller" — The entity that determines the purposes and means of data processing — Shalhevet Software Solutions.
• "Data Processor" — An entity that processes information on behalf of and under the instructions of the Data Controller.
• "QR Sticker" — A physical sticker bearing a unique QR code that is linked to the User's medical profile.
• "Scan" — The action whereby any third party scans the QR code and gains access to the shared medical information.
• "Medical Profile" — The entirety of medical information entered by the User in the Application.

3. Identity of the Data Controller

Shalhevet Software Solutions is the Data Controller and the entity responsible for the processing of your personal information.

3.1 Data Protection Officer (DPO)

In accordance with Amendment 13 to the Protection of Privacy Law, Vera has appointed a Data Protection Officer responsible for ensuring compliance with legal requirements. For privacy-related inquiries:

4. Types of Data We Collect

4.1 Personal Identifying Information

• Full name
• Date of birth
• Phone number
• Email address
• Shipping address (city, street, apartment, postal code)

4.2 Sensitive Medical Information

• Medications (names, dosages, administration frequency)
• Allergies and sensitivities
• Pre-existing conditions and chronic conditions
• Blood type
• Emergency contacts (names, phone numbers, relationship)
• Additional medical information the User chooses to enter in the profile

4.3 Payment and Transaction Information

• Transaction details (amount, date, product purchased)
• Credit card details — processed directly by Stripe and never stored on Vera's servers
• Billing address (if different from the shipping address)

4.4 Technical and Usage Information

• IP address
• Device type, operating system, and browser version
• Device ID and Firebase Installation ID
• Application usage data (pages viewed, actions performed, usage times)
• QR scan logs (timestamp, scanner IP address, scanner device type)
• Language preference
• Crash reports

4.5 Data We Do Not Collect

• We do not collect location data (GPS) from your device.
• We do not collect biometric information (fingerprint, facial recognition).
• We do not collect information from the contacts on your device.

5. How We Collect Data

• Directly from you — Information you actively enter: account registration, completion of a medical profile, placing an order, contacting customer service.
• Automatically — Technical information collected automatically during use: IP address, device type, usage data, QR scan logs.
• From service providers — Information generated by our service providers: transaction details from Stripe, analytics data from Firebase.

Obligation to provide information: Providing basic personal information (name, email, phone) is required to create an account. Providing medical information is entirely voluntary but is required in order to use the core features of the Service (medical profile, QR sticker). Without medical information, it will not be possible to activate a QR sticker or use the safety check features.

6. Purposes of Data Processing and Legal Basis

7. Consent and Withdrawal of Consent

7.1 Explicit Consent for Medical Information

• The processing of medical information requires explicit, separate, unambiguous, and informed consent. This consent is not part of the general acceptance of the Terms of Service.
• Consent is requested at the stage of entering medical information in the Application, with a clear explanation of how the information will be used and shared.
• Consent is recorded and documented for compliance and audit purposes.

7.2 Withdrawal of Consent

• Consent to the processing of medical information may be withdrawn at any time through the Application settings.
• Withdrawal of consent will result in deactivation of the medical profile, cessation of information sharing via QR, and deletion of medical information within 30 days.
• Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.
• Withdrawal of consent will not prevent the use of features that do not require medical information.

7.3 Consequences of Not Providing Consent

Without consent to the processing of medical information, it will not be possible to: create a medical profile, activate a QR sticker, or use the safety check features. Other Application features (such as general reminders) will remain available.

8. Information Sharing via QR

8.1 How It Works

By activating a QR sticker, the User expressly consents that:

• The medical information selected for sharing will be accessible to any person who scans the QR code — without the need for identification, downloading an application, or obtaining the User's approval.
• The purpose of this open access is to enable rapid access to critical information in emergency situations, including by paramedics, physicians, and bystanders.
• The legal basis for this access is explicit consent (upon sticker activation) and vital interests (Art. 9(2)(c) GDPR) in situations where the User is unable to give consent.

8.2 User Control

• The User controls which data fields are displayed in the QR scan through the Application settings.
• A sticker may be deactivated at any time through the Application. After deactivation, scanning the code will not display any information.
• In the event of loss or theft of a sticker, it must be deactivated immediately through the Application.

8.3 Acknowledged Risks

• Vera cannot control the identity of scanners or prevent scans by unauthorized parties.
• Information viewed by a scanner cannot be "undone" after viewing.
• Vera logs scans (timestamp, IP address, device type) and displays a scan history to the User.

9. Sharing Information with Third Parties

9.1 Service Providers (Data Processors)

Data Processing Agreements are signed with all service providers in accordance with the requirements of Article 28 of the GDPR and Amendment 13 to the Protection of Privacy Law.

9.2 Authorities

Vera may disclose personal information to legal authorities if required by law, court order, or for the protection of the rights, safety, or property of Vera, its users, or the public.

9.3 What We Do Not Do

• We never sell personal or medical information to third parties — ever.
• We do not share medical information with advertising, marketing, or data brokerage entities.
• We do not transfer information to insurance companies, employers, or any other commercial entity.
• We do not permit service providers to access medical information beyond what is necessary for operating the Service.

10. International Data Transfers

• Data is stored on Firebase / Google Cloud servers, which may be located in the United States, the European Union, or other regions.
• Israel is recognized by the European Union as a country with an adequate level of privacy protection (Adequacy Decision); therefore, data transfers between Israel and the European Union are permitted.
• Data transfers to the United States and other countries are conducted subject to Standard Contractual Clauses (SCCs) and Google's Data Processing Terms.
• Stripe processes payments on servers with the highest level of PCI-DSS certification and implements SCCs for international transfers.
• All international data transfers are conducted subject to data transfer agreements that ensure a level of protection equivalent to Israeli law and the GDPR.

11. Data Retention Periods

At the end of the retention period, data will be securely deleted or fully anonymized in a manner that does not allow reconstruction.

Vera conducts an annual review of stored data to ensure compliance with retention periods.

12. Data Security

• Encryption — All data is encrypted both at rest and in transit using TLS 1.2+ and AES-256 protocols.
• Access control — Access to medical information is restricted to authorized personnel only via Role-Based Access Control (RBAC).
• Secure infrastructure — Firebase / Google Cloud comply with SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 standards.
• Monitoring and logging — Continuous monitoring of database access, activity logging, and anomaly detection.
• PCI-DSS — Payments are processed by Stripe in accordance with PCI-DSS Level 1.
• Written information security policy — Vera maintains a written and updated information security policy as required by the Regulations.
• Annual review — The information security program is reviewed and updated at least once a year.

Despite our security efforts, no method of digital storage or transmission is 100% secure. We are committed to exercising reasonable diligence to protect your information and to notify you of any significant security incident in accordance with the law.

13. User Rights

In accordance with the Protection of Privacy Law (including Amendment 13) and the GDPR, you have the following rights:

14. Data Breach Notification

• In the event of a severe security incident that may infringe upon your rights, we will notify the Privacy Protection Authority (PPA) without undue delay, in accordance with the Data Security Regulations.
• If the breach is likely to pose a high risk to your rights, we will also notify you directly (by email, in-app notification).
• For breaches subject to the GDPR, notification to the supervisory authority will be sent within 72 hours (Article 33 of the GDPR). A breach involving medical information will almost always be considered "high risk" requiring notification to affected individuals.
• The notification will include: a description of the breach, the types of data exposed, the steps taken to mitigate the harm, and contact information for further inquiries.

15. Privacy of Minors and Dependent Profiles

15.1 Minors

• The Service is intended for individuals aged 18 and above only for independent account creation.
• Minors aged 14–17 may use the Service with the consent of a parent or legal guardian.
• We do not knowingly collect personal information from minors under the age of 14 without verified parental consent.
• If we become aware that information from a minor has been collected without appropriate consent, the information will be deleted immediately.
• If you are a parent or guardian and discover that your child has used the Service, please contact us and we will address the matter immediately.

15.2 Dependent Profiles (Family Members)

• Account holders may create and manage medical profiles for dependent family members (children, elderly parents, spouses).
• Creating a profile for another person requires the explicit consent of that person, or legal authority (guardianship, power of attorney).
• The account holder bears responsibility for the accuracy of the information and for obtaining the required consent.

16. Cookies and Tracking Technologies

16.1 Types of Cookies

• Essential cookies — Required for basic website operation (authentication, language preferences, CSRF prevention). These cannot be disabled.
• Analytics cookies — For analyzing usage patterns and improving the Service. Based on Firebase Analytics. These do not personally identify users.

16.2 What We Do Not Use

• We do not use advertising or remarketing cookies.
• We do not use third-party tracking cookies for marketing purposes.
• We do not use Facebook Pixel, Google Ads, or similar advertising tools.

16.3 Managing Cookies

You may manage your cookie preferences through your browser settings. Please note that blocking essential cookies may impair the functionality of the website.

16.4 Do Not Track Signal

The website and Application do not respond to "Do Not Track" (DNT) signals from the browser, as we do not engage in advertising tracking whatsoever.

17. Automated Decision-Making

• Vera does not perform automated decision-making or profiling that significantly affects users.
• Medication safety checks (drug interactions, allergies) are based on algorithmic comparison against pharmaceutical databases and are presented to the User as informational only — they do not constitute medical advice and do not replace professional evaluation.
• No artificial intelligence (AI) is used to analyze or process users' medical information.

18. Changes to the Privacy Policy

• Vera may update this policy from time to time.
• Material changes (particularly those relating to the processing of medical information) will be communicated via the Application, the website, or by email at least 30 days in advance.
• Material changes to the processing of medical information will require renewed consent — it will not be possible to continue processing medical information without active approval on your part.
• The date of the last update is indicated at the top of this document.

19. Language and Governing Law

• This Privacy Policy was drafted in Hebrew. In the event that it is translated into additional languages and a discrepancy arises, the Hebrew version is the binding version.
• This policy is governed by the laws of the State of Israel.
• Exclusive jurisdiction for any matter arising from this policy is vested in the competent courts of the Tel Aviv-Jaffa district.

20. Contact Us Regarding Privacy

For questions, inquiries, rights exercise requests, or complaints regarding privacy: