Washington Consumer Health Data Privacy Policy
This policy is published under the Washington My Health My Data Act (RCW 19.373). It applies to Washington residents, and to Nevada residents under Nevada SB 370, which provides comparable protections.
Effective: 24 September 2026 · Last updated: 24 September 2026
1. Categories of consumer health data we collect, and the purpose
IDFire Technologies Inc. collects one category of data that may fall within the definition of consumer health data:
| Category | Purpose, and how it is used |
|---|---|
| Biometric data — a live capture of your face and a three-dimensional map of its geometry, and the protected mathematical reference derived from them | To confirm a live person is present and not a photograph, mask, recording or synthetic forgery; to confirm that the person presenting an identity document is the person pictured in it; and to confirm that you do not already hold an IDFire identity. These are the services you request when you create an IDFire identity |
We do not collect data concerning physical or mental health conditions, diagnoses, treatment, medication, reproductive or sexual health, gender-affirming care, or precise location that could indicate an attempt to receive health services. We do not infer any health condition from biometric data.
2. Categories of sources
Consumer health data is collected from you — from the capture you make on your own device during identity verification. We do not obtain consumer health data from data brokers, from public records, or from any other third party.
3. Categories of consumer health data that is shared
None. We do not share consumer health data.
We do not sell consumer health data, and we will not sell it. Selling consumer health data requires your signed, valid authorization, and we have never sought one.
4. Categories of third parties and affiliates with whom we share it
None.
Amazon Web Services hosts our systems and processes data on our documented instructions as a service provider. It is not permitted to use consumer health data for any purpose of its own.
5. How to exercise your rights
You have the right to:
- Confirm whether we are collecting, sharing or selling your consumer health data, and to access that data, including a list of all third parties with whom we have shared it;
- Withdraw consent to our collection and sharing of your consumer health data; and
- Delete your consumer health data.
Exercise any of these by writing to privacy@idfire.ai, or in the IDFire app under account settings. You may also use an authorised agent.
We respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you within the first 45 days and explain why. We will not charge you, and we will not deny you goods or services, for exercising these rights.
If we decline a request, we will tell you why and how to appeal. You may appeal by replying to our decision; we respond to an appeal within 45 days. If we deny the appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the Nevada Attorney General if you are a Nevada resident.
6. Contact
IDFire Technologies Inc. — privacy@idfire.ai