Form Version: BDP-1.10 — Effective Date: September 28, 2026 — Last Updated: October 10, 2026

ResonantVibe LLC — Biometric Data Policy

VAVE Systems sense physiological signals through their integrated Biofeedback layer — brain activity (EEG) and heart rate via the InteraXon Muse S Athena headband, and, if and when voice analysis is offered and you enable voice biofeedback, voice-derived acoustic features via a microphone, together with similar signals from any future sensor we support — to power biofeedback sessions. To the extent any of this Biofeedback Data is treated as a "biometric identifier" or "biometric information" under laws such as the Illinois Biometric Information Privacy Act (BIPA) or the Texas Capture or Use of Biometric Identifier Act (CUBI), this policy applies. This policy supplements our Privacy Policy and is set out here as our written, publicly available biometric policy, including the retention schedule and destruction guidelines those laws require.

1. Purpose

We collect these signals only to run the biofeedback features you choose, display your readings, and generate the wellness insights you enable. We do not use them to identify you. We do not use facial recognition, fingerprints, or voiceprints; if and when voice analysis is offered, voice biofeedback analyzes acoustic features of your voice for wellness insights only and is never used to identify you.

2. Consent

We collect these signals only after you provide informed, written (electronic) consent during App onboarding, which describes what is collected, why, and for how long. Each consent is recorded with the form version presented, the timestamp, and your authenticated account. You may decline and still use your VAVE System's non-biofeedback functions.

3. No Sale or Profit

We do not sell, lease, trade, or otherwise profit from your biometric data.

4. Disclosure

We disclose biometric data only to service providers bound by contract to protect it (see the sub-processor roster in our Privacy Policy §15), with your further consent (for example, sharing with a Covered Customer's Hub account you have authorized), or as required by law.

5. Retention Schedule and Destruction Guidelines

Where biometric data is stored. All Biofeedback Data resides on Amazon Web Services (AWS): the session database holding session metadata and processed summaries ("deltas"), and Amazon S3 object storage for raw biometric recordings where the Raw Biometrics Storage module is enabled — in each case tagged only with pseudonymized session identifiers and operated under our agreement with AWS. Your identity records are held on separate identity infrastructure (Supabase — identity, authentication, and entitlements only), and Cloudflare provides content delivery only; no biometric data is stored on or transits either service, and no API traffic carrying biometric data is proxied through Cloudflare's network. Raw biometric storage is off by default: unless you hold an active Raw Biometrics Storage subscription and have given its separate consent, raw sensor readings are never retained beyond the computation of your session delta, as the schedule below records.

  • Raw sensor readings (default use): deleted as soon as your session's processed summary ("delta") is computed at session termination.
  • Raw sensor readings (active Raw Biometrics Storage subscription, with its separate consent): retained while the subscription is active; on lapse, deleted within ninety (90) days after an export window.
  • Deltas and session history: retained while used for the purposes above, and permanently destroyed when the purpose for collection has been satisfied, when you delete your account or withdraw consent, or within twenty-four (24) months of your last interaction with the Services — whichever comes first. The twenty-four-month period lets us show you your own session history and run the features you chose. When you delete your account or ask us to delete your data, we keep only a record that each session took place (the time, the composition, the duration and the VAVE System), with no name, no other personal data and no biometric data, as in a Private Mode session (Privacy Policy §6): under the account of the person who ran the session, or, for sessions you ran on your own VAVE System, in that System's history.
  • Twenty-four-month cap controls. For every user, the twenty-four-month-from-last-interaction limit applies to identifiable biometric data regardless of any Extended Data Retention or Raw Biometrics Storage subscription; an active subscription refreshes your "last interaction" only through your actual use of the Services.
  • Research-study data is retained in coded form under your study-specific consent and, once de-identified, is no longer biometric information under these laws.

Destruction uses secure deletion methods, including purging from routine backups on our backup-expiry cycle (within 90 days). Full schedules are in Section 13 of our Privacy Policy.

6. Security

We protect biometric data using a reasonable standard of care at least equal to how we protect our own confidential information, and at least the standard of care of our industry: encryption in transit and at rest, upload tagged only with a pseudonymized session identifier, identity records held on separate Backend infrastructure, and role-based, logged access controls (see Privacy Policy §3.3 and §14).

7. Contact

Questions or requests: privacy@resonantvibe.com or +1 (303) 222 0963 — ResonantVibe LLC, 42 W Byers Pl., Denver, Colorado 80223.

ResonantVibe LLC. Biometric Data Policy, BDP-1.10.‍