COMPREHENSIVE PRIVACY NOTICE – ESCANÉAME

This notice is issued in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the “Law”).

1. Who is the data controller

Mauricio Chávez Moguel, an individual, operating under the commercial brand Escanéame, with an address at Ciencias Administrativas 368, Col. Higo Quemado Terán, Tuxtla Gutiérrez, Chiapas, C.P. 29059, Mexico, is responsible for the processing of your personal data on the site https://escanea-vida-segura.base44.app and in the Escanéame services. For any privacy matter, please write to mauriciomoguel@hotmail.com.

2. What data we process

a) Data of the purchaser or account holder: name, email address, phone number (if provided) and preferred language.

b) Purchase data: order number, product, amount, date, payment status and service expiration date. Payment is processed with Stripe. Escanéame does not receive or store your full card number.

c) Emergency profile data, whether yours or that of the person you register: name, photograph, date of birth or age (if captured), blood type, allergies, chronic conditions, medications, instructions on how to act during a crisis, health insurance details (insurer and policy number) and emergency contacts (name, relationship and phone number).

d) Pet data, linked to their owner: pet’s name and photo, veterinary record, microchip number, rescue message and the owner’s contact details.

e) Organization data (“For Businesses” channel): name, position, organization, email, phone number and message of the person requesting a quote; corporate folio, and the data of the profiles the organization uploads, including via Excel files.

f) Contact form data: name, email and message.

g) Technical data: IP address, browser and device type, date and time of access, and cookies (see section 11).

h) Consent records: checkboxes ticked, email, date, time, IP and version of the notice accepted.

i) Data of the person who scans a QR code: approximate location (only with their permission), date and time. Escanéame does not store the scanner’s IP address.

j) Other data: name, email and WhatsApp of coupon creators (UGC), processed only to manage their commissions; and the contact name, email, phone number and folio kept as service data when an unpaid configuration expires.

SENSITIVE DATA: health data (blood type, allergies, conditions, medications, crisis instructions and health insurance). We protect the photograph with the same care; we do not use it for facial or biometric recognition. Sensitive data requires your express written consent (section 6).

3. Data of minors, persons with disabilities and other third parties

You may register profiles for your minor children, older adults, persons with disabilities or persons under guardianship, only if you hold parental authority, guardianship, legal representation or the supporting-person status that authorizes you under the law. By ticking the corresponding checkbox, you declare under oath that you hold that capacity and that you act in that person’s best interest. You are responsible for the truthfulness of that declaration.

If you register an adult capable of deciding, you declare that they authorized you. You also declare that you informed your emergency contacts that their name and phone number will appear on the profile.

We may ask you to prove the representation and suspend a profile created without authorization. To purchase the service you must be over 18.

4. What we use your data for

Primary purposes (necessary for the service):

1. Create and store your draft and your emergency profile.
2. Generate the emergency profile and the kit’s dynamic QR codes.
3. Display the profile, with the fields you choose, to anyone who scans the QR, and allow that person to call the emergency contacts.
4. Display the preview with watermarked or locked QR codes, process the payment and deliver the kit on screen.
5. Control the service’s 1-year term.
6. Handle contact, support and ARCO-rights requests.
7. For organizations: handle quotes, process bulk uploads and administer corporate folios.
8. Maintain site security, prevent fraud, keep proof of your consents and comply with legal and tax obligations.

We do not use your data for purposes other than the primary ones described here.

5. Your profile is PUBLIC to whoever scans the QR

In an emergency, anyone must be able to see the information without logging in. Therefore:

• Everything you activate on the profile can be seen by ANYONE who scans the QR, with no password. This includes strangers, not only medical staff or authorities.
• You decide which fields to show and can hide, edit or deactivate the profile at any time. We suggest showing only what is essential.
• We do not control what whoever scans the QR does, such as taking screenshots. Your changes are reflected in the dynamic QR, but they do not erase copies others may already have made.
• For children’s items, such as backpacks or badges, avoid showing data that makes them locatable, such as your home address or school.
• If the profile expires or is deleted, the QR will only show “This profile is not activated. You can reactivate it here”, with no personal data.

Displaying this data is your decision, which you expressly authorize. Escanéame does not sell this data.

6. Express consent for sensitive data

Under article 8 of the Law, we process health data only with your express written consent, given through an electronic checkbox you tick, linked to your email and session; we store the date, time, IP and version of the notice accepted. Without it we do not store health data, but you can create a profile with contacts only.

7. With whom we share your data

Processors that handle data on our behalf (data processors), which do not require your consent:

• Base44 and its cloud providers: hosting of the site, database and files. Their infrastructure may be located in the United States or other countries.
• The site fetches exchange rates from the public service open.er-api.com (ExchangeRate-API) directly from your browser: that service receives your IP address as in any standard web request, without Escanéame sending it any personal data.

Transfers that do not require your consent (article 36 of the Law):

• Stripe and its payment processors: to charge and deliver the kit we share your name, email and order data. This transfer is necessary for the contract you enter into. Stripe also processes that data under its own privacy policy.
• Competent authorities, when required by law, a court order or a duly founded and motivated mandate, or to defend a right in a proceeding.

As a result, your data may be processed in the United States, the United Kingdom and other countries where those providers operate. We make no other transfers; if any required your consent, we will ask for it beforehand.

Organizations (“For Businesses” channel): when a school, company or agency uploads data about its students, employees or clients, the organization is the CONTROLLER of that data. It is up to the organization to provide its own privacy notice, obtain the necessary consents, including express written consent for health data and parental/guardian consent for minors, verify the data and handle its users’ rights. In those cases Escanéame acts as a data processor: it processes the data only on behalf of the organization and in accordance with its instructions and the contract. Escanéame is indeed the controller of the data of the person requesting the quote. If your profile was created by an organization, you may contact them or us, and we will forward your request.

8. ARCO rights and withdrawal of consent

You, or your representative, may access your data, rectify, cancel or object to its processing (ARCO rights), and withdraw your consent. You can make many changes by editing or deleting your profile. For a formal request, write to mauriciomoguel@hotmail.com including:

1. Your name and an email address or other means for us to reply.
2. Official identification and, if a representative acts for you, or if it concerns a minor or represented person, the document proving the representation, parental authority or guardianship.
3. The data and the right you wish to exercise, or what you request. For a rectification, state the change and attach the supporting documents.
4. Your contact email or order number.

Time frames (article 31 of the Law): we will respond within 20 business days from receiving your request. If granted, we will make it effective within the 15 business days following the response. Both time frames may be extended once, for an equal period, if justified. The procedure is free; only reproduction or delivery costs could be charged (article 34).

Withdrawal is not retroactive. If you withdraw consent for health data, we will stop displaying it and delete it, except what the law requires us to keep.

9. How long we keep your data

• Pending (unpaid) configurations: automatically deleted 48 hours after they are created.
• Paid profiles: kept while the service is active (1 year from payment, plus renewals). Upon expiry, the profile stops being displayed and its data is kept hidden for 90 days to allow reactivation; afterwards it is deleted as a deleted profile.
• Deleted profile: immediately stops being displayed, even if the QR is still printed. It is deleted from our database within at most 30 days, and from backups within at most 90 days.
• Purchase data and consent records: kept, locked, for as long as tax and commercial laws require or as needed to prove the consent.

10. Security

We use reasonable administrative, technical and physical safeguards: encrypted connection (HTTPS), restricted access to the administration panel, providers with security controls, backups and minimal use of data. If a breach significantly affects your rights, we will inform you immediately so you can protect yourself (article 19 of the Law).

11. Cookies, similar technologies and scans

The site uses cookies and local storage to keep your session, remember your language (ES/EN) and make the preview and payment work. You can block or delete cookies from your browser, although some features may fail.

When you scan a QR code, the site may ask for your permission to record your approximate location, along with the date and time of the scan, to display it to the profile owner on the scans map and help locate the person or pet. It is optional: if you do not grant permission, the profile is displayed all the same. It is kept for at most 90 days.

12. Changes to this notice

The current version, with its date, will always be available at https://escanea-vida-segura.base44.app/aviso-de-privacidad. We will notify you of important changes on the site and, if new purposes or transfers require it, we will ask for your consent again. This notice is published in Spanish and English; in case of discrepancy, the Spanish version prevails.

13. Authority you may turn to

If you consider that your data protection right has been violated, you may turn to the Secretaría Anticorrupción y Buen Gobierno, which replaced the INAI in this matter:

• If we did not respond to an ARCO request, or if you disagree with our response, you may file a rights-protection request within 15 business days following our response, or from the moment the deadline lapses if we did not respond (article 40).
• You may report improper processing so that a verification procedure is initiated (article 54).

Means: https://www.gob.mx/buengobierno and https://sidec.buengobierno.gob.mx (option “Protección de Datos Personales”); or in writing at Av. Insurgentes Sur 1735, Planta Baja, Col. Guadalupe Inn, Álvaro Obregón, C.P. 01020, Mexico City.