Knowledge Base

Privacy

Privacy-By-Design

FaceReader is installed on-site and adheres to strict privacy-by-design protocols. For example, the software offers the option not to record the test participant's face during the analysis. In this case only meta data are acquired that cannot be related to an identifiable person. Examples of meta data are facial expressions, head pose, age and gender.

FaceReader is a software tool for scientific research. FaceReader is not capable of recognizing or identifying faces or people, and therefore unsuitable for surveillance purposes. For more details about applications please refer to our ethics statement on the following web page:

https://www.noldus.com/about-noldus/ethics-face-reading

GDPR And HIPAA Compliance

FaceReader analyzes your participant's face while interacting with the digital content on their screen. When you analyze or record the participant's face, please be aware of requirements for storing personal data. Video and audio of the participant are personally identifiable information and are, therefore, subject to GDPR regulations in Europe and HIPAA regulations in the USA. Facial expressions, video recordings with the test participant's voice, heart rate, breathing rate data are sensitive data. With the correct procedure you can make sure that you comply with privacy regulations.

To comply with GDPR or HIPAA regulations, take notice of the following:

When you record the participant, or share these recordings, make sure you ask the participant consent for video recording and let him or her sign a consent form. This informed consent form should include:

• The purpose of the recordings. If there is a possibility that the recordings will be reused for other studies, describe this explicitly.
• Which personally identifiable information is stored.

  When you do a camera analysis, by default the video is stored, which is personally identifiable information. To switch off video recording, deselect the Record option in the window in which you select your camera.

  If you enter participant details like their name, age or gender this is also personally identifiable information. We recommend to use generic names, like participant 1, and to use age classes instead of specific ages.

  Facial expressions, video recordings with the test participant's voice, heart rate, and breathing rate data are sensitive data.

  Export files may also contain personally identifiable information or sensitive data.

• Who will have access to the personally identifiable information. Think of authorized staff directly involved in the study, but also of Noldus support staff in case support is needed.
• The retention policy, when the personally identifiable information will be deleted.
• The right of subjects to withdraw permission for the use of the personally identifiable information and instructions for the participant to withdraw permission.
• The right to data portability and instructions for the participant how to receive their data.
• Security and privacy measures taken.

  In FaceReader, video and data are stored locally on the computer. Take security measurements for the stored videos and describe this in the consent form.

For information about Noldus' Privacy Policy with regard to your data, see: https://www.noldus.com/legal/privacy-policy

Source: FaceReader 10 Reference Manual (Help), Noldus Information Technology