Biometric Data Retention and Destruction Policy
1. What this covers
Two services we use create biometric information on our behalf ("Biometric Data"):
- Identity verification. Persona Identities, Inc. ("Persona") verifies the identity of people who join our research community and prevents duplicate or fraudulent accounts. It compares a selfie you take with the photo on your government-issued ID, which creates facial geometry.
- Skin analysis. In skin studies, Perfect Corp. (YouCam) analyses Study photos of your face to measure skin features such as wrinkles, spots, texture and redness. To do this it maps the features of your face.
This policy explains how Biometric Data is collected, used, kept and destroyed.
2. Consent
- Identity verification: before you begin, the app shows you a notice from Reputable and Persona shows its consent screen; together with this policy, they tell you the purpose and how long Biometric Data is kept. Selecting "Begin verifying" is your written consent. If you do not want to verify this way, contact legal@reputable.health and we will arrange an alternative method.
- Skin analysis: the Study Consent Form asks for your separate written consent before any of your photos are analysed this way. You may take part in the rest of the Study without it where the Study design allows.
3. Use and disclosure
- Biometric Data is used only for identity verification and fraud prevention (Persona) or for measuring skin outcomes in the Study you joined (YouCam).
- It is created and held by those providers as our agents, so Reputable is responsible for it under biometric privacy laws even though Reputable never receives or stores facial geometry itself. From Persona we receive the verification result and details from your ID (such as name, date of birth and gender); from skin analysis we receive the skin measurements.
- We do not sell, lease, trade or otherwise profit from Biometric Data.
- We do not disclose it to anyone other than those providers, except with your consent, to complete a transaction you requested, or where required by law or a valid legal order.
4. Retention and destruction
Identity verification. Persona keeps Biometric Data, selfie and ID images to verify your identity when you join and, while your account is open, to prevent the same person opening a second account, for no longer than three years. It is permanently destroyed at the earliest of:
- when you delete your Reputable account, which also deletes your Persona record;
- when it is no longer needed for verification or fraud prevention; and
- three years after your last interaction with Reputable.
Skin analysis. Perfect Corp processes Study photos to provide skin analysis. Retention of photos and facial feature data by Perfect Corp depends on the service and features used, as described in its privacy policy.
Where applicable law requires us to retain a verification record, that record contains only the verification outcome and date. It does not include images or Biometric Data. Study photos are retained separately as described in the Consent Form.
5. Security
Our providers store and transmit Biometric Data using a reasonable standard of care, and in a manner at least as protective as they protect other confidential and sensitive information, including encryption in transit and at rest and restricted access.
6. Contact
Questions or requests: legal@reputable.health, or Reputable Labs Inc., attention Legal, 251 Little Falls Drive, Wilmington, DE 19808, USA.