Data Protection & Privacy

Effective Date: February 10, 2026

This Policy describes the practices of Prism Labs Inc. (“Prism” or “we”) concerning information that we obtain when you use the Prism-powered body scanning feature in the application of a Prism customer (“Customer”), such as a health or fitness provider. By using the body scanning technology, you consent to the collection, use, disclosure, retention, and other handling of body scans (including biometric face scans) and other data as described below.

1. Collection and Use of Data

The Customer uses technology supplied by Prism to provide its body scan service. 

You must provide consent before you perform a scan for the first time. Some users are presented with a second, optional “Research Consent.” You do not need to provide a Research Consent to use the body scan service and may revoke either consent by contacting the Customer that operates the application through which you consented.

In each scan, the Customer sends Prism images or videos of you and related data, such as gender, height, weight, and birth year. Prism uses this to provide the scanning service, including:

• to build 3D body scans of you from head to toe (including some biometric face geometry); 
• to allow the Customer to show you part of the scan as a 3D avatar of you; and
• to calculate insights for the Customer such as your body composition (like body fat percentage and lean body mass).

Because the scans include rough measurements of face geometry, some data in the scans and avatars may be considered “biometric identifiers” or similar under certain biometric privacy laws, even though Prism does not use the scans for identification purposes.

In addition, if you provide a Research Consent, Prism will use the images or videos of you and related data in its research database. Examples of data and usage in the research database include:

• Images captured during your scans, which may be used to make new 3D body scans (including of biometric facial geometry) and improve the accuracy and consistency of 3D reconstruction across different lighting, clothing, and device conditions.
• 3D body scans and geometric measurements (such as face, waist, hip, torso, and limb geometry), which may support improvements in measurement consistency over time.  
• Demographic information such as height, weight, gender, and birth year, which may support population-level insights.
• Body-composition estimates including body fat %, lean mass, and fat mass, which may help refine health-related insights across a broad range of users.
• Scan-session metadata such as device model, camera behavior, and frame quality, which may help reduce scan failures and improve guided capture.
• Anonymized or aggregated patterns, which may help support the development of healthier-range benchmarks, recommendations, and indicators.

The data does not include your name, username, email, phone number, or other contact information, and Prism never uses it to identify you.  The copies of scans and other data in this opt-in research database are not used to provide services to the Customer.

2. Disclosure of Information

Subject to applicable law, Prism may disclose the images, the full scans, and other data we have about you, as follows:

• To service providers. Prism may share the scans and other data with affiliates and other service providers that support the purposes described in Section 1, such as providers of data storage and security. The current list of such service providers is at https://www.prismlabs.tech/subprocessors. The specific service providers are subject to change without notice, but we will keep the list up to date.  
• To the Customer. Prism sends the Customer a scan (e.g., in 3D avatar form) and body insights data. The Customer's collection, use, disclosure, retention, and other handling of the scan and other data are subject to the Customer’s own policies and practices, not this Policy.
• In connection with business changes. Subject to applicable law, Prism may share the scans and related data for an actual or contemplated business sale, merger, consolidation, change in control, transfer of substantial assets, or reorganization of Prism, or due diligence in anticipation of such an event (for example, if a company were to acquire Prism, it may also acquire the scans and other data we hold).  

• To other third parties. Prism may share the scans and other data with third parties where (i) required by applicable law, including responses to appropriate legal process (such as a qualifying subpoena or warrant); or (ii) the disclosure completes a financial transaction requested by you or your legally authorized representative.

Prism may authorize its service providers and affiliates to make the same sorts of disclosures of the scan data and other data.

We may seek your additional consent to these or other disclosures, or we may omit your data from the transfer, where we believe this is required by applicable law.

3. Retention and Destruction of Face Scans

Prism stores its copy of the data described in this Policy, including the body scans that contain face geometry, for the purposes described in Section 1 above. Prism will permanently destroy our copy of any scans of face geometry that we hold for powering a Customer application when the first of the following occurs:

• The purpose for collecting such information has been satisfied (such as when the Customer informs us that an opt-out now applies to the records, or when the Customer requests that we delete the records because the Customer’s lawful retention period is expiring);
• Within 3 years of your last scan with Prism through that Customer’s application.

Biometric face scans located in the research database are promptly destroyed right after receipt or creation.

To select a destruction method for the scans of face geometry, Prism will take into consideration (i) available technology, (ii) the nature of the data, and (iii) the means by which the data has been stored. Prism may retain other data about you under different retention policies and procedures.

4. Automated Processing and AI Generated Outputs

Prism uses automated algorithms and artificial intelligence models to create 3D body scans and related body-composition insights from the images or videos and other information described in this Policy. These AI-generated scans and insights are provided to you and to the Customer to support visualization and wellness-related information only and are not a substitute for professional medical advice, diagnosis, or treatment. When you use the Prism-powered body scan feature, you are interacting with an AI-enabled system.

_{A list of data subprocessors can be found at www.prismlabs.tech/subprocessors}