Biometric Data Policy

Purpose and Scope

HealthEquity (“HealthEquity”) may use Biometric Data (as defined below). To the extent that HealthEquity collects Biometric Data, this Biometric Data Policy sets forth HealthEquity’s policy for the collection, use, safeguarding, storage, retention and destruction of Biometric Data.

Definitions

Biometric Identifier means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.

Biometric Informationmeans any information based on an individual’s Biometric Identifier used to identify any individual.

Biometric Data means both or either of Biometric Identifier or Biometric Information.

Purpose for Collection of Biometric Data

HealthEquity collects and uses Biometric Data solely for fraud prevention and identity verification.

Authorization

Before collecting Biometric Data, HealthEquity will:

• Inform the individual in writing that Biometric Data is being collected
• Inform the individual in writing of the specific purpose and length of use
• Inform the individual how to opt out
• Receive a written release from the individual authorizing collection

Disclosure

HealthEquity may disclose Biometric Data only when:

• The individual has provided written consent
• Disclosure completes a financial transaction authorized by the individual
• Disclosure is required by law
• Disclosure is required by a valid warrant or subpoena

Retention Schedule

Biometric Data is retained until the purpose for collection has been satisfied, or within one year of the individual’s last interaction with HealthEquity, whichever occurs first.

Data Storage

HealthEquity maintains reasonable physical, administrative, and technical safeguards to protect Biometric Data. HealthEquity will not knowingly sell, lease, trade, or otherwise profit from an individual’s Biometric Data.