Terms &
Conditions

LifePassport is designed so that you are always in control of your identity data. Your verified credentials are stored on your device, encrypted and protected by your biometric authentication. No personal identity data is shared with any third party without your explicit, per-request approval.

You may verify your identity using the App by:

• Scanning your passport or driving licence (OCR and NFC chip reading)
• Completing a liveness verification (selfie check)
• Connecting to government services via OAuth (e.g. HMRC, NHS Login)
• Providing a self-asserted identity profile (subject to cross-referencing against documents)

You are responsible for ensuring that the identity documents you scan are your own and are valid. Attempting to verify using another person's documents is a violation of these Terms and may constitute identity fraud.

When an Identity Consumer requests verification of your identity, you will receive a notification showing exactly which Claims are being requested. You may:

• Approve — Share the requested Claims with the business
• Approve with ZKP — Confirm facts (e.g. "over 18") without revealing the underlying data
• Reject — Decline the request entirely

Approval requires biometric authentication (fingerprint or face recognition). Once approved, the shared Claims are transmitted to the requesting business. You can view all past sharing events in the App's audit log.

You are responsible for:

• Maintaining the security of your device (screen lock, biometric protection, software updates)
• Not sharing your device unlock credentials with others
• Reporting a lost or stolen device promptly so we can revoke device registration
• Not rooting, jailbreaking, or otherwise compromising your device's security

You may delete your account at any time through the App settings. This will:

• Remove all server-side data (account details, hashes, device registrations) within 30 days
• Retain verification receipts for up to 7 years (regulatory requirement)
• Not affect data already stored on your device (uninstall the App to remove that)
• Revoke all active child profile consents if you have child profiles

Children under 18 cannot create their own LifePassport account. Only a parent or legal guardian may create a Child Profile within their own account. By creating a Child Profile, you represent and warrant that:

• You are the child's parent or legal guardian
• You have the legal authority to consent to the processing of the child's data
• The information you provide about the child is accurate

As a Parent, you are solely responsible for managing your child's identity on the platform. This includes:

• Deciding which platforms can request your child's identity verification
• Granting and revoking consent for each platform individually
• Completing re-verification checks when notified by the system
• Reviewing your child's verification history in the audit log

Consent granted to a platform remains active until you revoke it, the child changes age bracket (triggering automatic review), or the platform's re-verification schedule expires without renewal.

Child profiles are subject to periodic age re-verification. The system will automatically schedule re-checks based on the child's age bracket and the requirements of each consented platform. You will be notified via push notification when a re-verification is due.

If a re-verification is not completed within the required period, the child's verification status with the affected platform will be marked as stale and may be suspended.

When a child transitions to a new age bracket (e.g. turning 13, 16, or 18), the system may automatically revoke consents that are no longer appropriate. You will be notified of any automatic revocations and may re-grant consent where appropriate.

When a child reaches 18, they may create their own LifePassport account and take ownership of their verified identity. The parent's Child Profile will be retired, and the young adult will manage their own identity going forward.

You may invite a secondary parent or guardian to co-manage a child's profile. Both parents will have visibility of the child's consent status and verification history. The primary parent retains ultimate control and can remove the secondary parent at any time.

To use the LifePassport Consumer Portal and API, you must register your business by providing accurate company details, industry category, and contact information. You represent and warrant that:

• You are authorised to act on behalf of the registered business
• The business is a legitimate, legally registered entity
• The industry category you select is accurate (this determines which Claims you may request)
• You will comply with all applicable data protection laws when handling identity data received through our platform

LifePassport enforces strict, regulation-based restrictions on which Claims each business category may request. These restrictions are enforced programmatically by our data governance service and cannot be overridden. Examples:

• A gambling operator may request age verification but not medical data
• A hotel may request name and address verification but not credit scores
• A healthcare provider may request NHS number but not employment history

Attempting to circumvent these restrictions (e.g. by misrepresenting your industry category) is a material breach of these Terms and will result in immediate account termination.

When you receive identity data through the LifePassport platform, you are the data controller for that data under applicable data protection law. You agree to:

• Process received identity data only for the stated purpose of the verification request
• Implement appropriate technical and organisational security measures to protect the data
• Comply with applicable data retention requirements and delete data when no longer needed
• Respond to data subject access requests from Identity Owners in a timely manner
• Notify LifePassport and affected Identity Owners of any data breach involving their identity data

Your use of the LifePassport API is subject to the following conditions:

• API keys are confidential and must not be shared or exposed in client-side code
• You must implement webhook signature verification (HMAC-SHA256) to prevent tampering
• Rate limits apply and must be respected — excessive requests may result in throttling or suspension
• You must maintain separate API keys for sandbox/staging and production environments
• API keys should be rotated periodically and revoked immediately if compromised

LifePassport's pricing and payment terms are set out in your service agreement or on the pricing page of the Website. We reserve the right to change pricing with 30 days' notice. Continued use of the platform after a pricing change constitutes acceptance of the new pricing.

We aim to provide a highly available service but do not guarantee 100% uptime. Planned maintenance will be communicated in advance where possible. We are not liable for service interruptions beyond our reasonable control.

If your platform receives verification data about a child (under 18), you must:

• Implement age-appropriate access controls as required by the Online Safety Act 2023 and the Age Appropriate Design Code
• Not use child identity data for profiling, behavioural advertising, or any purpose beyond the stated verification purpose
• Comply with the re-verification schedule set by the system and the parent
• Immediately cease using a child's verification data if the parent revokes consent

You agree to indemnify and hold harmless LifePassport from any claims, damages, or expenses arising from your misuse of the platform, including providing false identity information or using another person's documents.

You agree to indemnify and hold harmless LifePassport from any claims, damages, or expenses arising from your handling of identity data received through the platform, including data breaches, non-compliance with data protection law, or misuse of verification data.