Biometric Information Consent

Last Updated: September 21, 2026

1. What Is Biometric Information?

For purposes of this Consent, "biometric information" includes:

• Progress photos you voluntarily upload (which may include images of your face and body).
• Voice recordings captured when you use Lexi's voice input feature.

Lexi does not perform biometric identification from photos or voice — we do not identify you from your face geometry or voiceprint. We obtain this written consent as a matter of compliance best practice given the nature of the data.

2. Progress Photos — Purpose and Use

What we collect: Images you voluntarily upload through the progress photo feature.

Why: To allow you to visually track your body composition and physical progress. Photos are displayed only to you.

• Stored and displayed only to you in your progress timeline.
• Not analyzed by AI for facial recognition or body geometry identification.
• Not shared with any third party for biometric analysis.
• Not used to identify you or any other person.
• Stored with Cloudflare R2, AES-256 encrypted at rest, presigned URL access only.

3. Voice Input — Purpose and Use

What we collect: Audio captured through your device microphone when you use Lexi's voice input feature.

Why: To transcribe your spoken input into text so Lexi can respond and process voice-logged meals.

• Voice audio is transmitted to Deepgram (for live conversation) or OpenAI Whisper (for recorded messages) solely for transcription. Audio is not retained by Lexi and is not retained by either provider beyond the processing of your request. Only the text transcript is kept.
• The audio bytes are transient — NOT stored by Lexi at any point. Audio is held in memory only for the duration of the API call, then discarded.
• Only the resulting text transcript is retained as part of your chat history.
• Not used for speaker identification, voice profiling, or biometric identification.

4. Third-Party Disclosure

4.1 Progress Photos

Progress photos are stored with Cloudflare R2, our encrypted cloud storage provider, accessible only to you via presigned URLs. Photos are not shared with any other party unless required by law.

4.2 Voice Recordings

Audio from voice input is transmitted to two third parties for transcription only:

We do not sell, lease, trade, profit from, or otherwise disclose your biometric information to any other third party.

5. Retention and Destruction

• Progress photos: retained while your account is active; individually deletable at any time. Hard-deleted within 30 days of account deletion.
• Voice audio (raw): NOT retained — transient only, discarded from memory after transcription.
• Voice transcriptions: retained as chat history per account lifecycle.

We will destroy biometric information no later than the earlier of: (a) when the initial purpose for collecting it has been satisfied; or (b) within 3 years of your last interaction with the Services.

6. Your Rights

• Right to Withdraw Consent: you may withdraw consent at any time in Settings. Withdrawal disables the progress photo and voice input features.
• Right to Delete: request deletion of all stored biometric information in Settings or by emailing privacy@meetlexi.ai.
• Right to Access: request a list of your stored biometric information and any third parties to whom it has been disclosed.

Illinois (BIPA): You have the right to receive this policy in writing before collection begins, to know the specific purpose and retention period, and to prohibit the sale of your biometric information. Statutory damages: $1,000 per negligent violation or $5,000 per intentional violation.

Texas (CUBI): You have the right to be informed before collection and to have biometric identifiers destroyed within a reasonable time after the purpose of collection is fulfilled, or within one year of your last interaction.

Washington (MHMDA): You have the right to confirm, access, delete, and withdraw consent for consumer health data. We do not sell biometric data.

7. Security

• In transit: TLS 1.2 or higher for all transmissions.
• At rest (photos): AES-256 encryption via Cloudflare R2; presigned URL access only.
• Access control: production systems accessible only to authorized personnel.
• Voice audio: never written to disk; processed in memory only.

8. Your Consent

By activating the progress photo feature or the voice input feature within the Lexi application, you:

• Confirm you have read and understood this Biometric Information Consent.
• Consent to the collection, storage, use, and disclosure of biometric information as described above.
• Acknowledge the retention and destruction schedule set forth above.
• Confirm you are at least 18 years of age.

You may withdraw this consent at any time by disabling the relevant feature in Settings or by emailing privacy@meetlexi.ai.

Contact

Flagship Digital LLC

7901 4th St N STE 300, St. Petersburg, FL 33702

Email: privacy@meetlexi.ai