Running Eye Tracking Studies without Compromising Participant Privacy

TL;DR

Why eye data needs careful handling

Eye tracking has become a valuable tool for neurological and ophthalmic research. It also produces some of the most sensitive data a study can collect.

To measure gaze and pupil response, eye tracking systems record images of the eye. Those images can include the iris, which is a recognized biometric trait, and depending on the camera field of view, parts of the face around the eye.

Regulators treat this kind of information seriously. HIPAA's Safe Harbor de-identification method lists biometric identifiers, as well as full-face photographs and comparable images, among the identifiers that must be removed. In practice, iris and retina scans are also treated as identifying. In Europe, GDPR places biometric data used to identify a person in its special categories of personal data, which carry stricter processing conditions. [2] [3]

The stakes of getting data protection wrong are also high. Healthcare data breaches averaged $6.64 million in IBM's 2026 report, making healthcare the costliest industry for data breaches for the 13th consecutive year. The same report found that 53 percent of breached organizations had not encrypted sensitive data at rest and in motion at the time of the breach. [1]

For research teams, the lesson is simple. Privacy cannot be added at the end of a study. It has to be part of how eye data is captured, processed, and stored from the start.

Where privacy creates friction in research

Most eye tracking studies meet privacy questions at several points before the first participant is enrolled.

• IRB and ethics review
  Review boards want to know exactly what is captured, how participant identity is protected, and what happens to images after the study.
• Sponsor security review
  Pharma and biotech sponsors often run their own security assessment before approving a vendor or a device for use in a trial.
• Procurement
  Health systems and research institutions typically require documentation on encryption, access control, and data retention before purchase.
• Participant consent
  Consent forms must describe eye image capture in plain language, and participants need a clear way to withdraw.
• Multi-site studies
  Each site must apply the same privacy settings, or data protection becomes inconsistent across the study.
• Cross-border data transfer
  International studies need to account for different rules on where data is stored and how it moves between countries.

When these questions do not have clear answers, studies stall. Clear, consistent privacy controls help research teams move through review faster and with fewer surprises.

Six principles for responsible eye data handling

3.1 Minimize at capture

The safest data is data that is never collected. Eye images should be limited to the region the research actually needs, such as the ocular surface, rather than the full camera frame.

3.2 De-identify images by default

When images are retained, identifying features should be removed automatically. That includes blurring the iris where iris texture is not needed for the research question, and stripping metadata such as capture timestamps and device serial numbers.

3.3 Keep derived data where raw data is not needed

Many studies only need measurements such as gaze position, saccade velocity, or pupil diameter. In those cases, raw images can be discarded immediately after processing, leaving only the derived metrics.

3.4 Make consent enforceable and revocable

Consent should do more than sit in a signed form. Software should block data collection that a participant has not agreed to, and withdrawal of consent should trigger deletion of the associated data.

3.5 Set retention and secure deletion rules

Every study should define how long data is kept on each device and how it is deleted. Secure deletion ensures removed data cannot be recovered.

3.6 Keep an audit trail

A record of who accessed or exported data, when, and with what outcome helps teams demonstrate compliance to reviewers, sponsors, and auditors.

Questions IRBs and security reviewers commonly ask

Research teams can save time by preparing answers to these questions before submission.

• What eye data is captured, and at what resolution?
• Are images of the iris or face retained?
• How is participant identity separated from study data?
• Is data encrypted when stored and when transferred?
• Where is data stored, and who can access it?
• How long is data kept, and how is it deleted?
• What happens to a participant's data if they withdraw consent?
• Is there an audit log of data access and export?
• Are the same privacy settings applied at every study site?

Shared responsibility between technology and study teams

Strong privacy depends on both the technology and the people running the study.

What the technology should handle

• Cropping images to the region of interest
• Blurring identifying features and stripping metadata
• Encrypting exported data
• Enforcing consent and retention rules
• Generating audit logs

What the study team owns

• Choosing the right privacy settings for the study
• Writing consent language and obtaining ethics approval
• Maintaining the secure link between anonymized study IDs and real participant identities
• Selecting where exported data is stored
• Reviewing audit logs and reporting to regulators and sponsors

When the technology handles safeguards automatically, study teams can focus their effort on the governance decisions that only they can make.

How IntelliXR® protects eye data

IntelliXR^® is a platform for eye and brain biomarkers, and privacy controls run on the device from the moment eye data is captured.

Privacy modes

Each study selects a privacy mode at setup. In clinical, privacy, and edge-only modes, iris blur is applied automatically. Edge-only mode also blocks cloud sync, so all data stays on the device.

Ocular-surface cropping

Eye images default to the ocular surface, including the cornea, conjunctiva, tear film, and pupil. Periocular skin, eyebrows, and facial geometry are cropped out.

Metadata removal

Capture timestamps, sensor serial numbers, and participant identifiers are stripped from exported files, and file names use randomized session IDs.

Derived-only mode

When enabled, raw camera frames are discarded immediately after processing, and only derived metrics such as gaze and pupil measurements are kept.

Consent management

The SDK records consent by type and version, blocks operations that require consent until it is granted, and deletes associated data automatically when consent is withdrawn.

Retention and secure deletion

Teams can set automatic deletion periods for local data, or disable local storage entirely, and use secure multi-pass deletion.

Encryption and audit logging

Exported session data can be encrypted with AES-256. A tamper-evident audit log records sensitive actions and can be exported to support HIPAA, SOC 2, and ISO 27001 reporting.

Anonymized sessions

Sessions are created with anonymized study and subject IDs only, so real names and medical record numbers never enter the platform.

Supporting privacy across multi-site studies

Privacy controls only work if every site applies them the same way. IntelliMDM manages headsets across locations, keeping configurations and policies consistent so that each site runs under the same privacy settings.

The IntelliXR^® stack currently supports more than 10,000 users across 2,000 clinics, giving research teams a foundation that scales from a single site to a multi-site study without changing how participant data is protected.

Run eye tracking studies with privacy in place from day one

If your team is planning an eye tracking study and needs to satisfy IRB, sponsor, or procurement review, we would be glad to walk you through how IntelliXR^® handles participant data.

Book a demo to see the platform's privacy controls in action, or read the Privacy, Security, and Compliance Overview for full technical detail.

Frequently asked questions