| 1 | Measurement Accuracy | Confirm whether the device measures skin tone, pigmentation, redness, pores, wrinkles, texture, and moisture consistently. | Look for validation against calibrated reference instruments, documented error margins, and repeatability testing. | Independent validation reports, test protocols, sample size, and defined measurement uncertainty. | Critical |
| 2 | Repeatability and Reliability | Check whether repeated scans of the same person produce similar results under the same conditions. | Run at least three repeated scans and compare score variation; large unexplained changes indicate poor repeatability. | Repeatability data, coefficient of variation, retest results, and calibration interval. | High |
| 3 | Lighting and Image Standardization | Evaluate controlled illumination, camera exposure, white balance, distance, and face-position guidance. | The system should detect poor lighting, obstructed facial areas, movement, and incorrect positioning before analysis. | Image-quality rules, lighting specifications, positioning instructions, and failed-scan examples. | High |
| 4 | Performance Across Skin Tones | Determine whether the algorithm has been tested on diverse skin tones, ages, genders, and facial conditions. | Require subgroup performance results rather than relying only on an overall accuracy figure. | Demographic coverage, subgroup error rates, dataset description, and bias-mitigation procedures. | Critical |
| 5 | Data Privacy and Ownership | Identify who owns facial images, analysis results, metadata, and derived biometric information. | The contract should define ownership, permitted use, retention periods, deletion procedures, and consent requirements. | Privacy policy, data-processing agreement, retention schedule, consent workflow, and deletion confirmation process. | Critical |
| 6 | Cybersecurity Controls | Review protection for data in transit, stored data, user accounts, devices, backups, and administrative access. | Prefer encryption in transit using modern TLS, encryption at rest, multi-factor authentication, role-based access, and audit logs. | Security documentation, penetration-test summary, vulnerability-management policy, access-control records, and incident-response plan. | Critical |
| 7 | Reporting Depth and Clarity | Assess whether reports show raw observations, scores, reference ranges, trends, images, and limitations. | Reports should separate measured values from recommendations and clearly identify the assessment date and conditions. | Sample PDF reports, trend views, customizable fields, interpretation notes, and user-access permissions. | High |
| 8 | Data Export and Integration | Check whether results can be exported or connected to appointment, customer-record, analytics, or electronic record systems. | Useful options include CSV or PDF export, documented APIs, structured fields, and access controls for integrations. | API documentation, export samples, integration fees, data formats, and synchronization process. | High |
| 9 | Ease of Use and Workflow | Evaluate setup time, scan duration, staff training, cleaning procedures, and the number of steps required per client. | Conduct a live trial with typical users and record scan time, failed scans, training time, and daily throughput. | Demonstration checklist, training materials, operating instructions, maintenance schedule, and user feedback. | Medium |
| 10 | Support, Updates, and Total Cost | Review warranty coverage, software updates, calibration service, technical support, subscription fees, and replacement costs. | Compare the complete cost of ownership over several years, including hardware, software, training, maintenance, and data storage. | Service-level agreement, warranty terms, update policy, response times, calibration requirements, and itemized pricing. | High |