By default, no personal data is collected. The iris scan is immediately deleted once the iris code is generated.
If the iris scan is immediately deleted can someone claim a few codes? Asking for a friend.

Well, for sure there's a lot of abuse in the crypto space when it comes to claiming "free coins". And new ways to combat it are constantly emerging... but this is definitely one of the craziest ways I ever saw.
I don't think that's good at all. 94% of the supply is held by 20 people. What can possibly go wrong?
What can possibly go wrong... I think you said it all.