Overview
Lenskart has transformed eyewear shopping with virtual try-on technology that maps facial geometry in 3D, combined with online prescription management. This means Lenskart processes: eye prescriptions (health data), facial structure measurements (biometric-adjacent), pupillary distance (physical measurement), and visual acuity information.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
Three categories of sensitive data processed under standard e-commerce consent:
- Eye prescriptions — Health data revealing vision conditions, potentially neurological indicators
- 3D face scanning — Facial geometric mapping for virtual try-on
- Physical measurements — Pupillary distance, face width, nose bridge measurements
Under DPDP, each requires separate, informed consent explaining how this data will be used, stored, and shared.
Section 8 — Obligations of Data Fiduciary ⚠️
Standard security for e-commerce. But:
- Face scan data needs biometric-grade encryption
- Prescription data needs health-data-level access controls
- Third-party lens manufacturers receiving prescription data — what security do they maintain?
Section 9 — Data Retention 🔴
No retention timelines for:
- 3D face scan data (how many face scans are stored from virtual try-on sessions?)
- Eye prescriptions (medical data)
- Physical measurements
- Virtual try-on session recordings
Critical question: If you tried on 50 frames virtually, does Lenskart retain 50 renders of your face indefinitely?
Section 11 — Rights of Data Principal 🔴
- Can users delete face scan data while keeping their prescription on file?
- No transparency on facial geometric data processing
- No portability for prescription data to another eyewear provider
- No nomination rights
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Facial geometry data | Critical | Biometric-adjacent data under e-commerce privacy |
| Prescription data | High | Health data with no special handling |
| Data retention | High | Face scans and health data indefinitely stored |
| Third-party sharing | High | Prescription data to manufacturers |
Recommendations
- Classify face scans as biometric-adjacent — Enhanced encryption, limited retention, and separate consent
- Add prescription data health protections — Treat eye prescriptions as medical data with defined retention
- Define face scan lifecycle — “Virtual try-on scans: processed in real-time, deleted within 24 hours; saved for ‘My Fits’: until user deletion”
- Implement prescription portability — Allow users to export prescriptions to other providers
- Separate consent for facial mapping — Clear explanation of how face geometry is processed and stored
How Does Your Policy Compare?
Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.