Biometric Information Notice and Consent
Visibility Group Limited · Version 1.0
1. Who we are
Visibility Group Limited ("Acclaimedly", "we") is a company incorporated in Hong Kong [TBC: company number], at Unit 2904, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong. We run acclaimedly.com, and we decide why and how the biometric information described here is processed. That makes us the controller under data protection law and the "private entity in possession" under Illinois law.
2. What biometric information we collect
If you choose the face check, a short video of your face is captured by your device's camera. It goes directly to Amazon Rekognition Face Liveness, a service of Amazon Web Services, Inc. ("AWS"). From it, AWS:
- decides whether a live person was present
- produces a face template: a numeric representation (a vector) of your face's geometry
The template is a "biometric identifier" or "biometric information" under the laws of Illinois, Texas, Washington and Colorado, and "biometric data" under GDPR and UK GDPR. Other laws use similar terms. We treat it as the most sensitive information we hold.
We do not collect fingerprints, voiceprints, retina or iris scans, or any other biometric information, and we do not infer from your face your age, sex, ethnicity, emotion or anything else.
3. Why we collect it
For two purposes only:
- Liveness: to confirm that a real, living person is creating the account.
- One person, one account: to compare your template against the templates of other Acclaimedly members. This stops one person holding more than one account, and stops a person whose account we closed for breaking our rules from opening a new one.
We do not use it for any other purpose. We do not use it to identify you to anyone, to recognise you in photographs on the site or elsewhere, for marketing, or to train any system.
4. Who it is disclosed to
- AWS, which processes it on our instructions only. Under its service terms, AWS stores, searches and deletes face templates only at our direction, keeps them in a secure environment, does not use them for any other purpose and does not transfer them to any third party. We have opted out of AWS using our content to improve its services.
- Nobody else, unless we are required to by a valid warrant or subpoena issued by a court of competent jurisdiction, or by a law that requires it. If that happens and the law allows, we will tell you.
We never sell, lease, trade or otherwise profit from your biometric information.
5. How long we keep it, and when it is destroyed
| Situation | When the template is permanently destroyed |
|---|---|
| Your account is open and you use it | Kept, because the purposes in section 3 still apply |
| You have not signed in for 24 months | Within 30 days of the 24-month point. You will be asked to verify again next time you sign in |
| You close your account | Within 30 days of the account being deleted. This includes the optional 30-day pause, so at most 60 days after you ask to close it |
| You withdraw consent (Account › Verification, or by writing to us) | Within 30 days. You then verify with photo ID |
| We close your account for a serious or repeated breach of our rules | 24 months after the date of closure |
| Your face check fails, or you abandon it part-way | At once, because no template is stored. AWS deletes any session data under its own terms |
| A face check finds a possible match with another account | The new template is not stored. The match goes to a person at Acclaimedly to review, and you are offered photo ID instead |
In no case is a template kept longer than 24 months after your last interaction with Acclaimedly. That is shorter than the three-year limit in Illinois law and within the limits in Colorado and Texas law.
Destruction means deleting the template from the AWS face collection. That leaves nothing from which your face could be reconstructed or matched. We keep a log that a template with a given reference was destroyed on a given date. The log contains no biometric information.
6. How we protect it
We store, transmit and protect biometric information using the reasonable standard of care in our industry, and at least as carefully as the most sensitive other information we hold:
- the template is encrypted in transit and at rest
- it is held only in the AWS face collection, never in our own database
- our database holds only an opaque reference number that links your account to the template
- access to the collection is limited to a single service role, used only for the purposes in section 3
- staff cannot view or export templates
7. Your choices and rights
- The face check is optional. Photo ID gives you exactly the same account. Choosing it, or withdrawing consent later, never costs you anything.
- You may withdraw consent at any time, with the same effect as in section 5.
- Depending on where you live, you also have the rights set out in our Privacy Policy: to access, delete or correct your information, to object, and to complain to a regulator. You will not be treated differently for using any of these rights.
To use any of these rights, write to [privacy@acclaimedly.com TBC] or use Account › Privacy.
8. Legal basis (EU, UK and similar laws)
We rely on your explicit consent (GDPR and UK GDPR Articles 6(1)(a) and 9(2)(a)). You give it by ticking the box on the verification screen. You give it separately from accepting our Terms, and it can be withdrawn without affecting your account.
9. Where it is processed
The face collection is held by AWS in the US East (N. Virginia, us-east-1) region. If you are in the EU, UK or another country with transfer rules, see section 9 of the Privacy Policy.
10. Changes to this notice
If we ever want to use biometric information for a new purpose, or keep it longer, we will ask for your consent again first. Without it, your template will not be used for the new purpose. Other changes are dated below.
Version history: 1.0 — 18 October 2026.
Part C — Consumer Health Data Privacy Policy (Washington, Nevada)
Washington's My Health My Data Act (RCW 19.373) and Nevada SB 370 count biometric data as "consumer health data". Washington requires a separate policy with a prominent link on the home page. The only consumer health data Acclaimedly processes is the face template in Part B.
- Categories collected: biometric data, meaning a face template produced from a face check you choose to make.
- Sources: you, through your device's camera, processed by AWS.
- Purpose: confirming you are a live person, and keeping each person to one account (Part B section 3).
- Shared with: AWS, as our processor. Nobody else, apart from the legal-compulsion case in Part B section 4.
- Sold: never. We do not sell consumer health data and will not ask you for an authorisation to sell it.
- Your rights: to confirm whether we hold your consumer health data and get a copy, to see the list of third parties and affiliates it is shared with, to withdraw consent and to have it deleted. Deletion includes deletion by AWS. Write to [privacy@acclaimedly.com TBC]. If we refuse a request, you may appeal by replying to our decision. A second person will decide within 45 days, and if they also refuse, we will tell you how to contact the Washington Attorney General.
- Geofence: we do not use a geofence around any health care facility.