No where on your site do you reference FDA approval and I see that you are not in the U.S., so take my comments with a grain of salt.
Bio-metric authentication using cardiac wave forms? I'm not sure that is a good way to go, but it sure sounds good. What happens when the user takes medications that changes the waveform (ie., they start new blood pressure medicine or cardiac meds, or intermittently take those meds)? What if the user has PVCs when trying to authenticate? What about diabetics with high glucose levels?
The only time I've seen a legitimate use for using ECG in a consumer/commercial application is detecting a pulse when a user is attempting validate a finger print. I worked with a guy who had to implement something for ATMs being shipped to Africa. They required the user to authenticate with a finger print scanner in order to withdraw money. It wasn't long before people were loosing their fingers.
As far as monitoring for cardiac anomalies, they don't happen all the time. Your device only appears to work when you hands are touching it. It often takes days or weeks for them to occur, requiring continuous monitoring for days, weeks, and sometimes months.