Medical information receives additional protection
Blood type, allergies, medication, medical conditions and emergency instructions are health data and special-category personal data under the UK GDPR. Adding these fields is optional.
Why and how it is processed
RiderSOS processes account and service data where necessary to provide the service requested by the user under Article 6(1)(b). Security and fraud-prevention records may be processed for RiderSOS’s legitimate interests under Article 6(1)(f). Health information is processed on the basis of the user’s explicit consent under Article 9(2)(a).
Consent is requested separately from marketing, recorded with the wording and version accepted, and can be withdrawn from the account dashboard. Withdrawal does not affect processing that was lawful before withdrawal.
You choose what a scan reveals
Each category has its own visibility switch. Information switched on may be viewed by anyone who scans the physical tag or obtains its emergency-profile link. RiderSOS cannot verify the identity of every viewer in an emergency, so users should publish only what is necessary.
Withdrawing consent immediately deactivates the emergency profile. A separate deletion request is available for erasure.
Safeguards
Medical fields are encrypted at rest. RiderSOS also uses HTTPS, secure session cookies, access controls, CSRF protection, rate limits, non-sequential public tokens and audit records. Access is limited to authorised functions and service providers that need it to operate the platform.
No internet service can promise absolute security. RiderSOS maintains incident-handling procedures and will assess and report qualifying personal-data breaches as required by law.
Service providers and transfers
RiderSOS may use contracted providers for hosting and database infrastructure, storage, email, payments, messaging, security and customer support. They may process only the information needed for their function and must be governed by appropriate data-processing terms.
If personal data is transferred outside the UK, RiderSOS will use an applicable adequacy regulation or approved safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with a transfer-risk assessment where required. RiderSOS does not sell medical data.
Retention and deletion
Profile information is retained while the account and service remain active. A withdrawn profile is hidden immediately. Valid erasure requests are completed without undue delay and normally within one month, subject to identity checks and lawful exceptions. Residual encrypted backups are removed through the normal backup-expiry cycle.
Consent and request records may be retained where necessary to demonstrate compliance or establish, exercise or defend legal claims. Transaction records may be retained where tax, accounting or fraud-prevention law requires it.
Your data rights
Users may request access, correction, erasure, restriction, portability, or object to relevant processing. Account holders can edit visibility, export their profile in JSON or CSV, withdraw medical consent and submit a deletion request from the profile dashboard.
RiderSOS may ask for proportionate identity verification before fulfilling a request. Requests are normally answered within one month, although the law permits an extension for complex or numerous requests.
Questions and complaints
Contact support@ridersos.uk or write to RiderSOS, 54 Cromwell Road, Cheltenham, Gloucestershire, GL52 5DW.
You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Last updated: 26 July 2026.