Legal
Privacy policy
Last updated October 2026
This policy explains what personal information QR Life collects, why, who can see it, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are
QR Life is operated by Qrlife (Pty) Ltd (registration 2026/803884/07), 1 Oval Place, Westville, KwaZulu-Natal, 3629 (the “responsible party”). Our Information Officer is Claire Fisher, reachable at privacy@qrlife.co.za or +27 83 607 8096.
2. What we collect and why
| Information | Purpose | Basis |
|---|---|---|
| Name, email address, phone number | To create and run your account and to contact you about it | Contract / your request |
| Password (stored only as a one-way hash) | To let you log in securely | Contract |
| Blood type, allergies, medical conditions, medications, notes | To show to people who scan your QR in an emergency | Your explicit consent |
| Up to three emergency contacts (name and number) | To let a responder reach someone on your behalf | Your explicit consent |
| Payment amount, date, method and bank reference | To confirm your payment and keep accounting records | Contract / legal obligation |
| Subscription plan, invoices, account credit and discounts | To bill your subscription, send renewal reminders and keep accounting records | Contract / legal obligation |
| Date you gave consent, wording version, age confirmation | To prove consent was given | Legal obligation |
| Last login date | Account security and housekeeping | Legitimate interest |
| Messages you send us (support tickets, the Get in touch form) and your name and email if you have no account | To answer your question and keep a record of the conversation | Your request / legitimate interest |
Health information is “special personal information” under POPIA. We process it only with your explicit consent, which you give when you register and can withdraw at any time by deleting your account. All medical fields are optional; give only what you are comfortable sharing. We do not use your information for marketing, profiling or automated decisions, and we never sell it.
3. Who can see your information
Anyone who scans your QR code, or who has its link, sees your first name and the emergency details you entered: blood type, allergies, conditions, medications, notes and your emergency contact. They do not see your surname, email address, phone number, address or payment information. If you display the QR in public, for example on a car windscreen or motorbike, passers-by can scan it. Only put on your profile what you are happy for a stranger in an emergency to read.
QR Life administrators can view your account and payment details to run the service. Your medical details are hidden from them by default; each time one is viewed, it is recorded in an audit log. We share information with our hosting provider (see below) and where the law requires. We do not share it with anyone else.
4. Your emergency contact
If you list another person as your emergency contact, you confirm that they know and have agreed. Their name and number are shown to anyone who scans your QR. If a listed contact asks us to remove their details, please contact us.
5. Where your information is stored
Your information is stored on servers operated by Oracle Cloud Infrastructure in London, United Kingdom. This means it is transferred outside South Africa. We do this under section 72 of POPIA: the United Kingdom has data-protection laws that give a level of protection similar to POPIA, and our hosting provider is bound by a written agreement to process data only on our instructions and not to use it for its own purposes. Connections to the service are encrypted (HTTPS), passwords are stored as one-way hashes, and access to the back office is restricted and logged.
6. How long we keep it
- Your account and medical information: for as long as you want your QR to work, until you delete your account. We do not delete paid accounts for being inactive, because a QR code is meant to sit on your vehicle or belongings for years without you logging in. We may email you from time to time to ask you to check that your details are still correct.
- Accounts that were created but never paid for (so no QR was issued): may be deleted after 12 months.
- Payment records: the amount, date and method are kept anonymised (not linked to you) after account deletion, for the period the law requires us to keep accounting records (generally five years or more).
- Consent records: kept while your account exists.
- Support tickets: deleted with your account. Messages from people without an account are deleted 24 months after the conversation is closed. Copies of emails we send are kept for up to 60 days.
7. Your rights
- Access: use “Download my data” on your dashboard to get a copy of everything we hold about you.
- Correction: edit your details at any time in your account.
- Deletion: use “Delete my account” on your dashboard to erase your account and medical information immediately.
- Withdraw consent / object: delete your account, or ask us at privacy@qrlife.co.za.
- Lost or stolen QR: contact contactus@qrlife.co.za and we will disable the old code and issue a new one.
8. If something goes wrong
If your information is compromised in a way that could harm you, we will notify you and the Information Regulator as soon as reasonably possible, as POPIA requires.
9. Complaints
Please contact us first at privacy@qrlife.co.za. You may also complain to the Information Regulator of South Africa at POPIAComplaints@inforegulator.org.za (general enquiries: enquiries@inforegulator.org.za, 010 023 5200, inforegulator.org.za).
10. Important limitation
QR Life is a self-reported information aid. It is not a medical device, and we cannot guarantee that anyone will scan your code, that the information is complete or current, or that it will change the care you receive.