Biometric Policy

01Data Processing

As part of the process of creating an account with ChainIT®, you must provide a photo of your government-issued identification document (“Government ID”) and live video of your face. Here is how that data is processed:

Government ID Submission

You provide a photo of your Government ID (e.g., driver’s license). ChainIT uses barcode and ID data to retrieve your official photo from the issuing governmental authority (e.g., your state’s DMV). No face data is sent to the authority during this step.

Facial Map Extraction

ChainIT extracts facial maps from three sources: your live video, your uploaded Government ID photo, and the photo retrieved from the governmental authority. This is performed using Amazon Rekognition through a microservice in the ChainIT environment.

Fraud Analysis & Comparison

The extracted facial maps are analyzed for signs of fraud and compared against one another to verify your identity. Once verification is complete, the facial map data is deleted.

Bio ID Creation

Upon successful verification, ChainIT creates a unique Bio ID — a binary computing code derived from the facial map. This Bio ID is saved in the ChainIT Immutable Ledger database on AWS infrastructure and becomes one of five factors in your ChainIT ID. The original facial map is then deleted.

Ongoing Authentication

Each time you use your ChainIT ID, Amazon Rekognition extracts a fresh facial map from live video and compares it against your saved Bio ID. The face map is deleted immediately once the comparison is complete. Your Bio ID is device-bound and encrypted.

Your facial map and Bio ID are not shared with any other parties during this process. Each Bio ID is device-bound to your device and encrypted. ChainIT logs record only non-biometric verification events for audit purposes.

Some or all of the data described in this Biometric Policy may constitute biometric identifiers or biometric information under applicable laws.

02Data and Account Deletion

You can choose to delete your account at any time, and doing so will cause your Bio ID to be deleted. You cannot delete your Bio ID without deleting your entire account because ChainIT cannot be used without your Bio ID.

If you have not interacted with ChainIT (e.g., logged into your account, paid a subscription fee, used your ChainIT ID) for one year, ChainIT will automatically delete your account, including your Bio ID. You will need to create a new account if you choose to use ChainIT again in the future.

If you ever send ChainIT a biometric sample or screenshot in connection with seeking troubleshooting support, ChainIT will use it exclusively for the purpose of troubleshooting your issue and will destroy it once troubleshooting is complete.

03Data Security

ChainIT uses the reasonable standards of care within its industry for storing, transmitting, and protecting your data from disclosure, in a manner that is at least as good as the methods we use to store, transmit, and protect other confidential and sensitive information.

Industry-standard encryption

Bio ID data is encrypted at rest and in transit.

Immutable audit trails

ChainIT maintains audit logs verifying system integrity.

Device-bound Bio ID

Each Bio ID is cryptographically bound to your specific device.

Immediate deletion

Face maps are deleted immediately after each use — none are stored.

04Data Disclosure

ChainIT will not sell, lease, trade, or otherwise profit from your face map data or Bio ID.

Except as described in this Biometric Policy, ChainIT will not disclose, redisclose, or otherwise disseminate your Bio ID unless required by law.

05Washington My Health My Data Act Rights

🏔 Washington State

Washington residents and individuals whose biometric data is collected in Washington may have the following rights related to their biometric data to the extent such information is considered consumer health data under the Washington My Health My Data Act (the “Washington Act”):

Confirm whether we are collecting, sharing, or selling your biometric data. As explained above, we do not sell biometric data.
Access your biometric data.
Request deletion of your biometric data. Please see the Data and Account Deletion section above for more information.
Withdraw consent from our collection and sharing of your biometric data. Please note that this will result in deletion of your account.
Obtain a list of all third parties and affiliates with whom we have shared your consumer health data and an active email address or other online mechanism to contact them. We do not share consumer health data with third parties or affiliates, as those terms are defined in the Washington Act.

We will not discriminate against you for choosing to exercise any of these privacy rights. If we deny your privacy rights request and you believe it was denied in error, you have the right to request an appeal.

Submit a request or appeal privacy@chainit.com