Adopting new technology isn't only a software purchase. It's a decision about where your patients' biometric data lives, who can reach it, and what happens if something goes wrong.

Most optical technology vendors don't make that easy to see. Terms of service run for dozens of pages. Data passes through several third parties. Facial scans, prescriptions and purchase histories end up spread across servers you've never heard of, run by companies with nothing riding on your practice's reputation.

That's more than a privacy worry. It's a liability question every eye care professional should understand before signing the next technology contract.

The hidden cost of third-party data dependencies

Think about what happens when a patient uses a typical virtual try-on system. A camera captures their face. The image goes through a facial recognition API — often Google, Amazon or a specialist computer vision company. It's matched against frame dimensions from another database and rendered by yet another service. Every handoff makes a copy, and every copy adds risk.

In 2023, the optical industry saw several high-profile data incidents involving patient information held by third-party processors. The practices involved had technically done nothing wrong: they used reputable vendors with standard security certifications. But when those vendors' partners were breached, patient data was exposed — and the practices took the reputational hit.

Regulation is tightening. Illinois' Biometric Information Privacy Act (BIPA) has produced more than $2 billion in settlements since 2015, and cases increasingly target businesses that collected biometric data through third-party tools without proper consent. Texas, Washington and several other states have passed similar laws, with more on the way.

For optometry practices, the facial geometry used in virtual try-on falls squarely under these rules. If your vendor routes that data through third parties, you inherit compliance obligations you may not even know about.

What first-party architecture actually means

The idea is simple: data collected in your practice stays inside systems you control or have a direct contract with. No quiet handoffs to fourth parties. No data-monetization clauses buried in the terms. No "anonymized" pooling that empties patient consent of meaning.

Doing this well takes real technical investment, which is why many vendors avoid it. Building your own computer vision models costs more upfront than licensing an existing API. Running dedicated infrastructure takes more expertise than chaining cloud services together. Processing data on the device rather than on remote servers takes more sophisticated engineering.

The payoff grows over time. When facial mesh analysis happens entirely on a local device and is never sent to an outside server, there's no breach path — the data never leaves where it was collected. When pupillary distance is calculated with proprietary algorithms instead of third-party APIs, no outside company builds a profile of your patients.

That's the approach Eyebrowse has taken with our kiosk systems. Our virtual try-on and PD measurement process all biometric data on-device, using proprietary computer vision models we built specifically for optical use. Patient facial data never leaves the kiosk hardware. It's not a bolt-on privacy feature — it's a core architecture choice that removes whole categories of compliance risk.

Questions to ask your current vendors

Before your next contract renewal, put these questions to every vendor:

  • Where is facial or biometric data processed? The answer should name specific systems in specific locations. "The cloud" isn't an answer. Neither is "our secure servers" without documentation of what "secure" means and where those servers physically are.
  • Which third parties receive patient data? Ask for a complete data-flow diagram. Many vendors say they don't share data while routing it through several processing APIs. The real question is whether data ever leaves systems under their direct control.
  • What happens to data after the session ends? Retention rules should be explicit and auditable. "We delete data when it's no longer needed" means nothing. You need specific timeframes and specific deletion procedures.
  • How do you handle state biometric privacy laws? Any vendor working with facial recognition or facial geometry should have a clear BIPA compliance plan. If they seem unfamiliar with biometric privacy rules, treat that as a serious red flag.
  • Can I audit your data practices? Reputable vendors offer audit rights or independent audit reports — SOC 2 Type II is the relevant standard. Pushback on audits suggests practices that won't stand up to scrutiny.

Running a privacy-forward practice

Beyond choosing vendors carefully, a few habits lower your data liability:

  • Document your data flows. Draw a simple diagram of every system that touches patient information, who runs it, and where data moves between systems. This often uncovers dependencies you didn't know you had.
  • Match your consent forms to what you actually do. Generic HIPAA consent forms don't cover biometric data. If you use virtual try-on, AR tools or any facial recognition, your consent language should name biometric data specifically, explain how it's processed, and identify any third parties involved.
  • Name a privacy point person. It needn't be a full-time role, but someone should own vendor contract reviews, keep the data-flow documentation current and stay on top of relevant regulations.
  • Choose on-device processing when you can. Technology that handles sensitive data locally instead of sending it to remote servers fundamentally reduces your exposure — for PD measurement, virtual try-on and any other system that captures patient biometrics.
  • Check your insurance. Cyber liability policies differ widely. Make sure yours covers biometric data specifically, and understand which compliance failures could void it.

Trust is a competitive advantage

Patients increasingly know their data has value and that not every business treats it with care. A 2024 Pew Research study found that 79% of Americans are concerned about how companies use their personal data, with health data among the most sensitive categories.

Practices that can credibly show privacy-forward operations stand out. When a patient asks what happens to their facial scan, being able to say "it's processed entirely on this device and deleted right away — it never goes to an outside server" builds trust that matters.

This isn't about fear or regulatory panic. It's about recognizing that data practices reflect values, and patients notice when a practice takes their privacy seriously.

The technology you bring in says something about your priorities. Choosing systems built on first-party architecture — where patient data stays where it belongs — is both a risk-management decision and a statement about the kind of practice you're building.