What seems more likely for a startup doing online mental health to collect biometric data? 1. "getting ahead" of potentially changing regulations. 2. collecting data they don't need because it's (a) easier and (b) never know when you'll need it!

Surely this would affect all online prescribers and third party certification companies, who have been using government ID card verification for years.

I don't think biometric data is necessary at all here.