In an emergency, first responders need facts in seconds: allergies, blood group, chronic conditions, emergency contacts. The problem is that the fastest way to share those facts — a QR code anyone can scan — is also the least private way to store them. That tension shaped MedTagID , an app that stores emergency medical details and shares them instantly through a secure QR code, with encrypted storage, a simple dashboard for updating the profile, and Firebase Auth plus Firestore behind it.

This guide covers the Flutter pattern that makes that design work: a QR code that encodes a reference instead of a record, encryption before anything touches the cloud, and Firestore rules that keep the profile owned by exactly one person.

The one rule: the QR code is a pointer, not a record

A QR code is not a secure container. Any phone camera can decode it, any screenshot preserves it, and a printed code cannot be recalled once it leaves your hands. So the code must never contain allergies, medications, or conditions.…