Privacy & Trust
People should not have to accept being watched in order to be safer at home.
ilonai learns as little as possible about a person's life while still detecting a possible fall. Formal legal and security audits have not been completed. The promises below are the boundaries we hold the product to.
The privacy promise
If nothing happens, no image leaves the system.
No live camera access. No audio. No daily activity profile. No ilonai staff viewing rooms.
We build around the Swiss FADP privacy-by-design principles: collect only for a stated purpose, collect as little as possible, restrict who can reach it, and keep it briefly. Formal validation will be published when it exists.
The Swiss FDPIC notes that recognizable video counts as personal-data processing even when images are not saved, and that where looking afterwards is enough, nobody should be looking unless an incident occurs. We agree, and the product is built that way.
What the cameras can send
Normal operation
What leaves: health/status metadata only.
What does not leave: images, video, audio, routine or activity history.
Possible fall
What ilonai never provides
- no live camera page
- no surveillance dashboard
- no vendor camera access
- no audio
- no facial recognition
- no daily activity log
- no sleep or bathroom-behavior reports
- no staff or family surveillance of ordinary life
Protecting the images is not enough on its own. A system can delete every pixel and still hand someone a detailed account of how you spent your day, and we will not build that either.
The rolling buffer
Video is not retained during normal operation. A short encrypted rolling buffer exists locally and is continuously overwritten. If a possible fall is detected, that short window can be preserved as an incident clip.
That is why we do not say “never stored even for a millisecond” and also “we can show ten seconds before the fall.” Both are true only because of the buffer.
Emergency exception
A designated person, named in advance, can receive a confirmation image when the system believes help may be needed. That is the one moment someone may need to look.
An optional short incident clip stays on the local computer, encrypted and access-controlled, with a deletion policy. It never becomes ordinary cloud video.
System diagnostics vs. watching a life
What ilonai can see remotely: camera 4 is offline, which software version is installed, a heartbeat is missing, the power has been out for a while.
What ilonai cannot see remotely: what the resident is doing in the room.
Training-data policy
Customer footage is not used to improve models unless we have separate, explicit permission. You are buying a safety installation, and we will not quietly turn it into a source of training data.
What we will not claim
We will not say “GDPR certified,” “no cloud vulnerabilities,” or “no compliance issues.” A local system can still have security bugs. What we can say accurately is narrower: no cloud video exposure, and nothing that depends on someone remembering to wear a device.