We are compliant with the data privacy regulation in every country we operate. If there are no relevant data privacy laws in a country of operation, we use HIPAA (the US healthcare data privacy regulation ) as our legal framework for data licensing.
This means companies, such as ours, are allowed to collect DE-IDENTIFIED patient data (No personal information, such as patients' names, phone numbers, etc., and no images with identifiable elements, such as areas around the open eyes in the case of face localization).
As long as you provide us with the de-identified data, we are compliant with the data privacy regulation in most jurisdictions.