Privacy by design
Your data never goes on a public ledger.
Public blockchains are permanent and world-readable. That makes them a terrible place to store anyone's medical history — so we don't.
What stays private
Your name, passport number, conditions, medications, and contacts are stored only on your device. They are never transmitted to a blockchain, and never leave your phone unless you choose to export a PDF or scan the emergency QR code — which encodes blood type, allergies, medications, and emergency contact as plain text, readable by any phone camera.
on-device only
no account required
exportable, deletable anytime
What goes on-chain
A SHA-256 fingerprint of your card data — and only the fingerprint — is anchored on the XRP Ledger Mainnet, signed by your own wallet. It proves your card hasn't been silently altered, without revealing a single detail of what's inside it.
XRPL Mainnet
hash-only
irreversible by design
The full chain of trust — what "VERIFIED ON XRPL" actually means
The gold stamp on your card isn't decoration. It reflects a real, layered chain of verifiable events — each one building on the last.
Step 1 — A real, KYC-verified person acquired the XRP
To fund a wallet, XRP must be purchased through a regulated exchange (Coinbase, Kraken, MoonPay, etc.). Every regulated exchange requires identity verification (KYC) before allowing a purchase or withdrawal. This means a real, verified human had to be involved in the chain — you can't fund a TravelMedID wallet anonymously.
Step 2 — Only one person controls that wallet
The wallet's secret key never leaves your device and is never seen by TravelMedID. Only the person holding that key could have signed the anchor transaction — proving the same person who funded the wallet is the one anchoring the card.
Step 3 — The card data is anchored to that wallet, permanently
When you anchor, your card's SHA-256 fingerprint is published to XRPL Mainnet in a transaction signed by your key. The card data, the wallet, and the moment of signing are now permanently and publicly linked on the ledger. Anyone can verify the card hasn't changed since — by recomputing the hash and comparing it to what's on-chain.
What this chain proves: a real KYC-verified person controls this wallet, committed to this specific card data at a specific point in time, and the data hasn't changed since. What it doesn't prove: that the name and medical information on the card is accurate — the card's contents are self-reported. That's the one gap that remains.
Step 4 — VerraLinQ: institutional attestation (coming, automatic)
Once VerraLinQ's platform opens, completing steps 1–3 will automatically trigger a VerraLinQ credential issued to your wallet address — no extra action needed. TravelMedID will attest that a KYC-verified person activated this wallet, signed the card anchor, and the chain is intact. VerraLinQ secures that credential on their own blockchain layer, adding the institutional stamp that turns the math proof into an accountable, named attestation.
The code is already wired and waiting. The moment VerraLinQ's API goes live, the "Verified by VerraLinQ" badge activates for anyone who has completed steps 1–3 — including people who already have.
KYC at exchange level
self-custodial signing
immutable anchor
VerraLinQ attestation — coming
A real wallet, not just a verification tool
The XRPL wallet behind your card isn't limited to anchoring — it's a fully functional, self-custodial XRP wallet, the same as any other on the ledger. You can send and receive XRP from it directly, to and from any other wallet or exchange.
Receive: share your wallet's address, or let someone scan the QR code right on the back of your card, and XRP lands directly in your wallet — from a friend, an exchange withdrawal, or anywhere else on the ledger.
Send: enter a destination address and an amount, sign with your secret key, and it's submitted to XRPL Mainnet — the same way you'd send from any other XRP wallet, including to exchange accounts.
Two things need to be in place first: your TravelMedID card must exist (send/receive live inside the card's own menu), and your wallet must be activated — meaning it's been funded with a small amount of real XRP through a regulated exchange. Until the wallet is activated, the card shows an "Activate wallet" prompt instead of the send/receive options.
This isn't a closed-loop or app-specific balance — it's your XRP, on the public ledger, under your own key. TravelMedID never touches it, never custodies it, and has no ability to move, freeze, or access it on your behalf.
requires an activated wallet
send to any wallet
receive from any wallet or exchange
self-custodial — you hold the key
Uploaded medical records
If you choose to upload a medical record — from the application form or by tapping "manage records" on the back of your card — that file is stored only on your device, the same way your card data is. TravelMedID does not upload it to a server, does not view it, and cannot access it. Uploading a record is entirely optional and has no effect on the rest of your card.
Because this involves sensitive health information, a few things are true regardless of how the data was provided:
- We are not a covered entity or business associate under HIPAA, since records come directly from you and not from a healthcare provider, insurer, or clearinghouse acting through us.
- We still treat this as sensitive consumer health data and follow applicable obligations under the FTC Health Breach Notification Rule and state health-privacy laws (such as Washington's My Health My Data Act and California's CMIA/CCPA), including breach notification where required.
- We do not sell uploaded records or share them with third parties, and we do not use them for any purpose beyond displaying them back to you on your own device.
- You can delete an uploaded record at any time from your device; once deleted, we have no copy of it anywhere.
on-device only
never uploaded to us
not sold or shared
deletable anytime