Privacy Policy & Data Security Compliance

1. Executive Commitment & Data Governance Framework

Emteq Limited (operating globally as Emteq Labs, headquartered at Sussex Innovation Centre, Brighton BN1 9SB, United Kingdom) is committed to protecting the privacy, security, and integrity of physiological and behavioural data processed through our OCOsense™ smart glasses, companion software applications, and cloud telemetry analytics infrastructure.

This policy details the operational protocols governing data capture, on-device algorithmic extraction, data minimization, and regulatory alignment with UK GDPR, EU GDPR (Regulation 2016/679), and international healthcare bio-data standards. Emteq Labs acts as the Data Controller or Data Processor depending on custom commercial deployment agreements with research laboratories, enterprise healthcare providers, and OEM partners.

2. Scope of Compliance & Multi-Tiered User Protection

This privacy standard applies across all digital and physical interactions with OCOsense™ hardware devices, mobile application SDKs, and cloud API endpoints. When deployed in clinical, research, or organizational environments involving minor participants under 16 years of age, verified parental or institutional review board (IRB) consent is mandatory prior to hardware provisioning or data synchronization.

3. Categories of Biometric & Technical Telemetry Collected

To deliver high-precision facial muscle activation mapping and behavioural insights, Emteq Labs captures distinct categories of data engineered with privacy-by-design principles:

A. Physiological & Optomyography (OMG) Data

Patented OCO™ non-contact optical sensors measure sub-millimetre facial skin displacement, muscle contractions (e.g., Zygomaticus, Corrugator), micro-expressions, and physical biomechanics. Sensor values stream via encrypted Bluetooth® Low Energy to the local application before secure transmission to cloud analytics modules.

B. Spatial Motion & Environmental Telemetry

Continuous spatial orientation, posture, and kinetic activity are recorded using integrated 9-axis Inertial Measurement Units (IMU) and barometric altimeters to correlate physical movement with emotional valence and expressivity.

C. Contextual Image & Landmark Extraction

Optional outward-facing cameras and depth-sensing APIs (including hardware-level TrueDepth interfaces) capture context and facial landmark coordinates to validate dietary pace, swallowing frequency, and environmental focus. Raw imagery is processed locally wherever feasible; video telemetry is retained only under explicit, opt-in client consent protocols for study annotation.

D. System Technical Metadata

To ensure system stability, enterprise performance monitoring includes device operating system versions, latency metrics, hardware diagnostics, and connection timestamps.

4. Lawful Basis & Purpose of Data Processing

Data processing activities conducted by Emteq Labs adhere strictly to legal requirements under Article 6 and Article 9 of the EU GDPR:

• Contractual Performance: Enabling core biofeedback telemetry, real-time analytics streaming, billing services, and customer technical support.
• Explicit User Consent: Collection of Special Category Personal Data (physiological bio-signals) and optional video annotation feeds.
• Legitimate Commercial Interest: Technical validation, machine learning model enhancement, algorithm calibration, and hardware optimization within strict security boundaries.
• Regulatory & Legal Compliance: Fulfilling medical device regulatory demands, CE mark audits, and statutory obligations.

5. Data Architecture, Processing & Encryption Standards

All biometric signals and raw time-series data undergo end-to-end encryption in transit (TLS 1.3) and at rest (AES-256). Edge-computing routines prioritize local feature extraction to minimize off-device transmission of raw imagery or sensitive raw facial files.

6. Data Sharing, Authorized Sub-processors & Cross-Border Transfers

Emteq Labs never monetizes or sells biometric or user data to third-party ad networks. Controlled access is strictly restricted to:

• Authorized institutional caregivers, clinical trial leads, or academic study administrators.
• Fully vetted cloud infrastructure and sub-processors adhering to SOC 2 Type II and ISO 27001 standards.
• Corporate restructuring partners under strict Non-Disclosure Agreements (NDAs).

For cross-border data transfers originating from the UK or EEA to international jurisdictions (e.g., United States), Emteq Labs implements standard contractual clauses (SCCs) and International Data Transfer Agreements (IDTAs) to maintain uniform safety standards.

7. Enterprise Retention Schedules & Data Subject Rights

Physiological data is retained only for the active lifecycle of the enterprise contract plus a maximum 10-year period to comply with clinical audit regulations, medical hardware verification laws, and legal defense requirements. Marketing preferences are maintained for 24 months post-contract termination.

Global subjects retain full statutory rights regarding their data, including the right of access, rectification, erasure, restriction of processing, data portability, and the right to lodge a formal complaint with the UK Information Commissioner's Office (ICO) or relevant EU Supervisory Authorities.