Biometric Data Retention & Destruction Policy
Effective date: July 26, 2026
1. What we treat as biometric data
Quathos LLC ("Quathos," "we") treats worker imagery as biometric data by default, whether or not a given frame meets the technical definition under any one state's statute. In practice this covers:
- Video from the cab-facing channel, including the frames a drowsiness or distraction model reads.
- Video from the road-facing channel and from the portable site camera, where workers appear.
- Photographs, verification selfies and signature captures collected in the field app.
- Voice notes recorded by a worker, and their transcriptions.
2. What we do not do
- We do not identify people. The models read conditions — helmet present, belt fastened, eyes closed, phone in hand — and attach them to a vehicle, a task or a work order. No component matches a face, a voice or a gait against a registry to answer "who is this."
- We do not capture ambient audio. The in-vehicle channels are video only. The sole audio input is a voice note a worker chooses to record.
- We do not produce a per-person score. There is no driver ranking and no individual safety index. Readings aggregate by route, task, shift and crew.
- We do not sell, lease, trade or otherwise profit from biometric data. Ever, and with no exception for de-identified or aggregated forms of it.
3. Consent comes first
No worker is captured without informed, written consent obtained before the first capture, in a language the worker reads. Consent states what is collected, why, for how long it is kept, and who may see it. It is a precondition of deployment: the system is not switched on for a crew until consent is on file for that crew, and a worker who declines is not captured.
Where the workforce is represented by a union, deployment also follows the employer's bargaining obligations before the system is enabled.
4. Retention schedule
Each category is kept for the shortest period that still serves the safety purpose it was collected for:
| Category | Retained for |
|---|---|
| Continuous footage with no associated event | 30 days, then automatically deleted |
| Clips attached to a safety event, alert or non-conformity | 12 months from the event, or until the non-conformity is closed and the review period ends, whichever is longer |
| Checklist photographs, verification selfies, signature captures | 12 months, as part of the shift record |
| Voice notes (audio) | 30 days; the transcription is kept with the shift record |
| Detection metadata with no imagery (e.g. "belt event, route 3, 06:05") | Kept in aggregate, de-identified, with no path back to an individual |
Outer limit. Regardless of the table above, biometric data is permanently destroyed when the purpose for collecting it has been satisfied, or within one year of the worker's last interaction with the deploying employer, whichever occurs first.
End of deployment. If the agreement with an employer ends, biometric data is destroyed within 30 days of termination, except where a legal hold under section 5 applies.
5. Legal holds
If material is relevant to an accident investigation, a claim, a regulatory proceeding or litigation, deletion is suspended for that material until the matter is resolved. This is a legal obligation, not a discretion: destroying evidence after notice of a claim is spoliation. A hold is recorded, scoped to what is relevant, and released as soon as it ends.
6. Destruction
Destruction is permanent and automated. Deleted material is removed from primary storage and from backups on the backup rotation, and access logs are retained separately to evidence that the deletion occurred. Destruction is not a manual task that depends on someone remembering.
7. Disclosure
We do not disclose biometric data except: to the deploying employer, which is the party responsible for acting on it; to service providers bound by contract to these same terms (see our Subprocessors); with the worker's separate written consent; or where required by a valid warrant or subpoena issued by a court of competent jurisdiction, or otherwise compelled by law.
Where the law permits, we notify the deploying employer and the affected worker before responding to compelled disclosure, so they have the opportunity to object.
8. Security
Biometric data is stored and transmitted encrypted, using at least the standard of care we apply to our own confidential information. Access is limited to people with an operational reason to act on it, requires multi-factor authentication, and is logged — including which clip was viewed, by whom, and when. Unexplained access is treated as an incident.
9. Worker rights
A worker captured by the platform may, through the deploying employer or directly at the address below: see what is held about them; see who has accessed a clip in which they appear; dispute an event; withdraw consent for future capture; and ask that their data be deleted, subject only to a legal hold. We do not retaliate, and we require the deploying employer not to retaliate, against a worker who exercises these rights.
10. Changes
We may update this policy. Changes are effective when posted here, with an updated effective date, and material changes are communicated to deploying employers. A change is never applied retroactively to extend the retention of data already collected.
11. Contact
Questions, requests or complaints: contact@quathos.com.
Quathos LLC · Dallas, Texas · United States. See also our Privacy Policy, Subprocessors and Terms of Use.