Raw video, face images, and biometric data are never sent anywhere. All measurement processing runs locally in the browser. The only data that can leave the device is the typed structured result — and only if you configure it to do so.
LOCAL ONLY
Camera
Device hardware
LOCAL ONLY
Local Engine
rPPG + quality gate
LOCAL ONLY
Structured Result
HR, RR, quality, timestamp
Optional Coach
Receives result only
Local boundary: Camera → Local Engine → Structured Result. All rPPG processing, face detection, and quality gating happens entirely on-device. Optional: the structured result (not raw data) can be sent to a webhook or AI coach module.
Raw camera stream
Processed entirely in-browser. Never transmitted.
Face images or video frames
Face detection runs locally. Zero face data leaves the device.
Biometric identifiers
No biometric profiles are created or stored.
rPPG signal data
Intermediate signal arrays are discarded after result is generated.
Device camera access logs
No server is informed when the camera is opened or closed.
Only the structured result — and only when you configure a webhook. Disabled by default.
HTTPS required
Camera access requires HTTPS. The SDK will not initialize over an unencrypted connection.
No SDK credentials stored client-side
API keys and credentials are never embedded in front-end code.
No third-party analytics in the scan flow
No tracking pixels, no marketing SDKs, no external requests during a scan.
Minimal permission scope
Only camera permission is requested. No microphone, location, or contacts.
Explicit permission on every session
Camera access is requested fresh each session. No background access.
AI coach data boundary enforced in SDK
The optional LLM layer receives its input from a defined, sanitised output subset — not from raw scan data.
Camera Vital Check is not a medical device and is not intended for clinical diagnosis or treatment decisions.
Integrators are responsible for ensuring their use case complies with applicable data protection regulations (GDPR, HIPAA, etc.) in their jurisdiction.
Any integration that captures, transmits, or stores scan results must obtain appropriate user consent.
Camera Vital Check does not store personally identifiable information. All on-device processing is session-scoped.