Update your application's privacy policy to explicitly state that biometric data is collected. Clearly define the types of biometric data collected, the specific purposes for its collection (e.g., authentication), how it is securely processed and stored (including security measures like encryption and template protection), user consent mechanisms (which often must be explicit), and data retention periods. A Data Protection Impact Assessment (DPIA) should be considered for this type of data processing.